@intentius/chant 0.46.0 → 0.50.0

package/dist/provenance.d.ts

@@ -5,9 +5,11 @@
  * entity object, so it never serializes into the emitted YAML/JSON — it is build
  * metadata, not declared configuration. Read it back with {@link getProvenance}.
  *
- * This is entity-level provenance (which file declared it, and which composite
- * expanded it), not a YAML-line source map. It answers "where did this resource
- * come from?", which is the question an agent asks before changing it.
+ * Entity-level provenance (which file declared it, and which composite expanded
+ * it) answers "where did this resource come from?", which is the question an
+ * agent asks before changing it. {@link PathOrigin} (chant #1443) answers the
+ * follow-up — "what set THIS field" — for the paths a build can attribute
+ * without guessing. Neither is a YAML-line source map.
  *
  * {@link BuildParamProvenance} (chant #1064) is the other half: not "where did
  * this ENTITY come from" but "what INPUTS was this whole BUILD invoked with" —
@@ -27,7 +29,55 @@ export interface EntityProvenance {
      * collapse a composite to a single node at coarse diagram detail levels (#494).
      */
     compositeInstance?: string;
+    /**
+     * Per-path origins within the entity's `props` (chant #1443). Read with
+     * {@link originOfPath}, which does the prefix resolution these keys are
+     * written for.
+     *
+     * Keys are dotted property paths only — `spec.template.spec.containers` —
+     * with `""` for the whole entity. They never carry an array segment, because
+     * a producing mechanism attributes a whole array at once: the coarsest path
+     * it actually determines is the honest one to record, and a positional key
+     * would go stale the moment an element moved.
+     *
+     * Query paths come from #1441's diff addressing and may carry `[#key]` for an
+     * element of an associative list or `[n]` for a positional one. Resolution is
+     * longest segment-boundary prefix, so `spec.containers[#app].image` finds a
+     * key recorded at `spec.containers`, and a key recorded at
+     * `spec.containers.image` never matches it. The two grammars agree without
+     * the recorder needing the lexicon's ordering hook, which it has no access to.
+     *
+     * Absent means this build could not record path origins, not that nothing
+     * governs the entity's fields — the run path executes modules and has no
+     * expression to inspect, and a sandboxed child's provenance does not survive
+     * the wire (`discovery/entity-wire-codec.ts` drops build metadata).
+     */
+    paths?: Record<string, PathOrigin>;
 }
+/**
+ * What produced one path inside an entity's props.
+ *
+ * - `authored` — written in the source file that declared the entity.
+ * - `composite` — the entity was expanded by a composite, or the path was
+ *   supplied by `propagate()`'s shared props at the instance.
+ * - `build-param` — the build parameters the authored expression for this path
+ *   *reads*, which is a syntactic dependency, not a value taint. For
+ *   `replicas: params.tier === "prod" ? 5 : 1` a taint says the value came from
+ *   the literal `5`, which is true and useless; the dependency says the field
+ *   is governed by `tier`, which is what an editor needs to know. Under-reports
+ *   (a shape the collector does not follow drops a dependency) and never
+ *   over-reports a parameter the expression does not mention.
+ */
+export type PathOrigin = {
+    kind: "authored";
+} | {
+    kind: "composite";
+    composite: string;
+    instance: string;
+} | {
+    kind: "build-param";
+    params: string[];
+};
 /**
  * Merge provenance onto an entity. Non-enumerable so it is invisible to
  * serializers and spreads. Existing fields win (`??=`), so the first/most
@@ -36,6 +86,26 @@ export interface EntityProvenance {
 export declare function setProvenance(entity: object, prov: EntityProvenance): void;
 /** Read an entity's build provenance, if any was stamped. */
 export declare function getProvenance(entity: object): EntityProvenance | undefined;
+/**
+ * Record one path's origin, first writer wins — the same rule
+ * {@link setProvenance} applies to entity-level fields, and for the same
+ * reason: expansion runs innermost-composite-first, so the earliest writer is
+ * the most specific one.
+ */
+export declare function setPathProvenance(entity: object, path: string, origin: PathOrigin): void;
+/**
+ * An entity's recorded path origins in sorted key order, or `undefined` when
+ * none were recorded. Sorted because a build's outputs are compared byte for
+ * byte and object key order is not something insertion should decide.
+ */
+export declare function getPathProvenance(entity: object): Record<string, PathOrigin> | undefined;
+/**
+ * The origin governing `path` — the longest recorded key that addresses it or
+ * one of its ancestors. See {@link PROVENANCE_PATH_GRAMMAR}.
+ */
+export declare function originOfPath(paths: Readonly<Record<string, PathOrigin>> | undefined, path: string): PathOrigin | undefined;
+/** One-line rendering of an origin, for diff output. */
+export declare function describePathOrigin(origin: PathOrigin): string;
 /**
  * One resolved build-time parameter (chant #1064, see ../build-params.ts): its
  * final value and which source won it, so a build's parameter inputs are

