@intentius/chant 0.25.0 → 0.26.0

package/dist/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,cAAc,EAAiC,MAAM,UAAU,CAAC;AACzE,OAAO,EAAE,aAAa,EAAmB,MAAM,kBAAkB,CAAC;AAGlE,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAKvF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,CACb,MAAM,EACN;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CACtD,CAAC;IACF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,wEAAwE;IACxE,UAAU,EAAE,UAAU,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IAClB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,MAAM,EAAE,GACrB,UAAU,CAuEZ;AAED;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,qDAAqD;IACrD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6DAA6D;IAC7D,MAAM,EAAE,KAAK,CAAC,cAAc,GAAG,UAAU,CAAC,CAAC;IAC3C,wDAAwD;IACxD,QAAQ,EAAE,aAAa,CAAC;IACxB,uCAAuC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;IAE9B;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CActC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CAuEjB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CAyFjB;AA6ED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,UAAU,EAAE,EACzB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAWtB;AA0KD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,sBAAsB,EAC5B,WAAW,EAAE,UAAU,EAAE,EACzB,KAAK,SAAsB,EAC3B,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAgBtB"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,cAAc,EAAiC,MAAM,UAAU,CAAC;AACzE,OAAO,EAAE,aAAa,EAAmB,MAAM,kBAAkB,CAAC;AAIlE,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAKvF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,CACb,MAAM,EACN;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CACtD,CAAC;IACF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,wEAAwE;IACxE,UAAU,EAAE,UAAU,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IAClB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,YAAY,EAAE,MAAM,EAAE,GACrB,UAAU,CA6EZ;AAED;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,qDAAqD;IACrD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6DAA6D;IAC7D,MAAM,EAAE,KAAK,CAAC,cAAc,GAAG,UAAU,CAAC,CAAC;IAC3C,wDAAwD;IACxD,QAAQ,EAAE,aAAa,CAAC;IACxB,uCAAuC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;IAE9B;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CActC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CAuEjB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,aAAa,EAAE,CA+FjB;AA6ED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,UAAU,EAAE,EACzB,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAWtB;AA0KD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,sBAAsB,EAC5B,WAAW,EAAE,UAAU,EAAE,EACzB,KAAK,SAAsB,EAC3B,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAgBtB"}

package/dist/cli/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AASnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2JAA2J;IAC3J,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CACjE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAoX9E;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAUnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2JAA2J;IAC3J,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CACjE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+Y9E;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAMA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAuB9E;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CA+NpD;AAmaD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5E"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAMA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAoE9E;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAoQpD;AA2aD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5E"}

package/dist/discovery/entity-wire-codec.d.ts

@@ -23,20 +23,25 @@
  * value) becomes a name-keyed marker instead. {@link decodeEntitySet} is the
  * inverse — it rebuilds a live `Map<string, Declarable>` whose entities are
  * BEHAVIORALLY indistinguishable from what `discover()` would have produced
- * in-process: real `AttrRef` instances (several call sites downstream key off
- * `instanceof AttrRef`, not just duck typing — `intrinsic-interpolation.ts`'s
+ * in-process: real `AttrRef` instances, not a duck-typed `{__attrRef}`
+ * envelope alone. `new AttrRef(...)` here is plain, direct construction from
+ * this module's own class — this codec runs inside the same module graph as
+ * every downstream reader (`intrinsic-interpolation.ts`'s
  * `defaultInterpolationSerializer`, `discovery/graph.ts`'s
  * `buildDependencyGraph`, `build.ts`'s `detectCrossLexiconRefs`/
- * `computeStackGraph` — so a plain `{__attrRef}` envelope alone is not
- * enough), and whole-entity embeds restored to the SAME object reference
- * (not a structurally-equal clone), so `entityNames.get(decl)` keeps working
- * by identity exactly as it does today.
+ * `computeStackGraph`, all converted to `isAttrRefLike` duck-typing by chant
+ * #1137 for the OTHER hazard, a separately-loaded lexicon copy) — so there is
+ * no dual-package boundary to duck-type across here, and building the real
+ * class is simply less code than hand-assembling a shape-alike stand-in with
+ * matching methods, and whole-entity embeds restored to the SAME object
+ * reference (not a structurally-equal clone), so `entityNames.get(decl)`
+ * keeps working by identity exactly as it does today.
  *
  * `serializer-walker.ts`'s `walkValue` needs NO changes for this: it already
  * falls back to reading a plain `{__attrRef}` envelope (added for intrinsics
  * whose own `toJSON()` embeds one). `decodeEntitySet` goes further and
- * reconstructs the real class so every OTHER `instanceof AttrRef` call site
- * keeps working too, not just the walker.
+ * reconstructs the real class, both simpler here and a belt-and-suspenders
+ * match for any call site that still checks `instanceof AttrRef` directly.
  *
  * Naming happens exactly once, inside the boundary — `resolveAttrRefs`
  * (./resolve.ts) runs as part of `discover()`, before `encodeEntitySet` is
@@ -78,7 +83,7 @@ import { type Declarable } from "../declarable.js";
  *   form. `refs` additionally captures any `AttrRef`/whole-entity reference
  *   found while walking the intrinsic's OWN fields (not through `toJSON()`)
  *   — `buildDependencyGraph` and `detectCrossLexiconRefs`/`computeStackGraph`
- *   walk raw entity property trees looking for `instanceof AttrRef`/a
+ *   walk raw entity property trees looking for an `AttrRef`-like value/a
  *   tracked `Declarable`, not through `toJSON()`, so a ref nested inside e.g.
  *   a `Sub` template needs to still be discoverable post-decode for
  *   cross-lexicon output auto-detection and dependency ordering to keep

