@intentius/chant 0.37.2 → 0.39.0

package/dist/op/emulator-freshness.d.ts

@@ -0,0 +1,44 @@
+/**
+ * How far behind an emulator's pinned image is (#1345, generalizing #808 T2).
+ *
+ * This began as `lexicons/fly/src/emulator-freshness.ts`, checking fly's two
+ * pins against their GitHub releases. The other three emulators — Floci for aws,
+ * floci-az, floci-gcp — ran `:latest`, so there was nothing to be behind and
+ * nothing to check: an image could change underneath a passing local test suite
+ * with no record in the repo of what moved.
+ *
+ * With the pin and its upstream declared on {@link EmulatorSpec}, the check
+ * covers every emulator any lexicon ships, and a new one is included by
+ * declaring `upstream` rather than by editing a list here.
+ *
+ * Advisory, never gating. Per the bump policy (#808) a pin moves when a
+ * consuming test needs the newer emulator, not because a release happened.
+ */
+import type { EmulatorSpec } from "./emulator-lifecycle.js";
+export interface FreshnessResult {
+    /** The emulator's container name, e.g. `chant-mudflaps`. */
+    name: string;
+    /** Pinned version, no leading `v`. */
+    pinned: string;
+    /** Latest released version, no leading `v`. */
+    latest: string;
+    /** True when the latest release is newer than the pin. */
+    behind: boolean;
+}
+/** The version tag of an image ref (`ghcr.io/x/mudflaps:0.3.1` → `0.3.1`). */
+export declare function parseVersion(image: string): string;
+/** Compare pinned against latest as dotted numeric versions. */
+export declare function compare(name: string, pinned: string, latest: string): FreshnessResult;
+/** The latest release tag for a repo, via the GitHub REST API. */
+export declare function latestRelease(repo: string, fetchImpl?: typeof fetch): Promise<string>;
+/**
+ * Check every spec that declares an upstream. A spec without one is skipped
+ * rather than reported — an emulator built from a local image has no release
+ * feed to be behind.
+ */
+export declare function checkFreshness(specs: readonly EmulatorSpec[], fetchImpl?: typeof fetch): Promise<FreshnessResult[]>;
+/** One-line human summary of a result. */
+export declare function formatResult(r: FreshnessResult): string;
+/** Emulator images that carry no version tag — `:latest` or none at all. */
+export declare function unpinned(specs: readonly EmulatorSpec[]): EmulatorSpec[];
+//# sourceMappingURL=emulator-freshness.d.ts.map

package/dist/op/emulator-freshness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emulator-freshness.d.ts","sourceRoot":"","sources":["../../src/op/emulator-freshness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlD;AAMD,gEAAgE;AAChE,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAcrF;AAED,kEAAkE;AAClE,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAQlG;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,EAAE,CAAC,CAO5B;AAED,0CAA0C;AAC1C,wBAAgB,YAAY,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAIvD;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,YAAY,EAAE,CAKvE"}

