@intentius/chant 0.38.0 → 0.41.0

package/src/apply.test.ts

@@ -0,0 +1,169 @@
+import { describe, test, expect } from "vitest";
+import {
+  NOT_ATTEMPTED_REASONS,
+  isNotAttemptedReason,
+  isApplyResult,
+  applyResult,
+  normalizeApply,
+  notAttemptedAll,
+  applyRefKey,
+  overlappingRefs,
+  unaccountedRefs,
+  type ApplyRef,
+} from "./apply";
+
+const ref = (kind: string, name: string): ApplyRef => ({ kind, name });
+
+describe("NotAttemptedReason is total (#1446)", () => {
+  test("every reason is recognised, and nothing else is", () => {
+    for (const r of NOT_ATTEMPTED_REASONS) expect(isNotAttemptedReason(r)).toBe(true);
+    expect(isNotAttemptedReason("skipped")).toBe(false);
+    expect(isNotAttemptedReason("")).toBe(false);
+    expect(isNotAttemptedReason(undefined)).toBe(false);
+  });
+
+  // The write-side peer of UnobservedReason. Free-form strings are what let the
+  // gcp skip say "no mapper for kind X" to stdout and nothing to the caller.
+  test("the prune-side reason exists, because it is a different fact", () => {
+    expect(NOT_ATTEMPTED_REASONS).toContain("not-prunable");
+    expect(NOT_ATTEMPTED_REASONS).toContain("unsupported-kind");
+  });
+});
+
+describe("the envelope discriminates itself (#1446)", () => {
+  test("isApplyResult recognises the versioned shape only", () => {
+    expect(isApplyResult(applyResult([]))).toBe(true);
+    expect(isApplyResult({ applied: [], pruned: [] })).toBe(false);
+    expect(isApplyResult({ apply: "v2" })).toBe(false);
+    expect(isApplyResult(null)).toBe(false);
+  });
+
+  test("applyResult omits empty buckets rather than emitting empty arrays", () => {
+    expect(applyResult([{ ...ref("Bucket", "a"), action: "created" }])).toEqual({
+      apply: "v1",
+      applied: [{ kind: "Bucket", name: "a", action: "created" }],
+    });
+  });
+});
+
+describe("normalizeApply (#1446)", () => {
+  test("an un-migrated applier's shape means 'everything I was handed, I attempted'", () => {
+    // The compatibility path. Nothing is invented on its behalf — an empty
+    // notAttempted is exactly the claim that shape implicitly makes.
+    const n = normalizeApply({ applied: [{ ...ref("K", "a"), action: "created" }] });
+    expect(n.notAttempted).toEqual([]);
+    expect(n.pruned).toEqual([]);
+    expect(n.applied).toHaveLength(1);
+  });
+
+  test("the envelope's notAttempted survives normalization", () => {
+    const n = normalizeApply(
+      applyResult([], [], [{ ...ref("SQLInstance", "db"), reason: "unsupported-kind" }]),
+    );
+    expect(n.notAttempted).toEqual([{ kind: "SQLInstance", name: "db", reason: "unsupported-kind" }]);
+  });
+
+  // The read side has the same rule for the same reason: returning nothing must
+  // not be a way to claim success over work that never happened.
+  test("undefined normalizes to empty, so 'I could not' must be said explicitly", () => {
+    expect(normalizeApply(undefined)).toEqual({ applied: [], pruned: [], notAttempted: [] });
+  });
+});
+
+describe("notAttemptedAll (#1446)", () => {
+  test("marks a whole plan with one reason, for the run-level failure", () => {
+    const out = notAttemptedAll([ref("K", "a"), ref("K", "b")], "no-credentials", "no token");
+    expect(out).toEqual([
+      { kind: "K", name: "a", reason: "no-credentials", detail: "no token" },
