@intentius/chant 0.38.0 → 0.39.0

package/dist/lifecycle/deep-diff.d.ts

@@ -50,6 +50,17 @@ export interface PropertyDrift {
      * accepted value there would lose the most useful column in the report.
      */
     baseline?: unknown;
+    /**
+     * The field manager that owns this path live, where the substrate records one
+     * (#1189) — Kubernetes' `managedFields`, and nowhere else today.
+     *
+     * `kind` says a path is `undeclared` or `changed`; this says who did it.
+     * "Owned by `kubectl-client-side-apply`" and "owned by `hpa-controller`" are
+     * the same `kind` and mean opposite things: one is somebody bypassing the
+     * pipeline, the other is a controller doing its job. Absent on a substrate
+     * with no per-field ownership, which is every substrate but k8s.
+     */
+    owner?: string;
 }
 /** Property-level drift for one declared entity. */
 export interface DeepEntityDrift {

package/dist/lifecycle/deep-diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-diff.d.ts","sourceRoot":"","sources":["../../src/lifecycle/deep-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEjF;;;;;;;;;GASG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEpE,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,qDAAqD;IACrD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8EAA8E;IAC9E,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,IAAI,EAAE,yBAAyB,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CA8F7D;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEjE"}
+{"version":3,"file":"deep-diff.d.ts","sourceRoot":"","sources":["../../src/lifecycle/deep-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEjF;;;;;;;;;GASG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEpE,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,qDAAqD;IACrD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8EAA8E;IAC9E,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,IAAI,EAAE,yBAAyB,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAmG7D;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEjE"}

package/dist/lifecycle/digest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/lifecycle/digest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAkB,UAAU,EAAE,MAAM,SAAS,CAAC;AAIvE;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGhD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,CAwBxE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,WAAW,GAAG,SAAS,GAChC,UAAU,CAgCZ"}
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/lifecycle/digest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAkB,UAAU,EAAE,MAAM,SAAS,CAAC;AAIvE;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGhD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,CA4BxE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,WAAW,GAAG,SAAS,GAChC,UAAU,CAiCZ"}

package/dist/lifecycle/identity.d.ts

@@ -0,0 +1,52 @@
+/**
+ * What makes an unqualified resource one resource (#1416).
+ *
+ * Managed resources are stack-qualified (`${stack}::${id}`, #1162) and cannot
+ * collide. Everything else — dependencies (#1273) and ambient resources (#1278)
+ * — is keyed by physical id and merged across stacks, because the account's
+ * default VPC route table is one resource however many stacks route through it.
+ *
+ * That is right for a resource that really is account-level, and wrong for a
+ * regional one. A VPC, subnet or security group in `us-west-1` is a different
+ * resource from one in `us-east-1`, and merging them by id drops all but the
+ * first sighting.
+ *
+ * On AWS the difference is invisible: VPC, subnet and security-group ids are
+ * globally unique, so keying by id and keying by (region, id) give the same
+ * answer. It shows up against an emulator that reuses ids across regions
+ * (lex00/floci#21), where a three-region estate's nine default subnets merged
+ * to three and "how many subnets are empty" came back 2 instead of 8.
+ *
+ * The rule is deliberately not a table of regional kinds. A lexicon stamps a
+ * region on a resource when region is part of that resource's identity — the
+ * AWS lexicon does it in `stampRegion` for ambient resources and its own
+ * property reads — and this reads that stamp back. A genuinely account-level
+ * resource carries no region and keeps merging as it always did, which is why
+ * dependencies (never stamped) are untouched by this.
+ */
+import type { ResourceMetadata } from "../lexicon.js";
+/**
+ * The region a resource records itself as being in, if it records one.
+ *
+ * Read from `attributes.region`, which is where a lexicon stamps it. Absent
+ * means the resource is account-level, or the lexicon has no region to give —
+ * both of which are read the same way, as "region is not part of this id".
+ */
+export declare function regionOf(meta: Pick<ResourceMetadata, "attributes">): string | undefined;
+/**
+ * The key an unqualified resource merges under.
+ *
+ * `${region}::${id}` for a resource that carries a region, matching the shape
+ * stack qualification already uses, and the bare id for one that does not.
+ *
+ * Applied only where results from more than one region are actually merged —
+ * `collectAmbient` across stacks, `replaySnapshots` across recorded stacks.
+ * Recording one region's observation qualifies nothing, so a stored snapshot
+ * keeps the keys it has always had and the first snapshot taken after this
+ * lands does not diff as "every ambient resource replaced".
+ *
+ * Idempotent, so an id that already carries this region survives a second pass
+ * unchanged rather than becoming `us-east-1::us-east-1::sg-1`.
+ */
+export declare function unqualifiedKey(id: string, meta: Pick<ResourceMetadata, "attributes">): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/lifecycle/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/lifecycle/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,SAAS,CAGvF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,GAAG,MAAM,CAI7F"}