package/dist/op/emulator-lifecycle.d.ts

@@ -16,6 +16,20 @@ export interface EmulatorSpec {
     ready?: (healthBody: string) => boolean;
     /** Extra `docker run` args inserted before the image (e.g. a socket mount). */
     runArgs?: readonly string[];
+    /**
+     * Where {@link image} is published, so how far behind the pin is can be
+     * answered (#1345).
+     *
+     * fly pinned its two emulators and tracked their freshness; aws, azure and gcp
+     * ran `floci/*:latest`, which is the drift a pin exists to stop — a local test
+     * suite that passes today and fails tomorrow because an image moved underneath
+     * it, with nothing in the repo recording what changed. Declaring the upstream
+     * makes the check general instead of one lexicon's private tooling.
+     */
+    upstream?: {
+        /** `owner/repo` whose latest GitHub release names the current version. */
+        repo: string;
+    };
 }
 /**
  * A lexicon's local-emulator capability (#920) — what `chant emulator` needs to
@@ -28,6 +42,28 @@ export interface EmulatorCapability {
     spec: EmulatorSpec;
     env(endpoint: string): Record<string, string>;
 }
+/**
+ * What a plugin declares: one emulator, or several (#1345).
+ *
+ * fly ships two — mudflaps for the Machines API and spritzer for Sprites — and
+ * a single-spec field could describe only one of them, so both stayed
+ * unreachable from `chant emulator` while the repo's docs presented them as
+ * first-class local targets.
+ */
+export type EmulatorDeclaration = EmulatorCapability | readonly EmulatorCapability[];
+/** Every emulator a plugin declares, normalized to a list. */
+export declare function emulatorsOf(declaration: EmulatorDeclaration | undefined): readonly EmulatorCapability[];
+/**
+ * The env vars whose value *is* the endpoint, as opposed to the credentials and
+ * region an emulator also needs (#1345).
+ *
+ * Derived by asking `env()` for a sentinel and keeping the keys that carry it,
+ * so a lexicon states the mapping once in the place it already states it. The
+ * alternative — `LEXICON_ENDPOINT_ENV_VAR`, a hand-maintained map in core — held
+ * two of the four lexicons that have one, and its module doc asserted azure had
+ * none while `describe-resources.ts` read `AZURE_ENDPOINT_URL` on every call.
+ */
+export declare function endpointEnvVars(capability: EmulatorCapability): string[];
 /** Per-call overrides for {@link EmulatorLifecycle.up} / `runCommand`. */
 export interface EmulatorUpArgs {
     name?: string;

package/dist/op/emulator-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emulator-lifecycle.d.ts","sourceRoot":"","sources":["../../src/op/emulator-lifecycle.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC;IAC1C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,EAAE,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,iBAAiB,CA2EvE"}
+{"version":3,"file":"emulator-lifecycle.d.ts","sourceRoot":"","sources":["../../src/op/emulator-lifecycle.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE;QACT,0EAA0E;QAC1E,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,SAAS,kBAAkB,EAAE,CAAC;AAErF,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,WAAW,EAAE,mBAAmB,GAAG,SAAS,GAAG,SAAS,kBAAkB,EAAE,CAGvG;AAKD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAIxE;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC;IAC1C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,EAAE,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,iBAAiB,CA2EvE"}

package/dist/op/index.d.ts

@@ -1,8 +1,10 @@
 export { Op, phase, activity, gate, build, kubectlApply, helmInstall, waitForStack, gitlabPipeline, lifecycleSnapshot, shell, teardown, k3dUp, k3dDown, flociUp, flociDown, flociAzUp, flociAzDown, flociGcpUp, flociGcpDown, httpCheck, azGroupEnsure, azGroupDelete, azApply, azDelete, awsApply, awsDelete, gcpApply, gcpDelete, policyGate, spriteCreate, spriteExec, spriteCheckpoint, spriteRestore, listCheckpoints, spriteDestroy, spriteWriteFile, spriteReadFile, spriteListDir, spriteRemove, spriteApplyNetworkPolicy, spriteApplyServices, spriteTaskCreate, spriteTaskRefresh, spriteTaskRelease, spritesUp, spritesDown } from "./builders.js";
 export { OpResource } from "./resource.js";
 export { safeHeartbeat, sleep } from "./activity-runtime.js";
-export { emulatorLifecycle } from "./emulator-lifecycle.js";
-export type { EmulatorSpec, EmulatorCapability, EmulatorUpArgs, EmulatorLifecycle } from "./emulator-lifecycle.js";
+export { emulatorLifecycle, emulatorsOf, endpointEnvVars } from "./emulator-lifecycle.js";
+export type { EmulatorSpec, EmulatorCapability, EmulatorDeclaration, EmulatorUpArgs, EmulatorLifecycle } from "./emulator-lifecycle.js";
+export { checkFreshness, compare, formatResult, latestRelease, parseVersion, unpinned } from "./emulator-freshness.js";
+export type { FreshnessResult } from "./emulator-freshness.js";
 export type { OpConfig, PhaseDefinition, StepDefinition, ActivityStep, GateStep } from "./types.js";
 export { discoverOps } from "./discover.js";
 export type { DiscoveredOp, OpDiscoveryResult } from "./discover.js";

package/dist/op/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/op/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EACzE,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EACtF,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAC3D,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EACrG,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EACzF,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAC5D,wBAAwB,EAAE,mBAAmB,EAC7C,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EACtD,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAChH,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpF,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClH,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/op/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EACzE,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EACtF,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAC3D,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EACrG,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EACzF,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAC5D,wBAAwB,EAAE,mBAAmB,EAC7C,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EACtD,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvF,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACrI,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpH,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpF,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClH,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/ownership.d.ts

