@intentius/chant 0.46.0 → 0.49.0

package/dist/lifecycle/observation-baseline.d.ts

@@ -91,15 +91,33 @@ export interface DeviationToAccept {
     value: unknown;
     note?: string;
 }
+/** Options for {@link acceptDeviations}. */
+export interface AcceptDeviationsOptions {
+    /** ISO timestamp to stamp instead of the wall clock (tests, replays). */
+    now?: string;
+    /**
+     * Entity names the caller recognized as effect receipts (#1833) — the
+     * marker-based read (`collectEffectReceipts`, ../effect-receipt.ts) over
+     * the build's entities, which is how a lexicon-materialized receipt row is
+     * caught even though its `entityType` is the row's own. Core-typed
+     * receipts are refused regardless, via {@link DeviationToAccept.type}.
+     */
+    receipts?: ReadonlySet<string>;
+}
 /**
  * Record deviations as accepted, returning a new baseline (the input is not
  * mutated). An existing acceptance for the same entity+path is replaced — that
  * is how re-accepting after a deliberate change works, and it keeps the file
  * from growing a second entry for every value a path has ever held.
+ *
+ * REFUSES a deviation on an effect receipt (#1833, epic #1703), throwing
+ * before anything is recorded: a receipt is the declared witness that its
+ * effect ran, and the `effect()` step is its only writer — baselining a
+ * receipt's live value would accept "the effect never fired" as the new
+ * normal and silently defuse the effect. The whole acceptance aborts, not
+ * just the receipt's row, so a partial baseline never lands.
  */
-export declare function acceptDeviations(baseline: ObservationBaseline, lexicon: string, deviations: readonly DeviationToAccept[], opts?: {
-    now?: string;
-}): ObservationBaseline;
+export declare function acceptDeviations(baseline: ObservationBaseline, lexicon: string, deviations: readonly DeviationToAccept[], opts?: AcceptDeviationsOptions): ObservationBaseline;
 /** Total accepted deviations across every lexicon — for the "N accepted" line. */
 export declare function countAccepted(baseline: ObservationBaseline | null | undefined): number;
 /**

package/dist/lifecycle/observation-baseline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observation-baseline.d.ts","sourceRoot":"","sources":["../../src/lifecycle/observation-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAKH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;IACf,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,uEAAuE;AACvE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE7D,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC3C;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAEtE;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAQlF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAU5F;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CAEvE;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,EAChD,OAAO,EAAE,MAAM,GACd,eAAe,CAEjB;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAC/B,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,iBAAiB,GAAG,SAAS,CAE/B;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,SAAS,iBAAiB,EAAE,EACxC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,mBAAmB,CAwBrB;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAOtF;AAID;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAErC;AAED,oFAAoF;AACpF,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAQjB"}
+{"version":3,"file":"observation-baseline.d.ts","sourceRoot":"","sources":["../../src/lifecycle/observation-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAMH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;IACf,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,uEAAuE;AACvE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE7D,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC3C;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAEtE;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAQlF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAU5F;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CAEvE;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,EAChD,OAAO,EAAE,MAAM,GACd,eAAe,CAEjB;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAC/B,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,iBAAiB,GAAG,SAAS,CAE/B;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,SAAS,iBAAiB,EAAE,EACxC,IAAI,CAAC,EAAE,uBAAuB,GAC7B,mBAAmB,CAkCrB;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAOtF;AAID;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAErC;AAED,oFAAoF;AACpF,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/dist/lifecycle/receipt-plan.d.ts

