@intentius/chant 0.24.0 → 0.26.0

package/dist/discovery/sandbox/policy-wire.d.ts

@@ -0,0 +1,177 @@
+import type { Declarable } from "../../declarable.js";
+import type { SerializerResult } from "../../serializer.js";
+import type { PostSynthContext } from "../../lint/post-synth.js";
+import { type EntitySetWire } from "../entity-wire-codec.js";
+import { type ConfigWireOffender } from "./config-wire.js";
+/**
+ * chant #1131 — what a build result looks like on its way INTO the sandboxed
+ * policy child, and what a `PostSynthDiagnostic` must look like on its way back
+ * out.
+ *
+ * A project's `lint.policies` checks are project-authored functions chant calls
+ * over the finished build. #1113 put `chant.config.ts` behind the `--sandbox`
+ * boundary but could not take the policies with it, because the config declares
+ * them as *paths*: the modules were still imported and their `check` functions
+ * still invoked in the CLI's own process, with the CLI's filesystem, network,
+ * environment and process-spawn access, after discovery was over.
+ *
+ * The shape of the fix is forced by what a policy is. It is not data that can
+ * be evaluated somewhere and carried back — it is a callback over the resolved
+ * resources, so it has to run somewhere it can see them. It also cannot run in
+ * the #1045 discovery child, because that child only ever sees the run-fallback
+ * *subset*: folded files are collected in the parent, and serialization happens
+ * in the parent, so no complete view of the build exists on that side. What
+ * does exist, after the parent has merged and serialized, is a build result
+ * that is *nearly* data already — which is what this module makes explicit.
+ *
+ * So: one more child, after the merge, handed the encoded build result,
+ * importing the policy modules inside the boundary and returning plain
+ * diagnostics. Same bundling (`./bundle.ts`), same spawn and `--permission`
+ * profile (`./fork.ts`), same error classification (`./child-errors.ts`), same
+ * "only JSON crosses, and anything else is named, never dropped" contract
+ * (`./config-wire.ts`, whose walk is reused directly).
+ *
+ * ## What crosses, and what that costs
+ *
+ * `PostSynthContext` gives a check five things. Four of them are already data:
+ * `outputs` (each lexicon's serialized text), `warnings`, `errors`,
+ * `sourceFileCount`. The fifth, `entities`, is a live `Map<string, Declarable>`
+ * whose cross-entity references are object identity and `WeakRef`s — the exact
+ * problem chant #1045 Phase 1 solved for discovery, so this reuses that codec
+ * (`../entity-wire-codec.ts`) rather than inventing a second one.
+ *
+ * That reuse is what makes the round trip cheap AND what defines its limits.
+ * `encodeEntitySet`/`decodeEntitySet` is documented as producing entities
+ * "behaviorally indistinguishable" from the in-process ones for chant's own
+ * consumers (serializers, the dependency graph, cross-lexicon detection), and
+ * a policy is a consumer of the same shape. Where it is NOT identical is
+ * written down in `docs/.../architecture/sandbox.mdx` and pinned by
+ * `./policy-wire.test.ts`:
+ *
+ *  - An intrinsic (`Sub`, `Ref`, gitlab's `!reference`, …) decodes to a
+ *    marker-bearing wrapper exposing `toJSON()`/`toYAML()`, not to an instance
+ *    of the lexicon's own intrinsic class.
+ *  - A decoded entity is a plain marker-bearing object, not an instance of the
+ *    lexicon's resource class, and its `lexicon`/`entityType`/`kind`/`props`/
+ *    `attributes` are non-enumerable (so `Object.keys(entity)` sees only the
+ *    per-attribute/extra fields). Reads — `entity.props`, `entity.entityType`,
+ *    `isDeclarable(entity)`, `instanceof AttrRef` — all still work.
+ *  - A `ChildProjectInstance` (`nestedStack()`) has no wire form at all;
+ *    `encodeEntitySet` throws rather than mis-encoding it, so a `--sandbox`
+ *    build that both uses `nestedStack()` and declares `lint.policies` fails
+ *    loudly. (No corpus entry uses `nestedStack()`.)
