@intentius/chant 0.45.0 → 0.49.0

package/dist/secret-materialization.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Generated-once secret materialization — the one implementation behind the
+ * `ensure-secret` capability verb (components/verbs/ensure-secret.ts) and the
+ * `ensureSecret(...)` op step builder (op/builders.ts). chant #1829, epic
+ * #1365 decisions 3 and 6.
+ *
+ * The contract is read-then-write:
+ *
+ * - Absent: mint once, through the store adapter, and report `created`.
+ * - Present: verify presence, the declared key-set, and any declared
+ *   metadata, then STOP — present means done. Never mint over an existing
+ *   value. Never rotate implicitly. A re-run of a whole deploy leaves the
+ *   stored bytes untouched.
+ * - Mismatch: fail loudly, naming what mismatched — key names and metadata
+ *   keys, never a value or a value-derived hash (#1365 decision 6).
+ *
+ * The constitutional line (../secret-provenance.ts): no code path here may
+ * hold, log, hash, or compare a secret value. That is structural, not
+ * discipline:
+ *
+ * - {@link ensureSecretMaterialization} never calls the generator. It hands
+ *   the generator to the store adapter's `create`, which consumes the
+ *   material as it writes. The engine's result type has no field that could
+ *   carry material.
+ * - The generator produces {@link SecretMaterial}, an opaque single-use
+ *   handle. The plaintext lives in a module-private WeakMap, not on the
+ *   object: enumeration, `JSON.stringify`, `String(...)`, and `util.inspect`
+ *   all see only a redaction marker. Only {@link consumeSecretMaterial} —
+ *   meant for store adapters, at the write — yields the plaintext, exactly
+ *   once; a second consume throws.
+ * - `describe` returns key names and metadata only, so the mismatch check
+ *   has nothing value-shaped to compare even by accident.
+ *
+ * Store adapters are per-provider (#1830 is the k8s row); core defines only
+ * the seam.
+ */
+/**
+ * A single-use, opaque handle to generated secret material. The plaintext is
+ * not a property of this object — it lives in a module-private WeakMap — so
+ * spreading, enumerating, stringifying, or logging the handle yields only a
+ * redaction marker. A store adapter redeems it with
+ * {@link consumeSecretMaterial} at the moment it writes; nothing else can.
+ */
+export declare class SecretMaterial {
+    private constructor();
+    /** Wrap plaintext in an opaque handle. Call inside a generator only. */
+    static mint(plaintext: string): SecretMaterial;
+    toString(): string;
+    toJSON(): string;
+}
+/**
+ * Redeem a {@link SecretMaterial} handle for its plaintext — exactly once.
+ * For store adapters only, at the write to the backing store. Throws if the
+ * handle was already consumed (or was never minted here): material flows to
+ * the store exactly once and is retained nowhere.
+ */
+export declare function consumeSecretMaterial(material: SecretMaterial): string;
+/**
+ * Produces the material for one key of a secret being minted. Called by the
+ * store adapter (never by the engine) once per declared key, at create time —
+ * generation is apply-time I/O, never synthesis.
+ */
+export type SecretMaterialGenerator = (key: string) => SecretMaterial | Promise<SecretMaterial>;
+/** 32 bytes from the CSPRNG, base64url — the default mint. */
+export declare const defaultSecretMaterialGenerator: SecretMaterialGenerator;
+/** What `describe` reports about an existing secret: key NAMES and metadata. Never values. */
+export interface SecretStoreDescription {
+    /** The key names present in the stored secret. */
+    readonly keys: readonly string[];
+    /** Store metadata (e.g. k8s labels/annotations the provider surfaces). */
+    readonly metadata?: Readonly<Record<string, string>>;
+}
+/**
+ * A provider's view of one secret store — the seam #1830 (k8s) and future
+ * provider rows implement. `create` receives the generator and consumes each
+ * key's material as it writes; no method returns material.
+ */
+export interface SecretStoreAdapter {
+    /** Whether a secret of this name exists in the store. */
+    exists(name: string): Promise<boolean>;
+    /** Key names and metadata of an existing secret. Never values. */
+    describe(name: string): Promise<SecretStoreDescription>;
+    /**
+     * Create the secret, minting material for each declared key via
+     * `generate` and writing it straight to the store. Returns nothing:
+     * material must not travel back through this seam.
+     */
+    create(name: string, keys: readonly string[], generate: SecretMaterialGenerator): Promise<void>;
+}
+/** The declared contract to ensure — names and keys only, never material. */
+export interface EnsureSecretSpec {
+    /** The secret's name as the store knows it. */
+    readonly name: string;
+    /** The declared key-set. Creation mints one value per key; verification compares names. */
+    readonly keys: readonly string[];
+    /** Declared metadata an existing secret must carry (compared per key; mismatches are reported by KEY). */
+    readonly metadata?: Readonly<Record<string, string>>;
+}
+/** What `ensureSecretMaterialization` did. No field can carry material. */
+export interface EnsureSecretOutcome {
+    /** `created` = minted now (first materialization); `present` = existed and matched the contract (no write). */
+    readonly outcome: "created" | "present";
+    /** The secret's name. */
+    readonly name: string;
+    /** The declared key names the contract was checked (or minted) against. */
+    readonly keys: readonly string[];
+}
+/**
+ * The loud failure: an existing secret does not match its declared contract.
+ * `mismatches` names what differed — key names and metadata keys only.
+ * Constructing one with anything value-shaped is the reviewer's tripwire;
+ * nothing in this module can, because nothing in this module holds a value.
+ */
+export declare class SecretContractMismatchError extends Error {
+    /** The secret's name. */
+    readonly secretName: string;
+    /** Human-readable mismatch descriptions, naming keys — never values. */
+    readonly mismatches: readonly string[];
+    constructor(
+    /** The secret's name. */
+    secretName: string, 
+    /** Human-readable mismatch descriptions, naming keys — never values. */
+    mismatches: readonly string[]);
+}
+/**
+ * Ensure a `generated-once` secret exists and matches its declared contract.
+ * Read-then-write:
+ *
+ * - Absent: `store.create(name, keys, generate)` — one mint, then done.
+ * - Present and matching: no write of any kind; returns `present`.
+ * - Present and mismatching: throws {@link SecretContractMismatchError}
+ *   naming the missing/unexpected key names and mismatched metadata keys.
+ *
+ * The engine never calls `generate` itself and never sees what the adapter
+ * writes; its return value carries names only.
+ */
+export declare function ensureSecretMaterialization(store: SecretStoreAdapter, spec: EnsureSecretSpec, generate?: SecretMaterialGenerator): Promise<EnsureSecretOutcome>;
+//# sourceMappingURL=secret-materialization.d.ts.map

