@intentius/chant 0.19.1 → 0.21.0

package/src/components/sandbox/run.test.ts

@@ -0,0 +1,185 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { discoverComponentsSandboxed } from "./run";
+
+/**
+ * chant #1051 — proves the actual isolation properties for sandboxed
+ * component discovery (not just that it returns the right components),
+ * mirroring `../../discovery/sandbox/run.test.ts`'s coverage for the
+ * lexicon-resource run-fallback path (chant #1045 Phase 2): a hostile
+ * `*.component.ts` file cannot read outside the project directory, write
+ * anywhere, spawn a process, or read the ambient environment, and a
+ * permission denial names the file and the operation rather than leaking a
+ * raw `ERR_ACCESS_DENIED`.
+ *
+ * Fixtures are written to a fresh tmpdir per test, never into the source
+ * tree.
+ */
+describe("discoverComponentsSandboxed — isolation", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = await realpath(
+      await (async () => {
+        const dir = join(tmpdir(), `chant-component-sandbox-run-test-${Date.now()}-${Math.random()}`);
+        await mkdir(dir, { recursive: true });
+        return dir;
+      })(),
+    );
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  test("denies filesystem reads outside the project directory, naming the file and the operation", async () => {
+    const file = join(testDir, "evil.component.ts");
+    await writeFile(
+      file,
+      `
+        import { readFileSync } from "node:fs";
+        readFileSync("/etc/hosts", "utf-8");
+        export const evil = { name: "evil", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }] };
+      `,
+    );
+
+    const result = await discoverComponentsSandboxed([file], testDir);
+
+    expect(result.components.size).toBe(0);
+    expect(result.errors).toHaveLength(1);
+    expect(result.errors[0].file).toBe(file);
+    expect(result.errors[0].type).toBe("permission");
+    expect(result.errors[0].message).toMatch(/FileSystemRead/);
+    expect(result.errors[0].message).toContain(file);
+  });
+
+  test("denies filesystem writes anywhere", async () => {
+    const file = join(testDir, "evil.component.ts");
+    const targetPath = join(testDir, "..", "escaped.txt");
+    await writeFile(
+      file,
+      `
+        import { writeFileSync } from "node:fs";
+        writeFileSync(${JSON.stringify(targetPath)}, "pwned");
+        export const evil = { name: "evil", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }] };
+      `,
+    );
+
+    const result = await discoverComponentsSandboxed([file], testDir);
+
+    expect(result.errors).toHaveLength(1);
+    expect(result.errors[0].type).toBe("permission");
+    expect(result.errors[0].message).toMatch(/FileSystemWrite/);
+    expect(existsSync(targetPath)).toBe(false);
+  });
+
+  test("denies spawning a child process", async () => {
+    const file = join(testDir, "evil.component.ts");
+    const markerPath = join(testDir, "spawned.txt");
+    await writeFile(
+      file,
+      `
+        import { execSync } from "node:child_process";
+        execSync(${JSON.stringify(`touch ${markerPath}`)});
+        export const evil = { name: "evil", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }] };
+      `,
+    );
+
+    const result = await discoverComponentsSandboxed([file], testDir);
+
+    expect(result.errors).toHaveLength(1);
+    expect(result.errors[0].type).toBe("permission");
+    expect(result.errors[0].message).toMatch(/ChildProcess/);
+    expect(existsSync(markerPath)).toBe(false);
+  });
+
+  test("scrubs the ambient environment — a real secret set on the parent's process.env is invisible to project source", async () => {
+    const file = join(testDir, "evil.component.ts");
+    await writeFile(
+      file,
+      `
+        const seen = process.env.CHANT_SANDBOX_TEST_SECRET;
+        if (seen !== undefined) {
+          throw new Error("ambient env leaked: " + seen);
+        }
+        export const evil = {
+          name: "evil",
+          dependsOn: [],
+          deploy: [{ phase: "Apply", steps: [{ kind: "shell", envKeyCount: Object.keys(process.env).length }] }],
+        };
+      `,
+    );
+
+    const previous = process.env.CHANT_SANDBOX_TEST_SECRET;
+    process.env.CHANT_SANDBOX_TEST_SECRET = "super-secret-should-not-cross-the-boundary";
+    try {
+      const result = await discoverComponentsSandboxed([file], testDir);
+      expect(result.errors).toEqual([]);
+      expect(result.components.has("evil")).toBe(true);
+    } finally {
+      if (previous === undefined) delete process.env.CHANT_SANDBOX_TEST_SECRET;
+      else process.env.CHANT_SANDBOX_TEST_SECRET = previous;
+    }
+  });
+
+  test("the same component object re-exported under two bindings in one file is NOT a duplicate — the identity check runs on live objects, before any serialization", async () => {
+    // `collectComponents`'s dedupe check (`../discover.ts`) compares
+    // candidates with `existing.component !== value` — real object identity,
+    // not deep equality. That distinction only matters if the check runs
+    // over the LIVE, still-in-memory export values: had this instead run
+    // over a JSON-round-tripped copy (e.g. serialize each file's exports in
+    // the child, decode in the parent, THEN dedupe), `JSON.parse` never
+    // returns the same reference twice, so even this legitimate case — one
+    // object, two export bindings — would wrongly report a duplicate. This
+    // proves the sandboxed path preserves the unsandboxed behavior: the
+    // dedupe collector (`collectComponents`) runs bundled INSIDE the child,
+    // over the driver's own live `modules` array, before the one
+    // `JSON.stringify` at the very end (`./driver.ts`).
+    const file = join(testDir, "aliased.component.ts");
+    await writeFile(
+      file,
+      `
+        const base = {
+          name: "search-service",
+          dependsOn: [],
+          deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }],
+        };
+        export const searchService = base;
+        export const searchServiceAlias = base;
+      `,
+    );
+
+    const result = await discoverComponentsSandboxed([file], testDir);
+
+    expect(result.errors).toEqual([]);
+    expect(result.components.size).toBe(1);
+    expect(result.components.has("search-service")).toBe(true);
+  });
+
+  test("a genuine duplicate — two DIFFERENT objects declaring the same component name — is still reported", async () => {
+    await writeFile(
+      join(testDir, "one.component.ts"),
+      `
+        export const svc = { name: "dup", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }] };
+      `,
+    );
+    await writeFile(
+      join(testDir, "two.component.ts"),
+      `
+        export const svcAgain = { name: "dup", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }] };
+      `,
+    );
+
+    const result = await discoverComponentsSandboxed(
+      [join(testDir, "one.component.ts"), join(testDir, "two.component.ts")],
+      testDir,
+    );
+
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].type).toBe("resolution");
+    expect(result.errors[0].message).toMatch(/Duplicate component name "dup"/);
+  });
+});

