@intentius/chant 0.41.19 → 0.42.1

package/src/codegen/okf-lexicon.test.ts

@@ -0,0 +1,248 @@
+import { describe, test, expect } from "vitest";
+import { buildLexiconOkfBundle, type LexiconOkfInput } from "./okf-lexicon";
+import { okfConformanceProblems, splitFrontmatter, OKF_VERSION, type OkfFile } from "../okf";
+import { parseYAML } from "../yaml";
+
+function fileMap(bundle: OkfFile[]): Map<string, string> {
+  return new Map(bundle.map((f) => [f.path, f.content]));
+}
+
+/** A docker-style registry: descriptions carried in the registry itself. */
+const registryStyleInput: LexiconOkfInput = {
+  name: "mockdocker",
+  registry: JSON.stringify({
+    Service: {
+      resourceType: "Mock::Compose::Service",
+      kind: "resource",
+      description: "A containerized service definition",
+      properties: {
+        image: { type: "string", description: "Container image to use" },
+        ports: { type: "string[]", description: "Published ports" },
+      },
+    },
+    Volume: {
+      resourceType: "Mock::Compose::Volume",
+      kind: "resource",
+      description: "A named volume",
+      properties: { driver: { type: "string", description: "Volume driver" } },
+    },
+    Service_Healthcheck: {
+      resourceType: "Mock::Compose::Service.Healthcheck",
+      kind: "property",
+    },
+  }),
+  typesDTS: "",
+  rules: [
+    {
+      meta: {
+        id: "MCK001",
+        severity: "warning",
+        category: "correctness",
+        description: "Avoid :latest image references on a Service",
+        type: "lint",
+      },
+      source: `// Checks each Service's image prop\nexport const rule = { id: "MCK001" };`,
+    },
+    {
+      meta: {
+        id: "MCK010",
+        severity: "error",
+        category: "post-synth",
+        description: "A declared Volume must be mounted somewhere",
+        type: "post-synth",
+      },
+      source: `export const check = { id: "MCK010", description: "..." }; // walks Volume mounts`,
+    },
+  ],
+};
+
+/** A CFN-style registry: no descriptions, JSDoc lives in the declarations. */
+const dtsStyleInput: LexiconOkfInput = {
+  name: "mockaws",
+  registry: JSON.stringify({
+    Bucket: {
+      resourceType: "Mock::S3::Bucket",
+      kind: "resource",
+      lexicon: "mockaws",
+      attrs: { Arn: "Arn", DomainName: "DomainName" },
+    },
+    // An alias entry for the same resource type must not mint a second concept.
+    S3Bucket: {
+      resourceType: "Mock::S3::Bucket",
+      kind: "resource",
+      lexicon: "mockaws",
+      attrs: { Arn: "Arn", DomainName: "DomainName" },
+    },
+    Bucket_VersioningConfiguration: {
+      resourceType: "Mock::S3::Bucket.VersioningConfiguration",
+      kind: "property",
+      lexicon: "mockaws",
+    },
+  }),
+  typesDTS: [
+    "export declare class Bucket {",
+    "  constructor(props: {",
+    "    /** A name for the bucket. */",
+    "    BucketName?: string;",
+    "    /** The versioning state. */",
+    "    VersioningConfiguration?: Bucket_VersioningConfiguration;",
+    "  }, attributes?: Record<string, unknown>);",
+    "  readonly Arn: string;",
+    "}",
+  ].join("\n"),
+  rules: [
+    {
+      meta: {
+        id: "MAW006",
+        severity: "warning",
+        category: "security",
+        description: "Detects Bucket creation without encryption",
+        type: "lint",
+      },
+      source: `if (expression.text === "Bucket") { /* Mock::S3::Bucket */ }`,
+    },
+  ],
+};
+
+describe("buildLexiconOkfBundle", () => {
+  test("emits a conformant bundle from a registry-described lexicon", () => {
+    const bundle = buildLexiconOkfBundle(registryStyleInput);
+    expect(okfConformanceProblems(bundle)).toEqual([]);
+    expect(bundle.map((f) => f.path)).toEqual([
+      "index.md",
+      "rules/MCK001.md",
+      "rules/MCK010.md",
+      "types/Service.md",
+      "types/Volume.md",
+    ]);
+  });
+
+  test("concept type is the category, the resource type rides in resource_type", () => {
+    const files = fileMap(buildLexiconOkfBundle(registryStyleInput));
+    const front = parseYAML(splitFrontmatter(files.get("types/Service.md")!)!.frontmatter);
+    expect(front.type).toBe("resource-type");
+    expect(front.resource_type).toBe("Mock::Compose::Service");
+    expect(front.title).toBe("Service");
+    expect(front.lexicon).toBe("mockdocker");
+    expect(front.description).toBe("A containerized service definition");
+  });
+
+  test("registry-carried property descriptions land in the concept body", () => {
+    const files = fileMap(buildLexiconOkfBundle(registryStyleInput));
+    const body = splitFrontmatter(files.get("types/Service.md")!)!.body;
+    expect(body).toContain("## Properties");
+    expect(body).toContain("- `image` (`string`): Container image to use");
+    expect(body).toContain("- `ports` (`string[]`): Published ports");
+  });
+
+  test("declaration JSDoc fills in property descriptions when the registry has none", () => {
+    const files = fileMap(buildLexiconOkfBundle(dtsStyleInput));
+    const body = splitFrontmatter(files.get("types/Bucket.md")!)!.body;
+    expect(body).toContain("- `BucketName` (`string`, optional): A name for the bucket.");