package/dist/secret-materialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-materialization.d.ts","sourceRoot":"","sources":["../src/secret-materialization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAWH;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,OAAO;IAEP,wEAAwE;IACxE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc;IAM9C,QAAQ,IAAI,MAAM;IAIlB,MAAM,IAAI,MAAM;CAQjB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAStE;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAEhG,8DAA8D;AAC9D,eAAO,MAAM,8BAA8B,EAAE,uBACe,CAAC;AAI7D,8FAA8F;AAC9F,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxD;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjG;AAID,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,0GAA0G;IAC1G,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,+GAA+G;IAC/G,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC;IACxC,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IAElD,yBAAyB;aACT,UAAU,EAAE,MAAM;IAClC,wEAAwE;aACxD,UAAU,EAAE,SAAS,MAAM,EAAE;;IAH7C,yBAAyB;IACT,UAAU,EAAE,MAAM;IAClC,wEAAwE;IACxD,UAAU,EAAE,SAAS,MAAM,EAAE;CAQhD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,kBAAkB,EACzB,IAAI,EAAE,gBAAgB,EACtB,QAAQ,GAAE,uBAAwD,GACjE,OAAO,CAAC,mBAAmB,CAAC,CA0C9B"}

package/dist/secret-provenance.d.ts

@@ -0,0 +1,218 @@
+/**
+ * Secret provenance vocabulary (chant #1828, epic #1365).
+ *
+ * A secret's PROVENANCE is where its value comes from — never what the value
+ * is. chant's constitutional line on secrets: no code path may hold, log,
+ * hash, or compare a secret value. This module makes that structural: the
+ * declaration types have no field that could carry material, the factory
+ * rejects material-shaped fields at both the type level (`never` fields) and
+ * at runtime (own-property check, naming only the offending KEY), and
+ * "mismatch" anywhere downstream means presence, declared key-set, and
+ * metadata — never a value or a value-derived hash (#1365 decision 6).
+ *
+ * The closed kind set:
+ *
+ * - `referenced` — the value exists out of band (a human or an external
+ *   process put it where consumers read it). chant records only that the
+ *   estate depends on it, which is what lets the consumed-but-unproduced
+ *   check (#1382) ship as an error instead of a guess.
+ * - `from-provider` — a declared provider binding materializes it (the
+ *   operator/CRD seam; `K8s::Infisical::InfisicalSecret` from #1321 is the
+ *   exemplar). The declaration POINTS at that binding, it does not re-model
+ *   it.
+ * - `generated-once` — minted on first materialization, then never
+ *   regenerated (present means done). The declaration carries contract flags
+ *   only — e.g. the declared key-set — never mint parameters holding
+ *   material. `generated-once` secrets never enter the prunable set (#1365
+ *   decision 5).
+ * - `committed-encrypted` — sops-style ciphertext committed in the repo,
+ *   decrypted by the delivery system (Flux) straight into the target. The
+ *   declaration records a repo-relative PATH to the ciphertext, never the
+ *   bytes: the factory is pure and touches no filesystem, so it still folds
+ *   under `--sandbox`. The bytes are read at `buildRoots()` — the one
+ *   sanctioned impure seam — and emitted as a sidecar file, never as a
+ *   document in the primary output. See
+ *   `docs/design/committed-encrypted-sops-provenance.md`.
+ *
+ * Declarations are serializer-neutral: discovery collects them like any
+ * entity (they are Declarables), but `partitionByLexicon` (../build.ts)
+ * excludes them from every serializer partition, so no lexicon ever emits
+ * them. They are data that lint rules and lexicons READ (via
+ * {@link collectSecretDeclarations}), not output.
+ */
+import { type Declarable } from "./declarable.js";
+/** The closed union of secret origins. */
+export type SecretProvenance = "referenced" | "from-provider" | "generated-once" | "committed-encrypted";
+/** Every provenance kind, for exhaustiveness checks. */
+export declare const SECRET_PROVENANCE_KINDS: readonly SecretProvenance[];
+/**
+ * Encryption tools a {@link CommittedEncryptedSecretDeclaration} understands.
+ * A closed union with one member, not a free string: a second tool later is a
