@intentius/chant 0.45.0 → 0.49.0

package/src/secret-materialization.ts

@@ -0,0 +1,235 @@
+/**
+ * Generated-once secret materialization — the one implementation behind the
+ * `ensure-secret` capability verb (components/verbs/ensure-secret.ts) and the
+ * `ensureSecret(...)` op step builder (op/builders.ts). chant #1829, epic
+ * #1365 decisions 3 and 6.
+ *
+ * The contract is read-then-write:
+ *
+ * - Absent: mint once, through the store adapter, and report `created`.
+ * - Present: verify presence, the declared key-set, and any declared
+ *   metadata, then STOP — present means done. Never mint over an existing
+ *   value. Never rotate implicitly. A re-run of a whole deploy leaves the
+ *   stored bytes untouched.
+ * - Mismatch: fail loudly, naming what mismatched — key names and metadata
+ *   keys, never a value or a value-derived hash (#1365 decision 6).
+ *
+ * The constitutional line (../secret-provenance.ts): no code path here may
+ * hold, log, hash, or compare a secret value. That is structural, not
+ * discipline:
+ *
+ * - {@link ensureSecretMaterialization} never calls the generator. It hands
+ *   the generator to the store adapter's `create`, which consumes the
+ *   material as it writes. The engine's result type has no field that could
+ *   carry material.
+ * - The generator produces {@link SecretMaterial}, an opaque single-use
+ *   handle. The plaintext lives in a module-private WeakMap, not on the
+ *   object: enumeration, `JSON.stringify`, `String(...)`, and `util.inspect`
+ *   all see only a redaction marker. Only {@link consumeSecretMaterial} —
+ *   meant for store adapters, at the write — yields the plaintext, exactly
+ *   once; a second consume throws.
+ * - `describe` returns key names and metadata only, so the mismatch check
+ *   has nothing value-shaped to compare even by accident.
+ *
+ * Store adapters are per-provider (#1830 is the k8s row); core defines only
+ * the seam.
+ */
+
+import { randomBytes } from "node:crypto";
+
+// ── Opaque secret material ────────────────────────────────────────────────────
+
+/** Module-private plaintext vault. Keyed by handle identity; consuming deletes. */
+const vault = new WeakMap<SecretMaterial, string>();
+
+const REDACTED = "[secret material]";
+
+/**
+ * A single-use, opaque handle to generated secret material. The plaintext is
+ * not a property of this object — it lives in a module-private WeakMap — so
+ * spreading, enumerating, stringifying, or logging the handle yields only a
+ * redaction marker. A store adapter redeems it with
+ * {@link consumeSecretMaterial} at the moment it writes; nothing else can.
+ */
+export class SecretMaterial {
+  private constructor() {}
+
+  /** Wrap plaintext in an opaque handle. Call inside a generator only. */
+  static mint(plaintext: string): SecretMaterial {
+    const handle = new SecretMaterial();
+    vault.set(handle, plaintext);
+    return handle;
+  }
+
+  toString(): string {
+    return REDACTED;
+  }
+
+  toJSON(): string {
+    return REDACTED;
+  }
+
+  /** node:util.inspect (console.log) sees the redaction marker, not the vault. */
+  [Symbol.for("nodejs.util.inspect.custom")](): string {
+    return REDACTED;
+  }
+}
+
+/**
+ * Redeem a {@link SecretMaterial} handle for its plaintext — exactly once.
+ * For store adapters only, at the write to the backing store. Throws if the
+ * handle was already consumed (or was never minted here): material flows to
+ * the store exactly once and is retained nowhere.
+ */
+export function consumeSecretMaterial(material: SecretMaterial): string {
+  const plaintext = vault.get(material);
+  if (plaintext === undefined) {
+    throw new Error(
+      "secret material already consumed — material flows to the store adapter exactly once and is never retained",
+    );
+  }
+  vault.delete(material);
+  return plaintext;
+}
+
+/**
+ * Produces the material for one key of a secret being minted. Called by the
+ * store adapter (never by the engine) once per declared key, at create time —
+ * generation is apply-time I/O, never synthesis.