package/dist/discovery/entity-wire-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-wire-codec.d.ts","sourceRoot":"","sources":["../../src/discovery/entity-wire-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAOzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,MAAM,GACN,MAAM,GACN,OAAO,GACP,SAAS,EAAE,GACX;IAAE,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,WAAW,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACnC;IAAE,UAAU,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,CAAA;KAAE,CAAA;CAAE,GAC1E;IAAE,WAAW,EAAE;QAAE,KAAK,EAAE,SAAS,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,SAAS,EAAE,CAAA;KAAE,CAAA;CAAE,GAC1E;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEjC,kIAAkI;AAClI,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACnC;AAED,iKAAiK;AACjK,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,eAAe,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,+KAA+K;IAC/K,GAAG,EAAE,SAAS,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAExE,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AA0KD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,aAAa,CAoBhF;AAuGD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CA0C5E"}
+{"version":3,"file":"entity-wire-codec.d.ts","sourceRoot":"","sources":["../../src/discovery/entity-wire-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAOzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,MAAM,GACN,MAAM,GACN,OAAO,GACP,SAAS,EAAE,GACX;IAAE,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,WAAW,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACnC;IAAE,UAAU,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,CAAA;KAAE,CAAA;CAAE,GAC1E;IAAE,WAAW,EAAE;QAAE,KAAK,EAAE,SAAS,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,SAAS,EAAE,CAAA;KAAE,CAAA;CAAE,GAC1E;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEjC,kIAAkI;AAClI,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACnC;AAED,iKAAiK;AACjK,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,eAAe,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,+KAA+K;IAC/K,GAAG,EAAE,SAAS,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AAExE,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AA0KD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,aAAa,CAoBhF;AAuGD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CA0C5E"}

package/dist/discovery/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/discovery/graph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIhD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAuB1B"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/discovery/graph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAKhD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAuB1B"}

package/dist/discovery/sandbox/config-wire.d.ts

@@ -18,6 +18,12 @@
  * the project code it is inspecting — so it must not import anything, and must
  * not touch the filesystem, the environment or the process.
  *
+ * chant #1131 reuses the same walk for the OTHER direction: a `lint.policies`
+ * check runs inside a sandboxed child and its `PostSynthDiagnostic[]` has to
+ * come back as data (`./policy-wire.ts`). That is the same "JSON is lossy
+ * without complaining" problem with a different root value, so the walk is
+ * exported as {@link scanValueWireSafety} rather than copied.
+ *
  * ## What `ChantConfig` legally holds
  *
  * Every field of `ChantConfig` (`../../config.ts`) is JSON data: string arrays
@@ -52,6 +58,16 @@ export interface ConfigWireOffender {
     /** What was found there, phrased for an error message (e.g. `a function`, `a Date`). */
     found: string;
 }
+/**
+ * chant #1131 — report every value ANYWHERE in `value` that cannot cross the
+ * sandbox boundary as JSON, with paths rooted at `rootPath`.
+ *
+ * {@link scanConfigWireSafety} is the config-shaped entry point (it tolerates a
+ * module namespace object at the root); this one takes the value as given, so
+ * an array root (`diagnostics`) or a plain object root both work. Same rules,
+ * same `undefined`-object-property allowance — see the module doc.
+ */
+export declare function scanValueWireSafety(value: unknown, rootPath?: string): ConfigWireOffender[];
 /**
  * Report every value in `config` that cannot cross the sandbox boundary as
  * JSON. An empty array means a `JSON.parse(JSON.stringify(config))` round-trip

package/dist/discovery/sandbox/config-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-wire.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/config-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;CACf;AAiFD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,EAAE,CAe1E;AAED,2IAA2I;AAC3I,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,MAAM,CAOR"}
+{"version":3,"file":"config-wire.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/config-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;CACf;AAiFD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAK,GAAG,kBAAkB,EAAE,CAIvF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,EAAE,CAe1E;AAED,2IAA2I;AAC3I,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,MAAM,CAOR"}

