@intentius/chant 0.27.0 → 0.29.0

package/dist/lint/policy.d.ts

@@ -13,12 +13,18 @@ import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth.js";
  */
 export declare function loadPolicyChecks(paths: string[], configDir: string): Promise<PostSynthCheck[]>;
 export interface PolicyEvaluation {
-    /** All policy diagnostics (errors + warnings). */
+    /** All policy diagnostics (errors + warnings), after `lint.rules` severity overrides. */
     diagnostics: PostSynthDiagnostic[];
-    /** The error-severity subset — these are policy *violations* that gate. */
+    /** The error-severity subset (post-override) — these are policy *violations* that gate. */
     violations: PostSynthDiagnostic[];
     /** The environment policies were evaluated against (if any). */
     env?: string;
+    /**
+     * chant #1138 — diagnostics `lint.rules` turned `"off"`, present here rather
+     * than dropped so a caller (`policyGate`, below) can report a count instead
+     * of the finding just vanishing.
+     */
+    suppressed: PostSynthDiagnostic[];
 }
 /**
  * Build a project and run its `lint.policies` over the resolved resources,

package/dist/lint/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGxE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAuBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2EAA2E;IAC3E,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8B5B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAIxE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAuBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2FAA2F;IAC3F,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmC5B"}

package/dist/lint/post-synth.d.ts

@@ -33,6 +33,19 @@ export interface PostSynthContext {
 export declare function getPrimaryOutput(output: string | SerializerResult): string;
 /**
  * A diagnostic from a post-synthesis check.
+ *
+ * chant #1138 — deliberately carries no `file`/`line` the way `LintDiagnostic`
+ * (`./rule.ts`) does. A post-synth check runs over `ctx.outputs` — the
+ * SYNTHESIZED output text (a CloudFormation template, a Kubernetes manifest) —
+ * not a `ts.SourceFile`, so there is no AST position to report in the first
+ * place. `entity` (below) is the closest thing to a locator and is NOT a
+ * substitute: it names a resource in that synthesized output (a CFN logical
+ * id, a k8s `metadata.name`), which several checks in this repo never even
+ * set (a cross-cutting check with no single implicated resource), and which
+ * is not guaranteed to match a `ctx.entities` map key. This is why source-
+ * comment (`chant-disable`) suppression is out of scope for post-synth
+ * findings — see `./config.ts`'s `applyConfiguredSeverity` doc for the full
+ * reasoning and what suppression surface post-synth findings get instead.
  */
 export interface PostSynthDiagnostic {
     /** ID of the check that produced this diagnostic */
@@ -41,7 +54,11 @@ export interface PostSynthDiagnostic {
     severity: Severity;
     /** Human-readable message */
     message: string;
-    /** Optional entity name related to this diagnostic */
+    /**
+     * Optional resource name related to this diagnostic — a name from the
+     * SYNTHESIZED OUTPUT (a CFN logical id, a k8s `metadata.name`), not a
+     * source file/line. See this interface's doc comment.
+     */
     entity?: string;
     /** Optional lexicon related to this diagnostic */
     lexicon?: string;

package/dist/lint/post-synth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,EAAE,CAavB"}
+{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,EAAE,CAavB"}