package/src/components/sandbox/run.ts

@@ -0,0 +1,177 @@
+import { fork } from "node:child_process";
+import { realpathSync, rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { bundleDriver } from "../../discovery/sandbox/bundle";
+import { classifyChildError } from "../../discovery/sandbox/child-errors";
+import { DiscoveryError, type DiscoveryErrorType } from "../../errors";
+import type { Component } from "../component";
+import type { DiscoveredComponent } from "../discover";
+import { generateComponentDriverSource } from "./driver";
+
+/**
+ * chant #1051 — imports every discovered `*.component.ts` file for a build
+ * TOGETHER, as one bundled module graph, inside one sandboxed child process,
+ * and returns the same shape `discoverComponents`'s own in-process import
+ * loop would have produced: named components plus any errors.
+ *
+ * Isolation mechanics are identical to `../../discovery/sandbox/run.ts`'s
+ * `runFallbackFilesSandboxed` (chant #1045 Phase 2 — see that module's doc
+ * for the full write-up, verified on Node v24.13.1): `--permission
+ * --allow-fs-read=<bundle dir>,<project dir>[,<trusted external package
+ * dirs>]`, a spawn-time-scrubbed `env`, and a bounded wait before the child
+ * is treated as hung. `bundleDriver` (`../../discovery/sandbox/bundle.ts`) is
+ * reused as-is — it is generic over what the driver does, so the same
+ * esbuild bundling (and the same `typescript`-stays-external carve-out) that
+ * serves the entity path serves this one too.
+ */
+
+export interface ComponentSandboxRunResult {
+  /** Discovered components from this sandboxed import, keyed by `component.name` — functionally indistinguishable from what `discoverComponents`'s in-process path would have produced for this same file set. */
+  components: Map<string, DiscoveredComponent>;
+  /** Import/collection/permission errors, already chant-shaped (`../../discovery/sandbox/child-errors.ts` — a permission denial names the file and the operation, never a raw `ERR_ACCESS_DENIED`). */
+  errors: DiscoveryError[];
+  /** esbuild bundling wall-clock time. */
+  bundleMs: number;
+  /** Bundle size in bytes. */
+  bundleBytes: number;
+}
+
+interface ChildComponentEntry {
+  name: string;
+  component: Component;
+  exportName: string;
+  filePath: string;
+}
+
+interface ChildResponse {
+  components: ChildComponentEntry[];
+  errors: Array<{ file: string; message: string; type: DiscoveryErrorType }>;
+  fatal?: boolean;
+}
+
+/** How long to wait for the sandboxed child to report back before treating it as hung and killing it. Generous, matching the entity path's own budget. */
+const CHILD_TIMEOUT_MS = 120_000;
+
+function isChildResponse(value: unknown): value is ChildResponse {
+  return typeof value === "object" && value !== null && "components" in value && "errors" in value;
+}
+
+/**
+ * Import `files` (every discovered `*.component.ts` file) together, isolated,
+ * in one sandboxed child process, and collect their `Component`-shaped
+ * exports — including the duplicate-name check, which runs INSIDE the child
+ * over live objects before anything is serialized (`../discover.ts`'s
+ * `collectComponents`, bundled into the driver).
+ *
+ * @param files - Absolute paths to every discovered `*.component.ts` file.
+ * @param buildRoot - The directory `discoverComponents` was pointed at — used
+ *   to compute the project-directory read allowance, mirroring `../../
+ *   discovery/sandbox/run.ts`.
+ */
+export async function discoverComponentsSandboxed(