package/dist/provenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../src/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAe1E;AAED,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAE1E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,sCAAsC;IACtC,MAAM,EAAE,KAAK,GAAG,aAAa,GAAG,KAAK,GAAG,SAAS,CAAC;CACnD"}
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../src/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACpC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAW9C;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAqB1E;AAED,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAExF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,CAQxF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAAG,SAAS,EACvD,IAAI,EAAE,MAAM,GACX,UAAU,GAAG,SAAS,CAQxB;AAED,wDAAwD;AACxD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAS7D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,sCAAsC;IACtC,MAAM,EAAE,KAAK,GAAG,aAAa,GAAG,KAAK,GAAG,SAAS,CAAC;CACnD"}

package/dist/runtime-adapter.d.ts

@@ -19,9 +19,15 @@ export interface RuntimeAdapter {
     readonly hashAlgorithm: string;
     /** Test whether filePath matches a glob pattern */
     globMatch(pattern: string, filePath: string): boolean;
-    /** Spawn a child process and collect output */
+    /**
+     * Spawn a child process and collect output. When `opts.stdin` is set, it is
+     * written to the child's stdin and the stream is closed — the caller never
+     * needs to round-trip content through a shell (`sh -c "echo … | cmd"`) just
+     * to feed a command that reads from stdin (e.g. `git hash-object --stdin`).
+     */
     spawn(cmd: string[], opts?: {
         cwd?: string;
+        stdin?: string;
     }): Promise<SpawnResult>;
     /** Commands to use when spawning package manager / executor */
     readonly commands: RuntimeCommands;