@@ -0,0 +1,62 @@
+import { type EffectReceiptDeclaration, type ReceiptInputResolver } from "../effect-receipt.js";
+import type { ResourceMetadata } from "../lexicon.js";
+import type { UnobservedReason } from "../observation.js";
+import type { ChangeSet, ChangeSetEntry } from "./change-set.js";
+/**
+ * The attribute a materialized receipt's live value is read from. A lexicon
+ * receipt row's observation (#1835) maps the stored value onto
+ * `attributes[RECEIPT_VALUE_ATTRIBUTE]`; `Value` is accepted as a fallback for
+ * observations that keep the provider's own casing (SSM's `Value`).
+ */
+export declare const RECEIPT_VALUE_ATTRIBUTE = "value";
+/** Read a live receipt's stored value off an observation's attributes. */
+export declare function readReceiptValue(attributes: Record<string, unknown> | undefined): unknown;
+/**
+ * What the plan's observation pass learned about one declared receipt.
+ * Deliberately tri-state, the same shape the change set rests on (#1089):
+ * `observed: false` means "nobody looked", which is a hole — never absence.
+ * A receipt with no reading at all means no loaded lexicon even claims it.
+ */
+export interface ReceiptReading {
+    /** The lexicon actually looked. `false` → the receipt is a plan hole. */
+    observed: boolean;
+    /** Observed present in the live system. Meaningful only when `observed`. */
+    present: boolean;
+    /** The live receipt's stored value ({@link readReceiptValue}). */
+    value?: unknown;
+    /** Live resource type, when reported. */
+    type?: string;
+    /** Provider-assigned physical id, when reported. */
+    physicalId?: string;
+    /** The lexicon whose observation produced this reading. */
+    lexicon?: string;
+    /** Why the read did not happen, when `observed: false`. */
+    unobservedReason?: UnobservedReason;
+    unobservedDetail?: string;
+}
+/**
+ * A {@link ReceiptInputResolver} over the plan's merged observed values: an
+ * attr-ref resolves to the referenced entity's observed attribute. Anything
+ * that is not among the observed values throws — which `planReceipts` renders
+ * as an effect-will-fire entry with an "unresolved input" note rather than a
+ * guessed expectation.
+ */
+export declare function observedValueResolver(resources: Readonly<Record<string, ResourceMetadata>>): ReceiptInputResolver;
+/**
+ * Classify every declared receipt into its change-set entry. See the module
+ * doc for the classification; entries come back sorted by name.
+ */
+export declare function planReceipts(receipts: ReadonlyMap<string, EffectReceiptDeclaration>, readings: ReadonlyMap<string, ReceiptReading>, resolver: ReceiptInputResolver): ChangeSetEntry[];
+/**
+ * Replace whatever the generic classification proposed for the receipts with
+ * the receipt entries built by {@link planReceipts}, in place.
+ *
+ * This is the plan-side write-exclusion (#1832): the generic change set,
+ * knowing nothing about receipts, classifies a declared-but-absent receipt as
+ * `create` and an undeclared-but-live one as `delete`/`adopt` — proposals the
+ * generic apply path must never act on for a receipt, and prune candidacy a
+ * receipt must never have. Every entry named like a receipt is dropped and
+ * the receipt's own entries stand in.
+ */
+export declare function mergeReceiptEntries(cs: ChangeSet, receipts: ReadonlyMap<string, EffectReceiptDeclaration>, receiptEntries: ChangeSetEntry[]): ChangeSet;
+//# sourceMappingURL=receipt-plan.d.ts.map

package/dist/lifecycle/receipt-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-plan.d.ts","sourceRoot":"","sources":["../../src/lifecycle/receipt-plan.ts"],"names":[],"mappings":"AAkCA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CAIzF;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GACpD,oBAAoB,CAiBtB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EACvD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,EAC7C,QAAQ,EAAE,oBAAoB,GAC7B,cAAc,EAAE,CAoGlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EACvD,cAAc,EAAE,cAAc,EAAE,GAC/B,SAAS,CAMX"}

package/dist/lifecycle/release-ledger.d.ts

@@ -74,6 +74,26 @@ export interface ReleaseRecord {
     approver?: string;
     /** Optional: the archive's own manifest digest (../components/verbs/build-archive.ts's `manifestDigest`), when the caller has it — lets a reader recover full build contents/provenance, not just the promoted image digest. */
     manifestDigest?: string;
+    /**
+     * Optional: set when the deploy's capability-profile assertion (chant
+     * #1244, helm lexicon) was deliberately overridden — carries the named
+     * divergences that were bypassed (declared vs live), so the ledger shows
+     * this release knowingly skewed from its declared profile. Absent for a
+     * deploy whose target matched, and for deploys with no declared profile.
+     */
+    profileOverride?: string;
+    /**
+     * Optional: the deploy's input-side digest, when `digest` is a
+     * rendered-content identity rather than an input identity. A pinned helm
+     * deploy (chant #1242) records the render's `contentDigest` as `digest` —
+     * what this cluster actually received — and carries the input digest
+     * (chart, chart version, resolved values, capability facts; chant #1243)
+     * here, because profiles are per cluster: two environments legitimately
+     * render to different bytes, so cross-environment "is prod running what
+     * staging tested" joins on this field while `digest` proves the exact
+     * bytes each cluster got. Absent when `digest` is already input-side.
+     */
+    inputDigest?: string;
 }
 /** Thrown by `appendReleaseRecord` when the record is missing a required field — a release record can never be recorded partially, since it is never editable afterward. */
 export declare class InvalidReleaseRecordError extends Error {

