@intentius/chant 0.41.19 → 0.41.20

package/dist/cli/build-params-cli.d.ts

@@ -46,10 +46,13 @@ export interface CliBuildParamsResolution {
  * chant #1064's acceptance criterion that this never surfaces as a thrown
  * error from inside user source.
  *
- * On success, every resolved parameter is logged via `console.error` as
- * `[param] <name> = <value> (<source>)` — unconditional, not gated on
- * `--verbose`, so a build's environment-varying inputs are always visible,
- * the same way #1022's fold decisions are.
+ * On success, every explicitly-set parameter is logged via `console.error` as
+ * `[param] <name> = <value> (<source>)`, and the ones still at their declared
+ * defaults collapse to a single count line (`CHANT_PARAM_ECHO=all` lists them
+ * individually). Overrides stay unconditionally visible — not gated on
+ * `--verbose` — so a build's environment-varying inputs are always in the log,
+ * the same way #1022's fold decisions are; the defaults are the part that
+ * never varies, which is exactly why they can be a count.
  */
 export declare function resolveCliBuildParams(buildParamsConfig: BuildParamsConfig | undefined, args: CliBuildParamsArgs): CliBuildParamsResolution;
 /**

package/dist/cli/build-params-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-params-cli.d.ts","sourceRoot":"","sources":["../../src/cli/build-params-cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D;;;;;;;;;;;;;;;GAeG;AAEH,4SAA4S;AAC5S,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAQtF;AAED,qOAAqO;AACrO,MAAM,WAAW,kBAAkB;IACjC,mNAAmN;IACnN,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,iHAAiH;IACjH,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,4FAA4F;IAC5F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,EAChD,IAAI,EAAE,kBAAkB,GACvB,wBAAwB,CAkC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CACtC,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,EAChD,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,OAAO,CAAC,oBAAoB,EAAE,GAAG,SAAS,CAAC,CAU7C"}
+{"version":3,"file":"build-params-cli.d.ts","sourceRoot":"","sources":["../../src/cli/build-params-cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D;;;;;;;;;;;;;;;GAeG;AAEH,4SAA4S;AAC5S,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAQtF;AAED,qOAAqO;AACrO,MAAM,WAAW,kBAAkB;IACjC,mNAAmN;IACnN,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,iHAAiH;IACjH,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,4FAA4F;IAC5F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CACnC,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,EAChD,IAAI,EAAE,kBAAkB,GACvB,wBAAwB,CAgD1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CACtC,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,EAChD,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,OAAO,CAAC,oBAAoB,EAAE,GAAG,SAAS,CAAC,CAU7C"}

package/dist/cli/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAYnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2JAA2J;IAC3J,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CACjE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAub9E;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAYnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2JAA2J;IAC3J,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CACjE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAoc9E;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}

package/dist/cli/commands/import.d.ts

@@ -29,6 +29,22 @@ export interface ImportResult {
  * Execute the import command
  */
 export declare function importCommand(options: ImportOptions): Promise<ImportResult>;
+/**
+ * Import from an in-memory template string through a KNOWN plugin — no
+ * detection, no JSON assumption (#1548). This is the seam
+ * `chant import --kustomize <dir>` drives with `kustomize build` output
+ * through the k8s plugin's YAML parser; `importCommand` above is the same
+ * pipeline behind file reading + JSON detection.
+ */
+export interface ContentImportOptions {
+    /** The raw template content (YAML or JSON — the plugin's parser decides). */
+    content: string;
+    /** The lexicon whose parser/generator handle it, e.g. "k8s". */
+    lexicon: string;
+    output?: string;
+    force?: boolean;
+}
+export declare function importFromContent(options: ContentImportOptions): Promise<ImportResult>;
 /**
  * Live import options — read from a running cloud/cluster instead of a file.
  */

package/dist/cli/commands/import.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/import.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,sBAAsB;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmID;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA8IjF;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;uBAEmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAkBD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAatF;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,QAAQ,CAAC,EACpD,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,OAAO,CAAC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC,CAezD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EAAE,EACxB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAoFvB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAsB5D"}
+{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/import.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,sBAAsB;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmID;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA4EjF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC,CA2B5F;AAuED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;uBAEmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAkBD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAatF;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,QAAQ,CAAC,EACpD,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,OAAO,CAAC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC,CAezD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EAAE,EACxB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAoFvB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAsB5D"}

package/dist/cli/handlers/misc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"misc.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/misc.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAgBlD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsDnE;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuClE;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8CtE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwDpE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAKpE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBpE"}
+{"version":3,"file":"misc.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/misc.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAgBlD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsDnE;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuClE;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8CtE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+FpE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAKpE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBpE"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAMA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AA2E9E;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAiRpD;AAmiBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5E"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAMA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AA2E9E;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAqRpD;AAmiBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5E"}

package/dist/cli/registry.d.ts

@@ -30,6 +30,8 @@ export interface ParsedArgs {
     live: boolean;
     /** `chant migrate --from <name>` (default "github") */
     migrateFrom?: string;
+    /** `chant import --kustomize <dir>` — render the kustomization, then import (#1548) */
+    kustomize?: string;
     /** `chant carve advise --state <path>` — opt-in .tfstate for accurate instance counts */
     statePath?: string;
     /** `chant carve emit --select <tf-address>` — the Terraform resource to carve */