package/dist/discovery/sandbox/driver.d.ts

@@ -30,4 +30,33 @@ export declare function generateDriverSource(options: GenerateDriverOptions): st
  * interpreted.
  */
 export declare function generateConfigDriverSource(configPath: string): string;
+/**
+ * chant #1131 — generate the driver module that imports a project's
+ * `lint.policies` modules INSIDE the sandboxed child, runs their checks over
+ * the build result the parent hands it, and sends back plain
+ * `PostSynthDiagnostic`s.
+ *
+ * Same machinery again: literal-specifier dynamic `import()`s esbuild can trace
+ * and inline, `./child-errors.ts` for classification so a permission denial
+ * names the policy file, one IPC message back. Two things are specific to this
+ * one:
+ *
+ *  - **It receives before it sends.** The run and config drivers are fully
+ *    parameterized by their generated source; a policy check needs the finished
+ *    build result, which is neither known at bundle time nor something to bake
+ *    into a source literal. It arrives as one IPC message (see `./fork.ts`'s
+ *    `send`). The `process.on("message", …)` registration is top-level and
+ *    synchronous, so it is in place before the event loop can deliver anything
+ *    — a message the parent sent before the child finished booting is queued on
+ *    the channel, not lost.
+ *  - **Checks run wrapped, not raw.** `runPostSynthChecks` (chant's own, from
+ *    `../../lint/post-synth.ts`) is invoked ONCE over every check from every
+ *    policy module, exactly as `cli/commands/build.ts` invokes it in-process —
+ *    so the checks share one `PostSynthContext` and run in one order, and the
+ *    diagnostics come back in the same sequence. The wrapper around each check
+ *    is what makes a bad return value attributable: it scans that check's own
+ *    output and throws a `PolicyWireError` naming the module the check was
+ *    loaded from, rather than reporting an offending index in a merged array.
+ */
+export declare function generatePolicyDriverSource(policyPaths: readonly string[]): string;
 //# sourceMappingURL=driver.d.ts.map

package/dist/discovery/sandbox/driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/driver.ts"],"names":[],"mappings":"AA8CA,MAAM,WAAW,qBAAqB;IACpC,qIAAqI;IACrI,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,oNAAoN;IACpN,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAqF3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA6CrE"}
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/driver.ts"],"names":[],"mappings":"AAiDA,MAAM,WAAW,qBAAqB;IACpC,qIAAqI;IACrI,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,oNAAoN;IACpN,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAqF3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA6CrE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAmGjF"}

package/dist/discovery/sandbox/fork.d.ts

@@ -42,6 +42,24 @@ export interface SandboxForkOptions {
     timeoutMs: number;
     /** What timed out / exited early, for the error message (e.g. `"sandboxed run"`). */
     label: string;
+    /**
+     * chant #1131 — an optional payload sent to the child over the SAME IPC
+     * channel its response comes back on, immediately after the fork.
+     *
+     * The run and config children are fully described by their generated driver
+     * source, so they need nothing inbound. The policy child does: its input is
+     * the finished build result, which exists only after the parent has merged
+     * and serialized, long after the bundle was built. Sending it rather than
+     * baking it into a source literal keeps the bundle small (esbuild would
+     * otherwise parse a multi-megabyte literal) and keeps it off disk.
+     *
+     * Safe to send before the child has booted: `child.send` writes to the IPC
+     * pipe and Node queues the message until the child's channel is read, and
+     * the driver registers its `process.on("message", …)` synchronously at module
+     * top level — before the event loop can deliver anything. This is NOT a
+     * second protocol: same channel, same JSON, same one-message-back response.
+     */
+    send?: Record<string, unknown>;
 }
 /**
  * Fork `bundlePath` under `--permission` with a scrubbed environment, and

package/dist/discovery/sandbox/fork.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fork.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/fork.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;IACxB,6IAA6I;IAC7I,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC7B,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CAoDZ"}
+{"version":3,"file":"fork.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/fork.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;IACxB,6IAA6I;IAC7I,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC7B,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CAwEZ"}

package/dist/discovery/sandbox/policy-run.d.ts

@@ -0,0 +1,33 @@
+import type { PostSynthDiagnostic } from "../../lint/post-synth.js";
+import { type EncodablePolicyBuildResult } from "./policy-wire.js";
+export interface SandboxPolicyResult {
+    /** What the policy pack reported — plain data, validated inside the child before it crossed (see `./policy-wire.ts`'s `scanPolicyDiagnostics`). */
+    diagnostics: PostSynthDiagnostic[];
+    /** esbuild bundling wall-clock time. */
+    bundleMs: number;
+    /** Bundle size in bytes. */
+    bundleBytes: number;
+    /** Encoded build-result payload size in bytes — what crossed the IPC channel. */
+    payloadBytes: number;
+}
+export interface SandboxPolicyOptions {
+    /** Absolute paths to the project's `lint.policies` modules, in declaration order. */
+    policyPaths: readonly string[];
+    /** The merged, serialized build result the checks run over. */
+    buildResult: EncodablePolicyBuildResult;
+    /** The environment/stack this build was evaluated for (`--env`, else `ownership.env`) — becomes `ctx.env`. */
+    env?: string;
+    /** Directory the child is granted `--allow-fs-read` for: the project root (the `chant.config.*` directory, which `lint.policies` paths are resolved against). */
+    projectRoot: string;
+}
+/**
+ * Evaluate `policyPaths` against `buildResult` inside a sandboxed child.
+ *
+ * Throws — rather than degrading to an in-process run — when the policies
+ * cannot be evaluated inside the boundary or their diagnostics cannot cross it
+ * as JSON. Under `--sandbox` a policy pack that "almost" ran is not a safe
+ * thing to proceed with, and quietly falling back would give away the property
+ * the flag exists to provide.
+ */
+export declare function runPoliciesSandboxed(options: SandboxPolicyOptions): Promise<SandboxPolicyResult>;
+//# sourceMappingURL=policy-run.d.ts.map