package/dist/runtime-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-adapter.d.ts","sourceRoot":"","sources":["../src/runtime-adapter.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,mDAAmD;IACnD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpE,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;CACpC;AAuCD;;GAEG;AACH,wBAAgB,WAAW,IAAI,cAAc,CAG5C;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAK3C;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEvD"}
+{"version":3,"file":"runtime-adapter.d.ts","sourceRoot":"","sources":["../src/runtime-adapter.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,mDAAmD;IACnD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpF,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;CACpC;AAuDD;;GAEG;AACH,wBAAgB,WAAW,IAAI,cAAc,CAG5C;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,cAAc,CAK3C;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/secret-materialization.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Generated-once secret materialization — the one implementation behind the
+ * `ensure-secret` capability verb (components/verbs/ensure-secret.ts) and the
+ * `ensureSecret(...)` op step builder (op/builders.ts). chant #1829, epic
+ * #1365 decisions 3 and 6.
+ *
+ * The contract is read-then-write:
+ *
+ * - Absent: mint once, through the store adapter, and report `created`.
+ * - Present: verify presence, the declared key-set, and any declared
+ *   metadata, then STOP — present means done. Never mint over an existing
+ *   value. Never rotate implicitly. A re-run of a whole deploy leaves the
+ *   stored bytes untouched.
+ * - Mismatch: fail loudly, naming what mismatched — key names and metadata
+ *   keys, never a value or a value-derived hash (#1365 decision 6).
+ *
+ * The constitutional line (../secret-provenance.ts): no code path here may
+ * hold, log, hash, or compare a secret value. That is structural, not
+ * discipline:
+ *
+ * - {@link ensureSecretMaterialization} never calls the generator. It hands
+ *   the generator to the store adapter's `create`, which consumes the
+ *   material as it writes. The engine's result type has no field that could
+ *   carry material.
+ * - The generator produces {@link SecretMaterial}, an opaque single-use
+ *   handle. The plaintext lives in a module-private WeakMap, not on the
+ *   object: enumeration, `JSON.stringify`, `String(...)`, and `util.inspect`
+ *   all see only a redaction marker. Only {@link consumeSecretMaterial} —
+ *   meant for store adapters, at the write — yields the plaintext, exactly
+ *   once; a second consume throws.
+ * - `describe` returns key names and metadata only, so the mismatch check
+ *   has nothing value-shaped to compare even by accident.
+ *
+ * Store adapters are per-provider (#1830 is the k8s row); core defines only
+ * the seam.
+ */
+/**
+ * A single-use, opaque handle to generated secret material. The plaintext is
+ * not a property of this object — it lives in a module-private WeakMap — so
+ * spreading, enumerating, stringifying, or logging the handle yields only a
+ * redaction marker. A store adapter redeems it with
+ * {@link consumeSecretMaterial} at the moment it writes; nothing else can.
+ */
+export declare class SecretMaterial {
+    private constructor();
+    /** Wrap plaintext in an opaque handle. Call inside a generator only. */
+    static mint(plaintext: string): SecretMaterial;
+    toString(): string;
+    toJSON(): string;
+}
+/**
+ * Redeem a {@link SecretMaterial} handle for its plaintext — exactly once.
+ * For store adapters only, at the write to the backing store. Throws if the
+ * handle was already consumed (or was never minted here): material flows to
+ * the store exactly once and is retained nowhere.
+ */
+export declare function consumeSecretMaterial(material: SecretMaterial): string;
+/**
+ * Produces the material for one key of a secret being minted. Called by the
+ * store adapter (never by the engine) once per declared key, at create time —
+ * generation is apply-time I/O, never synthesis.
+ */
+export type SecretMaterialGenerator = (key: string) => SecretMaterial | Promise<SecretMaterial>;
+/** 32 bytes from the CSPRNG, base64url — the default mint. */
+export declare const defaultSecretMaterialGenerator: SecretMaterialGenerator;
+/** What `describe` reports about an existing secret: key NAMES and metadata. Never values. */
+export interface SecretStoreDescription {
+    /** The key names present in the stored secret. */
+    readonly keys: readonly string[];
+    /** Store metadata (e.g. k8s labels/annotations the provider surfaces). */
+    readonly metadata?: Readonly<Record<string, string>>;
+}
+/**
+ * A provider's view of one secret store — the seam #1830 (k8s) and future
+ * provider rows implement. `create` receives the generator and consumes each
+ * key's material as it writes; no method returns material.
+ */
+export interface SecretStoreAdapter {
+    /** Whether a secret of this name exists in the store. */
+    exists(name: string): Promise<boolean>;
+    /** Key names and metadata of an existing secret. Never values. */
+    describe(name: string): Promise<SecretStoreDescription>;
+    /**
+     * Create the secret, minting material for each declared key via
+     * `generate` and writing it straight to the store. Returns nothing:
+     * material must not travel back through this seam.
+     */
+    create(name: string, keys: readonly string[], generate: SecretMaterialGenerator): Promise<void>;
+}
+/** The declared contract to ensure — names and keys only, never material. */
+export interface EnsureSecretSpec {
+    /** The secret's name as the store knows it. */
+    readonly name: string;
+    /** The declared key-set. Creation mints one value per key; verification compares names. */
+    readonly keys: readonly string[];
+    /** Declared metadata an existing secret must carry (compared per key; mismatches are reported by KEY). */
+    readonly metadata?: Readonly<Record<string, string>>;
+}
+/** What `ensureSecretMaterialization` did. No field can carry material. */
+export interface EnsureSecretOutcome {
+    /** `created` = minted now (first materialization); `present` = existed and matched the contract (no write). */
+    readonly outcome: "created" | "present";
+    /** The secret's name. */
+    readonly name: string;
+    /** The declared key names the contract was checked (or minted) against. */
+    readonly keys: readonly string[];
+}
+/**
+ * The loud failure: an existing secret does not match its declared contract.
+ * `mismatches` names what differed — key names and metadata keys only.
+ * Constructing one with anything value-shaped is the reviewer's tripwire;
+ * nothing in this module can, because nothing in this module holds a value.
+ */
+export declare class SecretContractMismatchError extends Error {
+    /** The secret's name. */
+    readonly secretName: string;
+    /** Human-readable mismatch descriptions, naming keys — never values. */
+    readonly mismatches: readonly string[];
+    constructor(
+    /** The secret's name. */
+    secretName: string, 
+    /** Human-readable mismatch descriptions, naming keys — never values. */
+    mismatches: readonly string[]);
+}
+/**
+ * Ensure a `generated-once` secret exists and matches its declared contract.
+ * Read-then-write:
+ *
+ * - Absent: `store.create(name, keys, generate)` — one mint, then done.
+ * - Present and matching: no write of any kind; returns `present`.
+ * - Present and mismatching: throws {@link SecretContractMismatchError}
+ *   naming the missing/unexpected key names and mismatched metadata keys.
+ *
+ * The engine never calls `generate` itself and never sees what the adapter
+ * writes; its return value carries names only.
+ */
+export declare function ensureSecretMaterialization(store: SecretStoreAdapter, spec: EnsureSecretSpec, generate?: SecretMaterialGenerator): Promise<EnsureSecretOutcome>;
+//# sourceMappingURL=secret-materialization.d.ts.map