+    expect(body).toContain("- `VersioningConfiguration` (`Bucket_VersioningConfiguration`, optional): The versioning state.");
+    expect(body).toContain("## Attributes");
+    expect(body).toContain("- `Arn`");
+  });
+
+  test("rules and resource types cross-link in both directions", () => {
+    const files = fileMap(buildLexiconOkfBundle(registryStyleInput));
+    expect(splitFrontmatter(files.get("types/Service.md")!)!.body).toContain(
+      "- [MCK001](/rules/MCK001.md): Avoid :latest image references on a Service",
+    );
+    expect(splitFrontmatter(files.get("rules/MCK001.md")!)!.body).toContain("- [Service](/types/Service.md)");
+    // MCK010 mentions Volume, not Service.
+    expect(splitFrontmatter(files.get("rules/MCK010.md")!)!.body).toContain("- [Volume](/types/Volume.md)");
+    expect(splitFrontmatter(files.get("rules/MCK010.md")!)!.body).not.toContain("types/Service.md");
+    expect(splitFrontmatter(files.get("types/Volume.md")!)!.body).toContain("- [MCK010](/rules/MCK010.md)");
+  });
+
+  test("rule concepts carry id, severity, category, and a docs page", () => {
+    const files = fileMap(buildLexiconOkfBundle(registryStyleInput));
+    const lint = parseYAML(splitFrontmatter(files.get("rules/MCK001.md")!)!.frontmatter);
+    expect(lint.type).toBe("lint-rule");
+    expect(lint.id).toBe("MCK001");
+    expect(lint.severity).toBe("warning");
+    expect(lint.category).toBe("correctness");
+    expect(lint.docs).toBe("https://intentius.io/chant/lexicons/mockdocker/rules/");
+
+    const postSynth = parseYAML(splitFrontmatter(files.get("rules/MCK010.md")!)!.frontmatter);
+    expect(postSynth.type).toBe("post-synth-check");
+    expect(postSynth.severity).toBe("error");
+  });
+
+  test("alias registry entries collapse into one concept per resource type", () => {
+    const bundle = buildLexiconOkfBundle(dtsStyleInput);
+    const typePaths = bundle.map((f) => f.path).filter((p) => p.startsWith("types/"));
+    expect(typePaths).toEqual(["types/Bucket.md"]);
+    expect(okfConformanceProblems(bundle)).toEqual([]);
+  });
+
+  test("property-kind registry entries do not become concepts", () => {
+    const files = fileMap(buildLexiconOkfBundle(registryStyleInput));
+    expect([...files.keys()].some((p) => p.includes("Healthcheck"))).toBe(false);
+  });
+
+  test("index.md sections resource types and rules with okf_version its only frontmatter", () => {
+    const index = fileMap(buildLexiconOkfBundle(registryStyleInput)).get("index.md")!;
+    expect(index).toContain(`okf_version: '${OKF_VERSION}'`);
+    expect(index).toContain("# Resource types");
+    expect(index).toContain("* [Service](/types/Service.md) - Mock::Compose::Service");
+    expect(index).toContain("# Rules");
+    expect(index).toContain("* [MCK001](/rules/MCK001.md) - Avoid :latest image references on a Service");
+  });
+
+  test("an empty lexicon still emits a conformant bundle", () => {
+    const bundle = buildLexiconOkfBundle({ name: "bare", registry: "{}", typesDTS: "", rules: [] });
+    expect(bundle.map((f) => f.path)).toEqual(["index.md"]);
+    expect(okfConformanceProblems(bundle)).toEqual([]);
+  });
+
+  test("deterministic: the same input yields byte-identical files", () => {
+    expect(buildLexiconOkfBundle(registryStyleInput)).toEqual(buildLexiconOkfBundle(registryStyleInput));
+  });
+
+  test("multi-line spec descriptions collapse to a single frontmatter line", () => {
+    const input: LexiconOkfInput = {
+      name: "mock",
+      registry: JSON.stringify({
+        Thing: {
+          resourceType: "Mock::A::Thing",
+          kind: "resource",
+          description: "First line.\nSecond line with detail.",
+        },
+      }),
+      typesDTS: "",
+      rules: [],
+    };
+    const bundle = buildLexiconOkfBundle(input);
+    expect(okfConformanceProblems(bundle)).toEqual([]);
+    const front = parseYAML(splitFrontmatter(fileMap(bundle).get("types/Thing.md")!)!.frontmatter);
+    expect(front.description).toBe("First line. Second line with detail.");
+  });
+
+  test("registry-style and dts-style bundles snapshot stably", () => {
+    expect(buildLexiconOkfBundle(registryStyleInput)).toMatchSnapshot();
+    expect(buildLexiconOkfBundle(dtsStyleInput)).toMatchSnapshot();
+  });
+});
+
+describe("okfConformanceProblems", () => {
+  test("flags a concept without frontmatter and a bundle without an index", () => {
+    const problems = okfConformanceProblems([{ path: "types/Broken.md", content: "no frontmatter here" }]);
+    expect(problems).toContain("types/Broken.md: no frontmatter block");
+    expect(problems).toContain("bundle has no root index.md");
+  });
+
+  test("flags an empty type and a relative cross-link", () => {
+    const bundle: OkfFile[] = [
+      {
+        path: "types/Bad.md",
+        content: "---\ntype: ''\n---\n\n- [x](x.md)\n",
+      },
+      { path: "index.md", content: `---\nokf_version: '${OKF_VERSION}'\n---\n` },
+    ];
+    const problems = okfConformanceProblems(bundle);
+    expect(problems.some((p) => p.includes("no non-empty type"))).toBe(true);
+    expect(problems.some((p) => p.includes('link target "x.md"'))).toBe(true);
+  });
+});