package/dist/discovery/sandbox/policy-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-run.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/policy-run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIjE,OAAO,EAGL,KAAK,0BAA0B,EAEhC,MAAM,eAAe,CAAC;AA+EvB,MAAM,WAAW,mBAAmB;IAClC,mJAAmJ;IACnJ,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,+DAA+D;IAC/D,WAAW,EAAE,0BAA0B,CAAC;IACxC,8GAA8G;IAC9G,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iKAAiK;IACjK,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA0DtG"}

package/dist/discovery/sandbox/policy-wire.d.ts

@@ -0,0 +1,177 @@
+import type { Declarable } from "../../declarable.js";
+import type { SerializerResult } from "../../serializer.js";
+import type { PostSynthContext } from "../../lint/post-synth.js";
+import { type EntitySetWire } from "../entity-wire-codec.js";
+import { type ConfigWireOffender } from "./config-wire.js";
+/**
+ * chant #1131 — what a build result looks like on its way INTO the sandboxed
+ * policy child, and what a `PostSynthDiagnostic` must look like on its way back
+ * out.
+ *
+ * A project's `lint.policies` checks are project-authored functions chant calls
+ * over the finished build. #1113 put `chant.config.ts` behind the `--sandbox`
+ * boundary but could not take the policies with it, because the config declares
+ * them as *paths*: the modules were still imported and their `check` functions
+ * still invoked in the CLI's own process, with the CLI's filesystem, network,
+ * environment and process-spawn access, after discovery was over.
+ *
+ * The shape of the fix is forced by what a policy is. It is not data that can
+ * be evaluated somewhere and carried back — it is a callback over the resolved
+ * resources, so it has to run somewhere it can see them. It also cannot run in
+ * the #1045 discovery child, because that child only ever sees the run-fallback
+ * *subset*: folded files are collected in the parent, and serialization happens
+ * in the parent, so no complete view of the build exists on that side. What
+ * does exist, after the parent has merged and serialized, is a build result
+ * that is *nearly* data already — which is what this module makes explicit.
+ *
+ * So: one more child, after the merge, handed the encoded build result,
+ * importing the policy modules inside the boundary and returning plain
+ * diagnostics. Same bundling (`./bundle.ts`), same spawn and `--permission`
+ * profile (`./fork.ts`), same error classification (`./child-errors.ts`), same
+ * "only JSON crosses, and anything else is named, never dropped" contract
+ * (`./config-wire.ts`, whose walk is reused directly).
+ *
+ * ## What crosses, and what that costs
+ *
+ * `PostSynthContext` gives a check five things. Four of them are already data:
+ * `outputs` (each lexicon's serialized text), `warnings`, `errors`,
+ * `sourceFileCount`. The fifth, `entities`, is a live `Map<string, Declarable>`
+ * whose cross-entity references are object identity and `WeakRef`s — the exact
+ * problem chant #1045 Phase 1 solved for discovery, so this reuses that codec
+ * (`../entity-wire-codec.ts`) rather than inventing a second one.
+ *
+ * That reuse is what makes the round trip cheap AND what defines its limits.
+ * `encodeEntitySet`/`decodeEntitySet` is documented as producing entities
+ * "behaviorally indistinguishable" from the in-process ones for chant's own
+ * consumers (serializers, the dependency graph, cross-lexicon detection), and
+ * a policy is a consumer of the same shape. Where it is NOT identical is
+ * written down in `docs/.../architecture/sandbox.mdx` and pinned by
+ * `./policy-wire.test.ts`:
+ *
+ *  - An intrinsic (`Sub`, `Ref`, gitlab's `!reference`, …) decodes to a
+ *    marker-bearing wrapper exposing `toJSON()`/`toYAML()`, not to an instance
+ *    of the lexicon's own intrinsic class.
+ *  - A decoded entity is a plain marker-bearing object, not an instance of the
+ *    lexicon's resource class, and its `lexicon`/`entityType`/`kind`/`props`/
+ *    `attributes` are non-enumerable (so `Object.keys(entity)` sees only the
+ *    per-attribute/extra fields). Reads — `entity.props`, `entity.entityType`,
+ *    `isDeclarable(entity)`, `instanceof AttrRef` — all still work.
+ *  - A `ChildProjectInstance` (`nestedStack()`) has no wire form at all;
+ *    `encodeEntitySet` throws rather than mis-encoding it, so a `--sandbox`
+ *    build that both uses `nestedStack()` and declares `lint.policies` fails
+ *    loudly. (No corpus entry uses `nestedStack()`.)
+ *  - `errors` cross as the plain objects `DiscoveryError`/`BuildError`'s own
+ *    `toJSON()` produces, not as `Error` instances. In practice this is never
+ *    observable: `chant build` runs policies only when the build produced no
+ *    errors at all, so the array is always empty at that point.
+ *
+ * Crucially, the first two are NOT new under `--sandbox`: a sandboxed build
+ * already merges decoded entities for every run-fallback file (`./run.ts`), so
+ * a policy running in-process on a `--sandbox` build is already looking at
+ * decoded entities for part of the set. Encoding is idempotent over a decoded
+ * entity (verified in `./policy-wire.test.ts`), so this child widens that from
+ * "the run-fallback subset" to "all of them" and changes nothing else.
+ */
+/** Wire form of one lexicon's serialized output — already data on both sides; carried as-is. */