package/dist/secret-materialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-materialization.d.ts","sourceRoot":"","sources":["../src/secret-materialization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAWH;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,OAAO;IAEP,wEAAwE;IACxE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc;IAM9C,QAAQ,IAAI,MAAM;IAIlB,MAAM,IAAI,MAAM;CAQjB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAStE;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAEhG,8DAA8D;AAC9D,eAAO,MAAM,8BAA8B,EAAE,uBACe,CAAC;AAI7D,8FAA8F;AAC9F,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxD;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjG;AAID,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,0GAA0G;IAC1G,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,+GAA+G;IAC/G,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC;IACxC,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IAElD,yBAAyB;aACT,UAAU,EAAE,MAAM;IAClC,wEAAwE;aACxD,UAAU,EAAE,SAAS,MAAM,EAAE;;IAH7C,yBAAyB;IACT,UAAU,EAAE,MAAM;IAClC,wEAAwE;IACxD,UAAU,EAAE,SAAS,MAAM,EAAE;CAQhD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,kBAAkB,EACzB,IAAI,EAAE,gBAAgB,EACtB,QAAQ,GAAE,uBAAwD,GACjE,OAAO,CAAC,mBAAmB,CAAC,CA0C9B"}

package/dist/secret-provenance.d.ts

@@ -0,0 +1,218 @@
+/**
+ * Secret provenance vocabulary (chant #1828, epic #1365).
+ *
+ * A secret's PROVENANCE is where its value comes from — never what the value
+ * is. chant's constitutional line on secrets: no code path may hold, log,
+ * hash, or compare a secret value. This module makes that structural: the
+ * declaration types have no field that could carry material, the factory
+ * rejects material-shaped fields at both the type level (`never` fields) and
+ * at runtime (own-property check, naming only the offending KEY), and
+ * "mismatch" anywhere downstream means presence, declared key-set, and
+ * metadata — never a value or a value-derived hash (#1365 decision 6).
+ *
+ * The closed kind set:
+ *
+ * - `referenced` — the value exists out of band (a human or an external
+ *   process put it where consumers read it). chant records only that the
+ *   estate depends on it, which is what lets the consumed-but-unproduced
+ *   check (#1382) ship as an error instead of a guess.
+ * - `from-provider` — a declared provider binding materializes it (the
+ *   operator/CRD seam; `K8s::Infisical::InfisicalSecret` from #1321 is the
+ *   exemplar). The declaration POINTS at that binding, it does not re-model
+ *   it.
+ * - `generated-once` — minted on first materialization, then never
+ *   regenerated (present means done). The declaration carries contract flags
+ *   only — e.g. the declared key-set — never mint parameters holding
+ *   material. `generated-once` secrets never enter the prunable set (#1365
+ *   decision 5).
+ * - `committed-encrypted` — sops-style ciphertext committed in the repo,
+ *   decrypted by the delivery system (Flux) straight into the target. The
+ *   declaration records a repo-relative PATH to the ciphertext, never the
+ *   bytes: the factory is pure and touches no filesystem, so it still folds
+ *   under `--sandbox`. The bytes are read at `buildRoots()` — the one
+ *   sanctioned impure seam — and emitted as a sidecar file, never as a
+ *   document in the primary output. See
+ *   `docs/design/committed-encrypted-sops-provenance.md`.
+ *
+ * Declarations are serializer-neutral: discovery collects them like any
+ * entity (they are Declarables), but `partitionByLexicon` (../build.ts)
+ * excludes them from every serializer partition, so no lexicon ever emits
+ * them. They are data that lint rules and lexicons READ (via
+ * {@link collectSecretDeclarations}), not output.
+ */
+import { type Declarable } from "./declarable.js";
+/** The closed union of secret origins. */
+export type SecretProvenance = "referenced" | "from-provider" | "generated-once" | "committed-encrypted";
+/** Every provenance kind, for exhaustiveness checks. */
+export declare const SECRET_PROVENANCE_KINDS: readonly SecretProvenance[];
+/**
+ * Encryption tools a {@link CommittedEncryptedSecretDeclaration} understands.
+ * A closed union with one member, not a free string: a second tool later is a
+ * deliberate widening with a detection rule attached, not an unvalidated
+ * string that silently means nothing.
+ */
+export type SecretEncryption = "sops";
+/** Every encryption tool, for exhaustiveness checks. */
+export declare const SECRET_ENCRYPTION_TOOLS: readonly SecretEncryption[];
+/** Marker symbol identifying a secret provenance declaration. `Symbol.for` so
+ * it survives the entity-wire codec (../discovery/entity-wire-codec.ts). */
+export declare const SECRET_DECLARATION_MARKER: unique symbol;
+/** The `entityType` every secret declaration carries. */
+export declare const SECRET_DECLARATION_ENTITY_TYPE = "Chant::SecretProvenance";
+/**
+ * Points a `from-provider` declaration at the provider binding that
+ * materializes the secret — the CRD seam, not a re-model of it. The binding
+ * itself is an ordinary declarable in its own lexicon (e.g. an
+ * `InfisicalSecret` instance, #1321); this ref names it so lint can resolve
+ * the pair without core depending on any lexicon.
+ */
+export interface SecretProviderRef {
+    /** Entity name (export name) of the provider binding declarable in this project. */
+    readonly binding: string;
+    /**
+     * Expected `entityType` of the binding (e.g.
+     * `"K8s::Infisical::InfisicalSecret"`). Optional; when present, lint can
+     * verify the named binding is actually the kind of seam the declaration
+     * claims.
+     */
+    readonly entityType?: string;
+}
+/**
+ * Fields that would carry secret material, forbidden by construction. Typed
+ * as `never` on every factory input so they fail to compile even when the
+ * input object was widened or spread (plain excess-property checks only catch
+ * object literals). The runtime check in {@link declareSecret} is the same
+ * list, for untyped callers.
+ */
+interface NoSecretMaterial {
+    readonly value?: never;
+    readonly data?: never;
+    readonly stringData?: never;
+    readonly material?: never;
+    readonly plaintext?: never;
+    readonly ciphertext?: never;
+}
+/** Fields shared by every secret declaration. */