+ */
+export type SecretMaterialGenerator = (key: string) => SecretMaterial | Promise<SecretMaterial>;
+
+/** 32 bytes from the CSPRNG, base64url — the default mint. */
+export const defaultSecretMaterialGenerator: SecretMaterialGenerator = () =>
+  SecretMaterial.mint(randomBytes(32).toString("base64url"));
+
+// ── The store adapter seam ────────────────────────────────────────────────────
+
+/** What `describe` reports about an existing secret: key NAMES and metadata. Never values. */
+export interface SecretStoreDescription {
+  /** The key names present in the stored secret. */
+  readonly keys: readonly string[];
+  /** Store metadata (e.g. k8s labels/annotations the provider surfaces). */
+  readonly metadata?: Readonly<Record<string, string>>;
+}
+
+/**
+ * A provider's view of one secret store — the seam #1830 (k8s) and future
+ * provider rows implement. `create` receives the generator and consumes each
+ * key's material as it writes; no method returns material.
+ */
+export interface SecretStoreAdapter {
+  /** Whether a secret of this name exists in the store. */
+  exists(name: string): Promise<boolean>;
+  /** Key names and metadata of an existing secret. Never values. */
+  describe(name: string): Promise<SecretStoreDescription>;
+  /**
+   * Create the secret, minting material for each declared key via
+   * `generate` and writing it straight to the store. Returns nothing:
+   * material must not travel back through this seam.
+   */
+  create(name: string, keys: readonly string[], generate: SecretMaterialGenerator): Promise<void>;
+}
+
+// ── The ensure contract ───────────────────────────────────────────────────────
+
+/** The declared contract to ensure — names and keys only, never material. */
+export interface EnsureSecretSpec {
+  /** The secret's name as the store knows it. */
+  readonly name: string;
+  /** The declared key-set. Creation mints one value per key; verification compares names. */
+  readonly keys: readonly string[];
+  /** Declared metadata an existing secret must carry (compared per key; mismatches are reported by KEY). */
+  readonly metadata?: Readonly<Record<string, string>>;
+}
+
+/** What `ensureSecretMaterialization` did. No field can carry material. */
+export interface EnsureSecretOutcome {
+  /** `created` = minted now (first materialization); `present` = existed and matched the contract (no write). */
+  readonly outcome: "created" | "present";
+  /** The secret's name. */
+  readonly name: string;
+  /** The declared key names the contract was checked (or minted) against. */
+  readonly keys: readonly string[];
+}
+
+/**
+ * The loud failure: an existing secret does not match its declared contract.
+ * `mismatches` names what differed — key names and metadata keys only.
+ * Constructing one with anything value-shaped is the reviewer's tripwire;
+ * nothing in this module can, because nothing in this module holds a value.
+ */
+export class SecretContractMismatchError extends Error {
+  constructor(
+    /** The secret's name. */
+    public readonly secretName: string,
+    /** Human-readable mismatch descriptions, naming keys — never values. */
+    public readonly mismatches: readonly string[],
+  ) {
+    super(
+      `secret "${secretName}" exists but does not match its declared contract: ${mismatches.join("; ")}. ` +
+        `chant never mints over or rotates an existing secret — reconcile the declaration or the stored secret explicitly.`,
+    );
+    this.name = "SecretContractMismatchError";
+  }
+}
+
+/**
+ * Ensure a `generated-once` secret exists and matches its declared contract.
+ * Read-then-write:
+ *
+ * - Absent: `store.create(name, keys, generate)` — one mint, then done.
+ * - Present and matching: no write of any kind; returns `present`.
+ * - Present and mismatching: throws {@link SecretContractMismatchError}
+ *   naming the missing/unexpected key names and mismatched metadata keys.
+ *
+ * The engine never calls `generate` itself and never sees what the adapter
+ * writes; its return value carries names only.
+ */
+export async function ensureSecretMaterialization(
+  store: SecretStoreAdapter,
+  spec: EnsureSecretSpec,
+  generate: SecretMaterialGenerator = defaultSecretMaterialGenerator,
+): Promise<EnsureSecretOutcome> {
+  if (typeof spec.name !== "string" || spec.name.length === 0) {
+    throw new Error("ensureSecret: `name` must be a non-empty string");
+  }
+  if (!Array.isArray(spec.keys) || spec.keys.length === 0) {
+    throw new Error(`ensureSecret("${spec.name}"): \`keys\` must name at least one key to materialize`);
+  }
+
+  if (await store.exists(spec.name)) {
+    const actual = await store.describe(spec.name);
+    const mismatches: string[] = [];
+
+    const actualKeys = new Set(actual.keys);
+    const declaredKeys = new Set(spec.keys);
+    const missing = spec.keys.filter((k) => !actualKeys.has(k));
+    const unexpected = actual.keys.filter((k) => !declaredKeys.has(k));
+    if (missing.length > 0) {
+      mismatches.push(`missing declared key(s): ${missing.join(", ")}`);
+    }
+    if (unexpected.length > 0) {
+      mismatches.push(`undeclared key(s) present: ${unexpected.join(", ")}`);
+    }
+
+    for (const [key, value] of Object.entries(spec.metadata ?? {})) {
+      const actualValue = actual.metadata?.[key];
+      if (actualValue === undefined) {
+        mismatches.push(`missing declared metadata key: ${key}`);
+      } else if (actualValue !== value) {
+        // Name the KEY only — metadata values stay out of the error by rule,
+        // the same line the whole module holds for secret values.