package/dist/cli/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/cli/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qaAAqa;IACra,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iIAAiI;IACjI,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;mFAC+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;oFACgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;2EAGuE;IACvE,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC;iFAC6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;6DAEyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0GAA0G;IAC1G,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kHAAkH;IAClH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uKAAuK;IACvK,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0HAA0H;IAC1H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gQAAgQ;IAChQ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oJAAoJ;IACpJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8RAA8R;IAC9R,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,8NAA8N;IAC9N,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uTAAuT;IACvT,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,geAAge;IAChe,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,wWAAwW;IACxW,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,ySAAyS;IACzS,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,uJAAuJ;IACvJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;yDAIqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAC;IAChB,4FAA4F;IAC5F,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,eAAe,GAAG,IAAI,CAiB/F"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/cli/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qaAAqa;IACra,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iIAAiI;IACjI,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;mFAC+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;oFACgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;2EAGuE;IACvE,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC;iFAC6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;6DAEyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0GAA0G;IAC1G,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kHAAkH;IAClH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uKAAuK;IACvK,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0HAA0H;IAC1H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gQAAgQ;IAChQ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oJAAoJ;IACpJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8RAA8R;IAC9R,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,8NAA8N;IAC9N,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uTAAuT;IACvT,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,geAAge;IAChe,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,wWAAwW;IACxW,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,ySAAyS;IACzS,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,uJAAuJ;IACvJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;yDAIqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAC;IAChB,4FAA4F;IAC5F,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,eAAe,GAAG,IAAI,CAiB/F"}

package/dist/components/deploy-units.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-units.d.ts","sourceRoot":"","sources":["../../src/components/deploy-units.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAItD,CAAC;AAEF,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,CA0BzD"}
+{"version":3,"file":"deploy-units.d.ts","sourceRoot":"","sources":["../../src/components/deploy-units.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAOtD,CAAC;AAEF,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,CA0BzD"}

package/dist/governance.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Governance verb vocabulary (#790, epic #787).
+ *
+ * `resourceType` on a change-set entry is a free provider-specific string
+ * ("team", "branch-protection", "protected-tag", …) chosen per cycle. That is
+ * right for display but useless for reading two providers' plans as one
+ * grammar. The verb is the cross-provider category a cycle reconciles;
+ * provider-specific cycle names stay for display.
+ *
+ * SCM and cloud cycles stamp the same verbs, so a GitHub plan and an AWS plan
+ * group the same way:
+ *
+ * - `org-unit` — the containers and their settings: GitHub org/repo settings,
+ *   GitLab group/project/instance settings, cloud OUs/folders/accounts.
+ * - `policy-guardrail` — rules constraining what may happen: branch
+ *   protections, rulesets, push rules, MR approvals, security features,
+ *   dependency hygiene, SCPs, Org Policies.
+ * - `membership` — who belongs, directly or via teams: org members, team
+ *   membership, group members.
+ * - `identity-assignment` — non-person and delegated access: tokens, deploy
+ *   keys, service credentials, SSO/IAM assignments. `membership` is people
+ *   in containers; this is everything else that can act.
+ * - `audit-sink` — where events and evidence flow: webhooks, integrations,
+ *   CloudTrail/audit-log sinks.
+ * - `secret-material` — secrets and CI variables the platform stores.
+ *
+ * A cycle has exactly one verb. When a cycle plausibly spans two (GitHub
+ * `environments` carries both reviewer gates and secrets), stamp the verb of
+ * the cycle's primary object — the thing whose create/delete the cycle owns —
+ * not of fields it also happens to write.
+ */
+/** The cross-provider governance category a cycle reconciles. */
+export type GovernanceVerb = "org-unit" | "policy-guardrail" | "membership" | "identity-assignment" | "audit-sink" | "secret-material";
+/** Every verb, for exhaustiveness checks ("does each cycle stamp one?"). */
+export declare const GOVERNANCE_VERBS: readonly GovernanceVerb[];
+export declare function isGovernanceVerb(v: unknown): v is GovernanceVerb;
+//# sourceMappingURL=governance.d.ts.map

package/dist/governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,iEAAiE;AACjE,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,kBAAkB,GAClB,YAAY,GACZ,qBAAqB,GACrB,YAAY,GACZ,iBAAiB,CAAC;AAEtB,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAOrD,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,cAAc,CAEhE"}

package/dist/reconcile.d.ts

@@ -18,6 +18,7 @@
  * are pure and clock-free; `runReconcile` is the orchestration loop and is the
  * only part that drives I/O (through the provider's `Cycle` implementations).
  */
+import { type GovernanceVerb } from "./governance.js";
 /** A single field-level change: what the old value was and what it will become. */
 export interface FieldChange {
     field: string;
@@ -31,6 +32,12 @@ export interface ChangeSetEntry {
     kind: ChangeKind;
     /** High-level resource category (e.g. "team", "member", "branch-protection"). */
     resourceType: string;
+    /**
+     * Cross-provider governance category (#790). `resourceType` stays the
+     * provider-specific display string; the verb is the shared grammar SCM and
+     * cloud plans group by. Stamped by `runReconcile` from the cycle's `verb`.
+     */
+    verb?: GovernanceVerb;
     /**
      * Unique key identifying this resource within its type.
      * - For top-level resources: a single name (team slug, member login, …).
@@ -172,6 +179,12 @@ export declare class BudgetExhaustedError extends Error {
 export interface Cycle<TClient, TConfig, TLive, TScope = unknown> {
     /** Human-readable name, e.g. "branch-protection". */
     name: string;
+    /**
+     * Cross-provider governance category this cycle reconciles (#790). Every
+     * SCM warden cycle stamps one; cloud cycles (epic #787 C2) must. Optional
+     * only so provider-external Cycle implementations don't break.
+     */
+    verb?: GovernanceVerb;
     fetchLive(client: TClient, scopeId: string, scope: TScope, budget: RateBudget): Promise<TLive>;
     buildDesired(config: TConfig, scopeId: string, scope: TScope): TConfig;
     apply(client: TClient, entry: ChangeSetEntry, scopeId: string, scope: TScope, budget: RateBudget): Promise<void>;
@@ -179,6 +192,8 @@ export interface Cycle<TClient, TConfig, TLive, TScope = unknown> {
 /** Per-cycle outcome recorded in the run result. */
 export interface CycleResult {
     name: string;
+    /** The cycle's governance verb (#790), when it stamps one. */
+    verb?: GovernanceVerb;
     /** Scope id this result is for (e.g. an org login). */
     org: string;
     counts: {