+export type PolicyOutputWire = string | {
+    primary: string;
+    files?: Record<string, string>;
+    warnings?: string[];
+};
+/** A build result as pure JSON, for the sandboxed policy child. */
+export interface PolicyBuildResultWire {
+    /** `../entity-wire-codec.ts`'s format — the same one the #1045 discovery child returns. */
+    entities: EntitySetWire;
+    /** `Map` entries as pairs; a `Map` itself JSON-stringifies to `{}`. */
+    outputs: Array<[string, PolicyOutputWire]>;
+    warnings: string[];
+    /** `DiscoveryError`/`BuildError`'s own `toJSON()` output. Always empty in practice — see the module doc. */
+    errors: Array<Record<string, unknown>>;
+    sourceFileCount: number;
+    /** `BuildResult.dependencies` (`Map<string, Set<string>>`) as pairs of arrays. Not part of `PostSynthContext`'s declared surface; carried so `ctx.buildResult` is not silently narrower than the object the in-process path passes. */
+    dependencies: Array<[string, string[]]>;
+    /** `BuildResult.manifest` — plain data (lexicons, cross-lexicon outputs, deploy order, stack graph). Same "not declared, still carried" reasoning as {@link dependencies}. */
+    manifest?: unknown;
+    /** `BuildResult.foldDecisions` — plain data. */
+    foldDecisions?: unknown[];
+    /** `BuildResult.buildParams` — plain data (#1064 provenance records). */
+    buildParams?: unknown[];
+}
+/** The subset of `BuildResult` this module knows how to carry. Structurally satisfied by `../../build.ts`'s `BuildResult`. */
+export interface EncodablePolicyBuildResult {
+    outputs: Map<string, string | SerializerResult>;
+    entities: Map<string, Declarable>;
+    warnings: string[];
+    errors: ReadonlyArray<{
+        name: string;
+        message: string;
+        toJSON?: () => unknown;
+    }>;
+    sourceFileCount: number;
+    dependencies?: Map<string, Set<string>>;
+    manifest?: unknown;
+    foldDecisions?: unknown[];
+    buildParams?: unknown[];
+}
+/**
+ * Encode a merged, serialized build result for the policy child.
+ *
+ * Runs in the PARENT. Throws — never drops — when the result holds something
+ * the wire cannot represent: `encodeEntitySet`'s own refusals (a `nestedStack()`
+ * child project, an `AttrRef` that never got a logical name) propagate, and the
+ * finished payload is walked by `./config-wire.ts`'s scan so a serializer that
+ * somehow produced a non-data output is named by key path rather than silently
+ * mangled by `JSON.stringify`.
+ */
+export declare function encodePolicyBuildResult(result: EncodablePolicyBuildResult): PolicyBuildResultWire;
+/**
+ * Rebuild the `PostSynthContext["buildResult"]` a check expects, from the wire.
+ *
+ * Runs INSIDE the child. The maps and the live entity graph are reconstructed
+ * here (`decodeEntitySet`), so a check sees the same kind of object it sees
+ * in-process — `ctx.entities` is a real `Map`, its values are real
+ * `Declarable`s, and an `AttrRef` between two of them is a real `AttrRef`
+ * carrying its resolved logical name.
+ */
+export declare function decodePolicyBuildResult(wire: PolicyBuildResultWire): PostSynthContext["buildResult"];
+/** One thing a policy returned that cannot cross back, with the policy module it came from. */
+export interface PolicyDiagnosticOffender extends ConfigWireOffender {
+    /** Absolute path of the `lint.policies` module whose check returned it. */
+    policy: string;
+}
+/**
+ * Validate what one policy module's checks returned, INSIDE the child, before
+ * it goes anywhere near the IPC channel.
+ *
+ * Two separate questions, both answered here rather than by hoping
+ * `JSON.stringify` behaves:
+ *
+ *  1. Is it data? A `PostSynthDiagnostic` is declared as five plain fields, but
+ *     a check is arbitrary project code and can return anything. A function, a
+ *     `Date`, a class instance, a circular reference — `JSON.stringify` would
+ *     drop or rewrite each of them without a word, and the CLI would print a
+ *     diagnostic that is not the one the policy produced.
+ *  2. Is it a diagnostic? A missing `checkId`, or a `severity` outside
+ *     `error`/`warning`/`info`, is reported here instead of turning into an
+ *     undefined-shaped line in the build's error list.
+ */
+export declare function scanPolicyDiagnostics(diagnostics: unknown, policyPath: string): PolicyDiagnosticOffender[];
+/**
+ * Thrown INSIDE the child by the per-check wrapper `./driver.ts` generates,
+ * when a check returns something that cannot cross back. Carries the offenders
+ * so the driver can report them as data rather than as a message string it
+ * would then have to parse.
+ *
+ * A class rather than a tagged object because the driver tests it with
+ * `instanceof`: both halves come from this one module, bundled once, so there
+ * is exactly one class identity inside the child.
+ */
+export declare class PolicyWireError extends Error {
+    readonly offenders: PolicyDiagnosticOffender[];
+    constructor(offenders: PolicyDiagnosticOffender[]);
+}
+/** Render offenders as the body of a build error — one line each, naming the policy module. */
+export declare function formatPolicyWireOffenders(subject: string, offenders: ReadonlyArray<ConfigWireOffender & {
+    policy?: string;
+}>): string;
+//# sourceMappingURL=policy-wire.d.ts.map

