@intentius/chant 0.27.0 → 0.28.0

package/dist/cli/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAUnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2JAA2J;IAC3J,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CACjE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+Y9E;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAWnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2JAA2J;IAC3J,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CACjE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA8a9E;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}

package/dist/cli/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAmBzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAmBhC;AAgED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AA0PD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAoJ3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAkBzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAmBhC;AAgED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAmPD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAoJ3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}

package/dist/discovery/sandbox/config-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-run.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/config-run.ts"],"names":[],"mappings":"AA0DA,MAAM,WAAW,mBAAmB;IAClC,kOAAkO;IAClO,MAAM,EAAE,OAAO,CAAC;IAChB,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,CAAC,CA6C9B"}
+{"version":3,"file":"config-run.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/config-run.ts"],"names":[],"mappings":"AA0DA,MAAM,WAAW,mBAAmB;IAClC,kOAAkO;IAClO,MAAM,EAAE,OAAO,CAAC;IAChB,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,CAAC,CAgD9B"}

package/dist/discovery/sandbox/fork.d.ts

@@ -9,6 +9,11 @@
  * one function is the cheapest way to make "same profile" a fact rather than
  * a claim.
  *
+ * chant #1148 — this is also the one place chant forwards a sandboxed
+ * child's own stdout/stderr, so `./run.ts`, `./config-run.ts` and
+ * `./policy-run.ts` cannot drift on whether project output vanishes. See
+ * {@link SandboxForkOptions.outputPrefix}.
+ *
  * Isolation mechanics (verified on Node v24.13.1 — see the chant#1045 PR
  * description for the full write-up):
  *  - `--permission --allow-fs-read=<bundle dir>,<project dir>[,<trusted
@@ -42,6 +47,26 @@ export interface SandboxForkOptions {
     timeoutMs: number;
     /** What timed out / exited early, for the error message (e.g. `"sandboxed run"`). */
     label: string;
+    /**
+     * chant #1148 — prepended to every line the child writes on EITHER stdout
+     * or stderr before it is relayed, line-buffered, to this process's own
+     * stderr (e.g. `"[sandbox:run]"`, `"[sandbox:config]"`,
+     * `"[policy:org.ts]"`).
+     *
+     * A sandboxed child's `console.log`/`console.error` used to go nowhere: its
+     * stdout was piped but never read, and its stderr was captured only into
+     * {@link stderrBuf}'s error-message use, never surfaced on a successful
+     * run. Diagnostics crossing as data (the whole point of the boundary) is
+     * not the same thing as incidental output being silently dropped — chant's
+     * stance is that nothing the project prints vanishes, sandboxed or not.
+     *
+     * This is forwarding, not a second capture: {@link stderrBuf} still
+     * accumulates the child's raw stderr for `classifyChildError`/the
+     * exited-before-reporting message exactly as before. Both read the same
+     * `data` events; one buffers for classification, this one relays for a
+     * human to see.
+     */
+    outputPrefix: string;
     /**
      * chant #1131 — an optional payload sent to the child over the SAME IPC
      * channel its response comes back on, immediately after the fork.

package/dist/discovery/sandbox/fork.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fork.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/fork.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;IACxB,6IAA6I;IAC7I,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC7B,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CAwEZ"}
+{"version":3,"file":"fork.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/fork.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;IACxB,6IAA6I;IAC7I,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAgCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC7B,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CA2FZ"}

package/dist/discovery/sandbox/policy-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-run.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/policy-run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIjE,OAAO,EAGL,KAAK,0BAA0B,EAEhC,MAAM,eAAe,CAAC;AA+EvB,MAAM,WAAW,mBAAmB;IAClC,mJAAmJ;IACnJ,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,+DAA+D;IAC/D,WAAW,EAAE,0BAA0B,CAAC;IACxC,8GAA8G;IAC9G,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iKAAiK;IACjK,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA0DtG"}
+{"version":3,"file":"policy-run.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/policy-run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIjE,OAAO,EAGL,KAAK,0BAA0B,EAEhC,MAAM,eAAe,CAAC;AA0FvB,MAAM,WAAW,mBAAmB;IAClC,mJAAmJ;IACnJ,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,+DAA+D;IAC/D,WAAW,EAAE,0BAA0B,CAAC;IACxC,8GAA8G;IAC9G,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iKAAiK;IACjK,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6DtG"}