+ *  - `errors` cross as the plain objects `DiscoveryError`/`BuildError`'s own
+ *    `toJSON()` produces, not as `Error` instances. In practice this is never
+ *    observable: `chant build` runs policies only when the build produced no
+ *    errors at all, so the array is always empty at that point.
+ *
+ * Crucially, the first two are NOT new under `--sandbox`: a sandboxed build
+ * already merges decoded entities for every run-fallback file (`./run.ts`), so
+ * a policy running in-process on a `--sandbox` build is already looking at
+ * decoded entities for part of the set. Encoding is idempotent over a decoded
+ * entity (verified in `./policy-wire.test.ts`), so this child widens that from
+ * "the run-fallback subset" to "all of them" and changes nothing else.
+ */
+/** Wire form of one lexicon's serialized output — already data on both sides; carried as-is. */
+export type PolicyOutputWire = string | {
+    primary: string;
+    files?: Record<string, string>;
+    warnings?: string[];
+};
+/** A build result as pure JSON, for the sandboxed policy child. */
+export interface PolicyBuildResultWire {
+    /** `../entity-wire-codec.ts`'s format — the same one the #1045 discovery child returns. */
+    entities: EntitySetWire;
+    /** `Map` entries as pairs; a `Map` itself JSON-stringifies to `{}`. */
+    outputs: Array<[string, PolicyOutputWire]>;
+    warnings: string[];
+    /** `DiscoveryError`/`BuildError`'s own `toJSON()` output. Always empty in practice — see the module doc. */
+    errors: Array<Record<string, unknown>>;
+    sourceFileCount: number;
+    /** `BuildResult.dependencies` (`Map<string, Set<string>>`) as pairs of arrays. Not part of `PostSynthContext`'s declared surface; carried so `ctx.buildResult` is not silently narrower than the object the in-process path passes. */
+    dependencies: Array<[string, string[]]>;
+    /** `BuildResult.manifest` — plain data (lexicons, cross-lexicon outputs, deploy order, stack graph). Same "not declared, still carried" reasoning as {@link dependencies}. */
+    manifest?: unknown;
+    /** `BuildResult.foldDecisions` — plain data. */
+    foldDecisions?: unknown[];
+    /** `BuildResult.buildParams` — plain data (#1064 provenance records). */
+    buildParams?: unknown[];
+}
+/** The subset of `BuildResult` this module knows how to carry. Structurally satisfied by `../../build.ts`'s `BuildResult`. */
+export interface EncodablePolicyBuildResult {
+    outputs: Map<string, string | SerializerResult>;
+    entities: Map<string, Declarable>;
+    warnings: string[];
+    errors: ReadonlyArray<{
+        name: string;
+        message: string;
+        toJSON?: () => unknown;
+    }>;
+    sourceFileCount: number;
+    dependencies?: Map<string, Set<string>>;
+    manifest?: unknown;
+    foldDecisions?: unknown[];
+    buildParams?: unknown[];
+}
+/**
+ * Encode a merged, serialized build result for the policy child.
+ *
+ * Runs in the PARENT. Throws — never drops — when the result holds something
+ * the wire cannot represent: `encodeEntitySet`'s own refusals (a `nestedStack()`
+ * child project, an `AttrRef` that never got a logical name) propagate, and the
+ * finished payload is walked by `./config-wire.ts`'s scan so a serializer that
+ * somehow produced a non-data output is named by key path rather than silently
+ * mangled by `JSON.stringify`.
+ */
+export declare function encodePolicyBuildResult(result: EncodablePolicyBuildResult): PolicyBuildResultWire;
+/**
+ * Rebuild the `PostSynthContext["buildResult"]` a check expects, from the wire.
+ *
+ * Runs INSIDE the child. The maps and the live entity graph are reconstructed
+ * here (`decodeEntitySet`), so a check sees the same kind of object it sees
+ * in-process — `ctx.entities` is a real `Map`, its values are real
+ * `Declarable`s, and an `AttrRef` between two of them is a real `AttrRef`
+ * carrying its resolved logical name.
+ */
+export declare function decodePolicyBuildResult(wire: PolicyBuildResultWire): PostSynthContext["buildResult"];
+/** One thing a policy returned that cannot cross back, with the policy module it came from. */
+export interface PolicyDiagnosticOffender extends ConfigWireOffender {
+    /** Absolute path of the `lint.policies` module whose check returned it. */
+    policy: string;
+}
+/**
+ * Validate what one policy module's checks returned, INSIDE the child, before
+ * it goes anywhere near the IPC channel.