+ * deliberate widening with a detection rule attached, not an unvalidated
+ * string that silently means nothing.
+ */
+export type SecretEncryption = "sops";
+/** Every encryption tool, for exhaustiveness checks. */
+export declare const SECRET_ENCRYPTION_TOOLS: readonly SecretEncryption[];
+/** Marker symbol identifying a secret provenance declaration. `Symbol.for` so
+ * it survives the entity-wire codec (../discovery/entity-wire-codec.ts). */
+export declare const SECRET_DECLARATION_MARKER: unique symbol;
+/** The `entityType` every secret declaration carries. */
+export declare const SECRET_DECLARATION_ENTITY_TYPE = "Chant::SecretProvenance";
+/**
+ * Points a `from-provider` declaration at the provider binding that
+ * materializes the secret — the CRD seam, not a re-model of it. The binding
+ * itself is an ordinary declarable in its own lexicon (e.g. an
+ * `InfisicalSecret` instance, #1321); this ref names it so lint can resolve
+ * the pair without core depending on any lexicon.
+ */
+export interface SecretProviderRef {
+    /** Entity name (export name) of the provider binding declarable in this project. */
+    readonly binding: string;
+    /**
+     * Expected `entityType` of the binding (e.g.
+     * `"K8s::Infisical::InfisicalSecret"`). Optional; when present, lint can
+     * verify the named binding is actually the kind of seam the declaration
+     * claims.
+     */
+    readonly entityType?: string;
+}
+/**
+ * Fields that would carry secret material, forbidden by construction. Typed
+ * as `never` on every factory input so they fail to compile even when the
+ * input object was widened or spread (plain excess-property checks only catch
+ * object literals). The runtime check in {@link declareSecret} is the same
+ * list, for untyped callers.
+ */
+interface NoSecretMaterial {
+    readonly value?: never;
+    readonly data?: never;
+    readonly stringData?: never;
+    readonly material?: never;
+    readonly plaintext?: never;
+    readonly ciphertext?: never;
+}
+/** Fields shared by every secret declaration. */
+interface SecretDeclarationBase extends Declarable {
+    readonly [SECRET_DECLARATION_MARKER]: true;
+    readonly lexicon: "chant";
+    readonly entityType: typeof SECRET_DECLARATION_ENTITY_TYPE;
+    /** The secret's name as consumers know it (e.g. the k8s Secret name). */
+    readonly name: string;
+    /** Which of the closed kind set this declaration is. */
+    readonly provenance: SecretProvenance;
+}
+/** A secret whose value exists out of band. */
+export interface ReferencedSecretDeclaration extends SecretDeclarationBase {
+    readonly provenance: "referenced";
+    /** Where consumers find it — free-form (a namespace, a vault path, a doc link). */
+    readonly scope?: string;
+}
+/** A secret a declared provider binding materializes. */
+export interface FromProviderSecretDeclaration extends SecretDeclarationBase {
+    readonly provenance: "from-provider";
+    readonly provider: SecretProviderRef;
+}
+/** A secret minted on first materialization and never regenerated. */
+export interface GeneratedOnceSecretDeclaration extends SecretDeclarationBase {
+    readonly provenance: "generated-once";
+    /**
+     * The declared key-set of the materialized secret. This is the contract a
+     * materializer (#1830) checks for mismatch — presence and keys, never
+     * values.
+     */
+    readonly keys?: readonly string[];
+}
+/**
+ * A secret whose ciphertext is committed to the repo and decrypted by the
+ * delivery system on the way into the target.
+ *
+ * The declaration is a POINTER: `file` is a repo-relative path, and nothing
+ * here carries bytes. That is what keeps the factory pure — the ciphertext is
+ * read at `buildRoots()` and emitted as a sidecar, never inlined into the
+ * primary output an applier reads.
+ */
+export interface CommittedEncryptedSecretDeclaration extends SecretDeclarationBase {
+    readonly provenance: "committed-encrypted";
+    /** Repo-relative path to the committed ciphertext file. */
+    readonly file: string;
+    /** Encryption tool. Defaults to `"sops"` when omitted. */
+    readonly encryption: SecretEncryption;
+    /**