package/dist/lifecycle/observe.d.ts

@@ -60,6 +60,11 @@ export declare function observeResources(environment: string, plugins: Observati
  * Ask a lexicon what exists of the kinds it manages, beyond what is declared
  * (#1278). Once per stack for the region, merged by physical id — the same
  * ambient resource seen from two stacks is one resource.
+ *
+ * "The same" is per region (#1416). Two stacks in one region reporting the
+ * account's default security group is one group; two regions' default security
+ * groups are two, whatever their ids look like, so the merge key carries the
+ * region a resource records itself in.
  */
 export declare function collectAmbient(plugin: ObservationLexicon, opts: {
     environment: string;

package/dist/lifecycle/observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observe.d.ts","sourceRoot":"","sources":["../../src/lifecycle/observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAUnD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE;IACL,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE;;8CAE0C;IAC1C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,aAAa,CAAC,CA6JxB;AAyBD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,GACA,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAqB3C;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,GACA,OAAO,CAAC,qBAAqB,CAAC,CA0ChC"}
+{"version":3,"file":"observe.d.ts","sourceRoot":"","sources":["../../src/lifecycle/observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAWnD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE;IACL,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE;;8CAE0C;IAC1C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,aAAa,CAAC,CA2KxB;AAyBD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,GACA,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CA2B3C;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,GACA,OAAO,CAAC,qBAAqB,CAAC,CA0ChC"}

package/dist/lifecycle/replay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../src/lifecycle/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD;;;;;;;;;;;;GAYG;AACH;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMvE;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,OAAO,CAAC;IAAE,YAAY,EAAE,eAAe,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAuFpH"}
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../src/lifecycle/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD;;;;;;;;;;;;GAYG;AACH;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMvE;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,OAAO,CAAC;IAAE,YAAY,EAAE,eAAe,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAsIpH"}

package/dist/lifecycle/types.d.ts

@@ -92,6 +92,18 @@ export interface ResourceDigest {
 export interface BuildDigest {
     /** Per-resource digest keyed by logical name */
     resources: Record<string, ResourceDigest>;
+    /**
+     * chant #1442 — lexicon name → version that produced this build.
+     *
+     * Recorded once per lexicon rather than on every {@link ResourceDigest},
+     * which would repeat one string across every resource of a stack for no
+     * added information.
+     *
+     * Optional because a digest read back from an older snapshot will not have
+     * it. Absent and empty are different: absent means "recorded before this
+     * existed", empty means "recorded, and no plugins were loaded".
+     */
+    lexiconVersions?: Record<string, string>;
     /** Resource-level dependency graph */
     dependencies: Record<string, string[]>;
     /** Cross-lexicon output bridges from BuildManifest */
@@ -115,5 +127,23 @@ export interface DigestDiff {
     changed: string[];
     /** Resources where propsHash matches */
     unchanged: string[];
+    /**
+     * chant #1442 — lexicons whose VERSION moved between the two digests, even
+     * where every resource is unchanged.
+     *
+     * A build whose only difference is the lexicon that emitted it is a real
+     * difference: the lexicon is a generated artifact pinned to an upstream
+     * spec, so a bump can change output with no source change. Reported
+     * separately from `changed` because no resource's declaration moved — the
+     * interpreter did.
+     *
+     * Empty when neither digest recorded versions, so a comparison against a
+     * pre-#1442 snapshot reports nothing rather than inventing a change.
+     */
+    lexiconVersionChanges: Array<{
+        lexicon: string;
+        previous?: string;
+        current?: string;
+    }>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/lifecycle/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lifecycle/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,MAAM,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB;;gFAE4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACrD;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,iCAAiC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lifecycle/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,MAAM,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB;;gFAE4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACrD;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,iCAAiC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxF"}