package/dist/reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wDAAwD;IACxD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAEzD;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,MAAM,EAAE,GACd,WAAW,EAAE,CAUf;AAMD,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB,CAAC,CAAC,EAAE,CAAC;IACxC,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,0CAA0C;IAC1C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrB,mEAAmE;IACnE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC;IACtD,uEAAuE;IACvE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC;IACnD,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;IAC5D,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,cAAc,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CA6C7E;AAMD,qCAAqC;AACrC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAI5E;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAuBrD;AAaD,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,WAAW,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AAE/F,0FAA0F;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,SAAS,KAAK,mBAAmB,GAAG,IAAI,CAAC;AAEjF,oCAAoC;AACpC,MAAM,WAAW,sBAAsB;IACrC,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAyC9D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,IAAI,GAAE,sBAA2B,GAChC,mBAAmB,GAAG,IAAI,CAgB5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,eAAe,CAQlG;AAMD,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,gFAAgF;IAChF,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAA0B;CAI9C;AAmBD;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC9D,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/F,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACvE,KAAK,CACH,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,GAAG,cAAc,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,YAAY,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC5E,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qDAAqD;IACrD,MAAM,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC;IACvF,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,KAAK,eAAe,CAAC;IACpE,wCAAwC;IACxC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sDAAsD;IACtD,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,EAC1E,IAAI,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GACzD,OAAO,CAAC,eAAe,CAAC,CAuG1B"}
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMxE,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wDAAwD;IACxD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAEzD;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,MAAM,EAAE,GACd,WAAW,EAAE,CAUf;AAMD,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB,CAAC,CAAC,EAAE,CAAC;IACxC,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,0CAA0C;IAC1C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrB,mEAAmE;IACnE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC;IACtD,uEAAuE;IACvE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC;IACnD,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;IAC5D,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,cAAc,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CA6C7E;AAMD,qCAAqC;AACrC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAI5E;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAgCrD;AAaD,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,WAAW,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AAE/F,0FAA0F;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,SAAS,KAAK,mBAAmB,GAAG,IAAI,CAAC;AAEjF,oCAAoC;AACpC,MAAM,WAAW,sBAAsB;IACrC,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAyC9D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,IAAI,GAAE,sBAA2B,GAChC,mBAAmB,GAAG,IAAI,CAgB5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,eAAe,CAQlG;AAMD,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,gFAAgF;IAChF,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAA0B;CAI9C;AAmBD;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC9D,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/F,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACvE,KAAK,CACH,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,GAAG,cAAc,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,YAAY,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC5E,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qDAAqD;IACrD,MAAM,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC;IACvF,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,KAAK,eAAe,CAAC;IACpE,wCAAwC;IACxC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sDAAsD;IACtD,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,EAC1E,IAAI,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GACzD,OAAO,CAAC,eAAe,CAAC,CA6G1B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.41.19",
+  "version": "0.41.20",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/build-params-cli.test.ts

@@ -56,18 +56,62 @@ describe("resolveCliBuildParams", () => {
     }
   });
 
-  test("logs every resolved parameter as '[param] name = value (source)'", () => {
+  test("a build with no overrides collapses to a single defaults count", () => {
+    // The provenance still records every value; the echo just stops naming
+    // what nobody set. One line, so silence still never means "no parameters
+    // reached us".
     const defs: BuildParamsConfig = { tier: { type: "string", default: "light" } };
     const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
     try {
-      resolveCliBuildParams(defs, {});
+      const result = resolveCliBuildParams(defs, {});
       const logged = errorSpy.mock.calls.map((call) => String(call[0]));
-      expect(logged.some((line) => line.includes("[param] tier") && line.includes("light") && line.includes("default"))).toBe(true);
+      expect(logged.some((line) => line.includes("1 parameters at their defaults"))).toBe(true);
+      expect(logged.some((line) => line.includes("[param] tier"))).toBe(false);
+      expect(result.provenance).toEqual([{ name: "tier", value: "light", source: "default" }]);
     } finally {
       errorSpy.mockRestore();
     }
   });
 