+      { kind: "K", name: "b", reason: "no-credentials", detail: "no token" },
+    ]);
+  });
+
+  test("omits detail when none is given", () => {
+    expect(notAttemptedAll([ref("K", "a")], "no-binding")).toEqual([
+      { kind: "K", name: "a", reason: "no-binding" },
+    ]);
+  });
+});
+
+describe("the three buckets are disjoint (#1446)", () => {
+  test("no overlap is the contract", () => {
+    expect(
+      overlappingRefs({
+        applied: [{ ...ref("K", "a"), action: "created" }],
+        pruned: [{ ...ref("K", "b"), deleted: true }],
+        notAttempted: [{ ...ref("K", "c"), reason: "unsupported-kind" }],
+      }),
+    ).toEqual([]);
+  });
+
+  // A resource cannot be both written and skipped. An applier reporting that has
+  // a bug the return shape would otherwise hide.
+  test("the same resource in two buckets is reported", () => {
+    expect(
+      overlappingRefs({
+        applied: [{ ...ref("K", "a"), action: "created" }],
+        pruned: [],
+        notAttempted: [{ ...ref("K", "a"), reason: "filtered" }],
+      }),
+    ).toEqual(["K/a"]);
+  });
+
+  test("same name, different kind, is not an overlap", () => {
+    expect(
+      overlappingRefs({
+        applied: [{ ...ref("Bucket", "x"), action: "created" }],
+        pruned: [{ ...ref("Topic", "x"), deleted: true }],
+        notAttempted: [],
+      }),
+    ).toEqual([]);
+  });
+});
+
+describe("nothing in the plan is dropped (#1446)", () => {
+  // The suite's central assertion, and the one gcp failed before #1447: the
+  // unmapped kind was in the plan, in no bucket, and the result looked complete.
+  test("a plan entry in no bucket is reported", () => {
+    const plan = [ref("Bucket", "mapped"), ref("SQLInstance", "unmapped")];
+    const dropped = unaccountedRefs(plan, {
+      applied: [{ ...ref("Bucket", "mapped"), action: "created" }],
+      pruned: [],
+      notAttempted: [],
+    });
+    expect(dropped).toEqual(["SQLInstance/unmapped"]);
+  });
+
+  test("the same plan accounted for in notAttempted passes", () => {
+    const plan = [ref("Bucket", "mapped"), ref("SQLInstance", "unmapped")];
+    expect(
+      unaccountedRefs(plan, {
+        applied: [{ ...ref("Bucket", "mapped"), action: "created" }],
+        pruned: [],
+        notAttempted: [{ ...ref("SQLInstance", "unmapped"), reason: "unsupported-kind" }],
+      }),
+    ).toEqual([]);
+  });
+
+  test("an empty plan is trivially accounted for", () => {
+    expect(unaccountedRefs([], { applied: [], pruned: [], notAttempted: [] })).toEqual([]);
+  });
+
+  // Prune deletes things the plan does not contain, by definition — so a pruned
+  // resource being outside the plan is correct, not a drop.
+  test("a pruned resource outside the plan is not a drop", () => {
+    expect(
+      unaccountedRefs([ref("Bucket", "keep")], {
+        applied: [{ ...ref("Bucket", "keep"), action: "unchanged" }],
+        pruned: [{ ...ref("Bucket", "orphan"), deleted: true }],
+        notAttempted: [],
+      }),
+    ).toEqual([]);
+  });
+});
+
+describe("applyRefKey", () => {
+  test("separates resources by kind and name", () => {
+    expect(applyRefKey(ref("Bucket", "x"))).toBe("Bucket/x");
+    expect(applyRefKey(ref("Topic", "x"))).not.toBe(applyRefKey(ref("Bucket", "x")));
+  });
+});