package/dist/managed-fields.d.ts

@@ -81,6 +81,17 @@ export interface OwnershipSets {
     foreignOwned: ReadonlySet<string>;
     /** The subset of `foreignOwned` where the declared manifest also sets the path — drift-relevant despite foreign ownership. */
     foreignContested: ReadonlySet<string>;
+    /**
+     * Path → the name of the manager that owns it (#1189).
+     *
+     * The three sets above answer *which category* owns a path, which is all the
+     * prune rule needs. A reader needs the other question — "owned by
+     * `kubectl-client-side-apply`" and "owned by `hpa-controller`" are the same
+     * category and mean very different things to an operator. Last writer wins
+     * where several managers touch one path, matching what the API server itself
+     * reports.
+     */
+    owners: ReadonlyMap<string, string>;
 }
 /**
  * Build the three ownership sets for one live object. `entries` is

package/dist/managed-fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-fields.d.ts","sourceRoot":"","sources":["../src/managed-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAIrE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAAC,MAAM,CAQjE,CAAC;AAwBH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAwBhF;AAID;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,kDAAkD;IAClD,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,8HAA8H;IAC9H,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAsHD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,SAAS,sBAAsB,EAAE,EAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,GACvD,aAAa,CAmBf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAM7E"}
+{"version":3,"file":"managed-fields.d.ts","sourceRoot":"","sources":["../src/managed-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAIrE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAAC,MAAM,CAQjE,CAAC;AAwBH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAwBhF;AAID;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,kDAAkD;IAClD,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,8HAA8H;IAC9H,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC;;;;;;;;;OASG;IACH,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AA6HD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,SAAS,sBAAsB,EAAE,EAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,GACvD,aAAa,CAoBf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAM7E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/build.ts

@@ -185,6 +185,14 @@ export interface BuildOptions {
    */
   lexicons?: readonly string[];
 
+  /**
+   * chant #1442 — lexicon name → the version of the plugin that served it.
+   * Recorded on {@link BuildResult.lexiconVersions} so a build digest can say
+   * WHAT interpreted the declarations, not only what was declared. The CLI
+   * populates this from `options.plugins`; `build()` only carries it.
+   */
+  lexiconVersions?: Readonly<Record<string, string>>;
+
   /**
    * chant #1045 Phase 2 — opt-in: run-fallback files (or, when {@link fold}
    * isn't set, every file) execute together, isolated, in one sandboxed
@@ -230,6 +238,21 @@ export interface BuildResult {
    */
   foldDecisions: FoldDecision[];
 
+  /**
+   * chant #1442 — lexicon name → the version of the plugin that served this
+   * build, passed through verbatim from {@link BuildOptions.lexiconVersions}.
+   *
+   * The other half of what a build digest needs. `hashProps` fingerprints the
+   * declaration; this records what turned it into output. A lexicon is a
+   * generated artifact pinned to an upstream spec, so a bump can change
+   * emitted output with no source change at all — and without this the two
+   * builds are indistinguishable.
+   *
+   * Empty when the caller supplied no plugins (`build()` used as a library,
+   * and most tests).
+   */
+  lexiconVersions: Record<string, string>;
+
   /**
    * This build's resolved build-time parameters (#1064) — the build
    * provenance record for `params.<name>` values, alongside the existing
@@ -717,6 +740,7 @@ async function buildFromDiscoveryResult(
     manifest,
     sourceFileCount: discoveryResult.sourceFiles.length,
     foldDecisions: discoveryResult.foldDecisions,
+    lexiconVersions: { ...(options?.lexiconVersions ?? {}) },
     buildParams: options?.buildParams ?? [],
   };
 }