+  files: readonly string[],
+  buildRoot: string,
+): Promise<ComponentSandboxRunResult> {
+  if (files.length === 0) {
+    return { components: new Map(), errors: [], bundleMs: 0, bundleBytes: 0 };
+  }
+
+  const driverSource = generateComponentDriverSource({ files });
+  const { bundlePath, bundleDir, externalReadPaths, durationMs, bytes } = await bundleDriver(driverSource);
+
+  try {
+    let projectRealpath: string;
+    try {
+      projectRealpath = realpathSync(resolve(buildRoot));
+    } catch {
+      projectRealpath = resolve(buildRoot);
+    }
+
+    const response = await runChildProcess(bundlePath, bundleDir, projectRealpath, externalReadPaths);
+
+    const errors = (response.errors ?? []).map((e) => new DiscoveryError(e.file, e.message, e.type));
+    if (response.fatal) {
+      return { components: new Map(), errors, bundleMs: durationMs, bundleBytes: bytes };
+    }
+
+    const components = new Map<string, DiscoveredComponent>();
+    for (const entry of response.components ?? []) {
+      components.set(entry.name, {
+        component: entry.component,
+        exportName: entry.exportName,
+        filePath: entry.filePath,
+      });
+    }
+    return { components, errors, bundleMs: durationMs, bundleBytes: bytes };
+  } catch (err) {
+    return {
+      components: new Map(),
+      errors: [classifyChildError("", err, "import")],
+      bundleMs: durationMs,
+      bundleBytes: bytes,
+    };
+  } finally {
+    rmSync(bundleDir, { recursive: true, force: true });
+  }
+}
+
+/** Fork the bundle under `--permission`, with a scrubbed environment, and resolve with its one IPC message (or reject on crash/timeout/fork error). Mirrors `../../discovery/sandbox/run.ts`'s `runChildProcess`. */
+function runChildProcess(
+  bundlePath: string,
+  bundleDir: string,
+  projectRealpath: string,
+  externalReadPaths: readonly string[],
+): Promise<ChildResponse> {
+  return new Promise((resolvePromise, reject) => {
+    const readAllowances = [bundleDir, projectRealpath, ...externalReadPaths].map(
+      (p) => `--allow-fs-read=${p}`,
+    );
+    const child = fork(bundlePath, [], {
+      execArgv: ["--permission", ...readAllowances],
+      // chant #1051 — Node's Permission Model does not gate `process.env`;
+      // scrubbing it here is the only way to keep the ambient environment out
+      // of untrusted project source's reach, exactly as the entity path does.
+      env: { PATH: process.env.PATH ?? "" },
+      stdio: ["ignore", "pipe", "pipe", "ipc"],
+    });
+
+    let settled = false;
+    let stderrBuf = "";
+
+    const timeout = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      child.kill();
+      reject(new Error(`sandboxed component discovery timed out after ${CHILD_TIMEOUT_MS}ms`));
+    }, CHILD_TIMEOUT_MS);
+
+    child.stderr?.on("data", (chunk: Buffer) => {
+      stderrBuf += chunk.toString();
+    });
+
+    child.on("message", (msg: unknown) => {
+      if (settled || !isChildResponse(msg)) return;
+      settled = true;
+      clearTimeout(timeout);
+      resolvePromise(msg);
+    });
+
+    child.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      reject(err);
+    });
+
+    child.on("exit", (code, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      reject(
+        new Error(
+          `sandboxed component discovery child exited before reporting results (code ${code}, signal ${signal})${stderrBuf.trim() ? `: ${stderrBuf.trim()}` : ""}`,
+        ),
+      );
+    });
+  });
+}