package/src/apply.ts

@@ -0,0 +1,249 @@
+/**
+ * The apply contract (#1446) — what a lexicon's applier is allowed to mean.
+ *
+ * The peer of `./observation.ts`, and it exists for the same reason on the other
+ * side of the lifecycle.
+ *
+ * The read path had two ways to return nothing for a declared entity and no way
+ * to tell them apart — "the provider says it is absent" versus "I never looked"
+ * — and the second was classifying as `create`. #1089 made that a tri-state and
+ * #1201 built a conformance suite so a lexicon could not pass by returning a
+ * well-shaped result that still proposed a create.
+ *
+ * The write path had the identical hole. An applier could skip a resource and
+ * report nothing:
+ *
+ *     const mapper = MAPPERS[r.kind];
+ *     if (!mapper) {
+ *       console.log(`skip: no mapper for kind ${r.kind}`);
+ *       continue;                    // never appears in `applied`, or anywhere
+ *     }
+ *
+ * A caller receiving `{ applied: [...] }` could not distinguish a complete apply
+ * from one that dropped half the manifest, and `ApplyOp` had nothing to gate on.
+ * A `console.log` on stdout is not a signal in a result, the same way a warn on
+ * stderr was not a signal in a change set (#1447 was the concrete bug; #1457
+ * found the same shape in two more appliers).
+ *
+ * The contract is a tri-state, per resource in the plan:
+ *
+ *   - **APPLIED** — the provider was called and converged. Carries the action
+ *     (`created` / `updated` / `unchanged`) and the physical id when resolved.
+ *   - **PRUNED** — owned, no longer declared, deleted.
+ *   - **NOT-ATTEMPTED** — carrying a total {@link NotAttemptedReason}. Never
+ *     silent, never inferred from absence.
+ *
+ * The three are **disjoint and total**: every resource the applier was given
+ * appears in exactly one. That is the assertion the conformance suite exists to
+ * make, and the one the gcp skip failed.
+ *
+ * Compatibility: an applier may keep returning its own shape. The envelope is
+ * discriminated by its literal `apply: "v1"` field, the same mechanism
+ * `observation: "v1"` uses, so an un-migrated applier normalizes to "everything
+ * I was handed, I attempted" and nothing breaks. Reporting NOT-ATTEMPTED
+ * requires the envelope — which is the point: you cannot claim the guarantee
+ * without adopting the shape that can express its absence.
+ */
+
+/**
+ * Why a resource in the plan was not attempted. Total: an applier that skips a
+ * resource must pick one of these, and consumers may switch exhaustively.
+ *
+ * - `unsupported-kind` — the lexicon has no mapper/writer for this type. The
+ *   resource is declared and simply was not written.
+ * - `no-credentials` — no usable credentials/authorization for the target.
+ * - `no-binding` — the environment resolves to no concrete target (no cluster
+ *   context, no subscription, no resource group, no endpoint).
+ * - `dependency-failed` — an upstream resource in the same run failed, so this
+ *   one was never reached. Distinct from a failure of its own.
+ * - `filtered` — reached but deliberately withheld by a caller-requested scope.
+ * - `not-prunable` — an owned orphan of a kind the applier cannot enumerate or
+ *   delete. The prune-side shape: not "there was nothing to prune" but "I could
+ *   not look for anything to prune here".
+ */
+export type NotAttemptedReason =
+  | "unsupported-kind"
+  | "no-credentials"
+  | "no-binding"
+  | "dependency-failed"
+  | "filtered"
+  | "not-prunable";
+
+/** Every legal {@link NotAttemptedReason}, for validation and conformance checks. */
+export const NOT_ATTEMPTED_REASONS: readonly NotAttemptedReason[] = [
+  "unsupported-kind",
+  "no-credentials",
+  "no-binding",
+  "dependency-failed",
+  "filtered",
+  "not-prunable",
+];
+
+/** True when `value` is a legal {@link NotAttemptedReason}. */
+export function isNotAttemptedReason(value: unknown): value is NotAttemptedReason {
+  return typeof value === "string" && (NOT_ATTEMPTED_REASONS as readonly string[]).includes(value);
+}
+
+/** What an apply did to a resource that it did reach. */
+export type AppliedAction = "created" | "updated" | "unchanged";
+
+/** Every legal {@link AppliedAction}. */
+export const APPLIED_ACTIONS: readonly AppliedAction[] = ["created", "updated", "unchanged"];
+
+/** How a resource is named across appliers whose native vocabularies differ. */
+export interface ApplyRef {
+  /**
+   * The provider's own type name — a CNRM `kind`, an ARM `type`, a
+   * CloudFormation resource type, a Fly entity class. Kept verbatim rather than
+   * normalized into a chant vocabulary, so an applier stays true to its target.
+   */
+  kind: string;
+  /** The resource's name within its scope. */
+  name: string;
+}
+
+/** APPLIED — the provider was called and the resource converged. */
+export interface AppliedResource extends ApplyRef {
+  action: AppliedAction;
+  /** Provider-assigned identifier, when the response carried one. */
+  physicalId?: string;
+}
+
+/** PRUNED — owned, no longer declared, deleted. */
+export interface PrunedResource extends ApplyRef {