package/src/cli/commands/build.ts

@@ -3,6 +3,7 @@ import { loadChantConfigUpward, resolveOwnershipMarker, resolveFoldEnabled, reso
 import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
+import { resolveLexiconVersions } from "../plugins";
 import { runPostSynthChecks } from "../../lint/post-synth";
 import { applyConfiguredSeverity } from "../../lint/config";
 import { loadPolicyChecks } from "../../lint/policy";
@@ -242,6 +243,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // ../plugins.ts and fold-import.ts's `lexiconPackageName`.
   const lexicons = options.plugins?.map((plugin) => plugin.name) ?? [];
 
+  // chant #1442 — which lexicon VERSION interpreted each declaration. The
+  // declaration is fingerprinted by `hashProps`; the thing that turned it into
+  // output was not recorded at all, so a lexicon bump that changed emitted
+  // output left the build digest identical. Captured here because this is the
+  // layer that knows which lexicons were loaded — `build()` is given only
+  // their names.
+  const lexiconVersions = resolveLexiconVersions(lexicons);
+
   // Run the build
   const result = await build(infraPath, options.serializers, undefined, {
     ownership,
@@ -250,6 +259,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
     sandbox,
     intrinsics,
     lexicons,
+    lexiconVersions,
     buildParams: paramsResolution.provenance,
   });
 

package/src/cli/commands/check-lexicon.ts

@@ -3,7 +3,7 @@ import { join, basename } from "path";
 import { auditIntrinsics } from "./check-lexicon-intrinsics";
 import { checkExamplesBuild } from "./check-lexicon-examples";
 import { auditDocsReachability } from "./check-lexicon-docs";
-import { auditMcpNames } from "./check-lexicon-mcp";
+import { auditMcpNames, lexiconNameFor } from "./check-lexicon-mcp";
 import { loadLexiconFromDir, registers, safeList } from "./check-lexicon-plugin";
 import { RULE_CATALOG } from "../../audit/catalog";
 
@@ -448,6 +448,25 @@ export async function checkLexicon(dir: string): Promise<CheckResult> {
           : "no marker channel — every verdict must be unknown",
   });
 
+  // #1344 — a lexicon that reads its own `chant.config.ts` namespace should
+  // declare its shape, or a typo inside that namespace is accepted and silently
+  // ignored: `forgejo: { runnerLabel: … }` left the dialect on its defaults with
+  // nothing said. Source scan, because the read happens deep in a serializer
+  // rather than anywhere the plugin object can be asked.
+  const lexiconName = lexiconNameFor(dir);
+  const readsOwnNamespace = findFiles(join(dir, "src"), (n) => n.endsWith(".ts") && !n.endsWith(".test.ts"))
+    .some((file) => new RegExp(`config\\s*\\??\\.\\s*${lexiconName}\\b`).test(readOr(file)));
+  items.push({
+    name: "Declares a configSchema if it reads its own config namespace",
+    tier: 2,
+    pass: !readsOwnNamespace || plugin?.configSchema !== undefined,
+    detail: readsOwnNamespace
+      ? plugin?.configSchema
+        ? `config.${lexiconName} is declared and validated`
+        : `reads config.${lexiconName} but declares no schema — unknown keys there are silently ignored`
+      : "reads no config namespace of its own",
+  });
+
   const compositeFiles = listTsFiles(join(dir, "src/composites"), ["index.ts"]);
   items.push({
     name: "At least 1 composite in src/composites/",