+     * Public recipient identifiers — age recipients or PGP fingerprints. Public
+     * by definition, which is the opposite of material; a private key here is
+     * refused by the factory.
+     */
+    readonly recipients?: readonly string[];
+    /**
+     * The declared key-set of the decrypted Secret — the same contract meaning
+     * as {@link GeneratedOnceSecretDeclaration.keys}: presence and key names,
+     * never values. SOPS leaves key NAMES cleartext, so this is checkable
+     * against the file itself.
+     */
+    readonly keys?: readonly string[];
+}
+/** A secret provenance declaration — the discriminant is `provenance`. */
+export type SecretDeclaration = ReferencedSecretDeclaration | FromProviderSecretDeclaration | GeneratedOnceSecretDeclaration | CommittedEncryptedSecretDeclaration;
+/** Narrow a declaration to the committed-encrypted kind. */
+export declare function isCommittedEncryptedSecret(decl: SecretDeclaration): decl is CommittedEncryptedSecretDeclaration;
+/** Factory input for a `referenced` secret. */
+export interface ReferencedSecretInput extends NoSecretMaterial {
+    readonly name: string;
+    readonly provenance: "referenced";
+    readonly scope?: string;
+}
+/** Factory input for a `from-provider` secret. */
+export interface FromProviderSecretInput extends NoSecretMaterial {
+    readonly name: string;
+    readonly provenance: "from-provider";
+    readonly provider: SecretProviderRef;
+}
+/** Factory input for a `generated-once` secret. */
+export interface GeneratedOnceSecretInput extends NoSecretMaterial {
+    readonly name: string;
+    readonly provenance: "generated-once";
+    readonly keys?: readonly string[];
+}
+/** Factory input for a `committed-encrypted` secret. */
+export interface CommittedEncryptedSecretInput extends NoSecretMaterial {
+    readonly name: string;
+    readonly provenance: "committed-encrypted";
+    /**
+     * Repo-relative path to the committed ciphertext file — `file`, never
+     * `ciphertext`: the declaration points at bytes, it does not carry them,
+     * and `ciphertext` is a forbidden material field.
+     */
+    readonly file: string;
+    /** Encryption tool. Closed union; `"sops"` is its only member today. */
+    readonly encryption?: SecretEncryption;
+    /** Public recipient identifiers — age recipients or PGP fingerprints. */
+    readonly recipients?: readonly string[];
+    /** The declared key-set of the decrypted Secret. Names only, never values. */
+    readonly keys?: readonly string[];
+}
+export type SecretDeclarationInput = ReferencedSecretInput | FromProviderSecretInput | GeneratedOnceSecretInput | CommittedEncryptedSecretInput;
+/**
+ * Declare a secret's provenance. The returned object is a locked Declarable:
+ * discovery collects it like any entity, `chant list` shows it, lint and
+ * lexicons read it — and no serializer ever emits it.
+ *
+ * Only the fields the kind defines are copied onto the declaration; anything
+ * else on the input — in particular anything that could carry material — is
+ * either a compile error ({@link NoSecretMaterial}) or a thrown error here.
+ * The thrown message names the offending KEY only, never its value.
+ */
+export declare function declareSecret(input: ReferencedSecretInput): ReferencedSecretDeclaration;
+export declare function declareSecret(input: FromProviderSecretInput): FromProviderSecretDeclaration;
+export declare function declareSecret(input: GeneratedOnceSecretInput): GeneratedOnceSecretDeclaration;
+export declare function declareSecret(input: CommittedEncryptedSecretInput): CommittedEncryptedSecretDeclaration;
+/** Type guard for a secret provenance declaration. */
+export declare function isSecretDeclaration(value: unknown): value is SecretDeclaration;
+/**
+ * Extract the secret declarations from a discovered entity map — the read
+ * surface for lint rules (#1382) and lexicon materializers (#1830). Keyed by
+ * entity name (export name), the same key `DiscoveryResult.entities` uses.
+ */
+export declare function collectSecretDeclarations(entities: ReadonlyMap<string, Declarable>): Map<string, SecretDeclaration>;
+export {};
+//# sourceMappingURL=secret-provenance.d.ts.map