+  /**
+   * False when the delete was a no-op because the resource was already gone.
+   * Still PRUNED: the applier looked, decided, and acted.
+   */
+  deleted: boolean;
+}
+
+/** NOT-ATTEMPTED — no provider call was made, and why. */
+export interface NotAttemptedResource extends ApplyRef {
+  reason: NotAttemptedReason;
+  /** Detail for the operator: the status and body, the missing binding, the unsupported kind. */
+  detail?: string;
+}
+
+/**
+ * The apply envelope. Explicitly versioned: `apply: "v1"`, which discriminates
+ * it from an applier's own return shape.
+ */
+export interface ApplyResult {
+  /** Discriminant + wire version. */
+  readonly apply: "v1";
+  applied: AppliedResource[];
+  pruned?: PrunedResource[];
+  /** Omit or leave empty when everything in the plan was attempted. */
+  notAttempted?: NotAttemptedResource[];
+}
+
+/** Normalized form every consumer works with. All three arrays always present. */
+export interface NormalizedApply {
+  applied: AppliedResource[];
+  pruned: PrunedResource[];
+  notAttempted: NotAttemptedResource[];
+}
+
+/** True when `value` is the versioned {@link ApplyResult} envelope. */
+export function isApplyResult(value: unknown): value is ApplyResult {
+  return typeof value === "object" && value !== null && (value as { apply?: unknown }).apply === "v1";
+}
+
+/**
+ * Build an {@link ApplyResult}. Appliers use this rather than writing the
+ * discriminant by hand.
+ */
+export function applyResult(
+  applied: AppliedResource[],
+  pruned?: PrunedResource[],
+  notAttempted?: NotAttemptedResource[],
+): ApplyResult {
+  return {
+    apply: "v1",
+    applied,
+    ...(pruned && pruned.length > 0 ? { pruned } : {}),
+    ...(notAttempted && notAttempted.length > 0 ? { notAttempted } : {}),
+  };
+}
+
+/**
+ * Normalize an applier's return value.
+ *
+ * A non-envelope value normalizes to "everything I was handed, I attempted" —
+ * an empty `notAttempted`. That is the compatibility path, and it is also
+ * exactly the claim an un-migrated applier is implicitly making, so nothing is
+ * invented on its behalf.
+ *
+ * `undefined` normalizes to three empty arrays. An applier that means "I applied
+ * nothing because I could not" must say so with {@link notAttemptedAll} rather
+ * than returning nothing, for the same reason `unobservedAll` exists on the read
+ * side.
+ */
+export function normalizeApply(value: ApplyResult | Partial<NormalizedApply> | undefined): NormalizedApply {
+  if (!value) return { applied: [], pruned: [], notAttempted: [] };
+  return {
+    applied: value.applied ?? [],
+    pruned: value.pruned ?? [],
+    notAttempted: value.notAttempted ?? [],
+  };
+}
+
+/**
+ * Mark every named resource NOT-ATTEMPTED with one reason — the whole-run
+ * failure case (no credentials, no binding, the transport never came up). Core
+ * applies this when an applier throws, so a thrown apply degrades to an honest
+ * "did not attempt" per resource instead of an empty result that reads as a
+ * successful no-op.
+ */
+export function notAttemptedAll(
+  refs: Iterable<ApplyRef>,
+  reason: NotAttemptedReason,
+  detail?: string,
+): NotAttemptedResource[] {
+  return [...refs].map((ref) => ({ ...ref, reason, ...(detail ? { detail } : {}) }));
+}
+
+/** A resource's identity within one apply, for disjointness checks. */
+export function applyRefKey(ref: ApplyRef): string {
+  return `${ref.kind}/${ref.name}`;
+}
+
+/**
+ * Every resource that appears in more than one bucket. Empty is the contract;
+ * a non-empty result means the applier both wrote and skipped the same
+ * resource, which is not a state that can be true.
+ *
+ * Pruned is checked against the other two but not against itself: an applier
+ * may legitimately apply a resource and prune a different, same-named one only
+ * if their kinds differ, and {@link applyRefKey} already separates those.
+ */
+export function overlappingRefs(result: NormalizedApply): string[] {
+  const seen = new Map<string, Set<string>>();
+  const note = (bucket: string, refs: ApplyRef[]): void => {
+    for (const ref of refs) {
+      const key = applyRefKey(ref);
+      (seen.get(key) ?? seen.set(key, new Set()).get(key)!).add(bucket);
+    }
+  };
+  note("applied", result.applied);
+  note("pruned", result.pruned);
+  note("notAttempted", result.notAttempted);
+  return [...seen.entries()].filter(([, buckets]) => buckets.size > 1).map(([key]) => key);
+}
+
+/**
+ * Resources in `plan` that the result accounts for in no bucket — the silent
+ * drop this contract exists to make impossible.
+ *
+ * The conformance suite's central assertion. Before #1447, gcp's applier failed
+ * exactly this: an unmapped kind was in the plan, in no bucket, and the result
+ * looked complete.
+ */
+export function unaccountedRefs(plan: Iterable<ApplyRef>, result: NormalizedApply): string[] {
+  const accounted = new Set<string>();
+  for (const bucket of [result.applied, result.pruned, result.notAttempted]) {
+    for (const ref of bucket) accounted.add(applyRefKey(ref));
+  }
+  return [...plan].map(applyRefKey).filter((key) => !accounted.has(key));
+}