+        mismatches.push(`metadata key differs: ${key}`);
+      }
+    }
+
+    if (mismatches.length > 0) {
+      throw new SecretContractMismatchError(spec.name, mismatches);
+    }
+    return { outcome: "present", name: spec.name, keys: spec.keys };
+  }
+
+  await store.create(spec.name, spec.keys, generate);
+  return { outcome: "created", name: spec.name, keys: spec.keys };
+}

package/src/secret-provenance.test.ts

@@ -0,0 +1,388 @@
+import { describe, test, expect } from "vitest";
+import { mkdir, writeFile, rm } from "node:fs/promises";
+import { join, dirname, resolve as resolvePath } from "node:path";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import {
+  declareSecret,
+  isSecretDeclaration,
+  isCommittedEncryptedSecret,
+  collectSecretDeclarations,
+  SECRET_DECLARATION_MARKER,
+  SECRET_DECLARATION_ENTITY_TYPE,
+  SECRET_PROVENANCE_KINDS,
+  type SecretDeclaration,
+} from "./secret-provenance";
+import { isDeclarable, type Declarable } from "./declarable";
+import { build, partitionByLexicon } from "./build";
+import type { Serializer } from "./serializer";
+
+describe("declareSecret — referenced", () => {
+  test("carries name, kind, and optional scope — nothing else", () => {
+    const decl = declareSecret({ name: "db-password", provenance: "referenced", scope: "ns:fountain" });
+    expect(decl.name).toBe("db-password");
+    expect(decl.provenance).toBe("referenced");
+    expect(decl.scope).toBe("ns:fountain");
+    expect(decl.lexicon).toBe("chant");
+    expect(decl.entityType).toBe(SECRET_DECLARATION_ENTITY_TYPE);
+    expect(Object.keys(decl).sort()).toEqual(["entityType", "lexicon", "name", "provenance", "scope"]);
+  });
+
+  test("scope is optional", () => {
+    const decl = declareSecret({ name: "api-token", provenance: "referenced" });
+    expect("scope" in decl).toBe(false);
+  });
+});
+
+describe("declareSecret — from-provider", () => {
+  test("points at the provider binding, never re-models it", () => {
+    const decl = declareSecret({
+      name: "fountain-secrets",
+      provenance: "from-provider",
+      provider: { binding: "fountainInfisical", entityType: "K8s::Infisical::InfisicalSecret" },
+    });
+    expect(decl.provenance).toBe("from-provider");
+    expect(decl.provider.binding).toBe("fountainInfisical");
+    expect(decl.provider.entityType).toBe("K8s::Infisical::InfisicalSecret");
+    expect(Object.isFrozen(decl.provider)).toBe(true);
+  });
+
+  test("requires a non-empty provider.binding", () => {
+    expect(() =>
+      declareSecret({ name: "x", provenance: "from-provider", provider: { binding: "" } }),
+    ).toThrow(/provider\.binding/);
+  });
+});
+
+describe("declareSecret — generated-once", () => {
+  test("carries contract flags only — the declared key-set", () => {
+    const decl = declareSecret({
+      name: "master-secrets-key",
+      provenance: "generated-once",
+      keys: ["MASTER_SECRETS_KEY"],
+    });
+    expect(decl.provenance).toBe("generated-once");
+    expect(decl.keys).toEqual(["MASTER_SECRETS_KEY"]);
+    expect(Object.isFrozen(decl.keys)).toBe(true);
+  });
+
+  test("keys is optional", () => {
+    const decl = declareSecret({ name: "seed", provenance: "generated-once" });
+    expect("keys" in decl).toBe(false);
+  });
+});
+
+describe("declareSecret — committed-encrypted", () => {
+  test("records a path and nothing else — the bytes stay on disk", () => {
+    const decl = declareSecret({
+      name: "db-credentials",
+      provenance: "committed-encrypted",