package/src/composite.test.ts

@@ -181,6 +181,27 @@ describe("expandComposite", () => {
     expect(expanded.get("sBucket")).toBe(bucket);
   });
 
+  test("is idempotent — repeated expansion does not duplicate shared array props (#1032)", () => {
+    const member = new MockResource({ type: "Bucket", tags: [{ key: "app", value: "x" }] });
+    const Comp = Composite<{}>(() => ({ bucket: member as unknown as Declarable }));
+    const instance = propagate(
+      Comp({}) as never,
+      { tags: [{ key: "env", value: "prod" }] },
+    );
+
+    const first = expandComposite("s", instance);
+    const firstTags = (first.get("sBucket") as unknown as MockResource).props.tags as unknown[];
+    // Expand the SAME singleton instance again (what building one tree twice in a
+    // process does) — must not re-merge onto the already-merged props.
+    const second = expandComposite("s", instance);
+    const secondTags = (second.get("sBucket") as unknown as MockResource).props.tags as unknown[];
+
+    // shared [env] + member [app] = 2 tags, both times — not 3 on the second pass.
+    expect(firstTags).toHaveLength(2);
+    expect(secondTags).toHaveLength(2);
+    expect(secondTags).toEqual(firstTags);
+  });
+
   test("handles empty composite", () => {
     const Empty = Composite<{}>(() => ({} as Record<string, Declarable>));
     const expanded = expandComposite("e", Empty({}));

package/src/composite.ts

@@ -150,7 +150,20 @@ export function expandComposite(
   if (shared) {
     for (const entity of result.values()) {
       if ("props" in entity) {
-        const existing = entity.props as Record<string, unknown>;
+        // Merge shared props onto each member's ORIGINAL props, not its current
+        // props. Members are module-level singletons, so without stashing the
+        // original a second expansion (e.g. building the same tree twice in one
+        // process) would re-merge shared arrays like tags onto the already-merged
+        // value, duplicating them on every rebuild (#1032). Stashing the original
+        // once makes expansion idempotent: same input -> same output, every time.
+        const store = entity as unknown as Record<symbol, unknown>;
+        let existing = store[ORIGINAL_PROPS] as Record<string, unknown> | undefined;
+        if (existing === undefined) {
+          existing = entity.props as Record<string, unknown>;
+          Object.defineProperty(entity, ORIGINAL_PROPS, {
+            value: existing, enumerable: false, configurable: true,
+          });
+        }
         const merged: Record<string, unknown> = {};
         for (const [k, v] of Object.entries(shared)) {
           if (v !== undefined) {
@@ -216,6 +229,12 @@ export function withDefaults<P, M extends CompositeMembers, D extends Partial<P>
  */
 export const SHARED_PROPS = Symbol.for("chant.composite.shared");
 