package/src/codegen/okf-lexicon.ts

@@ -0,0 +1,303 @@
+/**
+ * Lexicon OKF knowledge bundle (#1060, epic #1057) — projects a packaged
+ * lexicon's resource-type registry and lint rules into an Open Knowledge
+ * Format v0.2 bundle, emitted alongside the other build artifacts
+ * (`dist/meta.json`, `dist/types/`) as `dist/okf/`.
+ *
+ * Vocabulary, resolved against the project bundle (#1058, ../okf.ts): there a
+ * concept's `type` IS the entity's resource type; here `type` is the concept
+ * *category* — `resource-type`, `lint-rule`, `post-synth-check` — and the
+ * resource type string rides in `resource_type`. A consumer tells the two
+ * bundle kinds apart by exactly that.
+ *
+ * Cross-links run both directions: a resource concept lists the rules that
+ * govern it under "Governed by", a rule concept lists the types it applies to
+ * under "Applies to". The association is derived from the rule's source text
+ * (rules match on identifiers, not declared type lists), so it is a textual
+ * over-approximation — acceptable for knowledge, wrong for enforcement.
+ */
+
+import * as ts from "typescript";
+import { frontmatter, slug, OKF_VERSION, type OkfFile } from "../okf";
+import type { ScannedRule } from "./docs-rule-scanning";
+
+export interface LexiconOkfInput {
+  /** Lexicon name as the manifest states it, e.g. "aws". */
+  name: string;
+  /** The registry JSON — the exact content of `dist/meta.json`. */
+  registry: string;
+  /** The generated declarations — the content of `dist/types/index.d.ts`. */
+  typesDTS: string;
+  /** Scanned rules with their sources, for metadata and type association. */
+  rules: ScannedRule[];
+}
+
+interface RegistryEntry {
+  resourceType?: unknown;
+  kind?: unknown;
+  description?: unknown;
+  properties?: Record<string, { type?: string; description?: string }>;
+  attrs?: Record<string, string>;
+}
+
+interface ConceptProperty {
+  name: string;
+  type?: string;
+  required?: boolean;
+  description?: string;
+}
+
+interface TypeConcept {
+  className: string;
+  resourceType: string;
+  description?: string;
+  properties: ConceptProperty[];
+  attributes: string[];
+  path: string;
+}
+
+/** Collapse whitespace so a description fits a frontmatter scalar or a list line. */
+function oneLine(text: string): string {
+  return text.replace(/\s+/g, " ").trim();
+}
+
+function truncate(text: string, max: number): string {
+  return text.length <= max ? text : `${text.slice(0, max - 3).trimEnd()}...`;
+}
+
+/**
+ * Per-class constructor property docs, parsed out of the generated
+ * declarations. This is where CloudFormation- and OpenAPI-derived lexicons
+ * carry their spec-sourced property descriptions (the registry carries them
+ * only for hand-authored lexicons like docker).
+ */
+function parseDtsProperties(typesDTS: string): Map<string, ConceptProperty[]> {
+  const out = new Map<string, ConceptProperty[]>();
+  if (!typesDTS.includes("constructor")) return out;
+  const sf = ts.createSourceFile("types.d.ts", typesDTS, ts.ScriptTarget.Latest, false, ts.ScriptKind.TS);
+  for (const stmt of sf.statements) {
+    if (!ts.isClassDeclaration(stmt) || !stmt.name) continue;
+    const ctor = stmt.members.find(ts.isConstructorDeclaration);
+    const param = ctor?.parameters[0];
+    if (!param?.type || !ts.isTypeLiteralNode(param.type)) continue;
+    const props: ConceptProperty[] = [];
+    for (const member of param.type.members) {
+      if (!ts.isPropertySignature(member) || !member.name) continue;
+      const name =
+        ts.isIdentifier(member.name) || ts.isStringLiteral(member.name)
+          ? member.name.text
+          : member.name.getText(sf);
+      const raw = (member as unknown as { jsDoc?: ts.JSDoc[] }).jsDoc?.[0]?.comment;
+      const doc = typeof raw === "string" ? raw : raw ? ts.getTextOfJSDocComment(raw) : undefined;