package/dist/discovery/sandbox/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAA2B,MAAM,cAAc,CAAC;AAOvE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,2TAA2T;IAC3T,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,8LAA8L;IAC9L,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAsD3B"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/discovery/sandbox/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAA2B,MAAM,cAAc,CAAC;AAOvE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,2TAA2T;IAC3T,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,8LAA8L;IAC9L,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAyD3B"}

package/dist/kubectl-context.d.ts

@@ -0,0 +1,73 @@
+/**
+ * K8s environment→cluster binding — chant #1100.
+ *
+ * Every cloud lexicon binds an environment to a scope: AWS resolves `<env>`
+ * to a CloudFormation stack, Azure treats `<env>` as the resource group,
+ * Temporal looks up `temporal.profiles.<env>` in `chant.config.ts`. K8s (and
+ * GCP-via-Config-Connector, which observes through the same kubectl path)
+ * bound nothing — `describeResources` shelled out to `kubectl get` with no
+ * `--context`, so it read whatever cluster `kubectl config current-context`
+ * happened to point at. Point `prod` at a dev cluster and every declared
+ * resource reads as missing — a wrong-cluster diff that looks like a
+ * confident list of deletions.
+ *
+ * This module is the shared resolver both the k8s and gcp lexicons'
+ * `describeResources` call, so they resolve a cluster identity the same way
+ * (see `lexicons/k8s/src/config.ts`'s `K8sChantConfig` for the declared
+ * shape). It is intentionally provider-agnostic and lives in core (like
+ * `./ownership.ts`) rather than in the k8s lexicon package, since gcp's
+ * Config Connector observation needs it too without taking a dependency on
+ * the k8s lexicon.
+ */
+/** A single environment's cluster binding — see `K8sChantConfig` in the k8s lexicon. */
+export interface K8sClusterProfile {
+    /** kubectl context name this environment is bound to. */
+    context: string;
+}
+/** Shape of the `k8s` passthrough key in `chant.config.ts` that this resolver reads. */
+export interface K8sConfigShape {
+    profiles?: Record<string, K8sClusterProfile>;
+}
+/**
+ * Thrown when an environment declares a cluster binding but the ambient
+ * kubectl context disagrees with it. Refusing here — instead of silently
+ * observing whichever cluster is ambient — is the fix for #1100: a
+ * wrong-cluster read reports every declared resource as missing, which #1089
+ * then classifies as a confident (and wrong) list of `create` actions.
+ */
+export declare class ClusterBindingMismatchError extends Error {
+    readonly environment: string;
+    readonly expectedContext: string;
+    readonly ambientContext: string;
+    constructor(environment: string, expectedContext: string, ambientContext: string);
+}
+export interface ResolvedClusterTarget {
+    /**
+     * Explicit `--context` value to pass to every kubectl invocation. Present
+     * only when the environment has a declared binding — undefined means
+     * "no binding, keep today's ambient-context behavior".
+     */
+    context?: string;
+    /** Where the target came from. */
+    source: "bound" | "ambient";
+}
+/**
+ * Resolve the kubectl context an environment should be observed/applied
+ * against, reading `k8s.profiles.<environment>.context` from `chant.config.ts`
+ * (the `config` passed in is the passthrough `ChantConfig`, cast loosely since
+ * the `k8s` key isn't declared on the core schema — same pattern as
+ * `temporal.profiles`).
+ *
+ * - No binding declared: returns `{ source: "ambient" }` — unchanged
+ *   behavior — but logs a visible warning identifying the caller and
+ *   environment, so the fallback is never silent (#1100 acceptance).
+ * - Binding declared and the ambient context agrees (or ambient can't be
+ *   determined): returns `{ context: bound, source: "bound" }`. Callers
+ *   should pass this context explicitly on every kubectl invocation rather
+ *   than relying on it also being ambient.
+ * - Binding declared and the ambient context disagrees: throws
+ *   {@link ClusterBindingMismatchError} — a loud refusal instead of quietly
+ *   reading the wrong cluster.
+ */
+export declare function resolveClusterTarget(config: Record<string, unknown>, environment: string, lexiconName: string): Promise<ResolvedClusterTarget>;
+//# sourceMappingURL=kubectl-context.d.ts.map

package/dist/kubectl-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubectl-context.d.ts","sourceRoot":"","sources":["../src/kubectl-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;aAElC,WAAW,EAAE,MAAM;aACnB,eAAe,EAAE,MAAM;aACvB,cAAc,EAAE,MAAM;gBAFtB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,MAAM;CAWzC;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7B;AAaD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,qBAAqB,CAAC,CAmBhC"}