+  test("names the overrides and collapses the defaults into a count", () => {
+    const defs: BuildParamsConfig = {
+      tier: { type: "string", default: "light" },
+      target: { type: "string", default: "k3d" },
+      host: { type: "string", default: "localhost:4000" },
+    };
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      resolveCliBuildParams(defs, { cli: { tier: "ha" } });
+      const logged = errorSpy.mock.calls.map((call) => String(call[0]));
+      expect(logged.some((line) => line.includes("[param] tier") && line.includes("ha") && line.includes("cli"))).toBe(true);
+      expect(logged.some((line) => line.includes("2 more at their defaults"))).toBe(true);
+      expect(logged.some((line) => line.includes("[param] target"))).toBe(false);
+    } finally {
+      errorSpy.mockRestore();
+    }
+  });
+
+  test("CHANT_PARAM_ECHO=all restores the full listing", () => {
+    const defs: BuildParamsConfig = {
+      tier: { type: "string", default: "light" },
+      target: { type: "string", default: "k3d" },
+    };
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    const prev = process.env.CHANT_PARAM_ECHO;
+    process.env.CHANT_PARAM_ECHO = "all";
+    try {
+      resolveCliBuildParams(defs, { cli: { tier: "ha" } });
+      const logged = errorSpy.mock.calls.map((call) => String(call[0]));
+      expect(logged.some((line) => line.includes("[param] tier") && line.includes("ha"))).toBe(true);
+      expect(logged.some((line) => line.includes("[param] target") && line.includes("k3d") && line.includes("default"))).toBe(true);
+      expect(logged.some((line) => line.includes("more at their defaults"))).toBe(false);
+    } finally {
+      if (prev === undefined) delete process.env.CHANT_PARAM_ECHO;
+      else process.env.CHANT_PARAM_ECHO = prev;
+      errorSpy.mockRestore();
+    }
+  });
+
   test("no declared params → success with empty provenance and no logging", () => {
     const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
     try {

package/src/cli/build-params-cli.ts

@@ -62,10 +62,13 @@ export interface CliBuildParamsResolution {
  * chant #1064's acceptance criterion that this never surfaces as a thrown
  * error from inside user source.
  *
- * On success, every resolved parameter is logged via `console.error` as
- * `[param] <name> = <value> (<source>)` — unconditional, not gated on
- * `--verbose`, so a build's environment-varying inputs are always visible,
- * the same way #1022's fold decisions are.
+ * On success, every explicitly-set parameter is logged via `console.error` as
+ * `[param] <name> = <value> (<source>)`, and the ones still at their declared
+ * defaults collapse to a single count line (`CHANT_PARAM_ECHO=all` lists them
+ * individually). Overrides stay unconditionally visible — not gated on
+ * `--verbose` — so a build's environment-varying inputs are always in the log,
+ * the same way #1022's fold decisions are; the defaults are the part that
+ * never varies, which is exactly why they can be a count.
  */
 export function resolveCliBuildParams(
   buildParamsConfig: BuildParamsConfig | undefined,
@@ -99,9 +102,23 @@ export function resolveCliBuildParams(
     return { success: false, provenance: [], errors };
   }
 
-  for (const p of resolution.provenance) {
+  // Echo what the operator SET, one line each; collapse what they did not.
+  // A project with two dozen declared parameters printed two dozen grey lines
+  // on every build, and the ones that matter — the overrides — drowned in the
+  // ones that never vary. Defaults still get named on request
+  // (CHANT_PARAM_ECHO=all), and a build with no overrides still says how many
+  // parameters resolved, so silence never means "no parameters reached us"
+  // (the failure mode warnIfParamsCannotReachProject exists for).
+  const explicit = resolution.provenance.filter((p) => p.source !== "default");
+  const defaulted = resolution.provenance.length - explicit.length;
+  const echoAll = process.env.CHANT_PARAM_ECHO === "all";
+  for (const p of echoAll ? resolution.provenance : explicit) {
     console.error(formatInfo(`[param] ${p.name} = ${JSON.stringify(p.value)} (${p.source})`));
   }
+  if (!echoAll && defaulted > 0) {
+    const more = explicit.length > 0 ? `${defaulted} more` : `${defaulted} parameters`;
+    console.error(formatInfo(`[param] ${more} at their defaults (CHANT_PARAM_ECHO=all lists them)`));
+  }
 
   return { success: true, provenance: resolution.provenance, errors: [] };
 }

package/src/cli/commands/build.test.ts

@@ -732,3 +732,47 @@ describe("resolveBuildFormat", () => {
     expect(resolveBuildFormat("yaml", "template.yaml")).toEqual({ format: "yaml" });
   });
 });
+
+describe("buildCommand error grouping (fountain-ops#62)", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-cli-dedup-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  test("the same message from three files surfaces once, with a count of the others", async () => {
+    // The fountain-ops shape: a guard in a shared params module throws during
+    // every resource file's evaluation, so the identical sentence arrives
+    // once per file — fourteen times, in the report that named this issue.
+    for (const f of ["a", "b", "c"]) {
+      await writeFile(
+        join(testDir, `${f}.infra.ts`),
+        `throw new Error('tier "ha" cannot run on this seam — fix the seam');\n`,
+      );
+    }
+
+    const result = await buildCommand({ path: testDir, format: "json", serializers: [] });
+
+    expect(result.success).toBe(false);
+    const matching = result.errors.filter((e) => e.includes("cannot run on this seam"));
+    expect(matching).toHaveLength(1);
+    expect(matching[0]).toContain("and the same from 2 more files");
+  });
+
+  test("distinct messages keep their own lines", async () => {
+    await writeFile(join(testDir, "a.infra.ts"), `throw new Error("first failure");\n`);
+    await writeFile(join(testDir, "b.infra.ts"), `throw new Error("second failure");\n`);
+
+    const result = await buildCommand({ path: testDir, format: "json", serializers: [] });
+
+    expect(result.success).toBe(false);
+    expect(result.errors.some((e) => e.includes("first failure"))).toBe(true);
+    expect(result.errors.some((e) => e.includes("second failure"))).toBe(true);
+    expect(result.errors.some((e) => e.includes("more files"))).toBe(false);
+  });
+});

package/src/cli/commands/build.ts

@@ -275,13 +275,26 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
     }
   }
 
