@intentius/chant 0.41.19 → 0.42.1

package/dist/terraform/manifest.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The carve state manifest (#998) — what makes emit → bridge → apply compose.
+ *
+ * `carve emit` persists the boundary report and adoption selector next to the
+ * emitted source as `<target>.carve.json`. The later steps read it back from
+ * their output dir, so `carve bridge` and `carve apply` no longer need the
+ * target re-specified by hand, and each step records what it did for the next.
+ * Plain JSON on disk — reviewable, diffable, nothing proprietary.
+ */
+import type { CarveReport } from "./carve.js";
+import type { OwnershipMarker } from "../ownership.js";
+export declare const CARVE_MANIFEST_SUFFIX = ".carve.json";
+export interface CarveManifest {
+    version: 1;
+    /** Terraform address of the carved resource, e.g. `aws_s3_bucket.assets`. */
+    target: string;
+    /** Terraform resource type, when known. */
+    tfType?: string;
+    /** Absolute path of the Terraform estate the carve came from. */
+    from: string;
+    /** Absolute path of the tfstate used for adoption (offline path). */
+    statePath?: string;
+    /** Boundary classification persisted when the manifest was written. */
+    boundary: CarveReport;
+    /** Recorded by `carve emit`. */
+    emit?: {
+        source: "tfstate" | "live";
+        /** Emitted chant source file path(s). */
+        files: string[];
+        /**
+         * Deferred outbound inputs declared as build parameters in the emitted
+         * project (#998), keyed by parameter name.
+         */
+        params?: Record<string, {
+            /** The carved resource's own Terraform attribute the value enters through. */
+            tfAttr: string;
+            /** The survivor the Terraform source read, e.g. `aws_vpc.main`. */
+            survivor: string;
+            /** Survivor attribute(s) read. */
+            attrs: string[];
+            /** State-resolved default, when scalar. */
+            default?: string | number | boolean;
+        }>;
+        at: string;
+    };
+    /** Recorded by `carve bridge`. */
+    bridge?: {
+        written: string[];
+        appliedInPlace: boolean;
+        /** The git-applyable `.patch` carrying the whole survivor edit. */
+        patch?: string;
+        /** Carved addresses whose own `.tf` block the rewrites remove (#998). */
+        excised?: string[];
+        at: string;
+    };
+    /** Recorded by `carve apply`. */
+    apply?: {
+        marker: OwnershipMarker;
+        ownershipTags: Record<string, string>;
+        /** Emitted files the marker was stamped into (`--write-source`). */
+        stampedFiles?: string[];
+        at: string;
+    };
+}
+/** Filesystem-safe slug for a Terraform address (shared file-naming convention). */
+export declare function carveSlug(target: string): string;
+/** Where the manifest for `target` lives inside an output dir. */
+export declare function carveManifestPath(outDir: string, target: string): string;
+/** Write (or overwrite) a manifest into the output dir. Returns the path. */
+export declare function writeCarveManifest(outDir: string, manifest: CarveManifest): string;
+/** Read a manifest, or null when absent/unreadable/not a v1 manifest. */
+export declare function readCarveManifest(path: string): CarveManifest | null;
+/** All carve manifest paths in an output dir. */
+export declare function listCarveManifests(outDir: string): string[];
+export interface ResolvedManifest {
+    manifest?: CarveManifest;
+    path?: string;
+    error?: string;
+}
+/**
+ * Resolve the manifest a later carve step composes with. With a selected
+ * target, that target's manifest (absent is fine — the step just runs
+ * standalone). Without one, the single manifest in the output dir; none or
+ * several is an error naming what is (or is not) there.
+ */
+export declare function resolveCarveManifest(outDir: string, select?: string): ResolvedManifest;
+/** Read-modify-write a section of an existing manifest. No-op when absent. */
+export declare function updateCarveManifest(outDir: string, target: string, patch: Partial<Pick<CarveManifest, "boundary" | "emit" | "bridge" | "apply">>): string | undefined;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/terraform/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/terraform/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,EAAE,WAAW,CAAC;IACtB,gCAAgC;IAChC,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;QAC3B,yCAAyC;QACzC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CACb,MAAM,EACN;YACE,8EAA8E;YAC9E,MAAM,EAAE,MAAM,CAAC;YACf,mEAAmE;YACnE,QAAQ,EAAE,MAAM,CAAC;YACjB,kCAAkC;YAClC,KAAK,EAAE,MAAM,EAAE,CAAC;YAChB,2CAA2C;YAC3C,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;SACrC,CACF,CAAC;QACF,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,cAAc,EAAE,OAAO,CAAC;QACxB,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,yEAAyE;QACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iCAAiC;IACjC,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,eAAe,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,oEAAoE;QACpE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;CACH;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAKlF;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAUpE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAsBtF;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,GAC5E,MAAM,GAAG,SAAS,CAOpB"}