package/dist/live-endpoint.d.ts

@@ -0,0 +1,92 @@
+/**
+ * chant #1166 — let a declared `environment` carry its own endpoint so
+ * `--live --env <name>` is self-sufficient.
+ *
+ * The bug this closes: `chant graph --live --env floci` (and `lifecycle
+ * diff`/`plan`) observe a stack by shelling out through each lexicon's
+ * `describeResources()`. For AWS that shell-out honors the ambient
+ * `AWS_ENDPOINT_URL` env var — when a project's `floci` environment is a local
+ * emulator (`http://localhost:4566`) but the invoking shell never exported
+ * that var, the AWS CLI silently targets real AWS instead. The stack named
+ * after the environment doesn't exist there, so `describeResources` hits its
+ * `stackDoesNotExist` branch and returns an empty, unremarkable "nothing is
+ * deployed" — indistinguishable from the truthful answer. This cost real
+ * debugging time validating #1162's live overlay: the observation code was
+ * right, the manual repro just never set the var.
+ *
+ * The fix: `environments` in `chant.config.ts` can name an endpoint per
+ * environment (`config.ts`'s `EnvironmentDeclaration`), and {@link
+ * applyLiveEndpoint} injects it into the ambient env var each observing
+ * lexicon's CLI shell-out actually reads — but only for a var that isn't
+ * already set. Ambient always wins: a shell that already exports
+ * `AWS_ENDPOINT_URL` sees no change in behavior.
+ *
+ * Audited (#1166) which lexicons have an ambient-env-var endpoint knob at
+ * all, since that's the specific footgun — a lexicon whose environment
+ * binding is resolved from `chant.config` itself (not an ambient var) has
+ * nothing to inject here:
+ *
+ *   - **aws**  — `AWS_ENDPOINT_URL`, read directly by
+ *     `lexicons/aws/src/components/cloud-executor.ts` / `plugin.ts` before
+ *     every `aws …` shell-out (`applyAwsEndpoint`/`applyAwsEndpointArgv`).
+ *   - **fly**  — `FLY_FLAPS_BASE_URL`, read by `resolveEndpoint()` in
+ *     `lexicons/fly/src/op/activities/fly-apply.ts`, the same seam
+ *     `describeResources` (`../describe-resources.ts`) calls through.
+ *   - **gcp**, **k8s** — resolve their live target from `chant.config` itself
+ *     (`k8s.profiles.<env>.context` via `resolveClusterTarget`,
+ *     `packages/core/src/kubectl-context.ts`), not an ambient var. Nothing to
+ *     inject: the config *is* the binding already.
+ *   - **azure** — resolves via the `az` CLI's own logged-in
+ *     subscription/session context; no ambient endpoint var exists to miss.
+ *   - **temporal** — resolves its connection from `temporal.profiles.<env>`
+ *     (`resolveProfile`, `lexicons/temporal/src/describe-resources.ts`), the
+ *     same "config is the binding" shape as k8s/gcp.
+ */
+import { type EnvironmentDeclaration } from "./config.js";
+/**
+ * Per-lexicon ambient env var a `--live` read honors for its endpoint. Only
+ * lexicons with a genuine ambient-var footgun are listed — see the module doc
+ * for the full audit (gcp/k8s/azure/temporal resolve their target from
+ * `chant.config` instead, so they have nothing to inject).
+ */
+export declare const LEXICON_ENDPOINT_ENV_VAR: Record<string, string>;
+/** Result of {@link applyLiveEndpoint} — always call `restore()`, even when nothing was applied (it is then a no-op). */
+export interface AppliedEndpoint {
+    /**
+     * One line describing what happened, or `undefined` when the environment
+     * declares no endpoint at all (nothing to say). Present whether the
+     * declared endpoint was applied OR an ambient var already won — #1166's
+     * "no silent anything" stance: an operator should never have to guess which
+     * target a `--live` read actually used.
+     */
+    notice?: string;
+    /** Undo whatever ambient env vars this call set. Always safe to call. */
+    restore: () => void;
+}
+/**
+ * Resolve `environment`'s declared endpoint (if any) from `config.environments`
+ * and apply it to the ambient env var of every lexicon in `lexicons` that has
+ * one ({@link LEXICON_ENDPOINT_ENV_VAR}) — but only when that var isn't
+ * already set. Ambient always wins (#1166): behavior for a shell that already
+ * exports `AWS_ENDPOINT_URL` is unchanged.
+ *
+ * Call before a `--live` describe/enrich pass; `restore()` in a `finally` so
+ * the injected value never leaks into a later invocation in the same process
+ * (tests, or a long-lived host like the MCP server).
+ */
+export declare function applyLiveEndpoint(environments: EnvironmentDeclaration[] | undefined, environment: string, lexicons: readonly string[], env?: NodeJS.ProcessEnv): AppliedEndpoint;
+/**
+ * #1166 acceptance: when a `--live` describe comes back with zero resources
+ * for a lexicon that had declared entities to look for, and nothing was
+ * already reported NOT-OBSERVED (#1089) either, that is either "genuinely
+ * nothing is deployed yet" or a misconfigured endpoint/credentials — the two
+ * are visually identical, so a caller must say so rather than stay quiet.
+ * Returns `undefined` when there is nothing to declare (no declared entities
+ * to have asked about, or the emptiness is already explained by #1089's
+ * `unobserved`).
+ */
+export declare function zeroResourcesWarning(lexicon: string, environment: string, declaredCount: number, observed: {
+    resources: Record<string, unknown>;
+    unobserved: Record<string, unknown>;
+}): string | undefined;
+//# sourceMappingURL=live-endpoint.d.ts.map