@@ -78,4 +78,37 @@ export declare function tagArrayToMap(tags: ReadonlyArray<{
  * undefined when the managed-by marker is absent.
  */
 export declare function readOwnership(tagsOrLabels: Record<string, unknown> | undefined, keys: ChannelKeys): OwnershipMarker | undefined;
+/**
+ * A read path that can resolve an ownership verdict from the marker (#1348).
+ *
+ * Per-path rather than per-lexicon because the answer genuinely differs by
+ * path: aws stamps tags at synthesis and reads them on the deep observation and
+ * on live export, but `describeResources` is sourced from
+ * `describe-stack-resources`, which returns no tags at all — so an `owned: true`
+ * thin read against aws can only answer `unknown`.
+ */
+export type OwnershipReadPath = "describeResources" | "observeResourcesDeep" | "exportResources";
+/**
+ * Where a lexicon can stamp and read chant's ownership marker (#1348).
+ *
+ * `ResourceMetadata.ownership` documents an obligation — a lexicon with no
+ * marker channel on a path must stamp `unknown` rather than degrade silently,
+ * because the change set never escalates `unknown` to a delete — and that
+ * obligation had no type, no declaration, and no check. A caller could not
+ * learn whether `owned: true` was answerable except by asking and reading a
+ * warning on stderr afterwards, which is invisible to `lifecycle plan`, which
+ * is where the wrong delete gets proposed.
+ *
+ * Absent means the lexicon has no marker channel at all: every verdict it
+ * returns must be `unknown`. Declaring one is a claim the conformance suite
+ * checks — on a declared path, verdicts must be `owned` or `foreign`.
+ */
+export interface OwnershipChannel {
+    /** The provider-native keys this lexicon stamps into. */
+    readonly keys: ChannelKeys;
+    /** The read paths that resolve a verdict from the marker. */
+    readonly reads: readonly OwnershipReadPath[];
+}
+/** Whether this lexicon resolves a real verdict on `path`, or can only say `unknown`. */
+export declare function resolvesOwnershipOn(channel: OwnershipChannel | undefined, path: OwnershipReadPath): boolean;
 //# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,UAAU,CAAC;AAElD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,eAAe,GACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,WAAW,GAChB,OAAO,CAGT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,WAAW,GAChB,OAAO,GAAG,SAAS,CAErB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,aAAa,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,SAAS,GACjE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMzB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,WAAW,GAChB,eAAe,GAAG,SAAS,CAQ7B"}
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,UAAU,CAAC;AAElD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,eAAe,GACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,WAAW,GAChB,OAAO,CAGT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,WAAW,GAChB,OAAO,GAAG,SAAS,CAErB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,aAAa,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,SAAS,GACjE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMzB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,WAAW,GAChB,eAAe,GAAG,SAAS,CAQ7B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG,sBAAsB,GAAG,iBAAiB,CAAC;AAEjG;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC9C;AAED,yFAAyF;AACzF,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,gBAAgB,GAAG,SAAS,EACrC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAET"}

package/dist/serializer.d.ts

@@ -46,6 +46,21 @@ export interface Serializer {
      * Prefix used for rules in this lexicon
      */
     rulePrefix: string;
+    /**
+     * Further id families this lexicon owns, beyond {@link rulePrefix} (#1349).
+     *
+     * The prefix exists so ids do not collide when several lexicons are loaded
+     * together — forgejo wraps github's rules as `WFJ-GHA0xx` for exactly that
+     * reason. It was declared and checked by nothing, and k8s quietly shipped
+     * five `ARGO0xx` checks outside its own `WK8`.
+     *
+     * A second family is sometimes right: Argo CD is a distinct product surface
+     * that happens to be covered by the k8s lexicon, and renaming published ids
+     * would break every `chant-disable ARGO001` in the wild. Declaring it keeps
+     * the collision guarantee while allowing the split — an undeclared family is
+     * a tier-1 failure.
+     */
+    extraRulePrefixes?: readonly string[];
     /**
      * Serializes the entities to a string representation
      * @param entities - Map of entity name to Declarable entity