package/src/cli/handlers/lifecycle.ts

@@ -597,6 +597,16 @@ async function runLifecycleDiffDigest(args: DigestDiffArgs): Promise<number> {
     for (const name of diff.unchanged) {
       console.log(name.padEnd(20) + "unchanged".padEnd(12) + (currentDigest.resources[name]?.type ?? ""));
     }
+
+    // chant #1442 — a lexicon bump can change emitted output with no source
+    // change, so every resource above can read "unchanged" while the build is
+    // not the same build. Printed under the table rather than as a row: no
+    // resource's declaration moved, the thing that interpreted them did.
+    for (const change of diff.lexiconVersionChanges) {
+      const from = change.previous ?? "(absent)";
+      const to = change.current ?? "(absent)";
+      console.log(`\nlexicon ${change.lexicon}: ${from} → ${to}`);
+    }
   }
 
   return 0;

package/src/cli/handlers/run-client.ts

@@ -116,7 +116,9 @@ export function resolveProfile(
   config: Record<string, unknown>,
   profileName?: string,
 ): WorkerProfile {
-  const temporal = config.temporal as Record<string, unknown> | undefined;
+  // #1344 — the temporal lexicon declares this namespace and core validates it
+  // at load, so this reads a checked value rather than asserting one.
+  const temporal = (config as { temporal?: Record<string, unknown> }).temporal;
   if (!temporal?.profiles) {
     throw new Error(
       'No temporal.profiles found in chant.config.ts. Add a profile to use `chant run`.',

package/src/cli/handlers/search-kind.test.ts

@@ -0,0 +1,45 @@
+import { describe, it, expect } from "vitest";
+import { resolveKindTerms, type Term } from "./search";
+import type { IRNode } from "../../graph-ir";
+
+const nodes = [
+  { id: "vpc", kind: "AWS::EC2::VPC", lexicon: "aws", attrs: {} },
+  { id: "att", kind: "AWS::EC2::VPCGatewayAttachment", lexicon: "aws", attrs: {} },
+  { id: "sub", kind: "AWS::EC2::Subnet", lexicon: "aws", attrs: {} },
+  { id: "assoc", kind: "AWS::EC2::SubnetRouteTableAssociation", lexicon: "aws", attrs: {} },
+  { id: "igw", kind: "AWS::EC2::InternetGateway", lexicon: "aws", attrs: {} },
+] as IRNode[];
+
+const resolve = (a: string) => {
+  const t: Term = { kind: "kind", a };
+  resolveKindTerms([t], nodes);
+  return t.kinds ? [...t.kinds].sort() : undefined;
+};
+
+describe("a kind term means the kind, not any type containing its letters", () => {
+  it("EC2::VPC is the VPC, not the gateway attachment", () => {
+    // The estate has 6 VPCs and answered 9. VPCGatewayAttachment contains the
+    // characters "EC2::VPC" and is not a VPC.
+    expect(resolve("EC2::VPC")).toEqual(["AWS::EC2::VPC"]);
+  });
+
+  it("Subnet is the subnet, not the route table association", () => {
+    expect(resolve("Subnet")).toEqual(["AWS::EC2::Subnet"]);
+  });
+
+  it("a full type still resolves to itself", () => {
+    expect(resolve("AWS::EC2::Subnet")).toEqual(["AWS::EC2::Subnet"]);
+  });
+
+  it("a genuine substring search still works", () => {
+    // Nothing lines up with a `::` boundary here, so the documented substring
+    // rule applies and finds both gateway-ish kinds.
+    expect(resolve("Gateway")).toBeUndefined();
+  });
+
+  it("resolves inside an edge sub-term, where the negation lives", () => {
+    const t: Term = { kind: "edge", a: "", dir: "in", sub: { kind: "kind", a: "EC2::VPC" } };
+    resolveKindTerms([t], nodes);
+    expect(t.sub?.kinds && [...t.sub.kinds]).toEqual(["AWS::EC2::VPC"]);
+  });
+});