+      props.push({
+        name,
+        type: member.type?.getText(sf),
+        required: member.questionToken === undefined,
+        // Undo the `*\/` escaping generate-typescript applies inside JSDoc.
+        description: doc?.replace(/\*\\\//g, "*/"),
+      });
+    }
+    if (props.length > 0) out.set(stmt.name.text, props);
+  }
+  return out;
+}
+
+/**
+ * The resource types a rule's source mentions — by class name as a whole
+ * word, or by the resource type string anywhere.
+ */
+function ruleAppliesTo(source: string, concepts: TypeConcept[]): TypeConcept[] {
+  const words = new Set(source.match(/[A-Za-z0-9_$]+/g) ?? []);
+  return concepts.filter((c) => words.has(c.className) || source.includes(c.resourceType));
+}
+
+function propertyLine(prop: ConceptProperty): string {
+  const facts: string[] = [];
+  if (prop.type) facts.push(`\`${oneLine(prop.type)}\``);
+  if (prop.required === true) facts.push("required");
+  if (prop.required === false) facts.push("optional");
+  const head = facts.length > 0 ? `- \`${prop.name}\` (${facts.join(", ")})` : `- \`${prop.name}\``;
+  return prop.description ? `${head}: ${oneLine(prop.description)}` : head;
+}
+
+/**
+ * Build the OKF bundle for a packaged lexicon. Pure and deterministic: the
+ * same registry, declarations, and rules yield byte-identical files.
+ */
+export function buildLexiconOkfBundle(input: LexiconOkfInput): OkfFile[] {
+  let registry: Record<string, RegistryEntry>;
+  try {
+    registry = JSON.parse(input.registry) as Record<string, RegistryEntry>;
+  } catch {
+    registry = {};
+  }
+  const dtsProps = parseDtsProperties(input.typesDTS);
+
+  // One concept per resource type: alias entries share a resourceType, the
+  // first class name in sorted order names the concept.
+  const byType = new Map<string, { className: string; entry: RegistryEntry }>();
+  for (const className of Object.keys(registry).sort((a, b) => a.localeCompare(b))) {
+    const entry = registry[className];
+    if (entry?.kind !== "resource" || typeof entry.resourceType !== "string") continue;
+    if (!byType.has(entry.resourceType)) byType.set(entry.resourceType, { className, entry });
+  }
+
+  const concepts: TypeConcept[] = [];
+  const takenPaths = new Set<string>();
+  for (const { className, entry } of [...byType.values()].sort((a, b) => a.className.localeCompare(b.className))) {
+    const base = `types/${slug(className)}`;
+    let path = `${base}.md`;
+    for (let n = 2; takenPaths.has(path); n++) path = `${base}-${n}.md`;
+    takenPaths.add(path);
+
+    // Registry-carried property docs (hand-authored lexicons) win; the
+    // generated declarations fill in for spec-derived lexicons.
+    let properties: ConceptProperty[];
+    if (entry.properties && Object.keys(entry.properties).length > 0) {
+      properties = Object.entries(entry.properties).map(([name, p]) => ({
+        name,
+        type: p.type,
+        description: p.description,
+      }));
+    } else {
+      properties = dtsProps.get(className) ?? [];
+    }
+
+    concepts.push({
+      className,
+      resourceType: entry.resourceType as string,
+      description: typeof entry.description === "string" ? entry.description : undefined,
+      properties,
+      attributes: entry.attrs ? Object.values(entry.attrs).sort((a, b) => a.localeCompare(b)) : [],
+      path,
+    });
+  }
+
+  // One concept per rule id, first scan wins.
+  const rulesById = new Map<string, ScannedRule>();
+  for (const rule of input.rules) {
+    if (!rulesById.has(rule.meta.id)) rulesById.set(rule.meta.id, rule);
+  }
+  const rules = [...rulesById.values()].sort((a, b) => a.meta.id.localeCompare(b.meta.id));
+  const rulePath = (id: string): string => `rules/${slug(id)}.md`;
+
+  // Association, both directions.
+  const governedBy = new Map<string, ScannedRule[]>();