package/dist/lifecycle/release-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iJAAiJ;IACjJ,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAaD,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;gBAAjB,OAAO,EAAE,MAAM,EAAE;CAI9C;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,EAAE,CAO9E;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CAQpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB1D;AAED,4EAA4E;AAC5E,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}
+{"version":3,"file":"release-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC;IACX,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iJAAiJ;IACjJ,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gOAAgO;IAChO,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAaD,4KAA4K;AAC5K,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,OAAO,EAAE,MAAM,EAAE;gBAAjB,OAAO,EAAE,MAAM,EAAE;CAI9C;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,EAAE,CAO9E;AAED,gIAAgI;AAChI,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC,CAQpD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB1D;AAED,4EAA4E;AAC5E,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAE1F"}

package/dist/lifecycle/teardown.d.ts

@@ -86,11 +86,13 @@ export declare function planTeardown(opts: PlanTeardownOptions): Promise<Teardow
 export interface TeardownOutcomeEntry extends TeardownPlanEntry {
     /**
      * `skipped` is core's verdict for a candidate whose lexicon implements no
-     * `executeTeardown` yet; the other three come from the lexicon (see
-     * {@link TeardownOutcome}).
+     * `executeTeardown` yet; the others come from the lexicon (see
+     * {@link TeardownOutcome}). `retained` is the loud keep (#1365 decision 5):
+     * owned, no longer declared, deliberately not deleted — a `generated-once`
+     * secret survives every sweep and says so with a row.
      */
-    outcome: "deleted" | "failed" | "not-prunable" | "skipped";
-    /** The error for `failed`, the reason for `not-prunable`/`skipped`. */
+    outcome: "deleted" | "failed" | "not-prunable" | "retained" | "skipped";
+    /** The error for `failed`, the reason for `not-prunable`/`retained`/`skipped`. */
     detail?: string;
     /** True when this final outcome came from the bounded retry pass. */
     retried?: boolean;

package/dist/lifecycle/teardown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../../src/lifecycle/teardown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAGvG,0EAA0E;AAC1E,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kFAAkF;IAClF,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D;AAOD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FnF;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D;;;;OAIG;IACH,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;IAC3D,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,EAAE,YAAY,CAAC;IACnB,wEAAwE;IACxE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,+EAA+E;IAC/E,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE;;;OAGG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAkDD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAwE3F"}
+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../../src/lifecycle/teardown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAGvG,0EAA0E;AAC1E,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kFAAkF;IAClF,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D;AAOD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FnF;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D;;;;;;OAMG;IACH,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,GAAG,SAAS,CAAC;IACxE,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,EAAE,YAAY,CAAC;IACnB,wEAAwE;IACxE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,+EAA+E;IAC/E,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE;;;OAGG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAkDD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAwE3F"}

package/dist/lifecycle/unobserved-gate.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The unobserved gate predicate (#1568): a plan containing unobserved
+ * entities must not pass as clean.
+ *
+ * `buildChangeSet` (./change-set.ts) already refuses to guess when a lexicon
+ * could not look (#1089) — entries land as `action: "unobserved"`, carrying a
+ * total `unobservedReason` (`read-failed`, `no-credentials`, `no-binding`,
+ * `unsupported-kind`, `filtered`; see ../observation.ts). But nothing
+ * downstream is *required* to look: a gate that checks lint-clean,
+ * owned-only, and a blast-radius budget can walk right past a change set
+ * whose live read partially failed and call it clean, because none of those
+ * checks reads `unobserved` at all. A gate over an incomplete read is a gate
+ * over a guess.
+ *
+ * This is a reusable predicate, not a runtime — evaluate a `ChangeSet`
+ * against a policy and get back a verdict; the caller (a `lint.policies`
+ * check routed through `policyGate`, an Op step, #1487's gate-as-fact once it
+ * lands) decides what to do with a refusal (throw, diagnostic, a durable
+ * gated-run fact). Same instinct #1484 already adopts for `unknown` in the
+ * operating loop ("`unknown` never remediates"), surfaced here as something
+ * any gate can declare rather than a property of one runtime.
+ */
+import type { ChangeSet } from "./change-set.js";
+import { type UnobservedReason } from "../observation.js";
+/**
+ * How the gate treats the change set's unobserved set.
+ *
+ * - `"refuse"` (the default) — any unobserved entry not covered by `allow`
+ *   fails the gate outright. Fail-closed, the right default for a policy set
+ *   aimed at agent-proposed change sets: a hole must never launder into a
+ *   clean verdict just because nobody configured otherwise.
+ * - `"escalate"` — the gate does not fail here; instead the verdict reports
+ *   `escalate: true` so a caller can route the plan to a stricter gate class
+ *   rather than the ordinary path (the same shape of routing decision #1569
+ *   makes for pipeline changes).
+ * - `{ allow: [...] }` — the listed reasons are tolerated (e.g. `"filtered"`,
+ *   intentional in a scoped run) and never fail or escalate the gate; any
+ *   reason NOT in the list still refuses. `no-credentials` — a hole that must
+ *   never launder into a clean verdict — should never appear in an `allow`
+ *   list for a policy aimed at agent-proposed change sets.
+ */
+export type UnobservedGatePolicy = "refuse" | "escalate" | {
+    allow: UnobservedReason[];
+};
+/** One unobserved hole the gate found, carried into the refusal. */
+export interface UnobservedGateFinding {
+    name: string;
+    type?: string;
+    reason: UnobservedReason;
+    detail?: string;
+}
+export interface UnobservedGateVerdict {
+    /** False when the policy is `"refuse"` (default) and an unallowed unobserved entry exists. */
+    pass: boolean;
+    /** True when the policy is `"escalate"` and an unallowed unobserved entry exists — route to a stricter gate instead of failing here. */
+    escalate: boolean;
+    /** Every unobserved entry the policy did not allow. Empty when `pass` is true and `escalate` is false. */
+    findings: UnobservedGateFinding[];
+    /** Human-readable summary carrying the reasons into a refusal — the message a caller can surface as-is. Undefined when `findings` is empty. */
+    detail?: string;
+}
+/**
+ * Evaluate a `ChangeSet`'s unobserved set against `policy`. Pure — reads only
+ * `cs.entries`, no I/O. Defaults to `"refuse"`.
+ */
+export declare function evaluateUnobservedGate(cs: ChangeSet, policy?: UnobservedGatePolicy): UnobservedGateVerdict;
+//# sourceMappingURL=unobserved-gate.d.ts.map