-  // Format errors
+  // Format errors — grouped by message, because one refusal can surface once
+  // per resource file. A project whose params module throws (a guard like
+  // "this seam cannot back that tier") throws in EVERY file that imports it,
+  // and fourteen copies of one sentence bury the sentence
+  // (INTENTIUS/fountain-ops#62). The first file to hit it is named, the rest
+  // become a count; errors with genuinely different messages keep their own
+  // lines, and a message that appears once is printed exactly as before.
+  const byMessage = new Map<string, { first: (typeof result.errors)[number]; files: number }>();
   for (const error of result.errors) {
+    const key = `${error.name ?? ""}:${error.message}`;
+    const seen = byMessage.get(key);
+    if (seen) seen.files += 1;
+    else byMessage.set(key, { first: error, files: 1 });
+  }
+  for (const { first: error, files } of byMessage.values()) {
     const formatted = formatError({
       file: "file" in error ? (error as unknown as Record<string, unknown>).file as string | undefined : undefined,
       line: "line" in error ? (error as unknown as Record<string, unknown>).line as number | undefined : undefined,
       column: "column" in error ? (error as unknown as Record<string, unknown>).column as number | undefined : undefined,
-      message: error.message,
+      message: files > 1 ? `${error.message} (and the same from ${files - 1} more files)` : error.message,
       name: error.name,
     });
     errors.push(formatted);

package/src/cli/commands/import.ts

@@ -241,20 +241,68 @@ export async function importCommand(options: ImportOptions): Promise<ImportResul
 
   const lexicon = plugin.name;
 
+  return parseAndWrite(plugin, content, outputDir, options.force, warnings, generatedFiles, lexicon);
+}
+
+/**
+ * Import from an in-memory template string through a KNOWN plugin — no
+ * detection, no JSON assumption (#1548). This is the seam
+ * `chant import --kustomize <dir>` drives with `kustomize build` output
+ * through the k8s plugin's YAML parser; `importCommand` above is the same
+ * pipeline behind file reading + JSON detection.
+ */
+export interface ContentImportOptions {
+  /** The raw template content (YAML or JSON — the plugin's parser decides). */
+  content: string;
+  /** The lexicon whose parser/generator handle it, e.g. "k8s". */
+  lexicon: string;
+  output?: string;
+  force?: boolean;
+}
+
+export async function importFromContent(options: ContentImportOptions): Promise<ImportResult> {
+  const outputDir = resolve(options.output ?? "./infra/");
+  let plugins: LexiconPlugin[];
+  try {
+    plugins = await loadPlugins([options.lexicon]);
+  } catch (err) {
+    return {
+      success: false,
+      generatedFiles: [],
+      warnings: [],
+      error: `Could not load lexicon "${options.lexicon}": ${err}`,
+    };
+  }
+  const plugin = plugins[0];
+  if (!plugin) {
+    return { success: false, generatedFiles: [], warnings: [], error: `Lexicon "${options.lexicon}" not available.` };
+  }
   if (!plugin.templateParser || !plugin.templateGenerator) {
     return {
       success: false,
       generatedFiles: [],
       warnings: [],
       error: `Lexicon "${plugin.name}" does not support template import.`,
-      lexicon,
+      lexicon: plugin.name,
     };
   }
+  return parseAndWrite(plugin, options.content, outputDir, options.force, [], [], plugin.name);
+}
 
+/** The shared tail of every template import: parse → generate → write. */
+function parseAndWrite(
+  plugin: LexiconPlugin,
+  content: string,
+  outputDir: string,
+  force: boolean | undefined,
+  warnings: string[],
+  generatedFiles: string[],
+  lexicon: string,
+): ImportResult {
   // Parse template
   let ir: TemplateIR;
   try {
-    const parser = plugin.templateParser();
+    const parser = plugin.templateParser!();
     ir = parser.parse(content);
   } catch (err) {
     return {
@@ -265,10 +313,10 @@ export async function importCommand(options: ImportOptions): Promise<ImportResul
     };
   }
 
-  const generator = plugin.templateGenerator();
+  const generator = plugin.templateGenerator!();
 
   // Check output directory
-  if (existsSync(outputDir) && !options.force) {
+  if (existsSync(outputDir) && !force) {
     const files = readdirSync(outputDir);
     if (files.length > 0) {
       warnings.push(`Output directory ${outputDir} is not empty. Use --force to overwrite.`);
@@ -293,7 +341,7 @@ export async function importCommand(options: ImportOptions): Promise<ImportResul
     }
 