package/dist/secret-provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-provenance.d.ts","sourceRoot":"","sources":["../src/secret-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAElE,0CAA0C;AAC1C,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,qBAAqB,CAAC;AAE1B,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,EAAE,SAAS,gBAAgB,EAK9D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEtC,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,EAAE,SAAS,gBAAgB,EAAa,CAAC;AAqB7E;4EAC4E;AAC5E,eAAO,MAAM,yBAAyB,eAAyC,CAAC;AAEhF,yDAAyD;AACzD,eAAO,MAAM,8BAA8B,4BAA4B,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,UAAU,gBAAgB;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;CAC7B;AAWD,iDAAiD;AACjD,UAAU,qBAAsB,SAAQ,UAAU;IAChD,QAAQ,CAAC,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,8BAA8B,CAAC;IAC3D,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,+CAA+C;AAC/C,MAAM,WAAW,2BAA4B,SAAQ,qBAAqB;IACxE,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,yDAAyD;AACzD,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,8BAA+B,SAAQ,qBAAqB;IAC3E,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mCAAoC,SAAQ,qBAAqB;IAChF,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GACzB,2BAA2B,GAC3B,6BAA6B,GAC7B,8BAA8B,GAC9B,mCAAmC,CAAC;AAExC,4DAA4D;AAC5D,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB,GACtB,IAAI,IAAI,mCAAmC,CAE7C;AAED,+CAA+C;AAC/C,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,uBAAwB,SAAQ,gBAAgB;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC;AAED,mDAAmD;AACnD,MAAM,WAAW,wBAAyB,SAAQ,gBAAgB;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,wDAAwD;AACxD,MAAM,WAAW,6BAA8B,SAAQ,gBAAgB;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,MAAM,sBAAsB,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,wBAAwB,GACxB,6BAA6B,CAAC;AAElC;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,2BAA2B,CAAC;AACzF,wBAAgB,aAAa,CAAC,KAAK,EAAE,uBAAuB,GAAG,6BAA6B,CAAC;AAC7F,wBAAgB,aAAa,CAAC,KAAK,EAAE,wBAAwB,GAAG,8BAA8B,CAAC;AAC/F,wBAAgB,aAAa,CAC3B,KAAK,EAAE,6BAA6B,GACnC,mCAAmC,CAAC;AA2KvC,sDAAsD;AACtD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAO9E;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GACxC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAMhC"}