+interface SecretDeclarationBase extends Declarable {
+    readonly [SECRET_DECLARATION_MARKER]: true;
+    readonly lexicon: "chant";
+    readonly entityType: typeof SECRET_DECLARATION_ENTITY_TYPE;
+    /** The secret's name as consumers know it (e.g. the k8s Secret name). */
+    readonly name: string;
+    /** Which of the closed kind set this declaration is. */
+    readonly provenance: SecretProvenance;
+}
+/** A secret whose value exists out of band. */
+export interface ReferencedSecretDeclaration extends SecretDeclarationBase {
+    readonly provenance: "referenced";
+    /** Where consumers find it — free-form (a namespace, a vault path, a doc link). */
+    readonly scope?: string;
+}
+/** A secret a declared provider binding materializes. */
+export interface FromProviderSecretDeclaration extends SecretDeclarationBase {
+    readonly provenance: "from-provider";
+    readonly provider: SecretProviderRef;
+}
+/** A secret minted on first materialization and never regenerated. */
+export interface GeneratedOnceSecretDeclaration extends SecretDeclarationBase {
+    readonly provenance: "generated-once";
+    /**
+     * The declared key-set of the materialized secret. This is the contract a
+     * materializer (#1830) checks for mismatch — presence and keys, never
+     * values.
+     */
+    readonly keys?: readonly string[];
+}
+/**
+ * A secret whose ciphertext is committed to the repo and decrypted by the
+ * delivery system on the way into the target.
+ *
+ * The declaration is a POINTER: `file` is a repo-relative path, and nothing
+ * here carries bytes. That is what keeps the factory pure — the ciphertext is
+ * read at `buildRoots()` and emitted as a sidecar, never inlined into the
+ * primary output an applier reads.
+ */
+export interface CommittedEncryptedSecretDeclaration extends SecretDeclarationBase {
+    readonly provenance: "committed-encrypted";
+    /** Repo-relative path to the committed ciphertext file. */
+    readonly file: string;
+    /** Encryption tool. Defaults to `"sops"` when omitted. */
+    readonly encryption: SecretEncryption;
+    /**
+     * Public recipient identifiers — age recipients or PGP fingerprints. Public
+     * by definition, which is the opposite of material; a private key here is
+     * refused by the factory.
+     */
+    readonly recipients?: readonly string[];
+    /**
+     * The declared key-set of the decrypted Secret — the same contract meaning
+     * as {@link GeneratedOnceSecretDeclaration.keys}: presence and key names,
+     * never values. SOPS leaves key NAMES cleartext, so this is checkable
+     * against the file itself.
+     */
+    readonly keys?: readonly string[];
+}
+/** A secret provenance declaration — the discriminant is `provenance`. */
+export type SecretDeclaration = ReferencedSecretDeclaration | FromProviderSecretDeclaration | GeneratedOnceSecretDeclaration | CommittedEncryptedSecretDeclaration;
+/** Narrow a declaration to the committed-encrypted kind. */
+export declare function isCommittedEncryptedSecret(decl: SecretDeclaration): decl is CommittedEncryptedSecretDeclaration;
+/** Factory input for a `referenced` secret. */
+export interface ReferencedSecretInput extends NoSecretMaterial {
+    readonly name: string;
+    readonly provenance: "referenced";
+    readonly scope?: string;
+}
+/** Factory input for a `from-provider` secret. */
+export interface FromProviderSecretInput extends NoSecretMaterial {
+    readonly name: string;
+    readonly provenance: "from-provider";
+    readonly provider: SecretProviderRef;
+}
+/** Factory input for a `generated-once` secret. */
+export interface GeneratedOnceSecretInput extends NoSecretMaterial {
+    readonly name: string;
+    readonly provenance: "generated-once";
+    readonly keys?: readonly string[];
+}
+/** Factory input for a `committed-encrypted` secret. */
+export interface CommittedEncryptedSecretInput extends NoSecretMaterial {
+    readonly name: string;
+    readonly provenance: "committed-encrypted";
+    /**
+     * Repo-relative path to the committed ciphertext file — `file`, never
+     * `ciphertext`: the declaration points at bytes, it does not carry them,
+     * and `ciphertext` is a forbidden material field.
+     */
+    readonly file: string;
+    /** Encryption tool. Closed union; `"sops"` is its only member today. */
+    readonly encryption?: SecretEncryption;
+    /** Public recipient identifiers — age recipients or PGP fingerprints. */
+    readonly recipients?: readonly string[];
+    /** The declared key-set of the decrypted Secret. Names only, never values. */
+    readonly keys?: readonly string[];
+}
+export type SecretDeclarationInput = ReferencedSecretInput | FromProviderSecretInput | GeneratedOnceSecretInput | CommittedEncryptedSecretInput;
+/**
+ * Declare a secret's provenance. The returned object is a locked Declarable:
+ * discovery collects it like any entity, `chant list` shows it, lint and
+ * lexicons read it — and no serializer ever emits it.
+ *
+ * Only the fields the kind defines are copied onto the declaration; anything
+ * else on the input — in particular anything that could carry material — is
+ * either a compile error ({@link NoSecretMaterial}) or a thrown error here.
+ * The thrown message names the offending KEY only, never its value.
+ */
+export declare function declareSecret(input: ReferencedSecretInput): ReferencedSecretDeclaration;
+export declare function declareSecret(input: FromProviderSecretInput): FromProviderSecretDeclaration;
+export declare function declareSecret(input: GeneratedOnceSecretInput): GeneratedOnceSecretDeclaration;
+export declare function declareSecret(input: CommittedEncryptedSecretInput): CommittedEncryptedSecretDeclaration;
+/** Type guard for a secret provenance declaration. */
+export declare function isSecretDeclaration(value: unknown): value is SecretDeclaration;
+/**
+ * Extract the secret declarations from a discovered entity map — the read
+ * surface for lint rules (#1382) and lexicon materializers (#1830). Keyed by
+ * entity name (export name), the same key `DiscoveryResult.entities` uses.
+ */
+export declare function collectSecretDeclarations(entities: ReadonlyMap<string, Declarable>): Map<string, SecretDeclaration>;
+export {};
+//# sourceMappingURL=secret-provenance.d.ts.map