+ *
+ * Two separate questions, both answered here rather than by hoping
+ * `JSON.stringify` behaves:
+ *
+ *  1. Is it data? A `PostSynthDiagnostic` is declared as five plain fields, but
+ *     a check is arbitrary project code and can return anything. A function, a
+ *     `Date`, a class instance, a circular reference — `JSON.stringify` would
+ *     drop or rewrite each of them without a word, and the CLI would print a
+ *     diagnostic that is not the one the policy produced.
+ *  2. Is it a diagnostic? A missing `checkId`, or a `severity` outside
+ *     `error`/`warning`/`info`, is reported here instead of turning into an
+ *     undefined-shaped line in the build's error list.
+ */
+export declare function scanPolicyDiagnostics(diagnostics: unknown, policyPath: string): PolicyDiagnosticOffender[];
+/**
+ * Thrown INSIDE the child by the per-check wrapper `./driver.ts` generates,
+ * when a check returns something that cannot cross back. Carries the offenders
+ * so the driver can report them as data rather than as a message string it
+ * would then have to parse.
+ *
+ * A class rather than a tagged object because the driver tests it with
+ * `instanceof`: both halves come from this one module, bundled once, so there
+ * is exactly one class identity inside the child.
+ */
+export declare class PolicyWireError extends Error {
+    readonly offenders: PolicyDiagnosticOffender[];
+    constructor(offenders: PolicyDiagnosticOffender[]);
+}
+/** Render offenders as the body of a build error — one line each, naming the policy module. */
+export declare function formatPolicyWireOffenders(subject: string, offenders: ReadonlyArray<ConfigWireOffender & {
+    policy?: string;
+}>): string;
+//# sourceMappingURL=policy-wire.d.ts.map

package/dist/discovery/sandbox/policy-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-wire.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/policy-wire.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAuB,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,gGAAgG;AAChG,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjH,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,QAAQ,EAAE,aAAa,CAAC;IACxB,uEAAuE;IACvE,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,4GAA4G;IAC5G,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,uOAAuO;IACvO,YAAY,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACxC,8KAA8K;IAC9K,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,yEAAyE;IACzE,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;CACzB;AAED,8HAA8H;AAC9H,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,OAAO,CAAA;KAAE,CAAC,CAAC;IACjF,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,0BAA0B,GAAG,qBAAqB,CAsBjG;AAUD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAapG;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAClE,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,OAAO,EACpB,UAAU,EAAE,MAAM,GACjB,wBAAwB,EAAE,CA8B5B;AAED;;;;;;;;;GASG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,SAAS,EAAE,wBAAwB,EAAE,CAAC;gBAEnC,SAAS,EAAE,wBAAwB,EAAE;CAKlD;AASD,+FAA+F;AAC/F,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,aAAa,CAAC,kBAAkB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GACjE,MAAM,CAUR"}

package/dist/discovery/sandbox/run.d.ts

@@ -6,26 +6,16 @@ import { DiscoveryError } from "../../errors.js";
  * the same shape `discover()`'s own in-process run path would have produced:
  * a named, ref-resolved entities map plus any errors.
  *
- * Isolation mechanics (verified on Node v24.13.1 — see the chant#1045 PR
- * description for the full write-up):
- *  - `--permission --allow-fs-read=<bundle dir>,<project dir>[,<trusted
- *    external package dirs>]` — no filesystem write, no child-process, no
- *    worker-thread access. Bundling with esbuild first (not a packaging
- *    change — see `./bundle.ts`) means the child needs NO TypeScript loader
- *    (no `tsx`, so no `--allow-worker` and no writable temp dir either),
- *    unlike the plain `tsx`-based run path. The "trusted external package
- *    dirs" allowance is narrow and specific: `./bundle.ts` deliberately
- *    leaves a couple of chant/lexicon-internal dependencies (`typescript`)
- *    unbundled and resolves them to their real, fixed location instead —
- *    project source never controls what's installed there.