package/dist/serializer.d.ts

@@ -18,6 +18,17 @@ export interface SerializeContext {
      * ad-hoc builds (e.g. context tools) that pass no config.
      */
     config?: Record<string, unknown>;
+    /**
+     * Effect receipts (#1832, epic #1703) declared in this lexicon's partition.
+     * Withheld from the `entities` map by the build: receipts are observe-only
+     * to the generic apply path, and the serialized output is what feeds
+     * appliers, so a receipt must never enter the apply-bound document. A
+     * serializer that wants to render receipts for visibility (#1835) reads
+     * them here and puts them anywhere BUT the section an applier writes from;
+     * a serializer that ignores this field emits nothing for them, which is the
+     * safe default.
+     */
+    receipts?: ReadonlyMap<string, Declarable>;
 }
 /**
  * Result of serialization that may include additional files (e.g. nested stack templates).

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtC;;;;;OAKG;IACH,SAAS,CACP,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,CAAC,EAAE,aAAa,EAAE,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,GAAG,gBAAgB,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;CACpD"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtC;;;;;OAKG;IACH,SAAS,CACP,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,CAAC,EAAE,aAAa,EAAE,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,GAAG,gBAAgB,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;CACpD"}

package/dist/testing.d.ts

@@ -0,0 +1,136 @@
+/**
+ * `@intentius/chant/testing` (#1224) — the live-stack test harness.
+ *
+ * A vitest suite deploys a real instance of its project once, asserts against
+ * it, and tears it down — emulator-locally on a dev machine, real-cloud in CI,
+ * with the same suite text. One call composes machinery that already exists:
+ *
+ * - **build** — the same programmatic path `chant build` takes: config
+ *   resolution (`buildParams` + the ownership marker) mirrored from the CLI,
+ *   then `build()` over the project's own serializers.
+ * - **apply** — an additive `nativeApply` per built lexicon output, run
+ *   in-process through the local Op executor (`runOpLocally`). `deleteMode`
+ *   is `"never"`: a test deploy creates and updates, nothing else.
+ * - **destroy** — #1222's marker-scoped teardown (`executeTeardown`), called
+ *   in-process for exactly this suite's environment. Stateless by design:
+ *   a crashed suite's environment is recovered by calling destroy again (or
+ *   `chant lifecycle teardown <env> --yes`).
+ *
+ * ## Isolation
+ *
+ * Every deploy targets its own environment: `test-<suite>-<nonce>` by default
+ * ({@link testEnvName}), so parallel CI jobs never collide. The environment
+ * is the teardown key — everything the deploy stamps carries the ownership
+ * marker `{ stack, env }`, and `destroy()` selects on that identity and
+ * nothing else. A project that declares `environments` must legalize the
+ * dynamic names with a pattern entry (#1221):
+ *
+ * ```ts
+ * environments: ["dev", "prod", { name: "test-*", endpoint: "http://localhost:4566" }]
+ * ```
+ *
+ * ## Emulators
+ *
+ * The harness is emulator-aware the same way `--live` reads are (#1166): the
+ * target environment's declared `endpoint` is injected into each lexicon's
+ * ambient endpoint variable (`AWS_ENDPOINT_URL`, …) for the apply and the
+ * teardown — unless the variable is already set. Ambient always wins, so the
+ * env vars `chant emulator up --json` reports (#920) take precedence when
+ * exported, and a CI job pointing the identical suite at a real account just
+ * leaves both unset.
+ */
+import type { Declarable } from "./declarable.js";
+import type { SerializerResult } from "./serializer.js";
+import { type BuildParamValue } from "./build-params.js";
+import type { LexiconPlugin } from "./lexicon.js";
+import { type ActivityFn, type ActivityProfile } from "./op/activity-registry.js";
+import { type TeardownReport } from "./lifecycle/teardown.js";
+export interface DeployStackOptions {
+    /** The chant project directory (where the infra source lives). */
+    dir: string;
+    /**
+     * Explicit environment name. Overrides the default `test-<suite>-<nonce>`
+     * derivation — for a shared long-lived test environment, or a test that
+     * needs a deterministic name. Must be legal for the project's declared
+     * `environments`, exactly as `--env` would be.
+     */