package/dist/live-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-endpoint.d.ts","sourceRoot":"","sources":["../src/live-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAuB,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAG3D,CAAC;AAEF,yHAAyH;AACzH,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAClD,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,CAqCjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACpF,MAAM,GAAG,SAAS,CAKpB"}

package/dist/observation.d.ts

@@ -0,0 +1,123 @@
+/**
+ * The observation contract (#1089) — what a lexicon's `describeResources()`
+ * is allowed to mean.
+ *
+ * Before this module there were two ways for an observation to return nothing
+ * for a declared entity and no way to tell them apart:
+ *
+ *   1. The provider was asked and said the resource does not exist.
+ *   2. The lexicon never looked — no reader for that kind, the read errored,
+ *      no credentials, no cluster/subscription binding.
+ *
+ * Both arrived at the change set as "absent", and absent + declared classifies
+ * as `create`. So `chant lifecycle plan` proposed creating a Kubernetes CRD
+ * that already existed in the cluster, with nothing in the plan to say the tool
+ * had simply not looked (a warn on stderr is not a signal in a change set).
+ *
+ * The contract is a tri-state, per declared entity:
+ *
+ *   - **OBSERVED-PRESENT** — a key in `resources`. The provider returned it.
+ *   - **OBSERVED-ABSENT** — in neither map. The lexicon looked and the provider
+ *     reported it missing. This is the only shape that may become a `create`.
+ *   - **NOT-OBSERVED** — a key in `unobserved`, carrying a total
+ *     {@link UnobservedReason}. Never a `create`, never a `delete`; consumers
+ *     surface it and stop.
+ *
+ * Compatibility: `describeResources()` may still return the bare
+ * `name → ResourceMetadata` map it always did — that means "everything I was
+ * asked about, I looked at" and normalizes to an empty `unobserved`. Reporting
+ * NOT-OBSERVED requires the explicitly versioned {@link ObservationResult}
+ * envelope, which is discriminated by its literal `observation: "v1"` field (a
+ * bare map's value at any key is a `ResourceMetadata` object, never that
+ * string, so the two shapes can never be confused).
+ */
+import type { ResourceMetadata } from "./lexicon.js";
+/**
+ * Why a declared entity was not observed. Total: a lexicon that cannot observe
+ * an entity must pick one of these, and consumers may switch exhaustively.
+ *
+ * - `read-failed` — the provider was reached and the read errored (a non-zero
+ *   CLI exit, a 5xx, an unparseable response).
+ * - `no-credentials` — no usable credentials/authorization for the target.
+ * - `no-binding` — the environment resolves to no concrete target (no kubectl
+ *   context, no subscription, no stack, no endpoint).
+ * - `unsupported-kind` — the lexicon has no reader for this entity type (the
+ *   K8s CRD case, Azure's nested ARM types). The resource may well exist.
+ * - `filtered` — the entity was reached but withheld by a caller-requested
+ *   filter (`owned: true` against a resource carrying no chant marker). The
+ *   result deliberately says nothing about it, which is still not absence: a
+ *   declared resource that exists but is foreign must not classify as `create`.
+ */
+export type UnobservedReason = "read-failed" | "no-credentials" | "no-binding" | "unsupported-kind" | "filtered";
+/** Every legal {@link UnobservedReason}, for validation and conformance checks. */
+export declare const UNOBSERVED_REASONS: readonly UnobservedReason[];
+/** True when `value` is a legal {@link UnobservedReason}. */
+export declare function isUnobservedReason(value: unknown): value is UnobservedReason;
+/** One declared entity the lexicon could not observe, and why. */
+export interface UnobservedEntity {
+    /** Declared entity type, when the lexicon knows it (it usually does — the entity is declared). */
+    type?: string;
+    /** Total verdict. */
+    reason: UnobservedReason;
+    /** Human-readable detail: the command that failed, the missing binding key, the unsupported kind. */
+    detail?: string;
+}
+/**
+ * The observation envelope — a `describeResources()` return value that can say
+ * "I did not look at this one". Explicitly versioned: `observation: "v1"`.
+ */
+export interface ObservationResult {