- *  - The env is a spawn-time scrub (`env: {}` below, plus `PATH` — see the
- *    option below), not `--permission`: Node's Permission Model does not gate
- *    `process.env` at all (confirmed: every key stays readable even under
- *    `--permission`).
- *  - Network egress is NOT addressed here — Node has no flag for it. See the
- *    chant#1045 PR description / docs for the residual-risk statement and
- *    deployment guidance (a container with no egress, a network namespace).
- *    This function does not claim to close that gap.
+ * Isolation mechanics live in `./fork.ts` — the one function that spawns a
+ * sandboxed child, shared with chant #1113's config evaluation
+ * (`./config-run.ts`) so the two cannot drift apart. In short:
+ * `--permission --allow-fs-read=<bundle dir>,<project dir>[,<trusted external
+ * package dirs>]`, a spawn-time environment scrub, no writes, no spawning, no
+ * worker threads, and no network guarantee. The "trusted external package
+ * dirs" allowance is narrow and specific: `./bundle.ts` deliberately leaves a
+ * couple of chant/lexicon-internal dependencies (`typescript`) unbundled and
+ * resolves them to their real, fixed location instead — project source never
+ * controls what's installed there.
  *
  * What does NOT run inside the child: fold (`tryFoldFile`, `../fold-import`)
  * stays exactly where it is today, in the parent, unsandboxed — fold already

package/dist/discovery/sandbox/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/run.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAA2B,MAAM,cAAc,CAAC;AAMvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,2TAA2T;IAC3T,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,8LAA8L;IAC9L,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAsC3B"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAA2B,MAAM,cAAc,CAAC;AAOvE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,2TAA2T;IAC3T,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,8LAA8L;IAC9L,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAsD3B"}

package/dist/intrinsic-interpolation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intrinsic-interpolation.d.ts","sourceRoot":"","sources":["../src/intrinsic-interpolation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,MAAM,4BAA4B,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;AAEtE;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,EACpE,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GACxC,4BAA4B,CA2C9B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,MAAM,EAAE,SAAS,OAAO,EAAE,EAC1B,cAAc,EAAE,4BAA4B,GAC3C,MAAM,CASR"}
+{"version":3,"file":"intrinsic-interpolation.d.ts","sourceRoot":"","sources":["../src/intrinsic-interpolation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,MAAM,4BAA4B,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;AAEtE;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,EACpE,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GACxC,4BAA4B,CAkD9B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,MAAM,EAAE,SAAS,OAAO,EAAE,EAC1B,cAAc,EAAE,4BAA4B,GAC3C,MAAM,CASR"}

package/dist/lexicon-output.d.ts

@@ -1,5 +1,29 @@
 import { INTRINSIC_MARKER, type Intrinsic } from "./intrinsic.js";
 import { AttrRef } from "./attrref.js";
+/** A value `output()` accepts that is already fully resolved — not a
+ * reference to anything, just data the author computed (a literal, a prop,
+ * a template string). See chant #1121. */
+export type LexiconOutputLiteral = string | number | boolean;
+/**
+ * Marker symbol for LexiconOutput identification (chant #1122).
+ *
+ * A GLOBAL symbol (via `Symbol.for`), like every other chant-core brand
+ * check — `DECLARABLE_MARKER`, `STACK_OUTPUT_MARKER`, `INTRINSIC_MARKER` —
+ * holds across separately-loaded copies of chant-core the way `instanceof`
+ * does not. Two copies in one process is a plain npm-dedupe outcome: a
+ * lexicon pinned to a chant range that does not overlap the project's own
+ * gets a nested `node_modules/@intentius/chant`, and a project file
+ * importing `output` from that lexicon then holds a different `LexiconOutput`
+ * class than the CLI does. `instanceof LexiconOutput` returns false for a
+ * real output built by the other copy, and every `Outputs` entry vanishes
+ * silently.
+ *
+ * Installed non-enumerably in the constructor (not as a public class field)
+ * so a shallow spread/clone of a real instance — which would already lack
+ * its prototype methods (`getOutputValue()`, `_setSourceEntity()`, …) — does
+ * not silently pick up the marker and pass this guard too.