package/dist/lifecycle/unobserved-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unobserved-gate.d.ts","sourceRoot":"","sources":["../../src/lifecycle/unobserved-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,UAAU,GAAG;IAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC;AAEzF,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,8FAA8F;IAC9F,IAAI,EAAE,OAAO,CAAC;IACd,wIAAwI;IACxI,QAAQ,EAAE,OAAO,CAAC;IAClB,0GAA0G;IAC1G,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAClC,+IAA+I;IAC/I,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,SAAS,EACb,MAAM,GAAE,oBAA+B,GACtC,qBAAqB,CA+BvB"}

package/dist/lint/knowledge-checks.d.ts

@@ -0,0 +1,48 @@
+import type { PostSynthCheck } from "./post-synth.js";
+import type { OkfBundle } from "../okf-read.js";
+/**
+ * COR026: Stale Knowledge Binding (#1865, design #1059, epic #1057)
+ *
+ * A concept's `binds` frontmatter key names a discovered entity's logical
+ * name (#1864, `../okf-read.ts`'s `bindConcepts`). A name that resolves to
+ * nothing is a stale binding — the entity was renamed or removed, or the
+ * concept was authored against a name that never existed — and per #1059's
+ * stated failure posture ("the spec permits broken links, which argues for
+ * warn") that is a warning, never a build failure: knowledge is deliberately
+ * softer than the typed graph it describes, and OKF itself tolerates broken
+ * links (epic #1057).
+ *
+ * The converse is deliberately silent: a concept with no `binds` at all is
+ * orphaned knowledge, not an omission (a runbook, a decision about the
+ * project as a whole), and `bindConcepts` never reports it as unresolved in
+ * the first place — see its own doc comment. A project with no knowledge
+ * bundle loads an empty one (`loadOkfBundle`), so this check produces no
+ * diagnostics either.
+ *
+ * Wired into `chant build` (`../cli/commands/build.ts`) alongside
+ * `coreReceiptChecks` — same reasons COR023/COR024 are build-owned rather
+ * than a per-file `LintRule`: the check needs the full discovered entity map
+ * (`ctx.entities`), not one `ts.SourceFile`, and that map only exists after
+ * discovery has run. Unlike COR023/024 it never reads `ctx.outputs` — the
+ * bundle is loaded once, up front (async — `loadOkfBundle` reads the
+ * filesystem), and closed over here so the check itself stays the same sync
+ * shape every other `PostSynthCheck` has.
+ */
+export declare const STALE_KNOWLEDGE_BINDING_CHECK_ID = "COR026";
+/**
+ * Build the COR026 check for one loaded bundle. A factory, not a bare
+ * constant, because — unlike `coreReceiptChecks`, which needs nothing but
+ * `ctx.entities` — this check needs the bundle loaded from disk, and
+ * `loadOkfBundle` is async while `PostSynthCheck#check` is not. The caller
+ * loads the bundle once (`resolveKnowledgeDir` + `loadOkfBundle`) and passes
+ * it in; see `../cli/commands/build.ts`.
+ */
+export declare function staleKnowledgeBindingCheck(bundle: OkfBundle): PostSynthCheck;
+/**
+ * Core's own post-synth check over knowledge bindings, run by `chant build`
+ * over the full build result — unscoped, like `coreReceiptChecks`, since a
+ * concept's `binds` can name any discovered entity regardless of which
+ * lexicon owns it.
+ */
+export declare function coreKnowledgeChecks(bundle: OkfBundle): PostSynthCheck[];
+//# sourceMappingURL=knowledge-checks.d.ts.map