+  const appliesTo = new Map<string, TypeConcept[]>();
+  for (const rule of rules) {
+    const targets = ruleAppliesTo(rule.source, concepts);
+    appliesTo.set(rule.meta.id, targets);
+    for (const target of targets) {
+      if (!governedBy.has(target.resourceType)) governedBy.set(target.resourceType, []);
+      governedBy.get(target.resourceType)!.push(rule);
+    }
+  }
+
+  const docsUrl = `https://intentius.io/chant/lexicons/${input.name}/rules/`;
+  const files: OkfFile[] = [];
+
+  for (const concept of concepts) {
+    const head = frontmatter({
+      type: "resource-type",
+      title: concept.className,
+      description: truncate(
+        oneLine(concept.description ?? `${input.name} resource type ${concept.resourceType}`),
+        200,
+      ),
+      name: concept.className,
+      lexicon: input.name,
+      resource_type: concept.resourceType,
+    });
+
+    const body: string[] = [""];
+    body.push(
+      concept.description
+        ? oneLine(concept.description)
+        : `\`${concept.resourceType}\`, a resource type of the ${input.name} lexicon.`,
+    );
+
+    if (concept.properties.length > 0) {
+      body.push("", "## Properties", "");
+      for (const prop of concept.properties) body.push(propertyLine(prop));
+    }
+
+    if (concept.attributes.length > 0) {
+      body.push("", "## Attributes", "");
+      for (const attr of concept.attributes) body.push(`- \`${attr}\``);
+    }
+
+    const governing = governedBy.get(concept.resourceType) ?? [];
+    if (governing.length > 0) {
+      body.push("", "## Governed by", "");
+      for (const rule of governing) {
+        body.push(`- [${rule.meta.id}](/${rulePath(rule.meta.id)}): ${oneLine(rule.meta.description)}`);
+      }
+    }
+
+    body.push("");
+    files.push({ path: concept.path, content: head + body.join("\n") });
+  }
+
+  for (const rule of rules) {
+    const head = frontmatter({
+      type: rule.meta.type === "post-synth" ? "post-synth-check" : "lint-rule",
+      title: rule.meta.id,
+      description: truncate(oneLine(rule.meta.description), 200),
+      id: rule.meta.id,
+      severity: rule.meta.severity,
+      category: rule.meta.category,
+      lexicon: input.name,
+      docs: docsUrl,
+    });
+
+    const body: string[] = ["", oneLine(rule.meta.description)];
+    const targets = appliesTo.get(rule.meta.id) ?? [];
+    if (targets.length > 0) {
+      body.push("", "## Applies to", "");
+      for (const target of targets) {
+        body.push(`- [${target.className}](/${target.path})`);
+      }
+    }
+    body.push("");
+    files.push({ path: rulePath(rule.meta.id), content: head + body.join("\n") });
+  }
+
+  files.push({ path: "index.md", content: buildIndex(input.name, concepts, rules, rulePath) });
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  return files;
+}
+
+/**
+ * The bundle-root `index.md`: resource types and rules as sections of linked
+ * entries, `okf_version` its only frontmatter (spec §12).
+ */
+function buildIndex(
+  name: string,
+  concepts: TypeConcept[],
+  rules: ScannedRule[],
+  rulePath: (id: string) => string,
+): string {
+  const lines: string[] = ["---", `okf_version: '${OKF_VERSION}'`, "---", ""];
+
+  if (concepts.length > 0) {
+    lines.push("# Resource types", "");
+    for (const concept of concepts) {
+      lines.push(`* [${concept.className}](/${concept.path}) - ${concept.resourceType}`);
+    }
+    lines.push("");
+  }
+
+  if (rules.length > 0) {
+    lines.push("# Rules", "");
+    for (const rule of rules) {
+      lines.push(`* [${rule.meta.id}](/${rulePath(rule.meta.id)}) - ${truncate(oneLine(rule.meta.description), 160)}`);
+    }
+    lines.push("");
+  }
+
+  if (concepts.length === 0 && rules.length === 0) {
+    lines.push(`The ${name} lexicon declares no resource types or rules.`, "");
+  }
+
+  return lines.join("\n");
+}