+ */
+export declare const LEXICON_OUTPUT_MARKER: unique symbol;
 /**
  * Sanitize auto-generated Output name parts into a valid CloudFormation
  * logical id. Real CloudFormation logical ids (including `Outputs` keys)
@@ -21,11 +45,17 @@ export declare function sanitizeLogicalId(...parts: string[]): string;
  *
  * Implements Intrinsic so it can be used as Value<string> anywhere.
  *
- * Accepts either an AttrRef (resource attribute reference) or any Intrinsic
- * (e.g. Sub, Join) for computed output values like constructed URLs.
+ * Accepts an AttrRef (resource attribute reference), any Intrinsic (e.g. Sub,
+ * Join) for computed output values like constructed URLs, or an already-
+ * resolved literal (string/number/boolean) — a constant the author's code
+ * computed rather than a reference to anything (chant #1121).
  */
 export declare class LexiconOutput implements Intrinsic {
     readonly [INTRINSIC_MARKER]: true;
+    /** @internal Brand marker — see {@link LEXICON_OUTPUT_MARKER}. Declared
+     * here only for type purposes; the real, non-enumerable property is
+     * installed by the constructor. */
+    readonly [LEXICON_OUTPUT_MARKER]: true;
     readonly sourceLexicon: string;
     readonly sourceEntity: string;
     readonly sourceAttribute: string | null;
@@ -39,7 +69,17 @@ export declare class LexiconOutput implements Intrinsic {
      * checking on every field it reads (#1047).
      */
     readonly _intrinsic: Intrinsic | null;
-    constructor(ref: AttrRef | Intrinsic | string, name: string);
+    /**
+     * @internal The already-resolved literal (string/number/boolean) when
+     * constructed from neither an AttrRef nor an Intrinsic — non-null exactly
+     * when `_intrinsic` is null AND `sourceAttribute` is null. There is no
+     * source entity or attribute to reference, so `getOutputValue()` returns
+     * this value verbatim rather than fabricating a `Fn::GetAtt` out of an
+     * unset attribute (chant #1121). Readable outside the class for the same
+     * reason as `_intrinsic`/`_sourceParent` above.
+     */
+    readonly _literalValue: LexiconOutputLiteral | null;
+    constructor(ref: AttrRef | Intrinsic | LexiconOutputLiteral, name: string);
     /**
      * Set the source entity logical name.
      * Called during build when entity names are resolved.
@@ -48,6 +88,7 @@ export declare class LexiconOutput implements Intrinsic {
     _setSourceEntity(name: string): void;
     /**
      * Returns the CloudFormation Output Value for this output.
+     * For a literal output: the resolved value itself, verbatim.
      * For AttrRef-based outputs: emits Fn::GetAtt.
      * For Intrinsic-based outputs: delegates to the intrinsic's toJSON().
      */
@@ -71,7 +112,8 @@ export declare class LexiconOutput implements Intrinsic {
     };
 }
 /**
- * Create a LexiconOutput from an AttrRef or Intrinsic and a user-provided output name.
+ * Create a LexiconOutput from an AttrRef, an Intrinsic, or an already-
+ * resolved literal, and a user-provided output name.
  *
  * Usage with AttrRef:
  * ```ts
@@ -82,10 +124,24 @@ export declare class LexiconOutput implements Intrinsic {
  * ```ts
  * const solrUrl = output(Sub`http://${Ref(albDnsName)}/solr`, "solrUrl");
  * ```
+ *
+ * Usage with a literal (chant #1121) — a real value the caller already
+ * computed, not a reference:
+ * ```ts
+ * const apiVersion = output("v1", "ApiVersion");
+ * ```
  */
-export declare function output(ref: AttrRef | Intrinsic | string, name: string): LexiconOutput;
+export declare function output(ref: AttrRef | Intrinsic | LexiconOutputLiteral, name: string): LexiconOutput;
 /**
- * Type guard to check if a value is a LexiconOutput
+ * Type guard to check if a value is a LexiconOutput.
+ *
+ * Structural, not `instanceof` (chant #1122) — keys off {@link
+ * LEXICON_OUTPUT_MARKER}, a global symbol, so it holds across separately-
+ * loaded copies of chant-core the way `instanceof` does not. Every caller
+ * (`collect.ts`, `build.ts`, `graph-ir.ts`, `entity-wire-codec.ts`) reads
+ * only own-prototype members off the result (`outputName`, `_sourceParent`,
+ * `_setSourceEntity()`, `getOutputValue()`), all of which work identically
+ * on a cross-copy instance.