package/dist/lint/config.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import type { Severity, RuleConfig } from "./rule.js";
+import type { PostSynthDiagnostic } from "./post-synth.js";
 export { findProjectRoot } from "../project-root.js";
 export declare const LintConfigSchema: z.ZodObject<{
     rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
@@ -72,6 +73,31 @@ export interface ParsedRuleConfig {
  * Parse a rule config value into severity and options
  */
 export declare function parseRuleConfig(value: RuleConfig): ParsedRuleConfig;
+/**
+ * Resolve one check/rule id's effective severity (and options) against an
+ * already-resolved `lint.rules` map — the ONE place `"off"`/severity-override
+ * resolution happens, so a rule id behaves identically regardless of which
+ * phase produced it.
+ *
+ * chant #1138 — before this, the same `lint.rules: { ID: "off" }` config was
+ * resolved by two independent call sites that had grown their own copy of
+ * this logic (`../cli/commands/lint.ts`'s `getDefaultRules` for AST COR/EVL
+ * rules, and its `runComponentCheckDiagnostics` for whole-component COMP*
+ * checks) — identical in effect, but a rule id's suppression having two
+ * places to (potentially, eventually) diverge is itself the bug class #1138
+ * is about. Both were converted to call this instead, and post-synth checks/
+ * policies (`./post-synth.ts`'s `applyConfiguredSeverity`) now go through it
+ * too, closing the gap the issue reports: a post-synth check id honors
+ * `lint.rules` exactly like an AST rule id does.
+ *
+ * `rules` takes the already-resolved map (`config.rules`, or
+ * `resolveRulesForFile`'s per-file merge) rather than a whole `LintConfig` —
+ * callers that need per-file `overrides` resolve that first; post-synth
+ * checks have no per-file scope to begin with (see {@link
+ * ./post-synth.ts!PostSynthDiagnostic}'s doc for why), so they always pass
+ * `config.rules` directly.
+ */
+export declare function resolveConfiguredSeverity(rules: Record<string, RuleConfig> | undefined, id: string, defaultSeverity: Severity): ParsedRuleConfig;
 /**
  * Default configuration with all rules enabled at strict preset severities
  */
@@ -104,4 +130,58 @@ export declare function loadConfig(dir: string): LintConfig;
  * @returns Merged rule configuration with overrides applied
  */
 export declare function resolveRulesForFile(config: LintConfig, filePath: string): Record<string, RuleConfig>;
+/** Result of applying `lint.rules` to a set of post-synth diagnostics. */
+export interface PostSynthSeverityResult {
+    /** Diagnostics after config resolution — `"off"`-suppressed ones removed, everything else at its resolved severity. */
+    diagnostics: PostSynthDiagnostic[];
+    /**
+     * Diagnostics `lint.rules` turned `"off"`, unaltered — present so a caller
+     * can report a count (chant #1138) rather than the finding simply
+     * vanishing, mirroring `../lint/engine.ts`'s `LintRunResult.suppressed` for
+     * AST rules.
+     */
+    suppressed: PostSynthDiagnostic[];
+}
+/**
+ * Apply `lint.rules` severity overrides to already-produced post-synth
+ * diagnostics — one lexicon-shipped check's findings, or one project's
+ * `lint.policies` findings, it doesn't matter which: both are plain
+ * `PostSynthDiagnostic[]` by the time they reach this function, so both go
+ * through the identical resolution an AST rule id or a COMP* check id gets
+ * (`resolveConfiguredSeverity`, above), keyed by `diag.checkId` instead of
+ * `LintRule.id`/`ComponentCheck.id`. `"off"` suppresses (moved to
+ * `suppressed`); any other configured severity replaces `diag.severity`,
+ * exactly as a config override changes an AST diagnostic's reported level.
+ *
+ * Lives here rather than in `./post-synth.ts` (where `PostSynthDiagnostic` is
+ * declared) on purpose: `post-synth.ts` is a leaf every lexicon's checks
+ * import as a real runtime module, and this file resolves built-in preset
+ * paths via the runtime adapter at module scope — pulling that into every
+ * lexicon's check barrel merely to share one filter function would be the
+ * wrong trade. Only this file's TYPE (`PostSynthDiagnostic`) crosses back,
+ * which costs nothing at runtime.
+ *
+ * chant #1138 — deliberately does NOT also honor `chant-disable` source
+ * comments. `PostSynthDiagnostic` has no source anchor to disable AT — see
+ * its doc comment (`./post-synth.ts`) for why `entity` doesn't supply one —
+ * so there is no coherent site to check for a directive. Even in the one case
+ * a real anchor sometimes exists (a live, in-process `ctx.entities` value
+ * stamped with build provenance, `../provenance.ts`'s `getProvenance`), it
+ * would not generalize: not every check sets `entity`, `entity` isn't
+ * guaranteed to be an entities-map key (it's a name in the synthesized
+ * OUTPUT — a CFN logical id, a k8s `metadata.name` — which a serializer is
+ * free to have derived, prefixed, or renamed from the source-level entity
+ * name), and that provenance never crosses the `--sandbox` policy child's
+ * JSON wire (`../discovery/entity-wire-codec.ts` doesn't carry it, and
+ * re-deriving it on the far side would mean sending source file paths into a
+ * channel that's supposed to carry only the resolved build). Building
+ * directive suppression on a sometimes-present, sometimes-not anchor would
+ * make `chant build` and `chant build --sandbox` disagree about the
+ * identical finding depending on which path happened to still have the
+ * entity object around — precisely the kind of inconsistency #1138 exists to
+ * remove. Config severity (`"off"`) is the one suppression surface this can
+ * offer uniformly; a check that wants a per-instance escape hatch can read
+ * `ctx.env`/its own options to decide not to emit a diagnostic at all.
+ */
+export declare function applyConfiguredSeverity(diagnostics: readonly PostSynthDiagnostic[], rules: Record<string, RuleConfig> | undefined): PostSynthSeverityResult;
 //# sourceMappingURL=config.d.ts.map