package/src/build.ts

@@ -185,6 +185,14 @@ export interface BuildOptions {
    */
   lexicons?: readonly string[];
 
+  /**
+   * chant #1442 — lexicon name → the version of the plugin that served it.
+   * Recorded on {@link BuildResult.lexiconVersions} so a build digest can say
+   * WHAT interpreted the declarations, not only what was declared. The CLI
+   * populates this from `options.plugins`; `build()` only carries it.
+   */
+  lexiconVersions?: Readonly<Record<string, string>>;
+
   /**
    * chant #1045 Phase 2 — opt-in: run-fallback files (or, when {@link fold}
    * isn't set, every file) execute together, isolated, in one sandboxed
@@ -230,6 +238,21 @@ export interface BuildResult {
    */
   foldDecisions: FoldDecision[];
 
+  /**
+   * chant #1442 — lexicon name → the version of the plugin that served this
+   * build, passed through verbatim from {@link BuildOptions.lexiconVersions}.
+   *
+   * The other half of what a build digest needs. `hashProps` fingerprints the
+   * declaration; this records what turned it into output. A lexicon is a
+   * generated artifact pinned to an upstream spec, so a bump can change
+   * emitted output with no source change at all — and without this the two
+   * builds are indistinguishable.
+   *
+   * Empty when the caller supplied no plugins (`build()` used as a library,
+   * and most tests).
+   */
+  lexiconVersions: Record<string, string>;
+
   /**
    * This build's resolved build-time parameters (#1064) — the build
    * provenance record for `params.<name>` values, alongside the existing
@@ -717,6 +740,7 @@ async function buildFromDiscoveryResult(
     manifest,
     sourceFileCount: discoveryResult.sourceFiles.length,
     foldDecisions: discoveryResult.foldDecisions,
+    lexiconVersions: { ...(options?.lexiconVersions ?? {}) },
     buildParams: options?.buildParams ?? [],
   };
 }

package/src/cli/commands/build.ts

@@ -3,6 +3,7 @@ import { loadChantConfigUpward, resolveOwnershipMarker, resolveFoldEnabled, reso
 import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
+import { resolveLexiconVersions } from "../plugins";
 import { runPostSynthChecks } from "../../lint/post-synth";
 import { applyConfiguredSeverity } from "../../lint/config";
 import { loadPolicyChecks } from "../../lint/policy";
@@ -242,6 +243,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // ../plugins.ts and fold-import.ts's `lexiconPackageName`.
   const lexicons = options.plugins?.map((plugin) => plugin.name) ?? [];
 