+/**
+ * Symbol key stashing a member's original (pre-merge) props, so expandComposite()
+ * is idempotent across repeated expansions of the same singleton instance (#1032).
+ */
+export const ORIGINAL_PROPS = Symbol.for("chant.composite.origProps");
+
 /**
  * Attaches shared properties to a composite instance.
  * During expandComposite(), shared props are merged into every member's props.

package/src/config.ts

@@ -6,6 +6,7 @@ import type { OwnershipMarker } from "./ownership";
 import { DEFAULT_SBOM_FORMAT, type SbomFormat } from "./components/verbs/sbom-generator";
 import type { Severity } from "./components/verbs/vuln-scan";
 import type { VulnPolicy } from "./components/verbs/vuln-gate";
+import type { BuildParamsConfig } from "./build-params";
 
 /**
  * Zod schema for ChantConfig validation.
@@ -21,6 +22,20 @@ export const ChantConfigSchema = z.object({
     env: z.string().min(1).optional(),
     enabled: z.boolean().optional(),
   }).optional(),
+  build: z.object({
+    fold: z.boolean().optional(),
+  }).optional(),
+  buildParams: z.record(
+    z.string(),
+    z.object({
+      type: z.enum(["string", "number", "boolean"]),
+      default: z.union([z.string(), z.number(), z.boolean()]).optional(),
+      enum: z.array(z.union([z.string(), z.number(), z.boolean()])).optional(),
+      env: z.string().min(1).optional(),
+      required: z.boolean().optional(),
+      description: z.string().optional(),
+    }),
+  ).optional(),
   release: z.object({
     autoRecord: z.boolean().optional(),
   }).optional(),
@@ -117,6 +132,45 @@ export interface ChantConfig {
     enabled?: boolean;
   };
 
+  /**
+   * `chant build` behavior toggles (#1022, epic #1019).
+   */
+  build?: {
+    /**
+     * Opt-in: fold source modules statically instead of importing/running
+     * them, falling back to run per-file for anything the folder can't
+     * represent (composite factory calls, non-`new` exports, …). Default
+     * `false`. The `--fold` CLI flag overrides this per-invocation (a flag
+     * of `true` always wins; the flag cannot force fold *off* when this is
+     * `true`). See {@link resolveFoldEnabled}.
+     */
+    fold?: boolean;
+
+    /**
+     * chant #1045 Phase 2 — opt-in: run-fallback source files (or, when
+     * `fold` above isn't set, every file) execute together, isolated, in one
+     * sandboxed child process instead of in-process. Default `false`. The
+     * `--sandbox` CLI flag overrides this per-invocation (a flag of `true`
+     * always wins; the flag cannot force sandboxing *off* when this is
+     * `true`). See {@link resolveSandboxEnabled}.
+     */
+    sandbox?: boolean;
+  };
+
+  /**
+   * Build-time parameters (#1064) — values supplied to `chant build` (a
+   * `--param name=value` flag, a `--params-file` JSON file, or a declared
+   * `env` var mapping) and bound to `params.<name>` (`@intentius/chant/params`)
+   * for source to reference, instead of reading `process.env` at module
+   * scope. Distinct from the deploy-time `Parameter` class
+   * (`lexicons/aws/src/parameter.ts`, a CloudFormation `Parameters:` entry
+   * that resolves at stack deploy) — a build-time parameter resolves before
+   * the template is even synthesized, so it can change which resources are
+   * produced at all (e.g. a tier selecting `light` vs `production`). See
+   * {@link resolveBuildParams} in `./build-params.ts`.
+   */
+  buildParams?: BuildParamsConfig;
+
   /**
    * Release-ledger recording behavior (#597, epic #551). Auto-emitting a
    * release record on a successful `chant run --components <name> --env
@@ -265,6 +319,33 @@ export function resolveAutoReleaseDisabled(config: ChantConfig, cliFlag?: boolea
   return config.release?.autoRecord === false;
 }
 