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;;OAKG;IACH,SAAS,CACP,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,CAAC,EAAE,aAAa,EAAE,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,GAAG,gBAAgB,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;CACpD"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtC;;;;;OAKG;IACH,SAAS,CACP,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,CAAC,EAAE,aAAa,EAAE,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,GAAG,gBAAgB,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;CACpD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.37.2",
+  "version": "0.39.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/catalog.test.ts

@@ -1,10 +1,24 @@
 import { describe, test, expect } from "vitest";
+import { readdirSync } from "fs";
+import { join } from "path";
 import { RULE_CATALOG, RULE_CATEGORY, auditRule, resolveAuditCatalog } from "./catalog";
 import { loadPlugins } from "../cli/plugins";
 
-const AUDIT_LEXICONS = ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm"];
-
-/** All post-synth check ids the audit can actually surface, from the lexicons. */
+/**
+ * Every lexicon in the repo, enumerated rather than listed (#1346).
+ *
+ * This was nine hardcoded names. It missed fountain, which contributes a
+ * catalog, and could not notice fly and temporal, which did not — so their six
+ * post-synth checks reached `chant audit` with no title, tier, fix kind, or
+ * category, and the guard meant to catch exactly that was blind to them. A
+ * thirteenth lexicon would have been invisible to it on arrival.
+ */
+const AUDIT_LEXICONS = readdirSync(join(__dirname, "../../../../lexicons"), { withFileTypes: true })
+  .filter((e) => e.isDirectory())
+  .map((e) => e.name)
+  .sort();
+
+/** Post-synth check ids — what the catalog is required to cover. */
 async function realCheckIds(): Promise<Set<string>> {
   const plugins = await loadPlugins(AUDIT_LEXICONS);
   const ids = new Set<string>();
@@ -16,6 +30,27 @@ async function realCheckIds(): Promise<Set<string>> {
   return ids;
 }
 
+/**
+ * Every rule id a lexicon ships, post-synth or lint — what a catalog entry is
+ * allowed to name.
+ *
+ * Wider than {@link realCheckIds} on purpose. A catalog must cover the
+ * post-synth checks, because those are what `chant audit` surfaces, but an
+ * entry for a lint rule is not stale: fountain documents FTN001, a lint rule,
+ * because a reader hitting it wants the same metadata. Requiring the reverse —
+ * an entry for every lint rule in every lexicon — would be a much larger claim
+ * than the audit makes.
+ */
+async function shippedRuleIds(): Promise<Set<string>> {
+  const plugins = await loadPlugins(AUDIT_LEXICONS);
+  const ids = new Set<string>();
+  for (const plugin of plugins) {
+    for (const check of plugin.postSynthChecks?.() ?? []) ids.add(check.id);
+    for (const rule of plugin.lintRules?.() ?? []) ids.add(rule.id);
+  }
+  return ids;
+}
+
 /** The effective catalog the auditor uses — core static + every lexicon's contributed entries (#687). */
 const aggregate = () => resolveAuditCatalog(AUDIT_LEXICONS);
 
@@ -26,12 +61,29 @@ describe("RULE_CATALOG (aggregated: core static + lexicon-contributed, #687)", (
     expect(missing).toEqual([]);
   });
 
-  test("has no stale entries that aren't real checks", async () => {
-    const [real, catalog] = [await realCheckIds(), await aggregate()];
-    const stale = Object.keys(catalog).filter((id) => !real.has(id)).sort();
+  test("has no stale entries that aren't real rules", async () => {
+    const [shipped, catalog] = [await shippedRuleIds(), await aggregate()];
+    const stale = Object.keys(catalog)
+      .filter((id) => !shipped.has(id))
+      // Core's own cross-cutting ids are not any one lexicon's to ship.
+      .filter((id) => !(id in RULE_CATALOG))
+      .sort();
     expect(stale).toEqual([]);
   });
 