+      file: "secrets/db-credentials.sops.yaml",
+      encryption: "sops",
+      recipients: ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"],
+      keys: ["POSTGRES_USER", "POSTGRES_PASSWORD"],
+    });
+    expect(decl.provenance).toBe("committed-encrypted");
+    expect(decl.file).toBe("secrets/db-credentials.sops.yaml");
+    expect(decl.encryption).toBe("sops");
+    expect(decl.keys).toEqual(["POSTGRES_USER", "POSTGRES_PASSWORD"]);
+    expect(Object.isFrozen(decl.keys)).toBe(true);
+    expect(Object.isFrozen(decl.recipients)).toBe(true);
+    expect(Object.keys(decl).sort()).toEqual([
+      "encryption",
+      "entityType",
+      "file",
+      "keys",
+      "lexicon",
+      "name",
+      "provenance",
+      "recipients",
+    ]);
+    expect(isCommittedEncryptedSecret(decl)).toBe(true);
+  });
+
+  test("encryption defaults to sops; recipients and keys are optional", () => {
+    const decl = declareSecret({
+      name: "db-credentials",
+      provenance: "committed-encrypted",
+      file: "secrets/db.sops.yaml",
+    });
+    expect(decl.encryption).toBe("sops");
+    expect("recipients" in decl).toBe(false);
+    expect("keys" in decl).toBe(false);
+  });
+
+  test("the factory is pure — it never touches the filesystem", () => {
+    // A path that does not exist anywhere declares fine: existence is checked
+    // at buildRoots(), not here, which is what keeps the factory foldable.
+    const decl = declareSecret({
+      name: "nope",
+      provenance: "committed-encrypted",
+      file: "no/such/dir/nothing-here.sops.yaml",
+    });
+    expect(decl.file).toBe("no/such/dir/nothing-here.sops.yaml");
+    expect(isSecretDeclaration(decl)).toBe(true);
+  });
+
+  test("the same input twice yields equal declarations (foldable)", () => {
+    const input = {
+      name: "db-credentials",
+      provenance: "committed-encrypted",
+      file: "secrets/db.sops.yaml",
+      keys: ["A"],
+    } as const;
+    const a = declareSecret({ ...input });
+    const b = declareSecret({ ...input });
+    expect({ ...a }).toEqual({ ...b });
+  });
+
+  test("rejects a missing, absolute, or escaping path", () => {
+    expect(() =>
+      // @ts-expect-error — `file` is required
+      declareSecret({ name: "x", provenance: "committed-encrypted" }),
+    ).toThrow(/`file`/);
+    expect(() =>
+      declareSecret({ name: "x", provenance: "committed-encrypted", file: "" }),
+    ).toThrow(/`file`/);
+    expect(() =>
+      declareSecret({ name: "x", provenance: "committed-encrypted", file: "/etc/shadow.yaml" }),
+    ).toThrow(/repo-relative/);
+    expect(() =>
+      declareSecret({ name: "x", provenance: "committed-encrypted", file: "../../secrets/x.yaml" }),
+    ).toThrow(/\.\./);
+  });
+
+  test("v1 restricts the path to .yaml/.yml", () => {
+    expect(() =>
+      declareSecret({ name: "x", provenance: "committed-encrypted", file: "secrets/x.sops.json" }),
+    ).toThrow(/YAML/);
+    expect(
+      declareSecret({ name: "x", provenance: "committed-encrypted", file: "secrets/x.sops.YML" })
+        .file,
+    ).toBe("secrets/x.sops.YML");
+  });
+
+  test("rejects an unknown encryption tool", () => {
+    expect(() =>
+      declareSecret({
+        name: "x",
+        provenance: "committed-encrypted",
+        file: "secrets/x.yaml",
+        // @ts-expect-error — the encryption union is closed
+        encryption: "gpg",
+      }),
+    ).toThrow(/unknown encryption/);
+  });
+
+  test("refuses a private key pasted into recipients, without echoing it", () => {
+    const identity =