+    /** Discriminant + wire version. Distinguishes the envelope from the bare `name → ResourceMetadata` map. */
+    readonly observation: "v1";
+    /** OBSERVED-PRESENT, keyed by chant entity name. */
+    resources: Record<string, ResourceMetadata>;
+    /** NOT-OBSERVED, keyed by chant entity name. Omit or leave empty when everything asked about was looked at. */
+    unobserved?: Record<string, UnobservedEntity>;
+}
+/**
+ * What `describeResources()` may return: the bare map (pre-#1089, still valid —
+ * "I looked at everything") or the {@link ObservationResult} envelope.
+ */
+export type DescribeResourcesResult = Record<string, ResourceMetadata> | ObservationResult;
+/** Normalized form every consumer works with. Both maps always present. */
+export interface NormalizedObservation {
+    resources: Record<string, ResourceMetadata>;
+    unobserved: Record<string, UnobservedEntity>;
+}
+/** True when `value` is the versioned {@link ObservationResult} envelope. */
+export declare function isObservationResult(value: unknown): value is ObservationResult;
+/**
+ * Build an {@link ObservationResult}. Lexicons use this rather than writing the
+ * discriminant by hand.
+ */
+export declare function observation(resources: Record<string, ResourceMetadata>, unobserved?: Record<string, UnobservedEntity>): ObservationResult;
+/**
+ * Normalize either accepted return shape. `undefined` (a lexicon that returned
+ * nothing at all) normalizes to two empty maps — which reads as "everything was
+ * observed absent", so callers that mean "the read failed" must say so with
+ * {@link unobservedAll} rather than returning nothing.
+ */
+export declare function normalizeObservation(value: DescribeResourcesResult | undefined): NormalizedObservation;
+/**
+ * Mark every named entity NOT-OBSERVED with one reason — the whole-lexicon
+ * failure case (the provider CLI is missing, the cluster binding refused, the
+ * credentials are gone). Core applies this when `describeResources()` throws,
+ * so a thrown read degrades to an honest "did not look" for each declared
+ * entity instead of an empty map that classifies as N creates.
+ */
+export declare function unobservedAll(names: Iterable<string>, reason: UnobservedReason, detail?: string, types?: Map<string, {
+    entityType: string;
+}> | Record<string, string>): Record<string, UnobservedEntity>;
+/**
+ * Union several observations of the same lexicon (the multi-stack read, where
+ * `describeResources` runs once per stack). Precedence is
+ * present > not-observed > absent: a resource found in any stack is present; an
+ * entity nobody could look at stays not-observed; an entity every reader looked
+ * for and did not find is absent.
+ */
+export declare function mergeObservations(parts: Iterable<NormalizedObservation>): NormalizedObservation;
+/** One-line human phrasing of a reason, for CLI output. */
+export declare function unobservedReasonText(reason: UnobservedReason): string;
+/** `name — reason (detail)`, the shared rendering for CLI and plan output. */
+export declare function formatUnobserved(name: string, entry: UnobservedEntity): string;
+//# sourceMappingURL=observation.d.ts.map

package/dist/observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observation.d.ts","sourceRoot":"","sources":["../src/observation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,UAAU,CAAC;AAEf,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAMzD,CAAC;AAEF,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qBAAqB;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,qGAAqG;IACrG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,+GAA+G;IAC/G,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,iBAAiB,CAAC;AAE3F,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC9C;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAM9E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC5C,iBAAiB,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,GAAG,qBAAqB,CAMtG;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EACvB,MAAM,EAAE,gBAAgB,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACnE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAYlC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,qBAAqB,CAAC,GAAG,qBAAqB,CAW/F;AAED,2DAA2D;AAC3D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAarE;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAG9E"}