package/dist/discovery/sandbox/policy-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-wire.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/policy-wire.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAuB,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,gGAAgG;AAChG,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjH,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,QAAQ,EAAE,aAAa,CAAC;IACxB,uEAAuE;IACvE,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,4GAA4G;IAC5G,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,uOAAuO;IACvO,YAAY,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACxC,8KAA8K;IAC9K,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,yEAAyE;IACzE,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;CACzB;AAED,8HAA8H;AAC9H,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,OAAO,CAAA;KAAE,CAAC,CAAC;IACjF,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,0BAA0B,GAAG,qBAAqB,CAsBjG;AAUD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAapG;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAClE,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,OAAO,EACpB,UAAU,EAAE,MAAM,GACjB,wBAAwB,EAAE,CA8B5B;AAED;;;;;;;;;GASG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,SAAS,EAAE,wBAAwB,EAAE,CAAC;gBAEnC,SAAS,EAAE,wBAAwB,EAAE;CAKlD;AASD,+FAA+F;AAC/F,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,aAAa,CAAC,kBAAkB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GACjE,MAAM,CAUR"}

package/dist/intrinsic-interpolation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intrinsic-interpolation.d.ts","sourceRoot":"","sources":["../src/intrinsic-interpolation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,MAAM,4BAA4B,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;AAEtE;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,EACpE,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GACxC,4BAA4B,CA2C9B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,MAAM,EAAE,SAAS,OAAO,EAAE,EAC1B,cAAc,EAAE,4BAA4B,GAC3C,MAAM,CASR"}
+{"version":3,"file":"intrinsic-interpolation.d.ts","sourceRoot":"","sources":["../src/intrinsic-interpolation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,MAAM,4BAA4B,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;AAEtE;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,EACpE,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GACxC,4BAA4B,CAkD9B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,MAAM,EAAE,SAAS,OAAO,EAAE,EAC1B,cAAc,EAAE,4BAA4B,GAC3C,MAAM,CASR"}

package/dist/lexicon-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lexicon-output.d.ts","sourceRoot":"","sources":["../src/lexicon-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;0CAE0C;AAC1C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,eAAoC,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAW5D;AAED;;;;;;;;;;GAUG;AACH,qBAAa,aAAc,YAAW,SAAS;IAC7C,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAG,IAAI,CAAU;IAC5C;;uCAEmC;IACnC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;gBAExC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,oBAAoB,EAAE,IAAI,EAAE,MAAM;IA+DzE;;;;OAIG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpC;;;;;OAKG;IACH,cAAc,IAAI,OAAO;IAUzB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa;IAO5D,MAAM,IAAI;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE;CAGtC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,oBAAoB,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAOtE"}
+{"version":3,"file":"lexicon-output.d.ts","sourceRoot":"","sources":["../src/lexicon-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;0CAE0C;AAC1C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,eAAoC,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAW5D;AAED;;;;;;;;;;GAUG;AACH,qBAAa,aAAc,YAAW,SAAS;IAC7C,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAG,IAAI,CAAU;IAC5C;;uCAEmC;IACnC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;gBAExC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,oBAAoB,EAAE,IAAI,EAAE,MAAM;IAwEzE;;;;OAIG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIpC;;;;;OAKG;IACH,cAAc,IAAI,OAAO;IAUzB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa;IAO5D,MAAM,IAAI;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE;CAGtC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,oBAAoB,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAOtE"}