package/dist/lint/knowledge-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"knowledge-checks.d.ts","sourceRoot":"","sources":["../../src/lint/knowledge-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,gCAAgC,WAAW,CAAC;AAEzD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,GAAG,cAAc,CAoB5E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,cAAc,EAAE,CAEvE"}

package/dist/lint/output-checks.d.ts

@@ -0,0 +1,5 @@
+import type { PostSynthCheck } from "./post-synth.js";
+export declare const STRINGIFIED_REFERENCE_CHECK_ID = "COR025";
+/** Core-owned post-synth checks over serialized output text (#1526). */
+export declare function coreOutputChecks(): PostSynthCheck[];
+//# sourceMappingURL=output-checks.d.ts.map

package/dist/lint/output-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-checks.d.ts","sourceRoot":"","sources":["../../src/lint/output-checks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AAoCxE,eAAO,MAAM,8BAA8B,WAAW,CAAC;AA0DvD,wEAAwE;AACxE,wBAAgB,gBAAgB,IAAI,cAAc,EAAE,CAEnD"}

package/dist/lint/pipeline-change-gate.d.ts

@@ -0,0 +1,101 @@
+/**
+ * The pipeline-change gate class (#1569): changes to the pipeline itself
+ * route to a stricter gate.
+ *
+ * The honest concession in the PR-flow teardown (rubric-product-research,
+ * 06-objections §1): chant Ops have a `shell` step, so a governed plane is
+ * not automatically immune to "the change edits the machinery that applies
+ * changes." What chant *can* claim — and a plain PR flow structurally cannot
+ * — is that pipeline changes are distinguishable: a composition is data over
+ * a bounded verb registry, and the COMP rules already police the escape
+ * hatches (COMP006 — every `shell` step carries a declared reason;
+ * COMP005 — no noun-shaped escape hatches, `./rules/comp/`). What was missing
+ * was the routing: nothing classified a change as "touches the pipeline" and
+ * required a stricter gate for it, so a change to a composition rode through
+ * the same gate as a replica-count bump.
+ *
+ * This is the cheap first cut #1569 asks for: the registry-only predicate.
+ * A composition that contains only registry verbs is ordinary; a `shell`
+ * step (the deliberate escape hatch) or a change to the set of verbs a
+ * composition invokes trips the stricter class. comp005/comp006 already make
+ * both decidable from the text — this module reuses the same walk
+ * (`./rules/comp/support.ts`) rather than re-deriving it.
+ *
+ * Like #1568's `evaluateUnobservedGate`
+ * (../lifecycle/unobserved-gate.ts), this is a reusable predicate, not a
+ * runtime: classify a change and get back a verdict; the caller (a
+ * `lint.policies` check routed through `policyGate`, an Op step, #1487's
+ * gate-as-fact once it lands) decides what "stricter" means in its own
+ * context. The stricter class composes with #1487's principle that
+ * destructive verbs always wait for a person — pipeline changes are the
+ * second category that should never free-run, because they change what
+ * "gated" means for everything after them. That is why the default policy
+ * below is `"human-always"`, not `"stricter-gate"`.
+ */
+import type { Component } from "../components/component.js";
+/** Why a composition (or a change to one) tripped the pipeline-change class. */
+export type PipelineChangeReason = {
+    kind: "shell-step";
+    phaseName: string;
+} | {
+    kind: "unregistered-verb";
+    stepKind: string;
+    phaseName: string;
+} | {
+    kind: "verb-set-changed";
+    added: string[];
+    removed: string[];
+};
+export interface PipelineChangeClassification {
+    /** True when any reason below applies. */
+    pipelineChange: boolean;
+    reasons: PipelineChangeReason[];
+}
+/** Every non-gate step kind a component's composition invokes, across `deploy` and `rollback` (nested fan-out phases included, via `walkComponent`). `gate` steps are excluded — they are not a capability verb. */
+export declare function componentVerbSet(component: Component): Set<string>;
+/**
+ * Classify a single component's composition (the "cheap first cut", no
+ * before/after needed): a `shell` step trips the class unconditionally — it
+ * is the escape hatch by construction (COMP006) — and any step whose `kind`
+ * is outside `knownKinds` trips it too, since an unregistered verb is,
+ * structurally, the same kind of hole a `shell` step is: something the