package/dist/secret-provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-provenance.d.ts","sourceRoot":"","sources":["../src/secret-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAElE,0CAA0C;AAC1C,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,qBAAqB,CAAC;AAE1B,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,EAAE,SAAS,gBAAgB,EAK9D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEtC,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,EAAE,SAAS,gBAAgB,EAAa,CAAC;AAqB7E;4EAC4E;AAC5E,eAAO,MAAM,yBAAyB,eAAyC,CAAC;AAEhF,yDAAyD;AACzD,eAAO,MAAM,8BAA8B,4BAA4B,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,UAAU,gBAAgB;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;CAC7B;AAWD,iDAAiD;AACjD,UAAU,qBAAsB,SAAQ,UAAU;IAChD,QAAQ,CAAC,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,8BAA8B,CAAC;IAC3D,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,+CAA+C;AAC/C,MAAM,WAAW,2BAA4B,SAAQ,qBAAqB;IACxE,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,yDAAyD;AACzD,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,8BAA+B,SAAQ,qBAAqB;IAC3E,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mCAAoC,SAAQ,qBAAqB;IAChF,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GACzB,2BAA2B,GAC3B,6BAA6B,GAC7B,8BAA8B,GAC9B,mCAAmC,CAAC;AAExC,4DAA4D;AAC5D,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB,GACtB,IAAI,IAAI,mCAAmC,CAE7C;AAED,+CAA+C;AAC/C,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,uBAAwB,SAAQ,gBAAgB;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC;AAED,mDAAmD;AACnD,MAAM,WAAW,wBAAyB,SAAQ,gBAAgB;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,wDAAwD;AACxD,MAAM,WAAW,6BAA8B,SAAQ,gBAAgB;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,MAAM,sBAAsB,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,wBAAwB,GACxB,6BAA6B,CAAC;AAElC;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,2BAA2B,CAAC;AACzF,wBAAgB,aAAa,CAAC,KAAK,EAAE,uBAAuB,GAAG,6BAA6B,CAAC;AAC7F,wBAAgB,aAAa,CAAC,KAAK,EAAE,wBAAwB,GAAG,8BAA8B,CAAC;AAC/F,wBAAgB,aAAa,CAC3B,KAAK,EAAE,6BAA6B,GACnC,mCAAmC,CAAC;AA2KvC,sDAAsD;AACtD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAO9E;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GACxC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAMhC"}