package/src/codegen/package.ts

@@ -5,11 +5,13 @@
  * assemble BundleSpec → compute integrity → attach metadata.
  */
 
-import { readFileSync, readdirSync, writeFileSync, mkdirSync } from "fs";
-import { join } from "path";
+import { readFileSync, readdirSync, writeFileSync, mkdirSync, rmSync } from "fs";
+import { dirname, join } from "path";
 import type { BundleSpec, LexiconManifest } from "../lexicon";
 import { computeIntegrity } from "../lexicon-integrity";
 import type { GenerateResult } from "./generate";
+import { scanRulesWithSources } from "./docs-rule-scanning";
+import { buildLexiconOkfBundle } from "./okf-lexicon";
 
 // ── Types ──────────────────────────────────────────────────────────
 
@@ -73,13 +75,24 @@ export async function packagePipeline(
   log("Collecting skills...");
   const skills = config.collectSkills();
 
-  // Step 5: Assemble BundleSpec
+  // Step 5: Assemble BundleSpec, with the OKF knowledge bundle over the same
+  // artifacts (#1060) — derived here so it cannot drift from the registry and
+  // rules it describes.
+  log("Building OKF knowledge bundle...");
+  const okf = buildLexiconOkfBundle({
+    name: manifest.name,
+    registry: result.lexiconJSON,
+    typesDTS: result.typesDTS,
+    rules: scanRulesWithSources(config.srcDir),
+  });
+
   const spec: BundleSpec = {
     manifest,
     registry: result.lexiconJSON,
     typesDTS: result.typesDTS,
     rules,
     skills,
+    okf,
   };
 
   // Step 6: Compute integrity
@@ -151,7 +164,8 @@ export function collectRules(
  * Write a BundleSpec to the given dist directory.
  *
  * Creates the directory structure and writes all artifacts:
- * manifest.json, meta.json, types/index.d.ts, rules/*, skills/*, integrity.json.
+ * manifest.json, meta.json, types/index.d.ts, rules/*, skills/*, okf/*,
+ * integrity.json.
  */
 export function writeBundleSpec(spec: BundleSpec, distDir: string): void {
   mkdirSync(join(distDir, "types"), { recursive: true });
@@ -169,6 +183,17 @@ export function writeBundleSpec(spec: BundleSpec, distDir: string): void {
     writeFileSync(join(distDir, "skills", name), content);
   }
 