+      "AGE-SECRET-KEY-1QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ";
+    let thrown: Error | undefined;
+    try {
+      declareSecret({
+        name: "x",
+        provenance: "committed-encrypted",
+        file: "secrets/x.yaml",
+        recipients: [identity],
+      });
+    } catch (e) {
+      thrown = e as Error;
+    }
+    expect(thrown).toBeDefined();
+    expect(thrown!.message).toContain("recipients[0]");
+    expect(thrown!.message).not.toContain(identity);
+
+    expect(() =>
+      declareSecret({
+        name: "x",
+        provenance: "committed-encrypted",
+        file: "secrets/x.yaml",
+        recipients: ["-----BEGIN OPENSSH PRIVATE KEY-----"],
+      }),
+    ).toThrow(/PRIVATE key/);
+  });
+
+  test("`ciphertext` is still forbidden — the declaration points at bytes, never carries them", () => {
+    const input = {
+      name: "x",
+      provenance: "committed-encrypted",
+      file: "secrets/x.yaml",
+      ciphertext: "ENC[AES256_GCM,data:xxxx]",
+    };
+    let thrown: Error | undefined;
+    try {
+      // @ts-expect-error — `ciphertext` must not compile
+      declareSecret(input);
+    } catch (e) {
+      thrown = e as Error;
+    }
+    expect(thrown).toBeDefined();
+    expect(thrown!.message).toContain('"ciphertext"');
+    expect(thrown!.message).not.toContain("AES256_GCM");
+  });
+});
+
+describe("declareSecret — value unrepresentable", () => {
+  test("no declaration kind has a field that could hold material", () => {
+    const decls: SecretDeclaration[] = [
+      declareSecret({ name: "a", provenance: "referenced" }),
+      declareSecret({ name: "b", provenance: "from-provider", provider: { binding: "p" } }),
+      declareSecret({ name: "c", provenance: "generated-once", keys: ["k"] }),
+      declareSecret({ name: "d", provenance: "committed-encrypted", file: "s/d.sops.yaml" }),
+    ];
+    for (const decl of decls) {
+      for (const field of ["value", "data", "stringData", "material", "plaintext", "ciphertext"]) {
+        expect(field in decl).toBe(false);
+      }
+      // Declared fields are immutable (the object stays extensible so
+      // discovery can stamp its symbol-keyed metadata).
+      expect(() => {
+        (decl as { name: string }).name = "mutated";
+      }).toThrow();
+    }
+  });
+
+  test("a material-shaped field is rejected at runtime, naming only the key", () => {
+    const input = { name: "leaky", provenance: "referenced", value: "hunter2" };
+    let thrown: Error | undefined;
+    try {
+      // @ts-expect-error — a value field must not compile
+      declareSecret(input);
+    } catch (e) {
+      thrown = e as Error;
+    }
+    expect(thrown).toBeDefined();
+    expect(thrown!.message).toContain('"value"');
+    // The constitutional line: the error must not echo the material.
+    expect(thrown!.message).not.toContain("hunter2");
+  });
+
+  test("type-level: material fields do not compile on any kind", () => {
+    // @ts-expect-error — `value` is unrepresentable
+    const a = () => declareSecret({ name: "a", provenance: "referenced", value: "s" });
+    // @ts-expect-error — `data` is unrepresentable
+    const b = () => declareSecret({ name: "b", provenance: "generated-once", data: { k: "v" } });
+    const c = () =>
+      // @ts-expect-error — `stringData` is unrepresentable
+      declareSecret({ name: "c", provenance: "from-provider", provider: { binding: "p" }, stringData: {} });
+    // Widened objects (past excess-property checks) are still rejected by the `never` fields.