package/dist/serializer.d.ts

@@ -18,6 +18,17 @@ export interface SerializeContext {
      * ad-hoc builds (e.g. context tools) that pass no config.
      */
     config?: Record<string, unknown>;
+    /**
+     * Effect receipts (#1832, epic #1703) declared in this lexicon's partition.
+     * Withheld from the `entities` map by the build: receipts are observe-only
+     * to the generic apply path, and the serialized output is what feeds
+     * appliers, so a receipt must never enter the apply-bound document. A
+     * serializer that wants to render receipts for visibility (#1835) reads
+     * them here and puts them anywhere BUT the section an applier writes from;
+     * a serializer that ignores this field emits nothing for them, which is the
+     * safe default.
+     */
+    receipts?: ReadonlyMap<string, Declarable>;
 }
 /**
  * Result of serialization that may include additional files (e.g. nested stack templates).
@@ -27,6 +38,24 @@ export interface SerializerResult {
     primary: string;
     /** Additional files keyed by filename (e.g. "network.template.json" → content) */
     files?: Record<string, string>;
+    /**
+     * Basenames from `files` that must reach disk byte-for-byte — never
+     * `JSON.parse`d, key-sorted, or reformatted to YAML by the build's
+     * additional-file writer (chant#1937).
+     *
+     * A separate field rather than a per-file flag on `files` (e.g. widening
+     * its value to `string | { content: string; verbatim: boolean }`) so every
+     * existing lexicon serializer that returns `files: Record<string, string>`
+     * keeps compiling and behaving unchanged: this list defaults to empty, and
+     * only a serializer that actually carries opaque/pre-formatted bytes
+     * (committed ciphertext, a vendored file) needs to populate it.
+     *
+     * Before this field existed, "JSON.parse fails on this content" was the
+     * only way to opt out of round-tripping — true for YAML that happens not to
+     * parse as JSON, but never a structural guarantee (YAML is a JSON
+     * superset).
+     */
+    verbatimFiles?: string[];
     /**
      * Non-fatal diagnostics produced during serialization (e.g. a dialect
      * dropping keys the target platform ignores). The build pipeline collects