package/dist/lint/policy-import.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The single place chant imports a project's `lint.policies` module **in the
+ * CLI's own process** — and the flag that says it may not.
+ *
+ * The third member of the same family as `../discovery/import.ts`'s
+ * `importModule` (project source) and `../config-import.ts`'s
+ * `importConfigModule` (`chant.config.ts`): one narrow module whose only job is
+ * "execute project-authored code here", so that "did any project code run in
+ * this process?" has one place to look and one place to instrument — see
+ * `examples/sandbox-execution-boundary.test.ts`, which spies on all three.
+ *
+ * Before chant #1131 `./policy.ts` called `await import(resolved)` inline,
+ * which is why the corpus boundary gate could not see it even after #1113 put
+ * the config behind the boundary: there was nothing named to wrap.
+ *
+ * The armed flag lives here rather than in `./policy-sandbox.ts` (which owns
+ * the *decision* and documents the reasoning, and re-exports these three
+ * functions as its public surface) for one structural reason: `./policy.ts`
+ * needs to consult it, `./policy-sandbox.ts` needs to call `./policy.ts`, and a
+ * flag on a leaf module with no imports of its own breaks what would otherwise
+ * be an import cycle. It also puts the check on the narrowest possible thing —
+ * the function that actually executes project code — rather than on a caller
+ * that might forget to ask.
+ */
+/**
+ * Arm sandboxed policy execution for the rest of this process. See
+ * `./policy-sandbox.ts` for what arms it and why it is a process mode rather
+ * than a threaded option. Idempotent; there is deliberately no disarm.
+ */
+export declare function armSandboxPolicyExecution(): void;
+/** Whether {@link armSandboxPolicyExecution} has been called. */
+export declare function isSandboxPolicyExecutionArmed(): boolean;
+/** Test-only reset — vitest gives each test file its own module registry, so this exists for suites that arm and disarm within one file. */
+export declare function resetSandboxPolicyExecutionForTests(): void;
+/** The shape a policy module evaluates to — chant reads its exported values and keeps the `PostSynthCheck`-shaped ones. */
+export type PolicyModuleNamespace = Record<string, unknown>;
+/**
+ * Import a policy module into THIS process and return its module namespace.
+ * Node's ESM registry caches it, so repeated loads within one CLI invocation
+ * evaluate the file once.
+ *
+ * Refuses while armed. Under `--sandbox` the policy modules are imported inside
+ * a child process (`../discovery/sandbox/policy-run.ts`); arriving here anyway
+ * means something is about to execute project-authored code in the CLI's own
+ * process, which is exactly what the flag promises does not happen. Falling
+ * through would make `--sandbox` mean less than it says with nothing visible to
+ * notice, so this throws instead.
+ */
+export declare function importPolicyModule(policyPath: string): Promise<PolicyModuleNamespace>;
+//# sourceMappingURL=policy-import.d.ts.map

package/dist/lint/policy-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-import.d.ts","sourceRoot":"","sources":["../../src/lint/policy-import.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED,iEAAiE;AACjE,wBAAgB,6BAA6B,IAAI,OAAO,CAEvD;AAED,4IAA4I;AAC5I,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D;AAED,2HAA2H;AAC3H,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAO3F"}