package/dist/terraform/parse.d.ts

@@ -8,8 +8,14 @@
  * advisor fails with a one-line install hint.
  */
 import type { Hcl2JsonTree, TfGraph } from "./types.js";
-/** Minimal shape of the parser export we depend on. */
-type Hcl2JsonParse = (filename: string, hcl: string) => Promise<Hcl2JsonTree>;
+/** Minimal shape of the parser exports we depend on. */
+export interface Hcl2Json {
+    parse: (filename: string, hcl: string) => Promise<Hcl2JsonTree>;
+    /** Expression-AST reference extraction (#998) — one traversal accessor per reference. */
+    getReferencesInExpression: (filename: string, expression: string) => Promise<Array<{
+        value: string;
+    }>>;
+}
 export declare class Hcl2JsonNotInstalled extends Error {
     constructor(cause: unknown);
 }
@@ -17,7 +23,7 @@ export declare class Hcl2JsonNotInstalled extends Error {
  * Lazy-load the optional HCL parser. Throws `Hcl2JsonNotInstalled` with an
  * install hint when the package is missing, rather than a raw MODULE_NOT_FOUND.
  */
-export declare function loadHcl2json(): Promise<Hcl2JsonParse>;
+export declare function loadHcl2json(): Promise<Hcl2Json>;
 export interface ParseTerraformOptions {
     /** Opt-in `.tfstate` path (#214 T2): overlays state-expanded instance counts. */
     statePath?: string;
@@ -29,5 +35,4 @@ export interface ParseTerraformOptions {
  * instance counts become accurate (see `state.ts`).
  */
 export declare function parseTerraformDir(dir: string, opts?: ParseTerraformOptions): Promise<TfGraph>;
-export {};
 //# sourceMappingURL=parse.d.ts.map

package/dist/terraform/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/terraform/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAErD,uDAAuD;AACvD,KAAK,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAE9E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,KAAK,EAAE,OAAO;CAQ3B;AAED;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,CAO3D;AAuBD,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,OAAO,CAAC,CAWvG"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/terraform/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAErD,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAChE,yFAAyF;IACzF,yBAAyB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CACxG;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,KAAK,EAAE,OAAO;CAQ3B;AAED;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,CAMtD;AA+CD,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,OAAO,CAAC,CAWvG"}

package/dist/terraform/types.d.ts

@@ -46,6 +46,13 @@ export interface TfEdge {
     to: string;
     /** The attribute path(s) referenced, e.g. `["id", "arn"]`. */
     attrs: string[];
+    /**
+     * The referring block's own top-level attribute(s) the reference sits in,
+     * e.g. `["vpc_id"]` for a subnet reading its VPC (#998). This is what a
+     * deferred outbound input is named after when emit turns it into a build
+     * parameter. Empty when the reference came from a non-object block shape.
+     */
+    via: string[];
 }
 export interface TfGraph {
     nodes: TfNode[];

package/dist/terraform/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/terraform/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,MAAM;IACrB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/terraform/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,MAAM;IACrB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB"}

package/dist/terraform/unified-diff.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Minimal unified-diff generator for the carve bridge patch (#998). Emits
+ * git-applyable hunks (`git apply`, or plain `patch -p1`) so the whole survivor
+ * edit — data sources plus rewired references — lands in one reviewable file.
+ * LCS-based; bridge inputs are hand-sized `.tf` files, so O(n·m) is fine.
+ */
+/** One file's diff, `a/<path>` → `b/<path>`, with git headers. Empty when unchanged. */
+export declare function unifiedDiff(path: string, oldText: string, newText: string, context?: number): string;
+/** A new-file diff (`/dev/null` → `b/<path>`), git-applyable. */
+export declare function newFileDiff(path: string, text: string): string;
+//# sourceMappingURL=unified-diff.d.ts.map

package/dist/terraform/unified-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unified-diff.d.ts","sourceRoot":"","sources":["../../src/terraform/unified-diff.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,wFAAwF;AACxF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,SAAI,GAAG,MAAM,CA0B/F;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAa9D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.41.19",
+  "version": "0.42.1",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/__snapshots__/okf.test.ts.snap