package/dist/lint/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AASnD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiBlD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAkClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AASxD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiBlD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,EAC7C,EAAE,EAAE,MAAM,EACV,eAAe,EAAE,QAAQ,GACxB,gBAAgB,CAIlB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAkClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,uHAAuH;IACvH,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC;;;;;OAKG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,GAC5C,uBAAuB,CAczB"}

package/dist/lint/policy.d.ts

@@ -13,12 +13,18 @@ import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth.js";
  */
 export declare function loadPolicyChecks(paths: string[], configDir: string): Promise<PostSynthCheck[]>;
 export interface PolicyEvaluation {
-    /** All policy diagnostics (errors + warnings). */
+    /** All policy diagnostics (errors + warnings), after `lint.rules` severity overrides. */
     diagnostics: PostSynthDiagnostic[];
-    /** The error-severity subset — these are policy *violations* that gate. */
+    /** The error-severity subset (post-override) — these are policy *violations* that gate. */
     violations: PostSynthDiagnostic[];
     /** The environment policies were evaluated against (if any). */
     env?: string;
+    /**
+     * chant #1138 — diagnostics `lint.rules` turned `"off"`, present here rather
+     * than dropped so a caller (`policyGate`, below) can report a count instead
+     * of the finding just vanishing.
+     */
+    suppressed: PostSynthDiagnostic[];
 }
 /**
  * Build a project and run its `lint.policies` over the resolved resources,

package/dist/lint/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGxE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAuBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2EAA2E;IAC3E,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8B5B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAIxE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAuBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2FAA2F;IAC3F,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmC5B"}

package/dist/lint/post-synth.d.ts

@@ -33,6 +33,19 @@ export interface PostSynthContext {
 export declare function getPrimaryOutput(output: string | SerializerResult): string;
 /**
  * A diagnostic from a post-synthesis check.
+ *
+ * chant #1138 — deliberately carries no `file`/`line` the way `LintDiagnostic`
+ * (`./rule.ts`) does. A post-synth check runs over `ctx.outputs` — the
+ * SYNTHESIZED output text (a CloudFormation template, a Kubernetes manifest) —
+ * not a `ts.SourceFile`, so there is no AST position to report in the first
+ * place. `entity` (below) is the closest thing to a locator and is NOT a
+ * substitute: it names a resource in that synthesized output (a CFN logical
+ * id, a k8s `metadata.name`), which several checks in this repo never even
+ * set (a cross-cutting check with no single implicated resource), and which
+ * is not guaranteed to match a `ctx.entities` map key. This is why source-
+ * comment (`chant-disable`) suppression is out of scope for post-synth
+ * findings — see `./config.ts`'s `applyConfiguredSeverity` doc for the full
+ * reasoning and what suppression surface post-synth findings get instead.
  */
 export interface PostSynthDiagnostic {
     /** ID of the check that produced this diagnostic */
@@ -41,7 +54,11 @@ export interface PostSynthDiagnostic {
     severity: Severity;
     /** Human-readable message */
     message: string;
-    /** Optional entity name related to this diagnostic */
+    /**
+     * Optional resource name related to this diagnostic — a name from the
+     * SYNTHESIZED OUTPUT (a CFN logical id, a k8s `metadata.name`), not a
+     * source file/line. See this interface's doc comment.
+     */
     entity?: string;
     /** Optional lexicon related to this diagnostic */
     lexicon?: string;