+  if (spec.okf) {
+    // Replace rather than merge — a concept whose resource type was removed
+    // upstream must not survive as a stale file.
+    rmSync(join(distDir, "okf"), { recursive: true, force: true });
+    for (const file of spec.okf) {
+      const target = join(distDir, "okf", file.path);
+      mkdirSync(dirname(target), { recursive: true });
+      writeFileSync(target, file.content);
+    }
+  }
+
   if (spec.integrity) {
     writeFileSync(join(distDir, "integrity.json"), JSON.stringify(spec.integrity, null, 2));
   }

package/src/codegen/publish-order.test.ts

@@ -48,7 +48,7 @@ describe("publish order", () => {
     // same stranding by a different route.
     const all = execFileSync(
       "bash",
-      ["-c", 'for d in packages/*/ lexicons/*/; do [ -f "$d/package.json" ] && echo "${d%/}"; done'],
+      ["-c", 'for d in packages/*/ lexicons/*/ wardens/*/; do [ -f "$d/package.json" ] && echo "${d%/}"; done'],
       { cwd: REPO, encoding: "utf8" },
     )
       .split("\n")

package/src/codegen/release-wiring.test.ts

@@ -117,10 +117,14 @@ function recipeBody(name: string): string {
  * which is why this asserts the mechanism, not a shared literal.
  */
 describe("release wiring: peer ranges stay in lockstep (#1255)", () => {
-  it("the whole-repo release rewrites both @intentius peer ranges", () => {
+  it("the whole-repo release rewrites every @intentius peer range", () => {
+    // Since #788 the rewrite is generic (`with_entries` over every
+    // `@intentius/*` peer) rather than two named keys: the wardens added
+    // `@intentius/warden-core` as a third in-repo peer, and a hand-listed
+    // rewrite goes stale the same way the hand-listed publish steps did.
     const body = recipeBody("release");
-    expect(body).toMatch(/peerDependencies\["@intentius\/chant"\]/);
-    expect(body).toMatch(/peerDependencies\["@intentius\/chant-lexicon-github"\]/);
+    expect(body).toMatch(/\.peerDependencies\s*\|=\s*with_entries/);
+    expect(body).toMatch(/startswith\("@intentius\/"\)/);
   });
 
   it("the single-lexicon release rewrites them too", () => {

package/src/components/config-defaults.test.ts

@@ -200,6 +200,36 @@ describe("applyConfigDefaults", () => {
     expect(step.policy?.warnSeverity).toBe("medium");
   });
 
+  test("vuln-gate: exploitability fields (#1466) reach a step with no per-step policy written", () => {
+    const config: ChantConfig = { vulnPolicy: { failOnKev: true, failEpssAtOrAbove: 0.1, warnEpssAtOrAbove: 0.01, exploitabilityFixableOnly: false } };
+    const comp = component([
+      { phase: "Gate", steps: [{ kind: "vuln-gate", sbom: { bytes: "", mediaType: "", packageCount: 0, generator: "x", format: "spdx" } }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { policy?: { failOnKev?: boolean; failEpssAtOrAbove?: number; warnEpssAtOrAbove?: number; exploitabilityFixableOnly?: boolean } };
+    expect(step.policy).toEqual({ failOnKev: true, failEpssAtOrAbove: 0.1, warnEpssAtOrAbove: 0.01, exploitabilityFixableOnly: false });
+  });
+
+  test("vuln-gate: a per-step failOnKev: false beats a config-level true, field-by-field", () => {
+    const config: ChantConfig = { vulnPolicy: { failOnKev: true, failEpssAtOrAbove: 0.1 } };
+    const comp = component([
+      {
+        phase: "Gate",
+        steps: [{
+          kind: "vuln-gate",
+          sbom: { bytes: "", mediaType: "", packageCount: 0, generator: "x", format: "spdx" },
+          policy: { failOnKev: false },
+        }],
+      },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { policy?: { failOnKev?: boolean; failEpssAtOrAbove?: number } };
+    expect(step.policy?.failOnKev).toBe(false);
+    expect(step.policy?.failEpssAtOrAbove).toBe(0.1);
+  });
+
   test("recurses into nested fan-out phases and onFailure compensation phases", () => {
     const config: ChantConfig = { sbom: { format: "cyclonedx" } };
     const comp = component([