@@ -0,0 +1,381 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`buildOkfBundle over shipped examples > aws lambda-s3 emits a conformant, snapshot-stable bundle 1`] = `
+[
+  {
+    "content": "---
+type: AWS::S3::Bucket
+title: appBucket
+description: aws resource of type AWS::S3::Bucket
+name: appBucket
+lexicon: aws
+kind: resource
+source: main.ts
+composite: LambdaS3
+composite_instance: app
+---
+Declared in \`main.ts\`.
+
+## Referenced by
+
+- [appFunc](/aws/appFunc.md)
+- [appRole](/aws/appRole.md)
+",
+    "path": "aws/appBucket.md",
+  },
+  {
+    "content": "---
+type: AWS::Lambda::Function
+title: appFunc
+description: aws resource of type AWS::Lambda::Function
+name: appFunc
+lexicon: aws
+kind: resource
+source: main.ts
+composite: LambdaS3
+composite_instance: app
+---
+Declared in \`main.ts\`.
+
+## Depends on
+
+- [appBucket](/aws/appBucket.md)
+- [appRole](/aws/appRole.md)
+",
+    "path": "aws/appFunc.md",
+  },
+  {
+    "content": "---
+type: AWS::IAM::Role
+title: appRole
+description: aws resource of type AWS::IAM::Role
+name: appRole
+lexicon: aws
+kind: resource
+source: main.ts
+composite: LambdaS3
+composite_instance: app
+---
+Declared in \`main.ts\`.
+
+## Depends on
+
+- [appBucket](/aws/appBucket.md)
+
+## Referenced by
+
+- [appFunc](/aws/appFunc.md)
+",
+    "path": "aws/appRole.md",
+  },
+  {
+    "content": "---
+type: Output
+title: bucketArn
+description: aws output of type Output
+name: bucketArn
+lexicon: aws
+kind: output
+source: outputs.ts
+---
+Declared in \`outputs.ts\`.
+",
+    "path": "aws/bucketArn.md",
+  },
+  {
+    "content": "---
+type: AWS::CloudFormation::Parameter
+title: environment
+description: aws resource of type AWS::CloudFormation::Parameter
+name: environment
+lexicon: aws
+kind: resource
+source: params.ts
+---
+Declared in \`params.ts\`.
+",
+    "path": "aws/environment.md",
+  },
+  {
+    "content": "---
+type: chant:aws:defaultTags
+title: tags
+description: aws resource of type chant:aws:defaultTags
+name: tags
+lexicon: aws
+kind: resource
+source: tags.ts
+---
+Declared in \`tags.ts\`.
+",
+    "path": "aws/tags.md",
+  },
+  {
+    "content": "---
+okf_version: '0.2'
+---
+
+# Lexicon: aws
+
+* [appBucket](/aws/appBucket.md) - aws resource of type AWS::S3::Bucket
+* [appFunc](/aws/appFunc.md) - aws resource of type AWS::Lambda::Function
+* [appRole](/aws/appRole.md) - aws resource of type AWS::IAM::Role
+* [bucketArn](/aws/bucketArn.md) - aws output of type Output
+* [environment](/aws/environment.md) - aws resource of type AWS::CloudFormation::Parameter
+* [tags](/aws/tags.md) - aws resource of type chant:aws:defaultTags
+",
+    "path": "index.md",
+  },
+]
+`;
+
+exports[`buildOkfBundle over shipped examples > gitlab node-pipeline emits a conformant, snapshot-stable bundle 1`] = `
+[
+  {
+    "content": "---
+type: GitLab::CI::Job
+title: appBuild