  */
 export declare function isLexiconOutput(value: unknown): value is LexiconOutput;
 //# sourceMappingURL=lexicon-output.d.ts.map

package/dist/lexicon-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lexicon-output.d.ts","sourceRoot":"","sources":["../src/lexicon-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAW5D;AAED;;;;;;;;GAQG;AACH,qBAAa,aAAc,YAAW,SAAS;IAC7C,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAG,IAAI,CAAU;IAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;gBAE1B,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM;IA8B3D;;;;OAIG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpC;;;;OAIG;IACH,cAAc,IAAI,OAAO;IAOzB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa;IAO5D,MAAM,IAAI;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE;CAGtC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAErF;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAEtE"}
+{"version":3,"file":"lexicon-output.d.ts","sourceRoot":"","sources":["../src/lexicon-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;0CAE0C;AAC1C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,eAAoC,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAW5D;AAED;;;;;;;;;;GAUG;AACH,qBAAa,aAAc,YAAW,SAAS;IAC7C,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAG,IAAI,CAAU;IAC5C;;uCAEmC;IACnC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;gBAExC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,oBAAoB,EAAE,IAAI,EAAE,MAAM;IAwEzE;;;;OAIG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpC;;;;;OAKG;IACH,cAAc,IAAI,OAAO;IAUzB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa;IAO5D,MAAM,IAAI;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE;CAGtC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,oBAAoB,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAOtE"}

package/dist/lint/config.d.ts

@@ -83,6 +83,12 @@ export declare const DEFAULT_CONFIG: LintConfig;
  * then falls back to `chant.config.json` (legacy LintConfig format).
  * Returns default configuration if neither exists.
  *
+ * chant #1113 — the `chant.config.ts` branch executes project-authored code,
+ * so it goes through `../config-sandbox.ts` like every other config load
+ * rather than `require`-ing the file itself. Unarmed (which is every `chant
+ * lint` invocation today — `lint` has no `--sandbox` flag) that is the
+ * identical `createRequire` path this used before, moved one module over.
+ *
  * @param dir - Directory path to search for config file
  * @returns Loaded and merged configuration, or default config if not found
  */

package/dist/lint/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AASnD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiBlD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAoClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AASnD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiBlD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAkClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG"}

package/dist/lint/policy-import.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The single place chant imports a project's `lint.policies` module **in the
+ * CLI's own process** — and the flag that says it may not.
+ *
+ * The third member of the same family as `../discovery/import.ts`'s
+ * `importModule` (project source) and `../config-import.ts`'s
+ * `importConfigModule` (`chant.config.ts`): one narrow module whose only job is
+ * "execute project-authored code here", so that "did any project code run in
+ * this process?" has one place to look and one place to instrument — see
+ * `examples/sandbox-execution-boundary.test.ts`, which spies on all three.
+ *
+ * Before chant #1131 `./policy.ts` called `await import(resolved)` inline,
+ * which is why the corpus boundary gate could not see it even after #1113 put
+ * the config behind the boundary: there was nothing named to wrap.
+ *
+ * The armed flag lives here rather than in `./policy-sandbox.ts` (which owns
+ * the *decision* and documents the reasoning, and re-exports these three
+ * functions as its public surface) for one structural reason: `./policy.ts`
+ * needs to consult it, `./policy-sandbox.ts` needs to call `./policy.ts`, and a
+ * flag on a leaf module with no imports of its own breaks what would otherwise
+ * be an import cycle. It also puts the check on the narrowest possible thing —
+ * the function that actually executes project code — rather than on a caller
+ * that might forget to ask.
+ */
+/**
+ * Arm sandboxed policy execution for the rest of this process. See
+ * `./policy-sandbox.ts` for what arms it and why it is a process mode rather
+ * than a threaded option. Idempotent; there is deliberately no disarm.