+  test("every lexicon that ships post-synth checks contributes a catalog for them", async () => {
+    const plugins = await loadPlugins(AUDIT_LEXICONS);
+    const uncatalogued = plugins
+      .map((plugin) => {
+        const checks = (plugin.postSynthChecks?.() ?? []).map((c) => c.id);
+        const catalog = plugin.auditCatalog?.() ?? {};
+        const missing = checks.filter((id) => !(id in catalog) && !(id in RULE_CATALOG));
+        return missing.length > 0 ? `${plugin.name}: ${missing.join(", ")}` : undefined;
+      })
+      .filter((entry): entry is string => entry !== undefined);
+    expect(uncatalogued).toEqual([]);
+  });
+
   test("every entry has a title, remediation, and valid tier/fixKind/category", async () => {
     for (const [id, m] of Object.entries(await aggregate())) {
       expect(m.id, `${id} id matches key`).toBe(id);

package/src/build.ts

@@ -185,6 +185,14 @@ export interface BuildOptions {
    */
   lexicons?: readonly string[];
 
+  /**
+   * chant #1442 — lexicon name → the version of the plugin that served it.
+   * Recorded on {@link BuildResult.lexiconVersions} so a build digest can say
+   * WHAT interpreted the declarations, not only what was declared. The CLI
+   * populates this from `options.plugins`; `build()` only carries it.
+   */
+  lexiconVersions?: Readonly<Record<string, string>>;
+
   /**
    * chant #1045 Phase 2 — opt-in: run-fallback files (or, when {@link fold}
    * isn't set, every file) execute together, isolated, in one sandboxed
@@ -230,6 +238,21 @@ export interface BuildResult {
    */
   foldDecisions: FoldDecision[];
 
+  /**
+   * chant #1442 — lexicon name → the version of the plugin that served this
+   * build, passed through verbatim from {@link BuildOptions.lexiconVersions}.
+   *
+   * The other half of what a build digest needs. `hashProps` fingerprints the
+   * declaration; this records what turned it into output. A lexicon is a
+   * generated artifact pinned to an upstream spec, so a bump can change
+   * emitted output with no source change at all — and without this the two
+   * builds are indistinguishable.
+   *
+   * Empty when the caller supplied no plugins (`build()` used as a library,
+   * and most tests).
+   */
+  lexiconVersions: Record<string, string>;
+
   /**
    * This build's resolved build-time parameters (#1064) — the build
    * provenance record for `params.<name>` values, alongside the existing
@@ -717,6 +740,7 @@ async function buildFromDiscoveryResult(
     manifest,
     sourceFileCount: discoveryResult.sourceFiles.length,
     foldDecisions: discoveryResult.foldDecisions,
+    lexiconVersions: { ...(options?.lexiconVersions ?? {}) },
     buildParams: options?.buildParams ?? [],
   };
 }

package/src/cli/commands/build.ts

@@ -3,6 +3,7 @@ import { loadChantConfigUpward, resolveOwnershipMarker, resolveFoldEnabled, reso
 import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
+import { resolveLexiconVersions } from "../plugins";
 import { runPostSynthChecks } from "../../lint/post-synth";
 import { applyConfiguredSeverity } from "../../lint/config";
 import { loadPolicyChecks } from "../../lint/policy";
@@ -242,6 +243,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // ../plugins.ts and fold-import.ts's `lexiconPackageName`.
   const lexicons = options.plugins?.map((plugin) => plugin.name) ?? [];
 