+  // chant #1442 — which lexicon VERSION interpreted each declaration. The
+  // declaration is fingerprinted by `hashProps`; the thing that turned it into
+  // output was not recorded at all, so a lexicon bump that changed emitted
+  // output left the build digest identical. Captured here because this is the
+  // layer that knows which lexicons were loaded — `build()` is given only
+  // their names.
+  const lexiconVersions = resolveLexiconVersions(lexicons);
+
   // Run the build
   const result = await build(infraPath, options.serializers, undefined, {
     ownership,
@@ -250,6 +259,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
     sandbox,
     intrinsics,
     lexicons,
+    lexiconVersions,
     buildParams: paramsResolution.provenance,
   });
 

package/src/cli/commands/check-lexicon.ts

@@ -3,7 +3,7 @@ import { join, basename } from "path";
 import { auditIntrinsics } from "./check-lexicon-intrinsics";
 import { checkExamplesBuild } from "./check-lexicon-examples";
 import { auditDocsReachability } from "./check-lexicon-docs";
-import { auditMcpNames } from "./check-lexicon-mcp";
+import { auditMcpNames, lexiconNameFor } from "./check-lexicon-mcp";
 import { loadLexiconFromDir, registers, safeList } from "./check-lexicon-plugin";
 import { RULE_CATALOG } from "../../audit/catalog";
 
@@ -448,6 +448,25 @@ export async function checkLexicon(dir: string): Promise<CheckResult> {
           : "no marker channel — every verdict must be unknown",
   });
 
+  // #1344 — a lexicon that reads its own `chant.config.ts` namespace should
+  // declare its shape, or a typo inside that namespace is accepted and silently
+  // ignored: `forgejo: { runnerLabel: … }` left the dialect on its defaults with
+  // nothing said. Source scan, because the read happens deep in a serializer
+  // rather than anywhere the plugin object can be asked.
+  const lexiconName = lexiconNameFor(dir);
+  const readsOwnNamespace = findFiles(join(dir, "src"), (n) => n.endsWith(".ts") && !n.endsWith(".test.ts"))
+    .some((file) => new RegExp(`config\\s*\\??\\.\\s*${lexiconName}\\b`).test(readOr(file)));
+  items.push({
+    name: "Declares a configSchema if it reads its own config namespace",
+    tier: 2,
+    pass: !readsOwnNamespace || plugin?.configSchema !== undefined,
+    detail: readsOwnNamespace
+      ? plugin?.configSchema
+        ? `config.${lexiconName} is declared and validated`
+        : `reads config.${lexiconName} but declares no schema — unknown keys there are silently ignored`
+      : "reads no config namespace of its own",
+  });
+
   const compositeFiles = listTsFiles(join(dir, "src/composites"), ["index.ts"]);
   items.push({
     name: "At least 1 composite in src/composites/",

package/src/cli/commands/doctor.test.ts

@@ -351,3 +351,48 @@ describe("doctorCommand", () => {
     });
   });
 });
+
+/**
+ * #1421 — the sibling of the `tsconfig-paths` check. Both are project settings
+ * that silently break runtime module resolution; this one makes build
+ * parameters read as empty in project source on the run path, so declarations
+ * conditioned on them take their default branch while chant reports success.
+ */
+describe("package-type-module (#1421)", () => {
+  const withPkg = async (pkg: object | undefined, assert: (check: { status: string; message?: string } | undefined) => void): Promise<void> => {
+    await withTestDir(async (testDir) => {
+      if (pkg) writeFileSync(join(testDir, "package.json"), JSON.stringify(pkg));
+      const report = await doctorCommand(testDir);
+      assert(report.checks.find((c) => c.name === "package-type-module"));
+    });
+  };
+
+  test('passes for "type": "module"', async () => {
+    await withPkg({ name: "p", type: "module" }, (check) => {
+      expect(check?.status).toBe("pass");
+    });
+  });
+
+  test('warns for "type": "commonjs", saying what breaks', async () => {
+    await withPkg({ name: "p", type: "commonjs" }, (check) => {
+      expect(check?.status).toBe("warn");
+      expect(check?.message).toContain('"type": "commonjs"');
+      expect(check?.message).toContain("build parameters");
+      expect(check?.message).toContain('Set "type": "module"');
+    });
+  });
+
+  // The easier one to miss: no `type` field is CommonJS too.
+  test("warns when no type field is declared at all", async () => {
+    await withPkg({ name: "p" }, (check) => {
+      expect(check?.status).toBe("warn");
+      expect(check?.message).toContain("no `type` field");
+    });
+  });
+
+  test("says nothing when there is no package.json to judge", async () => {
+    await withPkg(undefined, (check) => {
+      expect(check).toBeUndefined();
+    });
+  });
+});