+ */
+export declare function armSandboxPolicyExecution(): void;
+/** Whether {@link armSandboxPolicyExecution} has been called. */
+export declare function isSandboxPolicyExecutionArmed(): boolean;
+/** Test-only reset — vitest gives each test file its own module registry, so this exists for suites that arm and disarm within one file. */
+export declare function resetSandboxPolicyExecutionForTests(): void;
+/** The shape a policy module evaluates to — chant reads its exported values and keeps the `PostSynthCheck`-shaped ones. */
+export type PolicyModuleNamespace = Record<string, unknown>;
+/**
+ * Import a policy module into THIS process and return its module namespace.
+ * Node's ESM registry caches it, so repeated loads within one CLI invocation
+ * evaluate the file once.
+ *
+ * Refuses while armed. Under `--sandbox` the policy modules are imported inside
+ * a child process (`../discovery/sandbox/policy-run.ts`); arriving here anyway
+ * means something is about to execute project-authored code in the CLI's own
+ * process, which is exactly what the flag promises does not happen. Falling
+ * through would make `--sandbox` mean less than it says with nothing visible to
+ * notice, so this throws instead.
+ */
+export declare function importPolicyModule(policyPath: string): Promise<PolicyModuleNamespace>;
+//# sourceMappingURL=policy-import.d.ts.map

package/dist/lint/policy-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-import.d.ts","sourceRoot":"","sources":["../../src/lint/policy-import.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED,iEAAiE;AACjE,wBAAgB,6BAA6B,IAAI,OAAO,CAEvD;AAED,4IAA4I;AAC5I,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D;AAED,2HAA2H;AAC3H,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAO3F"}

package/dist/lint/policy-sandbox.d.ts

@@ -0,0 +1,89 @@
+import { type PostSynthCheck, type PostSynthContext, type PostSynthDiagnostic } from "./post-synth.js";
+import { armSandboxPolicyExecution, isSandboxPolicyExecutionArmed, resetSandboxPolicyExecutionForTests } from "./policy-import.js";
+import type { EncodablePolicyBuildResult } from "../discovery/sandbox/policy-wire.js";
+/**
+ * chant #1131 — decides WHERE a project's `lint.policies` checks run.
+ *
+ * A policy is project-authored code. Every other piece of project code moved
+ * behind the `--sandbox` boundary in chant #1045 (run-fallback source), #1093
+ * (composite factories, constructors, intrinsic tags) and #1113
+ * (`chant.config.ts`), and all three had to leave this one out: the config
+ * declares its policies as *paths*, so putting the config behind the boundary
+ * did not put them there with it. `chant build` imported each policy module and
+ * called its `check` function in the CLI's own process, after discovery was
+ * over, with the CLI's filesystem, network, environment and process-spawn
+ * access. This module closes it.
+ *
+ * ## Why an armed process mode rather than a threaded option
+ *
+ * The same reason `../config-sandbox.ts` gives. `./policy.ts`'s
+ * `loadPolicyChecks` is exported from chant-core's public surface and called
+ * from more than one place (`../cli/commands/build.ts` for a build, and
+ * `evaluateProjectPolicies` for the `policyGate` Op step). Threading a
+ * `sandbox` flag to each is fail-OPEN: miss one and project code executes in
+ * the CLI process with nothing to notice. Arming the process once, before any
+ * policy is loaded, is fail-CLOSED — `loadPolicyChecks` REFUSES while armed, so
+ * a call site nobody remembered gets a loud error rather than a silent
+ * execution.
+ *
+ * ## What arms it
+ *
+ * Both ways of turning sandboxing on, unlike `../config-sandbox.ts`. That
+ * asymmetry is not an oversight: the config has a bootstrap limit (reading
+ * `build.sandbox` out of `chant.config.ts` means running it, so only the CLI
+ * flag, known before any config is touched, can cover the config's own
+ * evaluation). Policies have no such limit — they are loaded long after the
+ * config is known — so `build.sandbox: true` in a project's config sandboxes
+ * them just as `--sandbox` does, and `../cli/commands/build.ts` arms this from
+ * the RESOLVED value.
+ *
+ * There is deliberately no disarm: a security mode that can be turned off
+ * partway through a process is not one.