+    env?: string;
+    /**
+     * Suite name folded into the default environment name. Defaults to the
+     * project directory's basename.
+     */
+    suite?: string;
+    /** Build parameters, exactly as `--param name=value` flags would supply them. */
+    params?: Record<string, BuildParamValue>;
+    /**
+     * Loaded lexicon plugins. Defaults to loading the project's own declared/
+     * detected lexicons — pass this only to substitute test doubles.
+     */
+    plugins?: LexiconPlugin[];
+    /** Activity implementations for the apply. Defaults to the real registry. */
+    activities?: Map<string, ActivityFn>;
+    /** Activity profiles (timeouts/retries). Defaults to the lexicon-declared table. */
+    profiles?: Record<string, ActivityProfile>;
+    /**
+     * Extra lexicon-name → `nativeApply` target entries, merged over the
+     * built-in map (aws → cloudformation, k8s → kubectl, azure → arm,
+     * gcp → gcp, fly → fly). A seam for tests and out-of-tree lexicons.
+     */
+    applyTargets?: Record<string, string>;
+}
+/** The handle a suite holds between `beforeAll` and `afterAll`. */
+export interface DeployedStack {
+    /** The built outputs, keyed by lexicon — what was deployed. */
+    outputs: Map<string, string | SerializerResult>;
+    /** The discovered entities, keyed by name. */
+    entities: Map<string, Declarable>;
+    /** The environment this deploy targeted — the teardown key. */
+    env: string;
+    /**
+     * Tear down everything carrying this suite's marker `{ stack, env }`.
+     * Throws {@link TeardownIncompleteError} when any candidate failed to
+     * delete or the plan had holes — an environment that cannot be called
+     * clean is a test failure, never a silent leak. Safe to call again:
+     * teardown is stateless, and a second call over a clean environment
+     * plans nothing.
+     */
+    destroy(): Promise<TeardownReport>;
+}
+/**
+ * Thrown by {@link DeployedStack.destroy} when the environment cannot be
+ * called clean: candidates still `failed` after the retry pass, or the plan
+ * had holes (#1089 — parts of the estate could not be read, so "nothing
+ * left" would be a claim about what was readable, not about the environment).
+ * Carries the full report for diagnosis.
+ */
+export declare class TeardownIncompleteError extends Error {
+    readonly report: TeardownReport;
+    constructor(report: TeardownReport);
+}
+/**
+ * The default environment name for one suite run: `test-<suite>-<nonce>`.
+ * The `test-` prefix is what a project's `"test-*"` pattern entry (#1221)
+ * legalizes; the nonce keeps parallel CI jobs of the same suite apart.
+ */
+export declare function testEnvName(suite: string): string;
+/**
+ * Deploy a live instance of the project in `dir` for one test suite.
+ *
+ * Build (the CLI's own config resolution: `buildParams`, ownership marker,
+ * build roots) + additive apply (one `nativeApply` per built output with a
+ * native mechanism, via the local Op executor). Returns the handle the suite
+ * holds: outputs, entities, the environment name, and `destroy`.
+ *
+ * The ownership marker stamped on every resource is `{ stack: ownership.stack,
+ * env: <this deploy's environment> }` — the marker env always follows the
+ * suite environment, whatever `ownership.env` in config says, because the
+ * marker is the only thing `destroy()` selects on. A project with no
+ * `ownership.stack` is refused up front: a deploy that stamps nothing is a
+ * deploy nothing can sweep.
+ *
+ * Failures are thrown, never returned: build errors, unresolved parameters,
+ * an illegal environment name, and a failed apply (the local executor's
+ * `OpRunFailure`) all reject the returned promise.
+ */
+export declare function deployStack(options: DeployStackOptions): Promise<DeployedStack>;
+//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMrD,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAI1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAgC,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE7G,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgB5E,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,6EAA6E;IAC7E,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;CACpC;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aACpB,MAAM,EAAE,cAAc;gBAAtB,MAAM,EAAE,cAAc;CAkBnD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUjD;AA8BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CAkHrF"}