+description: gitlab resource of type GitLab::CI::Job
+name: appBuild
+lexicon: gitlab
+kind: resource
+source: pipeline.ts
+composite: NodePipeline
+composite_instance: app
+---
+Declared in \`pipeline.ts\`.
+",
+    "path": "gitlab/appBuild.md",
+  },
+  {
+    "content": "---
+type: GitLab::CI::Default
+title: appDefaults
+description: gitlab resource of type GitLab::CI::Default
+name: appDefaults
+lexicon: gitlab
+kind: resource
+source: pipeline.ts
+composite: NodePipeline
+composite_instance: app
+---
+Declared in \`pipeline.ts\`.
+",
+    "path": "gitlab/appDefaults.md",
+  },
+  {
+    "content": "---
+type: GitLab::CI::Job
+title: appTest
+description: gitlab resource of type GitLab::CI::Job
+name: appTest
+lexicon: gitlab
+kind: resource
+source: pipeline.ts
+composite: NodePipeline
+composite_instance: app
+---
+Declared in \`pipeline.ts\`.
+",
+    "path": "gitlab/appTest.md",
+  },
+  {
+    "content": "---
+okf_version: '0.2'
+---
+
+# Lexicon: gitlab
+
+* [appBuild](/gitlab/appBuild.md) - gitlab resource of type GitLab::CI::Job
+* [appDefaults](/gitlab/appDefaults.md) - gitlab resource of type GitLab::CI::Default
+* [appTest](/gitlab/appTest.md) - gitlab resource of type GitLab::CI::Job
+",
+    "path": "index.md",
+  },
+]
+`;
+
+exports[`buildOkfBundle over shipped examples > k8s layered-config emits a conformant, snapshot-stable bundle 1`] = `
+[
+  {
+    "content": "---
+okf_version: '0.2'
+---
+
+# Lexicon: k8s
+
+* [devAppDeployment](/k8s/devAppDeployment.md) - k8s resource of type K8s::Apps::Deployment
+* [devAppService](/k8s/devAppService.md) - k8s resource of type K8s::Core::Service
+* [prodAppDeployment](/k8s/prodAppDeployment.md) - k8s resource of type K8s::Apps::Deployment
+* [prodAppIngress](/k8s/prodAppIngress.md) - k8s resource of type K8s::Networking::Ingress
+* [prodAppPdb](/k8s/prodAppPdb.md) - k8s resource of type K8s::Policy::PodDisruptionBudget
+* [prodAppService](/k8s/prodAppService.md) - k8s resource of type K8s::Core::Service
+* [stagingAppDeployment](/k8s/stagingAppDeployment.md) - k8s resource of type K8s::Apps::Deployment
+* [stagingAppIngress](/k8s/stagingAppIngress.md) - k8s resource of type K8s::Networking::Ingress
+* [stagingAppPdb](/k8s/stagingAppPdb.md) - k8s resource of type K8s::Policy::PodDisruptionBudget
+* [stagingAppService](/k8s/stagingAppService.md) - k8s resource of type K8s::Core::Service
+",
+    "path": "index.md",
+  },
+  {
+    "content": "---
+type: K8s::Apps::Deployment
+title: devAppDeployment
+description: k8s resource of type K8s::Apps::Deployment
+name: devAppDeployment
+lexicon: k8s
+kind: resource
+source: web.ts
+composite: WebApp
+composite_instance: devApp
+---
+Declared in \`web.ts\`.
+",
+    "path": "k8s/devAppDeployment.md",
+  },
+  {
+    "content": "---
+type: K8s::Core::Service
+title: devAppService
+description: k8s resource of type K8s::Core::Service
+name: devAppService