+ * bounded registry does not account for.
+ */
+export declare function classifyComponentPipelineChange(component: Component, opts?: {
+    knownKinds?: ReadonlySet<string>;
+}): PipelineChangeClassification;
+/**
+ * Classify a *change* to a component's composition between two revisions
+ * (#1569's "add or modify a shell step ... or the composition graph
+ * itself"): on top of `classifyComponentPipelineChange`'s single-composition
+ * check on `after`, a change also trips the class when the verb set itself
+ * changed — a verb added or removed changes what the composition can invoke,
+ * which is the routing signal even when every individual verb, before and
+ * after, is registry-clean. `before: undefined` (a brand-new component) never
+ * reports a verb-set change — there is nothing to diff against, and the
+ * single-composition check already covers a new component's own shell/
+ * unregistered-verb findings.
+ */
+export declare function classifyPipelineChange(before: Component | undefined, after: Component, opts?: {
+    knownKinds?: ReadonlySet<string>;
+}): PipelineChangeClassification;
+/**
+ * How the gate routes a classified pipeline change.
+ *
+ * - `"human-always"` (the recommended default — see this module's doc
+ *   comment) — a pipeline change never free-runs, mirroring #1487's "a
+ *   destructive verb always waits for a person."
+ * - `"stricter-gate"` — route to a named stricter gate class rather than
+ *   requiring a person on every run; the caller supplies what "stricter"
+ *   means (an additional approval, a narrower blast-radius budget, ...).
+ */
+export type PipelineChangeGatePolicy = "stricter-gate" | "human-always";
+export interface PipelineChangeGateVerdict extends PipelineChangeClassification {
+    /** What the policy says to do about it. `"none"` when the change is not a pipeline change at all. */
+    route: PipelineChangeGatePolicy | "none";
+}
+/** Evaluate a component composition change against a routing policy. Pure — no I/O. */
+export declare function evaluatePipelineChangeGate(before: Component | undefined, after: Component, policy?: PipelineChangeGatePolicy, opts?: {
+    knownKinds?: ReadonlySet<string>;
+}): PipelineChangeGateVerdict;
+//# sourceMappingURL=pipeline-change-gate.d.ts.map

package/dist/lint/pipeline-change-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-change-gate.d.ts","sourceRoot":"","sources":["../../src/lint/pipeline-change-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAczD,gFAAgF;AAChF,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,4BAA4B;IAC3C,0CAA0C;IAC1C,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,oNAAoN;AACpN,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAGlE;AAED;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,SAAS,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAAE,GAC1C,4BAA4B,CAc9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,KAAK,EAAE,SAAS,EAChB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAAE,GAC1C,4BAA4B,CAe9B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAAG,eAAe,GAAG,cAAc,CAAC;AAExE,MAAM,WAAW,yBAA0B,SAAQ,4BAA4B;IAC7E,qGAAqG;IACrG,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAAC;CAC1C;AAED,uFAAuF;AACvF,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,KAAK,EAAE,SAAS,EAChB,MAAM,GAAE,wBAAyC,EACjD,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAAE,GAC1C,yBAAyB,CAG3B"}

package/dist/lint/post-synth.d.ts

@@ -31,6 +31,18 @@ export interface PostSynthContext {
  * Extract the primary content string from a serializer output.
  */
 export declare function getPrimaryOutput(output: string | SerializerResult): string;
+/**
+ * Extract the ADDITIONAL files from a serializer output — everything
+ * {@link getPrimaryOutput} discards.
+ *
+ * Every post-synth check shipped before this one reads the primary output
+ * only, which means a sidecar file (a nested stack template, committed SOPS
+ * ciphertext) is invisible to all of them. That is the right default — the
+ * primary output is what appliers read — but a rule ABOUT a sidecar has to
+ * be able to see it, and `PostSynthContext.outputs` has carried the data all
+ * along. WK8504 (k8s) is the first caller.
+ */
+export declare function getAdditionalFiles(output: string | SerializerResult): Record<string, string>;
 /**
  * A diagnostic from a post-synthesis check.
  *