     // Check for existing file
-    if (existsSync(filePath) && !options.force) {
+    if (existsSync(filePath) && !force) {
       warnings.push(`File ${file.path} already exists, skipping`);
       continue;
     }

package/src/cli/handlers/build.test.ts

@@ -88,7 +88,9 @@ describe("runBuild --components --generate (chant #1108 build-time parameters)",
       undefined,
       [{ name: "tier", value: "light", source: "default" }],
     );
-    expect(stderr.join("\n")).toContain("[param] tier");
+    // A parameter at its default collapses into the count line now; the
+    // provenance forwarded above is where its value is asserted.
+    expect(stderr.join("\n")).toContain("at their defaults");
     vi.restoreAllMocks();
   });
 

package/src/cli/handlers/misc.ts

@@ -1,6 +1,6 @@
 import { listCommand, printListResult } from "../commands/list";
 import { describeCommand, printDescribeResult } from "../commands/describe";
-import { importCommand, importFromLive, importFromLiveStacks, printImportResult } from "../commands/import";
+import { importCommand, importFromContent, importFromLive, importFromLiveStacks, printImportResult } from "../commands/import";
 import { loadChantConfig } from "../../config";
 import { resolve } from "path";
 import { auditCommand, printAuditResult, type AuditFormat, type AuditTier, type AuditFailOn } from "../commands/audit";
@@ -171,6 +171,45 @@ export async function runDescribe(ctx: CommandContext): Promise<number> {
 export async function runImport(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
 
+  // `--kustomize <dir>` (#1548): render the overlay and import the output
+  // through the k8s template parser — the flag NAMES the lexicon, so no JSON
+  // detection. `kustomize build`, falling back to kubectl's vendored
+  // kustomize when the standalone binary is absent; a big overlay renders
+  // megabytes, hence the buffer bound.
+  if (args.kustomize) {
+    const { exec } = await import("node:child_process");
+    const { promisify } = await import("node:util");
+    const execAsync = promisify(exec);
+    const run = (cmd: string) => execAsync(cmd, { maxBuffer: 64 * 1024 * 1024 });
+    const quoted = `'${args.kustomize.replace(/'/g, "'\\''")}'`;
+    let rendered: string;
+    try {
+      ({ stdout: rendered } = await run(`kustomize build ${quoted}`));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (!/ENOENT|not found|command not found|127/.test(message)) {
+        console.error(formatError({ message: `kustomize build failed: ${message.split("\n")[0]}` }));
+        return 1;
+      }
+      try {
+        ({ stdout: rendered } = await run(`kubectl kustomize ${quoted}`));
+      } catch (err2) {
+        console.error(formatError({
+          message: `neither kustomize nor kubectl could render ${args.kustomize}: ${err2 instanceof Error ? err2.message.split("\n")[0] : String(err2)}`,
+        }));
+        return 1;
+      }
+    }
+    const result = await importFromContent({
+      content: rendered,
+      lexicon: "k8s",
+      output: args.output,
+      force: args.force,
+    });
+    printImportResult(result);
+    return result.success ? 0 : 1;
+  }
+
   // `--from <env>` switches import from a template file to a live source.
   if (args.migrateFrom) {
     const selector: ResourceSelector | undefined =

package/src/cli/handlers/run.test.ts

@@ -951,7 +951,9 @@ describe("runOpComponents", () => {
       expect(runComponentsMock).toHaveBeenCalledWith(expect.any(String), "svc", expect.objectContaining({
         buildParams: [{ name: "tier", value: "light", source: "default" }],
       }));
-      expect(stderr.join("\n")).toContain("[param] tier");
+      // A parameter at its default collapses into the count line now; the
+      // provenance forwarded above is where its value is asserted.
+      expect(stderr.join("\n")).toContain("at their defaults");
     });
 
     test("--param overrides a declared default and is threaded through to runComponents", async () => {

package/src/cli/main.ts

@@ -188,6 +188,10 @@ export function parseArgs(args: string[]): ParsedArgs {
       // Shared by `migrate --from <lexicon>` and `import --from <env>`; the
       // two commands never run together, so one field carries both.
       result.migrateFrom = args[++i];
+    } else if (arg === "--kustomize") {
+      // `chant import --kustomize <dir>` (#1548): render the overlay, import
+      // the output through the k8s template parser.
+      result.kustomize = args[++i];
     } else if (arg === "--type") {
       result.selectType = args[++i];
     } else if (arg === "--name") {

package/src/cli/registry.ts

@@ -31,6 +31,8 @@ export interface ParsedArgs {
   live: boolean;
   /** `chant migrate --from <name>` (default "github") */
   migrateFrom?: string;
+  /** `chant import --kustomize <dir>` — render the kustomization, then import (#1548) */
+  kustomize?: string;
   /** `chant carve advise --state <path>` — opt-in .tfstate for accurate instance counts */
   statePath?: string;
   /** `chant carve emit --select <tf-address>` — the Terraform resource to carve */

package/src/codegen/publish-order.test.ts

@@ -48,7 +48,7 @@ describe("publish order", () => {
     // same stranding by a different route.
     const all = execFileSync(
       "bash",
-      ["-c", 'for d in packages/*/ lexicons/*/; do [ -f "$d/package.json" ] && echo "${d%/}"; done'],
+      ["-c", 'for d in packages/*/ lexicons/*/ wardens/*/; do [ -f "$d/package.json" ] && echo "${d%/}"; done'],
       { cwd: REPO, encoding: "utf8" },
     )
       .split("\n")