+  // chant #1442 — which lexicon VERSION interpreted each declaration. The
+  // declaration is fingerprinted by `hashProps`; the thing that turned it into
+  // output was not recorded at all, so a lexicon bump that changed emitted
+  // output left the build digest identical. Captured here because this is the
+  // layer that knows which lexicons were loaded — `build()` is given only
+  // their names.
+  const lexiconVersions = resolveLexiconVersions(lexicons);
+
   // Run the build
   const result = await build(infraPath, options.serializers, undefined, {
     ownership,
@@ -250,6 +259,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
     sandbox,
     intrinsics,
     lexicons,
+    lexiconVersions,
     buildParams: paramsResolution.provenance,
   });
 

package/src/cli/commands/check-lexicon-doc-drift.test.ts

@@ -0,0 +1,73 @@
+/**
+ * The completeness checklist and the tool it describes must agree (#1343).
+ *
+ * They did not. The doc listed 16/16/14 checks where the tool ran 18/14/9 —
+ * seven rows described checks that do not exist anywhere in `check-lexicon.ts`
+ * (`default-labels.test.ts`, `coverage.test.ts`, the three `import/*` tests,
+ * `exportResources()` implemented, and the ownership marker), and two real
+ * tier-1 checks were documented nowhere. The two missing ones were the damaging
+ * direction: an author reading the checklist would have believed live export and
+ * ownership marking were verified somewhere, and nothing verifies either.
+ *
+ * A hand-maintained parallel description of a tool drifts. This test makes the
+ * doc's first column the check's own `name`, so drift is a build failure rather
+ * than something a reviewer has to notice.
+ */
+
+import { describe, test, expect } from "vitest";
+import { readFileSync } from "fs";
+import { join } from "path";
+import { checkLexicon } from "./check-lexicon";
+
+const CHECKLIST = join(
+  __dirname,
+  "../../../../../docs/src/content/docs/lexicon-authoring/completeness-checklist.mdx",
+);
+
+/** The check names listed under `## Tier <n>` in the checklist. */
+function documentedChecks(markdown: string, tier: 1 | 2 | 3): string[] {
+  const section = markdown.split(new RegExp(`^## Tier ${tier}\\b`, "m"))[1];
+  if (section === undefined) throw new Error(`no "## Tier ${tier}" section in the checklist`);
+  const body = section.split(/^## /m)[0];
+  const names: string[] = [];
+  for (const line of body.split("\n")) {
+    // A table row whose first cell is a backticked check name.
+    const match = /^\|\s*`(.+?)`\s*\|/.exec(line);
+    if (match) names.push(match[1]);
+  }
+  return names;
+}
+
+describe("the completeness checklist matches check-lexicon (#1343)", () => {
+  const markdown = readFileSync(CHECKLIST, "utf-8");
+
+  // aws is the reference lexicon; the set of checks run is the same for any
+  // directory, since every check is pushed unconditionally.
+  const resultPromise = checkLexicon(join(__dirname, "../../../../../lexicons/aws"));
+
+  for (const tier of [1, 2, 3] as const) {
+    test(`tier ${tier} documents exactly the checks the tool runs`, async () => {
+      const executed = (await resultPromise).items.filter((i) => i.tier === tier).map((i) => i.name);
+      const documented = documentedChecks(markdown, tier);
+
+      const undocumented = executed.filter((n) => !documented.includes(n));
+      const phantom = documented.filter((n) => !executed.includes(n));
+
+      expect({ undocumented, phantom }).toEqual({ undocumented: [], phantom: [] });
+      expect(documented).toHaveLength(executed.length);
+    });
+  }
+
+  test("the checklist lists the checks in the order the tool reports them", async () => {
+    for (const tier of [1, 2, 3] as const) {
+      const executed = (await resultPromise).items.filter((i) => i.tier === tier).map((i) => i.name);
+      expect(documentedChecks(markdown, tier)).toEqual(executed);
+    }
+  });
+
+  test("no tier section is empty — a parsing regression would silently pass the set comparison", () => {
+    for (const tier of [1, 2, 3] as const) {
+      expect(documentedChecks(markdown, tier).length).toBeGreaterThan(0);
+    }
+  });
+});