package/dist/lint/policy-sandbox.d.ts

@@ -0,0 +1,89 @@
+import { type PostSynthCheck, type PostSynthContext, type PostSynthDiagnostic } from "./post-synth.js";
+import { armSandboxPolicyExecution, isSandboxPolicyExecutionArmed, resetSandboxPolicyExecutionForTests } from "./policy-import.js";
+import type { EncodablePolicyBuildResult } from "../discovery/sandbox/policy-wire.js";
+/**
+ * chant #1131 — decides WHERE a project's `lint.policies` checks run.
+ *
+ * A policy is project-authored code. Every other piece of project code moved
+ * behind the `--sandbox` boundary in chant #1045 (run-fallback source), #1093
+ * (composite factories, constructors, intrinsic tags) and #1113
+ * (`chant.config.ts`), and all three had to leave this one out: the config
+ * declares its policies as *paths*, so putting the config behind the boundary
+ * did not put them there with it. `chant build` imported each policy module and
+ * called its `check` function in the CLI's own process, after discovery was
+ * over, with the CLI's filesystem, network, environment and process-spawn
+ * access. This module closes it.
+ *
+ * ## Why an armed process mode rather than a threaded option
+ *
+ * The same reason `../config-sandbox.ts` gives. `./policy.ts`'s
+ * `loadPolicyChecks` is exported from chant-core's public surface and called
+ * from more than one place (`../cli/commands/build.ts` for a build, and
+ * `evaluateProjectPolicies` for the `policyGate` Op step). Threading a
+ * `sandbox` flag to each is fail-OPEN: miss one and project code executes in
+ * the CLI process with nothing to notice. Arming the process once, before any
+ * policy is loaded, is fail-CLOSED — `loadPolicyChecks` REFUSES while armed, so
+ * a call site nobody remembered gets a loud error rather than a silent
+ * execution.
+ *
+ * ## What arms it
+ *
+ * Both ways of turning sandboxing on, unlike `../config-sandbox.ts`. That
+ * asymmetry is not an oversight: the config has a bootstrap limit (reading
+ * `build.sandbox` out of `chant.config.ts` means running it, so only the CLI
+ * flag, known before any config is touched, can cover the config's own
+ * evaluation). Policies have no such limit — they are loaded long after the
+ * config is known — so `build.sandbox: true` in a project's config sandboxes
+ * them just as `--sandbox` does, and `../cli/commands/build.ts` arms this from
+ * the RESOLVED value.
+ *
+ * There is deliberately no disarm: a security mode that can be turned off
+ * partway through a process is not one.
+ */
+/**
+ * The mode itself lives on `./policy-import.ts` — the leaf module that actually
+ * performs an in-process policy import, so the refusal sits on the narrowest
+ * possible thing and `./policy.ts` can consult it without importing this file
+ * (which imports `./policy.ts`). Re-exported here because this is where the
+ * decision is documented and where callers look.
+ *
+ * `armSandboxPolicyExecution` is called from `../cli/commands/build.ts` once
+ * `build.sandbox`/`--sandbox` has resolved, and from `../cli/main.ts` off the
+ * parsed flag.
+ */
+export { armSandboxPolicyExecution, isSandboxPolicyExecutionArmed, resetSandboxPolicyExecutionForTests };
+export interface ProjectPolicyRun {
+    /** `lint.policies` as declared in the config — relative paths, resolved against {@link configDir}. */
+    policies: readonly string[];
+    /** The `chant.config.*` directory (`lint.policies` paths are relative to it), also the child's read allowance. */
+    configDir: string;
+    /** The merged, serialized build result the checks run over. */
+    buildResult: EncodablePolicyBuildResult & PostSynthContext["buildResult"];
+    /** `--env`, else `ownership.env`. Becomes `ctx.env`. */
+    env?: string;
+    /**
+     * Checks the caller already loaded into THIS process, before the build ran.
+     *
+     * `chant build` has always loaded `lint.policies` up front rather than at the
+     * point of use, so a policy path that doesn't resolve fails the command
+     * immediately — including when the build itself goes on to fail, which is
+     * exactly when a typo'd path would otherwise go unnoticed. Preserving that
+     * for the unsandboxed path is the whole reason this field exists.
+     *
+     * Ignored when armed: under `--sandbox` there is nothing loaded here to pass,
+     * and `loadPolicyChecks` refuses outright.
+     */
+    preloaded?: PostSynthCheck[];
+}
+/**
+ * Run a project's organizational policy checks over a finished build and return
+ * their diagnostics. Sandboxed in a post-merge child when armed, in-process
+ * otherwise.
+ *
+ * The unarmed path is byte-for-byte what `chant build` has always done: load
+ * the modules, hand every check one `PostSynthContext`, concatenate what they
+ * return. The armed path does the same thing on the other side of a process
+ * boundary — see `../discovery/sandbox/policy-run.ts`.
+ */
+export declare function runProjectPolicies(run: ProjectPolicyRun): Promise<PostSynthDiagnostic[]>;
+//# sourceMappingURL=policy-sandbox.d.ts.map

package/dist/lint/policy-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-sandbox.d.ts","sourceRoot":"","sources":["../../src/lint/policy-sandbox.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;GAUG;AACH,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,mCAAmC,EAAE,CAAC;AAEzG,MAAM,WAAW,gBAAgB;IAC/B,sGAAsG;IACtG,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,kHAAkH;IAClH,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,WAAW,EAAE,0BAA0B,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC1E,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAoB9F"}

package/dist/lint/policy.d.ts

@@ -1,5 +1,16 @@
 import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth.js";
-/** Load project policy checks (one or more `PostSynthCheck` exports) from files. */
+/**
+ * Load project policy checks (one or more `PostSynthCheck` exports) from files,
+ * **into this process**.
+ *
+ * chant #1131 — refuses while `./policy-sandbox.ts` is armed. Under `--sandbox`
+ * the policy modules are imported and their checks run inside a child process
+ * (`runProjectPolicies`); reaching this function anyway means a call site is
+ * about to execute project-authored code in the CLI's own process, which is
+ * precisely the thing the flag promises does not happen. Failing loudly is the
+ * only honest option — falling through would make `--sandbox` mean less than it
+ * says without anything visible to notice.
+ */
 export declare function loadPolicyChecks(paths: string[], configDir: string): Promise<PostSynthCheck[]>;
 export interface PolicyEvaluation {
     /** All policy diagnostics (errors + warnings). */

package/dist/lint/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExE,oFAAoF;AACpF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2EAA2E;IAC3E,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8B5B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGxE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAuBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2EAA2E;IAC3E,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8B5B"}