+lexicon: k8s
+kind: resource
+source: web.ts
+composite: WebApp
+composite_instance: devApp
+---
+Declared in \`web.ts\`.
+",
+    "path": "k8s/devAppService.md",
+  },
+  {
+    "content": "---
+type: K8s::Apps::Deployment
+title: prodAppDeployment
+description: k8s resource of type K8s::Apps::Deployment
+name: prodAppDeployment
+lexicon: k8s
+kind: resource
+source: web.ts
+composite: WebApp
+composite_instance: prodApp
+---
+Declared in \`web.ts\`.
+",
+    "path": "k8s/prodAppDeployment.md",
+  },
+  {
+    "content": "---
+type: K8s::Networking::Ingress
+title: prodAppIngress
+description: k8s resource of type K8s::Networking::Ingress
+name: prodAppIngress
+lexicon: k8s
+kind: resource
+source: web.ts
+composite: WebApp
+composite_instance: prodApp
+---
+Declared in \`web.ts\`.
+",
+    "path": "k8s/prodAppIngress.md",
+  },
+  {
+    "content": "---
+type: K8s::Policy::PodDisruptionBudget
+title: prodAppPdb
+description: k8s resource of type K8s::Policy::PodDisruptionBudget
+name: prodAppPdb
+lexicon: k8s
+kind: resource
+source: web.ts
+composite: WebApp
+composite_instance: prodApp
+---
+Declared in \`web.ts\`.
+",
+    "path": "k8s/prodAppPdb.md",
+  },
+  {
+    "content": "---
+type: K8s::Core::Service
+title: prodAppService
+description: k8s resource of type K8s::Core::Service
+name: prodAppService
+lexicon: k8s
+kind: resource
+source: web.ts
+composite: WebApp
+composite_instance: prodApp
+---
+Declared in \`web.ts\`.
+",
+    "path": "k8s/prodAppService.md",
+  },
+  {
+    "content": "---
+type: K8s::Apps::Deployment
+title: stagingAppDeployment
+description: k8s resource of type K8s::Apps::Deployment
+name: stagingAppDeployment
+lexicon: k8s
+kind: resource
+source: web.ts
+composite: WebApp
+composite_instance: stagingApp
+---
+Declared in \`web.ts\`.
+",
+    "path": "k8s/stagingAppDeployment.md",
+  },
+  {
+    "content": "---
+type: K8s::Networking::Ingress
+title: stagingAppIngress
+description: k8s resource of type K8s::Networking::Ingress
+name: stagingAppIngress
+lexicon: k8s
+kind: resource
+source: web.ts
+composite: WebApp
+composite_instance: stagingApp
+---
+Declared in \`web.ts\`.
+",
+    "path": "k8s/stagingAppIngress.md",
+  },
+  {
+    "content": "---
+type: K8s::Policy::PodDisruptionBudget
+title: stagingAppPdb
+description: k8s resource of type K8s::Policy::PodDisruptionBudget
+name: stagingAppPdb
+lexicon: k8s
+kind: resource
+source: web.ts
+composite: WebApp
+composite_instance: stagingApp
+---
+Declared in \`web.ts\`.
+",
+    "path": "k8s/stagingAppPdb.md",
+  },
+  {
+    "content": "---
+type: K8s::Core::Service
+title: stagingAppService
+description: k8s resource of type K8s::Core::Service
+name: stagingAppService
+lexicon: k8s
+kind: resource
+source: web.ts
+composite: WebApp
+composite_instance: stagingApp
+---
+Declared in \`web.ts\`.
+",
+    "path": "k8s/stagingAppService.md",
+  },
+]
+`;