package/src/codegen/release-wiring.test.ts

@@ -117,10 +117,14 @@ function recipeBody(name: string): string {
  * which is why this asserts the mechanism, not a shared literal.
  */
 describe("release wiring: peer ranges stay in lockstep (#1255)", () => {
-  it("the whole-repo release rewrites both @intentius peer ranges", () => {
+  it("the whole-repo release rewrites every @intentius peer range", () => {
+    // Since #788 the rewrite is generic (`with_entries` over every
+    // `@intentius/*` peer) rather than two named keys: the wardens added
+    // `@intentius/warden-core` as a third in-repo peer, and a hand-listed
+    // rewrite goes stale the same way the hand-listed publish steps did.
     const body = recipeBody("release");
-    expect(body).toMatch(/peerDependencies\["@intentius\/chant"\]/);
-    expect(body).toMatch(/peerDependencies\["@intentius\/chant-lexicon-github"\]/);
+    expect(body).toMatch(/\.peerDependencies\s*\|=\s*with_entries/);
+    expect(body).toMatch(/startswith\("@intentius\/"\)/);
   });
 
   it("the single-lexicon release rewrites them too", () => {

package/src/components/deploy-units.ts

@@ -37,6 +37,9 @@ export interface DeployUnitRule {
 export const DEPLOY_UNIT_RULES: readonly DeployUnitRule[] = [
   { kind: "cfn-deploy", field: "stack", lexicon: "aws" },
   { kind: "kubectl-apply", field: "stack", lexicon: "k8s" },
+  // kustomize renders, then applies through the same stack-labelled pipeline —
+  // so its unit is observed by the identical label sweep (#1548).
+  { kind: "kustomize-apply", field: "stack", lexicon: "k8s" },
   { kind: "helm-upgrade", field: "release", lexicon: "helm" },
 ];
 

package/src/governance.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, it } from "vitest";
+import { GOVERNANCE_VERBS, isGovernanceVerb, type GovernanceVerb } from "./governance.js";
+import { renderChangeSet, runReconcile, type ChangeSet, type Cycle } from "./reconcile.js";
+
+describe("governance verbs (#790)", () => {
+  it("the runtime list and the type stay in sync", () => {
+    // Compile-time: assigning the list's element type to GovernanceVerb and
+    // back fails if either side gains a member the other lacks.
+    const fromList: GovernanceVerb = GOVERNANCE_VERBS[0];
+    const toList: (typeof GOVERNANCE_VERBS)[number] = "audit-sink" satisfies GovernanceVerb;
+    expect(isGovernanceVerb(fromList)).toBe(true);
+    expect(isGovernanceVerb(toList)).toBe(true);
+    expect(isGovernanceVerb("teams")).toBe(false);
+    expect(isGovernanceVerb(undefined)).toBe(false);
+  });
+
+  it("runReconcile stamps the cycle's verb onto entries that lack one", async () => {
+    const cycle: Cycle<null, Record<string, never>, null> = {
+      name: "teams",
+      verb: "membership",
+      fetchLive: async () => null,
+      buildDesired: (c) => c,
+      apply: async () => {},
+    };
+    const result = await runReconcile({
+      scopes: { acme: {} },
+      client: null,
+      cycles: [cycle],
+      mode: "apply",
+      diff: (org) => ({
+        org,
+        entries: [
+          { kind: "create", resourceType: "team", key: "platform" },
+          // A diff that stamps its own verb wins over the cycle's.
+          { kind: "delete", resourceType: "grant", key: "bot", verb: "identity-assignment" },
+        ],
+      }),
+    });
+    expect(result.cycles[0].verb).toBe("membership");
+    expect(result.cycles[0].applied.map((e) => e.verb)).toEqual(["membership", "identity-assignment"]);
+  });
+
+  it("renderChangeSet groups by verb without changing line format", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: [
+        { kind: "create", resourceType: "webhook", key: "audit", verb: "audit-sink" },
+        { kind: "create", resourceType: "ou", key: "Security", verb: "org-unit" },
+        { kind: "create", resourceType: "team", key: "platform", verb: "membership" },
+      ],
+    };
+    const out = renderChangeSet(cs);
+    // Vocabulary order: org-unit before membership before audit-sink.
+    expect(out.indexOf("[ou] Security")).toBeLessThan(out.indexOf("[team] platform"));
+    expect(out.indexOf("[team] platform")).toBeLessThan(out.indexOf("[webhook] audit"));
+    // Line format is untouched — no verb appears in the rendering.
+    expect(out).not.toContain("org-unit");
+  });
+
+  it("a verbless change set renders exactly as before", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: [
+        { kind: "create", resourceType: "b", key: "2" },
+        { kind: "create", resourceType: "a", key: "1" },
+      ],
+    };
+    expect(renderChangeSet(cs)).toBe(
+      "Plan for acme: 2 to create, 0 to update, 0 to delete\n\nCREATE:\n  [b] 2\n  [a] 1",
+    );
+  });
+});