+ */
+/**
+ * The mode itself lives on `./policy-import.ts` — the leaf module that actually
+ * performs an in-process policy import, so the refusal sits on the narrowest
+ * possible thing and `./policy.ts` can consult it without importing this file
+ * (which imports `./policy.ts`). Re-exported here because this is where the
+ * decision is documented and where callers look.
+ *
+ * `armSandboxPolicyExecution` is called from `../cli/commands/build.ts` once
+ * `build.sandbox`/`--sandbox` has resolved, and from `../cli/main.ts` off the
+ * parsed flag.
+ */
+export { armSandboxPolicyExecution, isSandboxPolicyExecutionArmed, resetSandboxPolicyExecutionForTests };
+export interface ProjectPolicyRun {
+    /** `lint.policies` as declared in the config — relative paths, resolved against {@link configDir}. */
+    policies: readonly string[];
+    /** The `chant.config.*` directory (`lint.policies` paths are relative to it), also the child's read allowance. */
+    configDir: string;
+    /** The merged, serialized build result the checks run over. */
+    buildResult: EncodablePolicyBuildResult & PostSynthContext["buildResult"];
+    /** `--env`, else `ownership.env`. Becomes `ctx.env`. */
+    env?: string;
+    /**
+     * Checks the caller already loaded into THIS process, before the build ran.
+     *
+     * `chant build` has always loaded `lint.policies` up front rather than at the
+     * point of use, so a policy path that doesn't resolve fails the command
+     * immediately — including when the build itself goes on to fail, which is
+     * exactly when a typo'd path would otherwise go unnoticed. Preserving that
+     * for the unsandboxed path is the whole reason this field exists.
+     *
+     * Ignored when armed: under `--sandbox` there is nothing loaded here to pass,
+     * and `loadPolicyChecks` refuses outright.
+     */
+    preloaded?: PostSynthCheck[];
+}
+/**
+ * Run a project's organizational policy checks over a finished build and return
+ * their diagnostics. Sandboxed in a post-merge child when armed, in-process
+ * otherwise.
+ *
+ * The unarmed path is byte-for-byte what `chant build` has always done: load
+ * the modules, hand every check one `PostSynthContext`, concatenate what they
+ * return. The armed path does the same thing on the other side of a process
+ * boundary — see `../discovery/sandbox/policy-run.ts`.
+ */
+export declare function runProjectPolicies(run: ProjectPolicyRun): Promise<PostSynthDiagnostic[]>;
+//# sourceMappingURL=policy-sandbox.d.ts.map

package/dist/lint/policy-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-sandbox.d.ts","sourceRoot":"","sources":["../../src/lint/policy-sandbox.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;GAUG;AACH,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,mCAAmC,EAAE,CAAC;AAEzG,MAAM,WAAW,gBAAgB;IAC/B,sGAAsG;IACtG,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,kHAAkH;IAClH,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,WAAW,EAAE,0BAA0B,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC1E,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAoB9F"}

package/dist/lint/policy.d.ts

@@ -1,5 +1,16 @@
 import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth.js";
-/** Load project policy checks (one or more `PostSynthCheck` exports) from files. */
+/**
+ * Load project policy checks (one or more `PostSynthCheck` exports) from files,
+ * **into this process**.
+ *
+ * chant #1131 — refuses while `./policy-sandbox.ts` is armed. Under `--sandbox`
+ * the policy modules are imported and their checks run inside a child process
+ * (`runProjectPolicies`); reaching this function anyway means a call site is
+ * about to execute project-authored code in the CLI's own process, which is
+ * precisely the thing the flag promises does not happen. Failing loudly is the
+ * only honest option — falling through would make `--sandbox` mean less than it
+ * says without anything visible to notice.
+ */
 export declare function loadPolicyChecks(paths: string[], configDir: string): Promise<PostSynthCheck[]>;
 export interface PolicyEvaluation {
     /** All policy diagnostics (errors + warnings). */

package/dist/lint/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExE,oFAAoF;AACpF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2EAA2E;IAC3E,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8B5B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGxE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAuBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2EAA2E;IAC3E,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8B5B"}

package/dist/stack-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;mDAC+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAgBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,EACxB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,WAAW,CAuBb"}
+{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAG1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;mDAC+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAqBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,EACxB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,WAAW,CAiCb"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",