package/dist/yaml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../src/yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0BH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAgH/D;AAMD,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASlE;AAiFD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,WAAW,CA8Eb;AA0GD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,WAAW,CAqGb;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAelD"}
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../src/yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0BH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAgH/D;AAMD,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASlE;AAiFD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,WAAW,CA8Eb;AA0GD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,WAAW,CAqGb;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAwBlD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.45.0",
+  "version": "0.49.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -64,6 +64,11 @@
       "types": "./dist/components/index.d.ts",
       "default": "./src/components/index.ts"
     },
+    "./testing": {
+      "development": "./src/testing.ts",
+      "types": "./dist/testing.d.ts",
+      "default": "./src/testing.ts"
+    },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
@@ -86,5 +91,8 @@
   "devDependencies": {
     "@cdktf/hcl2json": "^0.21.0",
     "ajv": "^8.20.0"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1"
   }
 }

package/src/audit/core.test.ts

@@ -187,4 +187,61 @@ describe("auditFiles", () => {
     });
     expect(findings.map((f) => f.checkId)).toEqual(["OK001"]);
   });
+
+  test("parse-to-graph: an injected entities parser lets entity-reading checks fire per file (#1567)", async () => {
+    const entityCheck: PostSynthCheck = {
+      id: "ENT001",
+      description: "reads ctx.entities, not ctx.outputs",
+      check: (ctx) =>
+        [...ctx.entities.keys()].map((name) => ({ checkId: "ENT001", severity: "warning" as const, message: `saw ${name}`, entity: name })),
+    };
+    const findings = await auditFiles(
+      [
+        { path: "a.yaml", content: "one", lexicon: "custom" },
+        { path: "b.yaml", content: "two", lexicon: "custom" },
+      ],
+      {
+        checksProvider: async () => [entityCheck],
+        entitiesProvider: async () => (content) => new Map([[content, { entityType: "T::X" } as never]]),
+      },
+    );
+    expect(findings.map((f) => `${f.file}:${f.entity}`).sort()).toEqual(["a.yaml:one", "b.yaml:two"]);
+  });
+
+  test("parse-to-graph merge: the same entity name in two files keeps both — a duplicate check sees the collision cross-file", async () => {
+    const dupCheck: PostSynthCheck = {
+      id: "DUP001",
+      description: "fires when more than one entity is present",
+      check: (ctx) => (ctx.entities.size > 1 ? [{ checkId: "DUP001", severity: "error" as const, message: "name declared twice" }] : []),
+    };
+    const findings = await auditFiles(
+      [
+        { path: "a.yaml", content: "x", lexicon: "custom" },
+        { path: "b.yaml", content: "y", lexicon: "custom" },
+      ],
+      {
+        checksProvider: async () => [dupCheck],
+        // both files declare the entity name "dev" — the merged pass must keep both
+        entitiesProvider: async () => () => new Map([["dev", { entityType: "T::X" } as never]]),
+      },
+    );
+    const dup = findings.find((f) => f.checkId === "DUP001");
+    expect(dup).toBeDefined();
+    expect(dup!.file).toBe(CROSS_FILE);
+  });
+
+  test("an entities parser that throws contributes no entities and does not abort the audit", async () => {
+    const entityCheck: PostSynthCheck = {
+      id: "ENT002",
+      description: "counts entities",
+      check: (ctx) => (ctx.entities.size > 0 ? [{ checkId: "ENT002", severity: "warning" as const, message: "saw entities" }] : []),
+    };
+    const findings = await auditFiles([{ path: "a.yaml", content: "x", lexicon: "custom" }], {
+      checksProvider: async () => [entityCheck],
+      entitiesProvider: async () => () => {
+        throw new Error("unparseable");
+      },
+    });
+    expect(findings).toEqual([]);
+  });
 });

package/src/audit/detect-bundle.test.ts

@@ -9,7 +9,7 @@ import { fileURLToPath } from "url";
  * service content-detect all lexicons on Workers.
  */
 const repoRoot = fileURLToPath(new URL("../../../../", import.meta.url));
-const LEXICONS = ["k8s", "docker", "aws", "azure", "gcp", "helm"];
+const LEXICONS = ["k8s", "docker", "aws", "azure", "gcp", "helm", "fountain"];
 
 describe("detectTemplate modules are edge-bundle clean", () => {
   test("importing every lexicon's /detect pulls in no typescript or plugin.ts", async () => {