package/dist/stack-output.d.ts

@@ -22,10 +22,13 @@ export interface StackOutput extends Declarable {
     readonly lexicon: string;
     readonly entityType: string;
     readonly kind: "output";
-    /** The exported value: a bare attribute reference, or an intrinsic wrapping
-     * one (e.g. `Join(",", zone.NameServers)`). */
-    readonly sourceRef: AttrRef | Intrinsic;
+    /** The exported value: a bare attribute reference, an intrinsic wrapping
+     * one (e.g. `Join(",", zone.NameServers)`), or a literal string. */
+    readonly sourceRef: AttrRef | Intrinsic | string;
     readonly description?: string;
+    /** When set, the serializer emits a cross-stack export under this name
+     * (CloudFormation `Output.Export.Name`) in addition to the plain output. */
+    readonly exportName?: string;
 }
 /**
  * Type guard for StackOutput.
@@ -49,7 +52,9 @@ export declare function isStackOutput(value: unknown): value is StackOutput;
  * });
  * ```
  */
-export declare function stackOutput(ref: AttrRef | Intrinsic, options?: {
+export declare function stackOutput(ref: AttrRef | Intrinsic | string, options?: {
     description?: string;
+    exportName?: string;
+    lexicon?: string;
 }): StackOutput;
 //# sourceMappingURL=stack-output.d.ts.map

package/dist/stack-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAG1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;mDAC+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAqBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,EACxB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,WAAW,CAiCb"}
+{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAgB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAG1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;wEACoE;IACpE,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;gFAC4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2CD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,EACjC,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACxE,WAAW,CAyCb"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/build.test.ts

@@ -1,12 +1,14 @@
 import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
 import { buildCommand, resolveBuildFormat, type BuildOptions } from "./build";
 import type { Serializer } from "../../serializer";
+import type { LexiconPlugin } from "../../lexicon";
 import { parseYAML } from "../../yaml";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
 import { join, dirname, resolve as resolvePath } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { resetSandboxPolicyExecutionForTests } from "../../lint/policy-sandbox";
 
 describe("buildCommand", () => {
   let testDir: string;
@@ -514,6 +516,194 @@ export const testEntity = {
       { Key: "env", Value: "prod" },
     ]);
   });
+
+  /**
+   * chant #1138 — post-synth findings (a lexicon-shipped check's, and a
+   * project's `lint.policies`') honor `lint.rules` severity overrides the
+   * same way a pre-synth COR/EVL/COMP diagnostic does. `runComponentChecks`
+   * proved the shape (`component-lint.test.ts`); this proves the post-synth
+   * side of the same fix.
+   */
+  describe("post-synth findings honor lint.rules (chant #1138)", () => {
+    // `armSandboxPolicyExecution` is a one-way, process-global latch — once a
+    // `--sandbox` build in this file arms it, EVERY later `buildCommand` call
+    // in this worker (sandboxed or not) would otherwise see it armed and
+    // refuse to load policies in-process. Reset it around each test here so
+    // the plain/sandboxed pairs below are actually independent.
+    beforeEach(() => resetSandboxPolicyExecutionForTests());
+    afterEach(() => resetSandboxPolicyExecutionForTests());
+
+    /**
+     * One trivial declarable using the `mockSerializer`'s "test" lexicon, so
+     * `result.outputs` is non-empty and the build's own "discovered source
+     * but produced no output" guard (`../commands/build.ts`) doesn't fire —
+     * these tests are about post-synth suppression, not that guard.
+     */
+    async function writeTrivialEntity(): Promise<void> {
+      await writeFile(
+        join(testDir, "main.ts"),
+        `export const e = { lexicon: "test", entityType: "TestEntity", [Symbol.for("chant.declarable")]: true };\n`,
+      );
+    }
+
+    /** A minimal `LexiconPlugin` whose one post-synth check always emits one fixed diagnostic — the fixed-input half of a severity-override test. */
+    function fakePostSynthPlugin(checkId: string, severity: "error" | "warning" | "info"): LexiconPlugin {
+      return {