package/dist/lint/post-synth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,EAAE,CAavB"}
+{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,EAAE,CAavB"}

package/dist/stack-output.d.ts

@@ -22,10 +22,13 @@ export interface StackOutput extends Declarable {
     readonly lexicon: string;
     readonly entityType: string;
     readonly kind: "output";
-    /** The exported value: a bare attribute reference, or an intrinsic wrapping
-     * one (e.g. `Join(",", zone.NameServers)`). */
-    readonly sourceRef: AttrRef | Intrinsic;
+    /** The exported value: a bare attribute reference, an intrinsic wrapping
+     * one (e.g. `Join(",", zone.NameServers)`), or a literal string. */
+    readonly sourceRef: AttrRef | Intrinsic | string;
     readonly description?: string;
+    /** When set, the serializer emits a cross-stack export under this name
+     * (CloudFormation `Output.Export.Name`) in addition to the plain output. */
+    readonly exportName?: string;
 }
 /**
  * Type guard for StackOutput.
@@ -49,7 +52,9 @@ export declare function isStackOutput(value: unknown): value is StackOutput;
  * });
  * ```
  */
-export declare function stackOutput(ref: AttrRef | Intrinsic, options?: {
+export declare function stackOutput(ref: AttrRef | Intrinsic | string, options?: {
     description?: string;
+    exportName?: string;
+    lexicon?: string;
 }): StackOutput;
 //# sourceMappingURL=stack-output.d.ts.map

package/dist/stack-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAG1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;mDAC+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAqBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,EACxB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,WAAW,CAiCb"}
+{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAG1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;wEACoE;IACpE,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;gFAC4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAqBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,EACjC,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACxE,WAAW,CA0Cb"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/build.test.ts

@@ -1,12 +1,14 @@
 import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
 import { buildCommand, resolveBuildFormat, type BuildOptions } from "./build";
 import type { Serializer } from "../../serializer";
+import type { LexiconPlugin } from "../../lexicon";
 import { parseYAML } from "../../yaml";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
 import { join, dirname, resolve as resolvePath } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { resetSandboxPolicyExecutionForTests } from "../../lint/policy-sandbox";
 
 describe("buildCommand", () => {
   let testDir: string;
@@ -514,6 +516,194 @@ export const testEntity = {
       { Key: "env", Value: "prod" },
     ]);
   });
+
+  /**
+   * chant #1138 — post-synth findings (a lexicon-shipped check's, and a
+   * project's `lint.policies`') honor `lint.rules` severity overrides the
+   * same way a pre-synth COR/EVL/COMP diagnostic does. `runComponentChecks`
+   * proved the shape (`component-lint.test.ts`); this proves the post-synth
+   * side of the same fix.
+   */
+  describe("post-synth findings honor lint.rules (chant #1138)", () => {
+    // `armSandboxPolicyExecution` is a one-way, process-global latch — once a
+    // `--sandbox` build in this file arms it, EVERY later `buildCommand` call
+    // in this worker (sandboxed or not) would otherwise see it armed and
+    // refuse to load policies in-process. Reset it around each test here so
+    // the plain/sandboxed pairs below are actually independent.
+    beforeEach(() => resetSandboxPolicyExecutionForTests());
+    afterEach(() => resetSandboxPolicyExecutionForTests());
+
+    /**
+     * One trivial declarable using the `mockSerializer`'s "test" lexicon, so
+     * `result.outputs` is non-empty and the build's own "discovered source
+     * but produced no output" guard (`../commands/build.ts`) doesn't fire —
+     * these tests are about post-synth suppression, not that guard.
+     */
+    async function writeTrivialEntity(): Promise<void> {
+      await writeFile(
+        join(testDir, "main.ts"),
+        `export const e = { lexicon: "test", entityType: "TestEntity", [Symbol.for("chant.declarable")]: true };\n`,
+      );
+    }
+
+    /** A minimal `LexiconPlugin` whose one post-synth check always emits one fixed diagnostic — the fixed-input half of a severity-override test. */
+    function fakePostSynthPlugin(checkId: string, severity: "error" | "warning" | "info"): LexiconPlugin {
+      return {
+        name: "fake",
+        serializer: { name: "fake", rulePrefix: "FAKE", serialize: () => "{}" },
+        generate: async () => {},