package/src/cli/handlers/search.ts

@@ -1,6 +1,6 @@
 import { resolve } from "node:path";
 import { build } from "../../build";
-import { buildGraphIr, buildLiveGraphIr, sourceOverlayGraphs, type GraphIR, type IRNode } from "../../graph-ir";
+import { buildGraphIr, buildLiveGraphIr, sourceOverlayGraphs, type GraphIR, type IRNode, type IREdge } from "../../graph-ir";
 import { buildDeclaredPerStack } from "../../graph-declared";
 import { enrichEffectiveTopology } from "../../graph-effective";
 import { reconstructEdges, mergeCatalogs, type ReferenceCatalog } from "../../graph-refs";
@@ -127,6 +127,8 @@ export async function runSearch(ctx: CommandContext): Promise<number> {
       source = { kind: "live" };
     }
     let live = buildLiveGraphIr(observations);
+    // Containment edges, kept aside until after the overlay (see below).
+    let containmentEdges: IREdge[] = [];
     // Live-only: enrichment is a provider call, so it has no place in a replay.
     // A recorded answer that quietly reached for the API would stop being one.
     if (!args.at) {
@@ -147,13 +149,24 @@ export async function runSearch(ctx: CommandContext): Promise<number> {
     // topology has nothing to traverse on anything the declared graph does not
     // already model.
     const catalogs = observing.map((p) => p.referenceCatalog).filter((c): c is ReferenceCatalog => !!c);
+    // Held back until after the overlay — see where it is merged for why.
     if (catalogs.length > 0) {
       // Merge, never replace. A lexicon reports relationships a catalog cannot
       // reconstruct (#1273) — an instance placed in a subnet it did not declare
       // carries a template `Ref` in its attributes, not the physical subnet id,
       // so no identity index resolves it. Overwriting here dropped exactly those
       // edges and left the fold with a chain missing its first hop.
-      const reconstructed = reconstructEdges(live.nodes, mergeCatalogs(catalogs)).edges;
+      // Containment travels with the references here, and only here. `->`/`<-`
+      // asks which nodes reach which, and being inside something is a way of
+      // reaching it: "which subnets have no network interfaces IN them" and
+      // "which VPCs have no instances IN them" are containment questions, and
+      // with only peer references to walk the negation matched everything.
+      //
+      // `graph` still reads `.containment` on its own and draws boundary boxes,
+      // so nothing gains a line it did not have.
+      const rebuilt = reconstructEdges(live.nodes, mergeCatalogs(catalogs));
+      containmentEdges = rebuilt.containmentEdges;
+      const reconstructed = rebuilt.edges;
       const seen = new Set((live.edges ?? []).map((e) => `${e.from}|${e.to}|${e.viaAttr ?? ""}`));
       live = {
         ...live,
@@ -177,6 +190,36 @@ export async function runSearch(ctx: CommandContext): Promise<number> {
         ? await buildDeclaredPerStack(stacks, projectPath)
         : buildGraphIr((await discover(resolve(args.src ?? config.sourceDir ?? "."))).entities, projectPath);
     ir = sourceOverlayGraphs(declared, live);
+    // Containment goes on AFTER the overlay, not through it.
+    //
+    // `sourceOverlayGraphs` admits a live edge only when one end is foreign,
+    // because "declared edges already cover every declared relationship". That
+    // is true of the references it was written for and false of containment:
+    // the declared canvas carries what the source *says*, and no source says
+    // "this instance is in this VPC" — the instance declares a subnet, and the
+    // VPC is implied by the account.
+    //
+    // So an instance and its VPC, both declared, had their containment dropped
+    // between them, while an instance in the account's DEFAULT VPC kept it
+    // because that VPC is foreign. "Which VPCs have no instances" answered
+    // correctly for the one VPC nobody declared and wrongly for every VPC
+    // somebody did.
+    if (containmentEdges.length > 0) {
+      const present = new Set(ir.nodes.map((n) => n.id));
+      const seen = new Set(ir.edges.map((e) => `${e.from}|${e.to}|${e.viaAttr ?? ""}`));
+      ir = {
+        ...ir,
+        edges: [
+          ...ir.edges,
+          ...containmentEdges.filter(
+            (e) =>
+              present.has(e.from) &&
+              present.has(e.to) &&
+              !seen.has(`${e.from}|${e.to}|${e.viaAttr ?? ""}`),
+          ),
+        ],
+      };
+    }
     // Carry live-derived attrs onto the declared canvas — some facts only exist
     // in live account state (e.g. `internetFacing` for an instance in the
     // account's default VPC, whose route table chant does not model). The
@@ -190,6 +233,9 @@ export async function runSearch(ctx: CommandContext): Promise<number> {
   // Fold derived reachability facts (effectiveIngress, internetFacing) onto
   // instance nodes so multi-hop/launch-template joins are one node predicate (#1139).
   ir = enrichEffectiveTopology(ir);
+  // Resolve `kind:` terms against what is actually in this graph, before any
+  // node is tested against them.
+  resolveKindTerms(terms, ir.nodes);
   const nodeById = new Map(ir.nodes.map((n) => [n.id, n]));
   const matches = ir.nodes.filter((n) => terms.every((t) => matchTerm(n, t, ir, nodeById)));
   if (matches.length === 0) {
@@ -489,7 +535,7 @@ function describeTerm(t: Term): string {
   return leaf(t);
 }
 