package/src/cli/commands/check-lexicon-mcp.test.ts

@@ -0,0 +1,93 @@
+import { describe, test, expect } from "vitest";
+import { mkdtempSync, writeFileSync, mkdirSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { mcpNameViolations, lexiconNameFor } from "./check-lexicon-mcp";
+
+const tools = (...names: string[]) => names.map((name) => ({ name }));
+const resources = (...uris: string[]) => uris.map((uri) => ({ uri }));
+
+describe("mcpNameViolations (#1341)", () => {
+  test("a bare tool name is fine — core supplies the namespace", () => {
+    expect(mcpNameViolations("gitlab", tools("migrate"), [])).toEqual([]);
+  });
+
+  test("a self-prefixed tool name is fine — core does not double it", () => {
+    expect(mcpNameViolations("gitlab", tools("gitlab:diff"), [])).toEqual([]);
+  });
+
+  test("a name carrying another lexicon's prefix is a violation", () => {
+    // This is the shape the doubling bug produced: `gitlab:gitlab:diff`.
+    const found = mcpNameViolations("git", tools("gitlab:diff"), []);
+    expect(found).toHaveLength(1);
+    expect(found[0]).toContain("git:gitlab:diff");
+  });
+
+  test("an uppercase or spaced tool name is a violation", () => {
+    expect(mcpNameViolations("aws", tools("Diff Resources"), [])).toHaveLength(1);
+    expect(mcpNameViolations("aws", tools("Diff"), [])).toHaveLength(1);
+  });
+
+  test("hyphenated verbs are allowed", () => {
+    expect(mcpNameViolations("github", tools("github:workflow-yaml"), [])).toEqual([]);
+  });
+
+  test("a bare resource path is fine", () => {
+    expect(mcpNameViolations("aws", [], resources("examples/s3-bucket"))).toEqual([]);
+  });
+
+  test("the colon form the shared catalog helper emits is fine", () => {
+    expect(mcpNameViolations("aws", [], resources("aws:resource-catalog"))).toEqual([]);
+  });
+
+  test("the chant://lexicon/<name>/ form the authoring docs taught is fine once normalized", () => {
+    expect(mcpNameViolations("azure", [], resources("chant://lexicon/azure/catalog"))).toEqual([]);
+  });
+
+  test("a uri carrying a foreign scheme is a violation", () => {
+    // azure shipped `chant://azure/chant://lexicon/azure/catalog` this way when
+    // the lexicon name in the uri did not match the lexicon being registered.
+    const found = mcpNameViolations("aws", [], resources("chant://lexicon/azure/catalog"));
+    expect(found).toHaveLength(1);
+    expect(found[0]).toContain("chant://aws/chant://lexicon/azure/catalog");
+  });
+
+  test("an already-registered uri passes through", () => {
+    expect(mcpNameViolations("aws", [], resources("chant://aws/catalog"))).toEqual([]);
+  });
+
+  test("tools and resources are reported together", () => {
+    expect(mcpNameViolations("aws", tools("Bad Name"), resources("chant://other/x"))).toHaveLength(2);
+  });
+
+  test("a lexicon contributing nothing has nothing to violate", () => {
+    expect(mcpNameViolations("fly", [], [])).toEqual([]);
+  });
+});
+
+describe("lexiconNameFor", () => {
+  function fixture(pkg?: Record<string, unknown>): string {
+    const dir = mkdtempSync(join(tmpdir(), "chant-mcp-name-"));
+    mkdirSync(dir, { recursive: true });
+    if (pkg) writeFileSync(join(dir, "package.json"), JSON.stringify(pkg));
+    return dir;
+  }
+
+  test("reads the lexicon name out of the package name", () => {
+    expect(lexiconNameFor(fixture({ name: "@intentius/chant-lexicon-aws" }))).toBe("aws");
+  });
+
+  test("handles a hyphenated lexicon name", () => {
+    expect(lexiconNameFor(fixture({ name: "@intentius/chant-lexicon-my-cloud" }))).toBe("my-cloud");
+  });
+
+  test("falls back to the directory name when package.json is missing", () => {
+    const dir = fixture();
+    expect(lexiconNameFor(dir)).toBe(dir.split("/").pop());
+  });
+
+  test("falls back when the package name is not a lexicon package", () => {
+    const dir = fixture({ name: "@intentius/chant" });
+    expect(lexiconNameFor(dir)).toBe(dir.split("/").pop());
+  });
+});