+        name: "fake",
+        serializer: { name: "fake", rulePrefix: "FAKE", serialize: () => "{}" },
+        generate: async () => {},
+        validate: async () => {},
+        coverage: async () => {},
+        package: async () => {},
+        postSynthChecks: () => [
+          {
+            id: checkId,
+            description: "test check",
+            check: () => [{ checkId, severity, message: `${checkId} triggered` }],
+          },
+        ],
+      };
+    }
+
+    test("lint.rules off suppresses a lexicon-shipped post-synth finding and reports a suppressed count", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE001": "off" } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE001", "error")],
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.errors).toEqual([]);
+      expect(result.errors.join("\n")).not.toContain("FAKE001 triggered");
+      expect(result.warnings.some((w) => w.includes("1 post-synth finding(s) suppressed"))).toBe(true);
+    });
+
+    test("lint.rules downgrades an error-severity post-synth check to warning, so it no longer fails the build", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE002": "warning" } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE002", "error")],
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.errors).toEqual([]);
+      expect(result.warnings.some((w) => w.includes("FAKE002 triggered"))).toBe(true);
+    });
+
+    test("lint.rules upgrades a warning-severity post-synth check to error, so it now fails the build", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE003": "error" } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE003", "warning")],
+      });
+
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("FAKE003 triggered"))).toBe(true);
+    });
+
+    test("an unconfigured post-synth check id is unaffected — no drift from this fix for the common case", async () => {
+      await writeTrivialEntity();
+      await writeFile(join(testDir, "chant.config.ts"), `export default {};\n`);
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakePostSynthPlugin("FAKE004", "error")],
+      });
+
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("FAKE004 triggered"))).toBe(true);
+      expect(result.warnings.some((w) => w.includes("suppressed"))).toBe(false);
+    });
+
+    /** Write a `lint.policies` project: one policy file whose check always emits one fixed diagnostic. */
+    async function writePolicyProject(checkId: string, severity: "error" | "warning", rules: Record<string, string>): Promise<void> {
+      await mkdir(join(testDir, "policies"), { recursive: true });
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "policies", "org.ts"),
+        `export const check = {\n` +
+          `  id: ${JSON.stringify(checkId)},\n` +
+          `  description: "test policy",\n` +
+          `  check: () => [{ checkId: ${JSON.stringify(checkId)}, severity: ${JSON.stringify(severity)}, message: ${JSON.stringify(`${checkId} triggered`)} }],\n` +
+          `};\n`,
+      );
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { policies: ["policies/org.ts"], rules: ${JSON.stringify(rules)} } };\n`,
+      );
+    }
+
+    test(
+      "lint.rules off suppresses a lint.policies finding identically under plain and --sandbox builds",
+      async () => {
+        await writePolicyProject("ORG-OFF", "error", { "ORG-OFF": "off" });
+
+        const plain = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [] });
+        const sandboxed = await buildCommand({
+          path: testDir,
+          format: "json",
+          serializers: [mockSerializer],
+          plugins: [],
+          fold: true,
+          sandbox: true,
+        });
+
+        for (const result of [plain, sandboxed]) {
+          expect(result.success).toBe(true);
+          expect(result.errors).toEqual([]);
+          expect(result.warnings.some((w) => w.includes("1 post-synth finding(s) suppressed"))).toBe(true);
+        }
+      },
+      30_000,
+    );
+
+    test(
+      "lint.rules upgrades a lint.policies warning to error identically under plain and --sandbox builds",
+      async () => {
+        await writePolicyProject("ORG-UP", "warning", { "ORG-UP": "error" });
+
+        const plain = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [] });
+        const sandboxed = await buildCommand({
+          path: testDir,
+          format: "json",
+          serializers: [mockSerializer],
+          plugins: [],
+          fold: true,
+          sandbox: true,
+        });
+
+        for (const result of [plain, sandboxed]) {