-interface Term {
+export interface Term {
   kind: "word" | "kind" | "tag" | "attr" | "edge";
   /** `!term` — the node must NOT satisfy this (#1280). */
   negated?: boolean;
@@ -498,6 +544,53 @@ interface Term {
   /** For edge terms: the direction and the sub-predicate matched at the far end. */
   dir?: "out" | "in";
   sub?: Term;
+  /**
+   * For kind terms: the kinds this term actually means, resolved against the
+   * graph (see {@link resolveKindTerms}). Absent when nothing resolved it, in
+   * which case the substring rule applies unchanged.
+   */
+  kinds?: Set<string>;
+}
+
+/**
+ * Decide which kinds a `kind:` term means, given what is in the graph.
+ *
+ * `kind:` is documented as a substring, and substrings of a CloudFormation type
+ * cross kind boundaries: `kind:EC2::VPC` also matches
+ * `AWS::EC2::VPCGatewayAttachment`, and `kind:EC2::Subnet` also matches
+ * `AWS::EC2::SubnetRouteTableAssociation`. An estate with 6 VPCs answers 9, and
+ * the caller has no reason to suspect the number they were given.
+ *
+ * That cost real answers. Asked how many VPCs have no instances, agents named
+ * the right VPCs and reported "9 VPCs in the estate" beside them; the grader
+ * failed the answer for contradicting the estate, which it did.
+ *
+ * So: a term that lines up with `::` boundaries means those kinds and only
+ * those. `EC2::VPC` is the last two segments of `AWS::EC2::VPC` and is not any
+ * run of segments in `AWS::EC2::VPCGatewayAttachment`, because
+ * `VPCGatewayAttachment` is not `VPC`.
+ *
+ * Substring is kept as the fallback, so `kind:Gateway` still finds both
+ * `InternetGateway` and `VPCGatewayAttachment` — a genuine substring search
+ * that no segment rule would serve. Most specific wins; nothing else changes.
+ */
+export function resolveKindTerms(terms: Term[], nodes: IRNode[]): void {
+  const present = [...new Set(nodes.map((n) => n.kind).filter((k): k is string => !!k))];
+  const walk = (t: Term): void => {
+    if (t.sub) walk(t.sub);
+    if (t.kind !== "kind") return;
+    const want = t.a.toLowerCase().split("::").filter(Boolean);
+    if (want.length === 0) return;
+    const onBoundary = present.filter((k) => {
+      const have = k.toLowerCase().split("::");
+      for (let i = 0; i + want.length <= have.length; i++) {
+        if (want.every((w, j) => have[i + j] === w)) return true;
+      }
+      return false;
+    });
+    if (onBoundary.length > 0) t.kinds = new Set(onBoundary);
+  };
+  terms.forEach(walk);
 }
 