package/src/governance.ts

@@ -0,0 +1,54 @@
+/**
+ * Governance verb vocabulary (#790, epic #787).
+ *
+ * `resourceType` on a change-set entry is a free provider-specific string
+ * ("team", "branch-protection", "protected-tag", …) chosen per cycle. That is
+ * right for display but useless for reading two providers' plans as one
+ * grammar. The verb is the cross-provider category a cycle reconciles;
+ * provider-specific cycle names stay for display.
+ *
+ * SCM and cloud cycles stamp the same verbs, so a GitHub plan and an AWS plan
+ * group the same way:
+ *
+ * - `org-unit` — the containers and their settings: GitHub org/repo settings,
+ *   GitLab group/project/instance settings, cloud OUs/folders/accounts.
+ * - `policy-guardrail` — rules constraining what may happen: branch
+ *   protections, rulesets, push rules, MR approvals, security features,
+ *   dependency hygiene, SCPs, Org Policies.
+ * - `membership` — who belongs, directly or via teams: org members, team
+ *   membership, group members.
+ * - `identity-assignment` — non-person and delegated access: tokens, deploy
+ *   keys, service credentials, SSO/IAM assignments. `membership` is people
+ *   in containers; this is everything else that can act.
+ * - `audit-sink` — where events and evidence flow: webhooks, integrations,
+ *   CloudTrail/audit-log sinks.
+ * - `secret-material` — secrets and CI variables the platform stores.
+ *
+ * A cycle has exactly one verb. When a cycle plausibly spans two (GitHub
+ * `environments` carries both reviewer gates and secrets), stamp the verb of
+ * the cycle's primary object — the thing whose create/delete the cycle owns —
+ * not of fields it also happens to write.
+ */
+
+/** The cross-provider governance category a cycle reconciles. */
+export type GovernanceVerb =
+  | "org-unit"
+  | "policy-guardrail"
+  | "membership"
+  | "identity-assignment"
+  | "audit-sink"
+  | "secret-material";
+
+/** Every verb, for exhaustiveness checks ("does each cycle stamp one?"). */
+export const GOVERNANCE_VERBS: readonly GovernanceVerb[] = [
+  "org-unit",
+  "policy-guardrail",
+  "membership",
+  "identity-assignment",
+  "audit-sink",
+  "secret-material",
+];
+
+export function isGovernanceVerb(v: unknown): v is GovernanceVerb {
+  return typeof v === "string" && (GOVERNANCE_VERBS as readonly string[]).includes(v);
+}

package/src/reconcile.ts

@@ -19,6 +19,8 @@
  * only part that drives I/O (through the provider's `Cycle` implementations).
  */
 
+import { GOVERNANCE_VERBS, type GovernanceVerb } from "./governance.js";
+
 // ---------------------------------------------------------------------------
 // Change-set model
 // ---------------------------------------------------------------------------
@@ -38,6 +40,12 @@ export interface ChangeSetEntry {
   kind: ChangeKind;
   /** High-level resource category (e.g. "team", "member", "branch-protection"). */
   resourceType: string;
+  /**
+   * Cross-provider governance category (#790). `resourceType` stays the
+   * provider-specific display string; the verb is the shared grammar SCM and
+   * cloud plans group by. Stamped by `runReconcile` from the cycle's `verb`.
+   */
+  verb?: GovernanceVerb;
   /**
    * Unique key identifying this resource within its type.
    * - For top-level resources: a single name (team slug, member login, …).
@@ -211,8 +219,17 @@ export function renderChangeSet(cs: ChangeSet): string {
 
   const ORDER: ChangeKind[] = ["create", "update", "delete"];
   for (const kind of ORDER) {
-    const group = byKind[kind];
+    let group = byKind[kind];
     if (group.length === 0) continue;
+    // Verb-aware grouping (#790): when entries carry governance verbs, order
+    // each section by verb (vocabulary order, unverbed entries last) so mixed
+    // plans read category-by-category. Stable, and line format is unchanged —
+    // a verbless change set renders exactly as before.
+    if (group.some((e) => e.verb)) {
+      const rank = (e: ChangeSetEntry): number =>
+        e.verb ? GOVERNANCE_VERBS.indexOf(e.verb) : GOVERNANCE_VERBS.length;
+      group = [...group].sort((a, b) => rank(a) - rank(b));
+    }
     lines.push(`\n${kind.toUpperCase()}:`);
     for (const e of group) {
       lines.push(`  [${e.resourceType}] ${e.key}`);
@@ -399,6 +416,12 @@ class MutableRateBudget implements RateBudget {
 export interface Cycle<TClient, TConfig, TLive, TScope = unknown> {
   /** Human-readable name, e.g. "branch-protection". */
   name: string;
+  /**
+   * Cross-provider governance category this cycle reconciles (#790). Every
+   * SCM warden cycle stamps one; cloud cycles (epic #787 C2) must. Optional
+   * only so provider-external Cycle implementations don't break.
+   */
+  verb?: GovernanceVerb;
   fetchLive(client: TClient, scopeId: string, scope: TScope, budget: RateBudget): Promise<TLive>;
   buildDesired(config: TConfig, scopeId: string, scope: TScope): TConfig;
   apply(
@@ -413,6 +436,8 @@ export interface Cycle<TClient, TConfig, TLive, TScope = unknown> {
 /** Per-cycle outcome recorded in the run result. */
 export interface CycleResult {
   name: string;
+  /** The cycle's governance verb (#790), when it stamps one. */
+  verb?: GovernanceVerb;
   /** Scope id this result is for (e.g. an org login). */
   org: string;
   counts: { create: number; update: number; delete: number };
@@ -535,6 +560,11 @@ export async function runReconcile<TClient, TConfig, TLive, TScope = unknown>(
       }
 
       const changeSet = diffFn(scopeId, desired, live, diffOptions);
+      // Stamp the cycle's governance verb (#790) onto entries that don't
+      // carry one, so provider diffs stay verb-unaware.
+      if (cycle.verb) {
+        for (const e of changeSet.entries) e.verb ??= cycle.verb;
+      }
       const guardrailResult = guardrails(changeSet, live);
 
       const counts = { create: 0, update: 0, delete: 0 };
@@ -542,6 +572,7 @@ export async function runReconcile<TClient, TConfig, TLive, TScope = unknown>(
 
       const cycleResult: CycleResult = {
         name: cycle.name,
+        verb: cycle.verb,
         org: scopeId,
         counts,
         guardrails: guardrailResult,