package/src/cli/commands/doctor.ts

@@ -169,6 +169,46 @@ export async function doctorCommand(path: string): Promise<DoctorReport> {
     }
   }
 
+  // Check 8b: package.json declares "type": "module" (#1421)
+  //
+  // Sibling of the tsconfig-paths check above, and filed for the same reason:
+  // both are project settings that silently break runtime module resolution.
+  //
+  // chant's core is ESM. When the project is CJS — `"type": "commonjs"`, or no
+  // `type` field at all — tsx loads project source through the CommonJS
+  // transform, so the project's `require` of `params.ts` and core's `import` of
+  // it produce two separate module records. `setBuildParams` mutates one object
+  // in place; project source reads the other, and sees `{}`.
+  //
+  // The result is a silent wrong answer, not a failure: chant prints
+  // `[param] tier = "prod" (cli)` and then emits the graph for the default. It
+  // hits `chant graph` (always the run path) and `chant build --no-fold`; plain
+  // `chant build` escapes only because folding substitutes parameters
+  // statically and never reads the shared object.
+  const projectPkgPath = join(projectPath, "package.json");
+  if (existsSync(projectPkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync(projectPkgPath, "utf-8")) as { type?: string };
+      if (pkg.type === "module") {
+        checks.push({ name: "package-type-module", status: "pass" });
+      } else {
+        const found = pkg.type ? `"type": "${pkg.type}"` : "no `type` field";
+        checks.push({
+          name: "package-type-module",
+          status: "warn",
+          message:
+            `package.json has ${found} — chant is ESM, and a CommonJS project reads build ` +
+            `parameters as empty on the run path (\`chant graph\`, \`chant build --no-fold\`). ` +
+            `Declarations conditioned on \`params.<name>\` silently take their default branch. ` +
+            `Set "type": "module".`,
+        });
+      }
+    } catch (e) {
+      debug("project package.json parse failed:", e);
+      checks.push({ name: "package-type-module", status: "warn", message: "Could not parse package.json" });
+    }
+  }
+
   // Check 9: .mcp.json exists and has chant entry
   const mcpPath = join(projectPath, ".mcp.json");
   if (!existsSync(mcpPath)) {

package/src/cli/handlers/lifecycle.ts

@@ -597,6 +597,16 @@ async function runLifecycleDiffDigest(args: DigestDiffArgs): Promise<number> {
     for (const name of diff.unchanged) {
       console.log(name.padEnd(20) + "unchanged".padEnd(12) + (currentDigest.resources[name]?.type ?? ""));
     }
+
+    // chant #1442 — a lexicon bump can change emitted output with no source
+    // change, so every resource above can read "unchanged" while the build is
+    // not the same build. Printed under the table rather than as a row: no
+    // resource's declaration moved, the thing that interpreted them did.
+    for (const change of diff.lexiconVersionChanges) {
+      const from = change.previous ?? "(absent)";
+      const to = change.current ?? "(absent)";
+      console.log(`\nlexicon ${change.lexicon}: ${from} → ${to}`);
+    }
   }
 
   return 0;

package/src/cli/handlers/run-client.ts

@@ -116,7 +116,9 @@ export function resolveProfile(
   config: Record<string, unknown>,
   profileName?: string,
 ): WorkerProfile {
-  const temporal = config.temporal as Record<string, unknown> | undefined;
+  // #1344 — the temporal lexicon declares this namespace and core validates it
+  // at load, so this reads a checked value rather than asserting one.
+  const temporal = (config as { temporal?: Record<string, unknown> }).temporal;
   if (!temporal?.profiles) {
     throw new Error(
       'No temporal.profiles found in chant.config.ts. Add a profile to use `chant run`.',