 function parseLeaf(tok: string): Term {
@@ -616,7 +709,12 @@ function matchTerm(n: IRNode, t: Term, ir?: GraphIR, byId?: Map<string, IRNode>)
       .filter((x): x is IRNode => !!x);
     return neighbors.some((m) => matchTerm(m, t.sub!, ir, byId));
   }
-  if (t.kind === "kind") return (n.kind ?? "").toLowerCase().includes(t.a.toLowerCase());
+  if (t.kind === "kind") {
+    // Resolved kinds when the term lined up with `::` boundaries; the
+    // documented substring otherwise.
+    if (t.kinds) return t.kinds.has(n.kind ?? "");
+    return (n.kind ?? "").toLowerCase().includes(t.a.toLowerCase());
+  }
   if (t.kind === "attr") {
     const val = attrString((attrs as Record<string, unknown>)[t.a]);
     return t.b === undefined ? t.a in attrs : val.toLowerCase().includes(t.b.toLowerCase());

package/src/cli/main.ts

@@ -6,6 +6,7 @@ import { formatSuccess, formatError } from "./format";
 import { loadPlugins, resolveProjectLexicons } from "./plugins";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
 import { loadChantConfigUpward } from "../config";
+import { validateLexiconConfig, formatLexiconConfigProblems } from "../lexicon-config";
 import { armSandboxConfigEvaluation } from "../config-sandbox";
 import { armSandboxPolicyExecution } from "../lint/policy-import";
 import { ENV_VAR, unknownEnvError } from "../env";
@@ -559,16 +560,17 @@ Options:
                         project source; network egress is NOT blocked (see
                         docs). Default: off (also settable via
                         chant.config.ts's build.sandbox: true; #1045)
-  --param <name=value>  (build) Bind a declared build-time parameter
-                        (chant.config.ts's buildParams) to a value, for
-                        source to read as params.<name> (#1064) instead of
-                        process.env — repeatable. Distinct from the AWS
-                        lexicon's deploy-time Parameter(): this resolves
-                        before synthesis, so it can change which resources
-                        are produced at all. Highest precedence.
-  --params-file <path>  (build) JSON file of { "name": value } build-time
-                        parameter values (#1064). Second precedence, after
-                        --param.
+  --param <name=value>  (build, graph, run --components) Bind a declared
+                        build-time parameter (chant.config.ts's buildParams)
+                        to a value, for source to read as params.<name>
+                        (#1064) instead of process.env — repeatable.
+                        Distinct from the AWS lexicon's deploy-time
+                        Parameter(): this resolves before synthesis, so it
+                        can change which resources are produced at all.
+                        Highest precedence.
+  --params-file <path>  (build, graph, run --components) JSON file of
+                        { "name": value } build-time parameter values
+                        (#1064). Second precedence, after --param.
 
 Examples:
   chant build ./infra/
@@ -668,6 +670,26 @@ async function loadPluginsOrExit(path: string): Promise<import("../lexicon").Lex
     process.exit(1);
   }
 
+  // #1344 — a lexicon that declares the shape of its own `chant.config.ts`
+  // namespace gets it validated here, once, before any command runs. The
+  // config schema is `.passthrough()`, so before this an unknown key inside a
+  // namespace was accepted and silently ignored: `forgejo: { runnerLabel: … }`
+  // left the dialect on its defaults with nothing said. A namespace whose
+  // lexicon declares no schema keeps that passthrough.
+  try {
+    const { config } = await loadChantConfigUpward(resolve(path));
+    const problems = validateLexiconConfig(plugins, config);
+    if (problems.length > 0) {
+      console.error(formatError({
+        message: `Invalid lexicon configuration in chant.config:\n${formatLexiconConfigProblems(problems)}`,
+        hint: "Remove or correct the key. A lexicon's namespace accepts only the keys it declares.",
+      }));
+      process.exit(1);
+    }
+  } catch {
+    // No config, or one that failed to load — the caller's own handling stands.
+  }
+
   return plugins;
 }