+/**
+ * Whether `chant build` should use the fold path (#1022, epic #1019)
+ * instead of running each source module. Opt-in: off unless the CLI's
+ * `--fold` flag was passed (`cliFlag`) or the project config sets
+ * `build.fold: true` — the flag always wins for that one invocation,
+ * regardless of config.
+ */
+export function resolveFoldEnabled(config: ChantConfig, cliFlag?: boolean): boolean {
+  if (cliFlag) return true;
+  return config.build?.fold === true;
+}
+
+/**
+ * Whether `chant build` should run its run-fallback files (or, without
+ * `--fold`, every file) in an isolated sandboxed child process rather than
+ * in-process (chant #1045 Phase 2). Opt-in: off unless the CLI's `--sandbox`
+ * flag was passed (`cliFlag`) or the project config sets `build.sandbox:
+ * true` — the flag always wins for that one invocation, regardless of
+ * config. Independent of {@link resolveFoldEnabled}: sandboxing without
+ * folding isolates every discovered file; sandboxing with folding isolates
+ * only the per-file run-fallback remainder.
+ */
+export function resolveSandboxEnabled(config: ChantConfig, cliFlag?: boolean): boolean {
+  if (cliFlag) return true;
+  return config.build?.sandbox === true;
+}
+
 /**
  * Resolve which SBOM format a `generate-sbom` step should request (#606),
  * given the project's `chant.config.ts` `sbom.format` and an optional

package/src/declarable.ts

@@ -13,6 +13,26 @@ export interface Declarable {
   readonly [DECLARABLE_MARKER]: true;
 }
 
+/**
+ * A `Declarable` that carries a resource payload — the `props`/`attributes`
+ * fields that most lexicon serializers read to produce output. Not every
+ * `Declarable` has one (outputs and parameters genuinely don't), so this is
+ * kept as a sub-interface rather than widening the base type. See chant #1049.
+ */
+export interface ResourceDeclarable extends Declarable {
+  readonly props: unknown;
+  readonly attributes?: unknown;
+}
+
+/**
+ * Type guard for `ResourceDeclarable` — replaces the ad-hoc `"props" in x`
+ * checks that were previously repeated (with an `as unknown as` cast) at every
+ * call site that reads `props`/`attributes` off a `Declarable`.
+ */
+export function isResourceDeclarable(value: Declarable): value is ResourceDeclarable {
+  return "props" in value;
+}
+
 /**
  * Core parameter type for lexicon-agnostic parameters
  */

package/src/discovery/collect.ts

@@ -47,8 +47,21 @@ interface PendingEntry {
 /**
  * Flatten every module's exports into the ordered list of entities they
  * contribute — declarables directly, arrays element-by-element (indexed names),
- * composite instances expanded into members, and LexiconOutputs. Order is
- * preserved so downstream serializers emit resources in a stable order.
+ * composite instances expanded into members, and LexiconOutputs. `modules`
+ * order (one discovered file after another) is preserved so downstream
+ * serializers emit resources in a stable, file-discovery-order sequence.
+ *
+ * Within one module, exports are visited in ascending name order rather than
+ * `Object.entries()`'s own — a real ECMAScript Module namespace object
+ * already enumerates its (non-default) string keys this way per spec
+ * (`[[OwnPropertyKeys]]`, sorted), regardless of source declaration order;
+ * sorting here just makes that the case EXPLICITLY, so this doesn't quietly
+ * depend on whichever loader imported the file preserving (or not) that spec
+ * behavior — chant #1045 Phase 2 found `vite-node` (vitest's own in-process
+ * transform) does NOT sort, unlike plain Node, which made comparing an
+ * in-process build against a real-subprocess one (its differential's whole
+ * point) spuriously "drift" on multi-export-per-file modules whenever the
+ * in-process side ran under vitest.
  */
 function enumerateEntries(
   modules: Array<{ file: string; exports: Record<string, unknown> }>,
@@ -56,7 +69,8 @@ function enumerateEntries(
   const entries: PendingEntry[] = [];
 
   for (const { file, exports } of modules) {
-    for (const [rawName, value] of Object.entries(exports)) {
+    const sortedExports = Object.entries(exports).sort(([a], [b]) => a.localeCompare(b));
+    for (const [rawName, value] of sortedExports) {
       const name = exportKey(rawName, file);
       if (isDeclarable(value)) {
         entries.push({ bareKey: name, value, file, provenance: { sourceFile: file } });