+          expect(result.success).toBe(false);
+          expect(result.errors.some((e) => e.includes("[policy:ORG-UP]") && e.includes("ORG-UP triggered"))).toBe(true);
+          expect(result.warnings.some((w) => w.includes("suppressed"))).toBe(false);
+        }
+      },
+      30_000,
+    );
+  });
 });
 
 // ── #284 bug 1: -o extension drives format when --format is absent ────────

package/src/cli/commands/build.ts

@@ -4,6 +4,7 @@ import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
 import { runPostSynthChecks } from "../../lint/post-synth";
+import { applyConfiguredSeverity } from "../../lint/config";
 import { loadPolicyChecks } from "../../lint/policy";
 import { armSandboxPolicyExecution, runProjectPolicies } from "../../lint/policy-sandbox";
 import { sortedJsonReplacer } from "../../utils";
@@ -282,6 +283,16 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   }
 
   // Run post-synth checks from plugins — each plugin only sees its own lexicon's output
+  //
+  // chant #1138 — every diagnostic collected below (a lexicon-shipped check's
+  // AND a project's `lint.policies`') is resolved against `lint.rules` before
+  // it becomes an error/warning line, through the exact same
+  // `applyConfiguredSeverity` (../../lint/post-synth.ts) that keys off
+  // `diag.checkId` the way `lintCommand` keys an AST/COMP* diagnostic off its
+  // rule id — so `lint.rules: { WAW019: "off" }` suppresses a post-synth
+  // finding just as it suppresses a pre-synth one. A finding it suppresses is
+  // counted, not dropped silently — see `suppressedPostSynthCount` below.
+  let suppressedPostSynthCount = 0;
   if (result.errors.length === 0 && options.plugins) {
     for (const plugin of options.plugins) {
       if (!plugin.postSynthChecks) continue;
@@ -301,7 +312,9 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
 
       const scopedResult = { ...result, outputs: scopedOutputs };
       const postDiags = runPostSynthChecks(checks, scopedResult, env);
-      for (const diag of postDiags) {
+      const { diagnostics: activeDiags, suppressed } = applyConfiguredSeverity(postDiags, config.lint?.rules);
+      suppressedPostSynthCount += suppressed.length;
+      for (const diag of activeDiags) {
         const prefix = diag.entity ? `[${diag.entity}] ` : "";
         const lexiconSuffix = diag.lexicon ? ` (${diag.lexicon})` : "";
         if (diag.severity === "error") {
@@ -321,6 +334,15 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
     // result to a post-merge sandboxed child, which imports the policy modules
     // and runs their checks there, and only plain `PostSynthDiagnostic`s come
     // back. Unsandboxed, it is the same in-process load-and-run as before.
+    //
+    // #1138 — `applyConfiguredSeverity` runs HERE, in the parent, after the
+    // sandboxed child (when armed) has already returned — never inside it.
+    // The child only knows the policy paths and the encoded build result, not
+    // this project's resolved `lint.rules`, and by design nothing about the
+    // suppression surface needs to cross that boundary: both the plain and
+    // the `--sandbox` path funnel through this identical call with the
+    // identical `config.lint?.rules`, so a sandboxed and an unsandboxed build
+    // of the same project apply the same config to the same diagnostics.
     if (policies.length > 0) {
       const policyDiags = await runProjectPolicies({
         policies,
@@ -329,7 +351,9 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
         env,
         preloaded: preloadedPolicyChecks,
       });
-      for (const diag of policyDiags) {
+      const { diagnostics: activePolicyDiags, suppressed } = applyConfiguredSeverity(policyDiags, config.lint?.rules);
+      suppressedPostSynthCount += suppressed.length;
+      for (const diag of activePolicyDiags) {
         const prefix = diag.entity ? `[${diag.entity}] ` : "";
         const where = diag.lexicon ? ` (${diag.lexicon})` : "";
         const msg = `[policy:${diag.checkId}] ${prefix}${diag.message}${where}`;
@@ -337,6 +361,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
         else warnings.push(formatWarning({ message: msg }));
       }
     }
+
+    if (suppressedPostSynthCount > 0) {
+      warnings.push(
+        formatWarning({
+          message: `${suppressedPostSynthCount} post-synth finding(s) suppressed via lint.rules (severity "off")`,
+        }),
+      );
+    }
   }
 
   // Empty-output guard: source files were discovered but no lexicon produced