package/dist/lint/post-synth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,EAAE,CAavB"}
+{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5F;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,EAAE,CAavB"}

package/dist/lint/receipt-checks.d.ts

@@ -0,0 +1,9 @@
+import type { PostSynthCheck } from "./post-synth.js";
+export declare const RECEIPT_PLAIN_STORE_CHECK_ID = "COR023";
+/**
+ * Core's own post-synth checks over effect receipts, run by `chant build`
+ * over the full build result (plugin checks are lexicon-scoped; receipts are
+ * recognized by marker, so this set is deliberately not).
+ */
+export declare function coreReceiptChecks(): PostSynthCheck[];
+//# sourceMappingURL=receipt-checks.d.ts.map

package/dist/lint/receipt-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-checks.d.ts","sourceRoot":"","sources":["../../src/lint/receipt-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AAqCxE,eAAO,MAAM,4BAA4B,WAAW,CAAC;AAgDrD;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,EAAE,CAEpD"}

package/dist/lint/rules/cor022-receipt-leaf.d.ts

@@ -0,0 +1,13 @@
+import * as ts from "typescript";
+import type { LintRule } from "../rule.js";
+/** A variable declaration's `EffectReceipt(...)` initializer, if that is what it is. */
+export declare function receiptFactoryCall(decl: ts.VariableDeclaration): ts.CallExpression | undefined;
+/**
+ * Every variable name bound to an effect receipt in this file: direct
+ * `EffectReceipt(...)` initializers plus identifier aliases, resolved to a
+ * fixpoint so declaration order does not matter. Scope-naive by design, the
+ * same trade COR011 makes — a chant source file is flat declarations.
+ */
+export declare function collectReceiptVariables(sourceFile: ts.SourceFile): Set<string>;
+export declare const cor022ReceiptLeafRule: LintRule;
+//# sourceMappingURL=cor022-receipt-leaf.d.ts.map

package/dist/lint/rules/cor022-receipt-leaf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cor022-receipt-leaf.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/cor022-receipt-leaf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,SAAS,CAAC;AAsCrE,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,GAAG,EAAE,CAAC,cAAc,GAAG,SAAS,CAG9F;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CA2B9E;AASD,eAAO,MAAM,qBAAqB,EAAE,QA0CnC,CAAC"}

package/dist/lint/rules/cor024-receipt-secret-pointer.d.ts

@@ -0,0 +1,3 @@
+import type { LintRule } from "../rule.js";
+export declare const cor024ReceiptSecretPointerRule: LintRule;
+//# sourceMappingURL=cor024-receipt-secret-pointer.d.ts.map

package/dist/lint/rules/cor024-receipt-secret-pointer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cor024-receipt-secret-pointer.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/cor024-receipt-secret-pointer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,SAAS,CAAC;AA2IrE,eAAO,MAAM,8BAA8B,EAAE,QA6E5C,CAAC"}

package/dist/lint/rules/evl001-non-literal-expression.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evl001-non-literal-expression.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/evl001-non-literal-expression.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,SAAS,CAAC;AAsDrE,eAAO,MAAM,8BAA8B,EAAE,QAU5C,CAAC"}
+{"version":3,"file":"evl001-non-literal-expression.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/evl001-non-literal-expression.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,SAAS,CAAC;AA6DrE,eAAO,MAAM,8BAA8B,EAAE,QAU5C,CAAC"}

package/dist/lint/rules/index.d.ts

@@ -24,9 +24,11 @@ export { evl010CompositeNoTransformRule } from "./evl010-composite-no-transform.
 export { cor017CompositeNameMatchRule } from "./cor017-composite-name-match.js";
 export { cor018CompositePreferLexiconTypeRule } from "./cor018-composite-prefer-lexicon-type.js";
 export { cor021EnvLiteralNameRule } from "./cor021-env-literal-name.js";
+export { cor022ReceiptLeafRule, collectReceiptVariables, receiptFactoryCall } from "./cor022-receipt-leaf.js";
+export { cor024ReceiptSecretPointerRule } from "./cor024-receipt-secret-pointer.js";
 export { isInsideCompositeFactory } from "./composite-scope.js";
 /**
- * Load all 22 core lint rules (COR + EVL).
+ * Load all 24 core lint rules (COR + EVL).
  */
 export declare function loadCoreRules(): LintRule[];
 //# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAC;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAyB7D;;GAEG;AACH,wBAAgB,aAAa,IAAI,QAAQ,EAAE,CAyB1C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAC;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3G,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AA2B7D;;GAEG;AACH,wBAAgB,aAAa,IAAI,QAAQ,EAAE,CA2B1C"}