package/src/cli/build-params-cli.test.ts

@@ -56,18 +56,62 @@ describe("resolveCliBuildParams", () => {
     }
   });
 
-  test("logs every resolved parameter as '[param] name = value (source)'", () => {
+  test("a build with no overrides collapses to a single defaults count", () => {
+    // The provenance still records every value; the echo just stops naming
+    // what nobody set. One line, so silence still never means "no parameters
+    // reached us".
     const defs: BuildParamsConfig = { tier: { type: "string", default: "light" } };
     const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
     try {
-      resolveCliBuildParams(defs, {});
+      const result = resolveCliBuildParams(defs, {});
       const logged = errorSpy.mock.calls.map((call) => String(call[0]));
-      expect(logged.some((line) => line.includes("[param] tier") && line.includes("light") && line.includes("default"))).toBe(true);
+      expect(logged.some((line) => line.includes("1 parameters at their defaults"))).toBe(true);
+      expect(logged.some((line) => line.includes("[param] tier"))).toBe(false);
+      expect(result.provenance).toEqual([{ name: "tier", value: "light", source: "default" }]);
     } finally {
       errorSpy.mockRestore();
     }
   });
 
+  test("names the overrides and collapses the defaults into a count", () => {
+    const defs: BuildParamsConfig = {
+      tier: { type: "string", default: "light" },
+      target: { type: "string", default: "k3d" },
+      host: { type: "string", default: "localhost:4000" },
+    };
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      resolveCliBuildParams(defs, { cli: { tier: "ha" } });
+      const logged = errorSpy.mock.calls.map((call) => String(call[0]));
+      expect(logged.some((line) => line.includes("[param] tier") && line.includes("ha") && line.includes("cli"))).toBe(true);
+      expect(logged.some((line) => line.includes("2 more at their defaults"))).toBe(true);
+      expect(logged.some((line) => line.includes("[param] target"))).toBe(false);
+    } finally {
+      errorSpy.mockRestore();
+    }
+  });
+
+  test("CHANT_PARAM_ECHO=all restores the full listing", () => {
+    const defs: BuildParamsConfig = {
+      tier: { type: "string", default: "light" },
+      target: { type: "string", default: "k3d" },
+    };
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    const prev = process.env.CHANT_PARAM_ECHO;
+    process.env.CHANT_PARAM_ECHO = "all";
+    try {
+      resolveCliBuildParams(defs, { cli: { tier: "ha" } });
+      const logged = errorSpy.mock.calls.map((call) => String(call[0]));
+      expect(logged.some((line) => line.includes("[param] tier") && line.includes("ha"))).toBe(true);
+      expect(logged.some((line) => line.includes("[param] target") && line.includes("k3d") && line.includes("default"))).toBe(true);
+      expect(logged.some((line) => line.includes("more at their defaults"))).toBe(false);
+    } finally {
+      if (prev === undefined) delete process.env.CHANT_PARAM_ECHO;
+      else process.env.CHANT_PARAM_ECHO = prev;
+      errorSpy.mockRestore();
+    }
+  });
+
   test("no declared params → success with empty provenance and no logging", () => {
     const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
     try {

package/src/cli/build-params-cli.ts

@@ -62,10 +62,13 @@ export interface CliBuildParamsResolution {
  * chant #1064's acceptance criterion that this never surfaces as a thrown
  * error from inside user source.
  *
- * On success, every resolved parameter is logged via `console.error` as
- * `[param] <name> = <value> (<source>)` — unconditional, not gated on
- * `--verbose`, so a build's environment-varying inputs are always visible,
- * the same way #1022's fold decisions are.
+ * On success, every explicitly-set parameter is logged via `console.error` as
+ * `[param] <name> = <value> (<source>)`, and the ones still at their declared
+ * defaults collapse to a single count line (`CHANT_PARAM_ECHO=all` lists them
+ * individually). Overrides stay unconditionally visible — not gated on
+ * `--verbose` — so a build's environment-varying inputs are always in the log,
+ * the same way #1022's fold decisions are; the defaults are the part that
+ * never varies, which is exactly why they can be a count.
  */
 export function resolveCliBuildParams(
   buildParamsConfig: BuildParamsConfig | undefined,
@@ -99,9 +102,23 @@ export function resolveCliBuildParams(
     return { success: false, provenance: [], errors };
   }
 
-  for (const p of resolution.provenance) {
+  // Echo what the operator SET, one line each; collapse what they did not.
+  // A project with two dozen declared parameters printed two dozen grey lines
+  // on every build, and the ones that matter — the overrides — drowned in the
+  // ones that never vary. Defaults still get named on request
+  // (CHANT_PARAM_ECHO=all), and a build with no overrides still says how many
+  // parameters resolved, so silence never means "no parameters reached us"
+  // (the failure mode warnIfParamsCannotReachProject exists for).
+  const explicit = resolution.provenance.filter((p) => p.source !== "default");
+  const defaulted = resolution.provenance.length - explicit.length;
+  const echoAll = process.env.CHANT_PARAM_ECHO === "all";
+  for (const p of echoAll ? resolution.provenance : explicit) {
     console.error(formatInfo(`[param] ${p.name} = ${JSON.stringify(p.value)} (${p.source})`));
   }
+  if (!echoAll && defaulted > 0) {
+    const more = explicit.length > 0 ? `${defaulted} more` : `${defaulted} parameters`;
+    console.error(formatInfo(`[param] ${more} at their defaults (CHANT_PARAM_ECHO=all lists them)`));
+  }
 
   return { success: true, provenance: resolution.provenance, errors: [] };
 }