+    const widened = { name: "d", provenance: "referenced", value: "s" } as const;
+    // @ts-expect-error — `value` stays unrepresentable through a widened object
+    const d = () => declareSecret(widened);
+    expect([a, b, c, d].every((f) => typeof f === "function")).toBe(true);
+  });
+
+  test("rejects an empty name and an unknown kind", () => {
+    expect(() => declareSecret({ name: "", provenance: "referenced" })).toThrow(/name/);
+    // @ts-expect-error — the union is closed
+    expect(() => declareSecret({ name: "x", provenance: "sealed-secret" })).toThrow(/unknown provenance/);
+  });
+});
+
+describe("secret declarations and the entity map", () => {
+  test("a declaration is a Declarable and a SecretDeclaration; the kind set is closed", () => {
+    const decl = declareSecret({ name: "a", provenance: "referenced" });
+    expect(isDeclarable(decl)).toBe(true);
+    expect(isSecretDeclaration(decl)).toBe(true);
+    expect(isSecretDeclaration({ name: "a", provenance: "referenced" })).toBe(false);
+    expect((decl as unknown as Record<symbol, unknown>)[SECRET_DECLARATION_MARKER]).toBe(true);
+    expect(SECRET_PROVENANCE_KINDS).toEqual([
+      "referenced",
+      "from-provider",
+      "generated-once",
+      "committed-encrypted",
+    ]);
+  });
+
+  test("collectSecretDeclarations extracts declarations by entity name", () => {
+    const other = {
+      lexicon: "test",
+      entityType: "Test::Thing",
+      [Symbol.for("chant.declarable")]: true,
+    } as unknown as Declarable;
+    const entities = new Map<string, Declarable>([
+      ["thing", other],
+      ["dbPassword", declareSecret({ name: "db-password", provenance: "generated-once" })],
+    ]);
+    const secrets = collectSecretDeclarations(entities);
+    expect([...secrets.keys()]).toEqual(["dbPassword"]);
+    expect(secrets.get("dbPassword")!.name).toBe("db-password");
+  });
+
+  test("partitionByLexicon excludes declarations from every partition", () => {
+    const entities = new Map<string, Declarable>([
+      [
+        "thing",
+        {
+          lexicon: "test",
+          entityType: "Test::Thing",
+          [Symbol.for("chant.declarable")]: true,
+        } as unknown as Declarable,
+      ],
+      ["secret", declareSecret({ name: "s", provenance: "referenced" })],
+    ]);
+    const partitions = partitionByLexicon(entities);
+    expect([...partitions.keys()]).toEqual(["test"]);
+    expect(partitions.get("test")!.has("secret")).toBe(false);
+  });
+});
+
+describe("serializer neutrality (#1828 acceptance)", () => {
+  test("a built project's outputs never contain a declaration, and no serializer receives one", async () => {
+    const testDir = join(tmpdir(), `chant-secret-prov-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+    try {
+      const thisDir = dirname(fileURLToPath(import.meta.url));
+      const modulePath = resolvePath(thisDir, "secret-provenance");
+      await writeFile(
+        join(testDir, "secrets.infra.ts"),
+        `
+        import { declareSecret } from ${JSON.stringify(modulePath)};
+        export const dbPassword = declareSecret({ name: "db-password", provenance: "generated-once", keys: ["password"] });
+        export const apiToken = declareSecret({ name: "api-token", provenance: "referenced", scope: "vault:prod" });
+        export const providerFed = declareSecret({ name: "fountain-secrets", provenance: "from-provider", provider: { binding: "fountainInfisical" } });
+        export const realResource = {
+          lexicon: "test",
+          entityType: "Test::Thing",
+          [Symbol.for("chant.declarable")]: true,
+        };
+        `,
+      );
+
+      const seen: string[] = [];
+      const testSerializer: Serializer = {
+        name: "test",
+        rulePrefix: "TEST",
+        serialize: (entities) => {
+          seen.push(...entities.keys());
+          return JSON.stringify([...entities.keys()]);
+        },
+      };
+
+      const result = await build(testDir, [testSerializer]);
+
+      expect(result.errors).toEqual([]);
+      // Discovery found all four exports.
+      expect(result.entities.size).toBe(4);
+      expect(isSecretDeclaration(result.entities.get("dbPassword")!)).toBe(true);
+      const collected = collectSecretDeclarations(result.entities);
+      expect([...collected.keys()].sort()).toEqual(["apiToken", "dbPassword", "providerFed"]);
+
+      // No serializer received a declaration, no output mentions one, and the
+      // declarations' pseudo-lexicon produced neither an output nor a warning.
+      expect(seen).toEqual(["realResource"]);
+      expect([...result.outputs.keys()]).toEqual(["test"]);
+      for (const output of result.outputs.values()) {
+        const text = typeof output === "string" ? output : JSON.stringify(output);
+        expect(text).not.toContain("db-password");
+        expect(text).not.toContain("api-token");
+        expect(text).not.toContain("fountain-secrets");
+      }
+      expect(result.warnings.filter((w) => w.includes("No serializer"))).toEqual([]);
+      // The manifest's stack list has no pseudo-stack for the declarations.
+      expect(result.manifest.lexicons).toEqual(["test"]);
+    } finally {
+      await rm(testDir, { recursive: true, force: true });
+    }
+  });
+});