package/dist/okf-read.d.ts

@@ -0,0 +1,78 @@
+import type { Declarable } from "./declarable.js";
+/**
+ * One authored concept document, parsed from a bundle. Deliberately thinner
+ * than the emit side's internal `Concept` (`./okf.ts`) — this is what a
+ * *reader* trusts, and per the #1059 design that is `type`/`title` plus the
+ * single frontmatter key chant interprets, `binds`. Everything else an
+ * author wrote rides along in {@link frontmatter} unexamined, so a consumer
+ * that needs a project-specific key (a future `category`, say) can still
+ * reach it without a reader change.
+ */
+export interface OkfConcept {
+    /** Bundle-relative path (forward-slash separated), e.g. "decisions/public-assets.md". */
+    path: string;
+    /** The frontmatter `type`. May be empty — the reader never rejects a concept for it, unlike the emitter's conformance check. */
+    type: string;
+    /** Frontmatter `title`, when the author set one. */
+    title?: string;
+    /**
+     * This concept's `binds` frontmatter key, normalized to a list — one name,
+     * several, or `[]` for "declared no binding, and that's legitimate."
+     * Structural-looking keys (`name`, `lexicon`, `kind`) are deliberately
+     * *not* surfaced here or anywhere else on this type: the reader interprets
+     * exactly `binds` (#1059's precedence-by-construction), so authored and
+     * inferred knowledge cannot conflict at the fact level.
+     */
+    binds: string[];
+    /** Every frontmatter key this concept's document carries, `binds` included, verbatim. */
+    frontmatter: Record<string, unknown>;
+    /** Markdown body (everything after the closing `---`), unchanged. */
+    body: string;
+}
+/** A loaded OKF knowledge bundle: every authored concept found, reserved files already excluded. */
+export interface OkfBundle {
+    concepts: OkfConcept[];
+}
+/**
+ * Load every authored concept from an OKF knowledge bundle directory.
+ * `index.md`/`log.md` are skipped (reserved, by basename, at any depth —
+ * matching `okfConformanceProblems`'s check on the emit side). A directory
+ * that does not exist yields an empty bundle, not an error: the #1059 design
+ * treats a missing `knowledge/` as "this project has none yet," the same
+ * posture as a project with no lexicons configured.
+ *
+ * A file that fails to parse — no frontmatter block, unparseable YAML, or
+ * frontmatter that isn't a mapping — is skipped with a `console.warn` and
+ * does not affect any other file. Nothing here throws.
+ */
+export declare function loadOkfBundle(dir: string): Promise<OkfBundle>;
+/** {@link bindConcepts}'s result: bound concepts per entity, plus every binding that resolved nothing. */
+export interface BindConceptsResult {
+    /**
+     * Bound concepts keyed by entity logical name — the same names that key
+     * `DiscoveryResult.entities` (`./discovery/index.ts`). An entity with no
+     * bound concepts is absent from the map, never present with `[]`.
+     */
+    bound: Map<string, OkfConcept[]>;
+    /** Every `binds` entry that named no entity in `entities` — chant's own broken-link posture (#1059): a warning for the caller to surface (COR022, #1865), never a load failure. */
+    unresolved: UnresolvedBinding[];
+}
+/** One `binds` entry that resolved to nothing. */
+export interface UnresolvedBinding {
+    /** The concept whose `binds` named this entity. */
+    concept: OkfConcept;
+    /** The unresolved logical name. */
+    name: string;
+}
+/**
+ * Resolve every concept's `binds` against a project's discovered entities.
+ * `entities` is the same shape `./okf.ts`'s emitter takes, `DiscoveryResult`'s
+ * own `entities` map — a bare logical name is unambiguous within one
+ * discovery pass (#1059's "Rejected options" on binding ambiguity).
+ *
+ * A concept with no `binds` contributes to neither `bound` nor `unresolved`;
+ * an unbound concept is legitimate, not an omission (a runbook, a decision
+ * about the project as a whole).
+ */
+export declare function bindConcepts(bundle: OkfBundle, entities: Map<string, Declarable>): BindConceptsResult;
+//# sourceMappingURL=okf-read.d.ts.map

package/dist/okf-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"okf-read.d.ts","sourceRoot":"","sources":["../src/okf-read.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAkB/C;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,gIAAgI;IAChI,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAmCD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CA8CnE;AAED,0GAA0G;AAC1G,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACjC,mLAAmL;IACnL,UAAU,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,OAAO,EAAE,UAAU,CAAC;IACpB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,kBAAkB,CAgBrG"}