+        validate: async () => {},
+        coverage: async () => {},
+        package: async () => {},
+        postSynthChecks: () => [
+          {
+            id: checkId,
+            description: "test check",
+            check: () => [{ checkId, severity, message: `${checkId} triggered` }],
+          },
+        ],
+      };
+    }
+
+    test("lint.rules off suppresses a lexicon-shipped post-synth finding and reports a suppressed count", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE001": "off" } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE001", "error")],
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.errors).toEqual([]);
+      expect(result.errors.join("\n")).not.toContain("FAKE001 triggered");
+      expect(result.warnings.some((w) => w.includes("1 post-synth finding(s) suppressed"))).toBe(true);
+    });
+
+    test("lint.rules downgrades an error-severity post-synth check to warning, so it no longer fails the build", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE002": "warning" } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE002", "error")],
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.errors).toEqual([]);
+      expect(result.warnings.some((w) => w.includes("FAKE002 triggered"))).toBe(true);
+    });
+
+    test("lint.rules upgrades a warning-severity post-synth check to error, so it now fails the build", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE003": "error" } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE003", "warning")],
+      });
+
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("FAKE003 triggered"))).toBe(true);
+    });
+
+    test("an unconfigured post-synth check id is unaffected — no drift from this fix for the common case", async () => {
+      await writeTrivialEntity();
+      await writeFile(join(testDir, "chant.config.ts"), `export default {};\n`);
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE004", "error")],
+      });
+
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("FAKE004 triggered"))).toBe(true);
+      expect(result.warnings.some((w) => w.includes("suppressed"))).toBe(false);
+    });
+
+    /** Write a `lint.policies` project: one policy file whose check always emits one fixed diagnostic. */
+    async function writePolicyProject(checkId: string, severity: "error" | "warning", rules: Record<string, string>): Promise<void> {
+      await mkdir(join(testDir, "policies"), { recursive: true });
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "policies", "org.ts"),
+        `export const check = {\n` +
+          `  id: ${JSON.stringify(checkId)},\n` +
+          `  description: "test policy",\n` +
+          `  check: () => [{ checkId: ${JSON.stringify(checkId)}, severity: ${JSON.stringify(severity)}, message: ${JSON.stringify(`${checkId} triggered`)} }],\n` +
+          `};\n`,
+      );
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { policies: ["policies/org.ts"], rules: ${JSON.stringify(rules)} } };\n`,
+      );
+    }
+
+    test(
+      "lint.rules off suppresses a lint.policies finding identically under plain and --sandbox builds",
+      async () => {
+        await writePolicyProject("ORG-OFF", "error", { "ORG-OFF": "off" });
+
+        const plain = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [] });
+        const sandboxed = await buildCommand({
+          path: testDir,
+          format: "json",
+          serializers: [mockSerializer],
+          plugins: [],
+          fold: true,
+          sandbox: true,
+        });
+
+        for (const result of [plain, sandboxed]) {
+          expect(result.success).toBe(true);
+          expect(result.errors).toEqual([]);
+          expect(result.warnings.some((w) => w.includes("1 post-synth finding(s) suppressed"))).toBe(true);
+        }
+      },
+      30_000,
+    );
+
+    test(
+      "lint.rules upgrades a lint.policies warning to error identically under plain and --sandbox builds",
+      async () => {
+        await writePolicyProject("ORG-UP", "warning", { "ORG-UP": "error" });
+
+        const plain = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [] });
+        const sandboxed = await buildCommand({
+          path: testDir,
+          format: "json",
+          serializers: [mockSerializer],
+          plugins: [],
+          fold: true,
+          sandbox: true,
+        });
+
+        for (const result of [plain, sandboxed]) {
+          expect(result.success).toBe(false);
+          expect(result.errors.some((e) => e.includes("[policy:ORG-UP]") && e.includes("ORG-UP triggered"))).toBe(true);
+          expect(result.warnings.some((w) => w.includes("suppressed"))).toBe(false);
+        }
+      },
+      30_000,
+    );
+  });
 });
 
 // ── #284 bug 1: -o extension drives format when --format is absent ────────