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtC;;;;;OAKG;IACH,SAAS,CACP,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,CAAC,EAAE,aAAa,EAAE,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,GAAG,gBAAgB,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;CACpD"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtC;;;;;OAKG;IACH,SAAS,CACP,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,CAAC,EAAE,aAAa,EAAE,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,GAAG,gBAAgB,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;CACpD"}

package/dist/toml.d.ts

@@ -1,9 +1,44 @@
 /**
- * TOML emitter and parser — re-exports from split modules.
+ * Lightweight TOML parser (#446).
  *
- * Import from here for the public API:
- *   import { emitTOML, parseTOML } from "@intentius/chant/toml";
+ * Written for the audit engine's spike: is there a pure, dependency-free way
+ * to parse a config format the engine can't read today? TOML fits — it is a
+ * fully-specified, static (no macros/interpolation/imports) grammar, so a
+ * hand-rolled tokenizer + recursive-descent parser covers it without any
+ * runtime surface a Workers sandbox would reject (no `eval`, no native
+ * modules, no filesystem/network).
+ *
+ * Covers the subset of TOML v1.0 that real-world deploy configs
+ * (`wrangler.toml`, `Cargo.toml`, `pyproject.toml`, `netlify.toml`) actually
+ * use: basic/literal strings (single-line), integers, floats, booleans,
+ * arrays (including multi-line), inline tables, dotted keys, standard tables
+ * (`[a.b]`), and arrays of tables (`[[a.b]]`).
+ *
+ * Deliberately NOT a full spec implementation:
+ *  - Multi-line strings (`"""..."""`, `'''...'''`) are read as a single
+ *    opaque string body (no line-ending backslash trimming); good enough to
+ *    not crash, not spec-perfect for continuation whitespace.
+ *  - Dates/times are returned as their raw source text (a string), not a
+ *    `Date` — none of the checks built on this parser need calendar math.
+ *  - A dotted-key path element must be a bare word or a plain quoted string;
+ *    mixing exotic key shapes mid-path is not supported.
+ * These gaps only matter for exotic TOML; they don't affect the shapes the
+ * audit checks read (`[vars]`, `[[kv_namespaces]]`, `[env.NAME]`, …).
+ */
+export declare class TomlParseError extends Error {
+}
+type TomlValue = string | number | boolean | TomlValue[] | {
+    [k: string]: TomlValue;
+};
+type TomlTable = {
+    [k: string]: TomlValue;
+};
+/**
+ * Parse a TOML document into a plain nested object. Throws {@link TomlParseError}
+ * on malformed input — callers that scan arbitrary repo files should wrap the
+ * call in a try/catch (matching the rest of the audit engine's tolerance for
+ * unparseable content).
  */
-export { emitTOML, type EmitTOMLOptions } from "./toml-emit.js";
-export { parseTOML } from "./toml-parse.js";
+export declare function parseTOML(input: string): TomlTable;
+export {};
 //# sourceMappingURL=toml.d.ts.map

package/dist/toml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toml.d.ts","sourceRoot":"","sources":["../src/toml.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"toml.d.ts","sourceRoot":"","sources":["../src/toml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAqK5C,KAAK,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AACtF,KAAK,SAAS,GAAG;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAgJ5C;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CA8BlD"}

package/dist/yaml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../src/yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0BH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAgH/D;AAMD,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASlE;AAiFD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,WAAW,CA8Eb;AA0GD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,WAAW,CAqGb;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAelD"}
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../src/yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0BH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAgH/D;AAMD,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASlE;AAiFD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,WAAW,CA8Eb;AA0GD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,WAAW,CAqGb;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAwBlD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.46.0",
+  "version": "0.50.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -91,5 +91,8 @@
   "devDependencies": {
     "@cdktf/hcl2json": "^0.21.0",
     "ajv": "^8.20.0"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1"
   }
 }

package/src/audit/catalog.test.ts

@@ -91,7 +91,7 @@ describe("RULE_CATALOG (aggregated: core static + lexicon-contributed, #687)", (
       expect(m.remediation.length, `${id} has remediation`).toBeGreaterThan(0);
       expect(["merge-worthy", "report-only"]).toContain(m.tier);
       expect(["deterministic", "guidance"]).toContain(m.fixKind);
-      expect(["security", "correctness", "best-practice"], `${id} has a valid category`).toContain(m.category);
+      expect(["security", "correctness", "best-practice", "efficiency"], `${id} has a valid category`).toContain(m.category);
     }
   });