@intentius/chant 0.51.0 → 0.52.0

package/dist/cli/build-options.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The one place chant assembles `build()`'s options for a project directory.
+ *
+ * chant #2002 — `chant build` (./commands/build.ts) and the `policyGate` Op
+ * step (../lint/policy.ts's `evaluateProjectPolicies`) both build the same
+ * directory, and each used to assemble that option object itself. The two lists
+ * drifted to nine options against two: the gate built with fold off (the path
+ * `chant build` retired as its default in #1134), without the project's config
+ * (so serializers lost their lexicon-scoped dialect settings and a policy
+ * reading `ctx.docs` inspected different documents), and without `buildRoots`
+ * (so config-declared roots contributed no entities at all). A gate can only
+ * decide on a build `chant build` would produce if the two are assembled from
+ * one place, so they are.
+ *
+ * Two functions rather than one because the *modes* are needed earlier than the
+ * rest: `chant build` arms sandboxed policy execution from the resolved
+ * `sandbox` before it loads any policy module, which happens before build-time
+ * parameters and the ownership marker exist. {@link resolveBuildModes} is that
+ * early half; {@link resolveProjectBuildOptions} takes its result and assembles
+ * everything `build()` is given.
+ */
+import { type ChantConfig } from "../config.js";
+import type { LexiconPlugin } from "../lexicon.js";
+import type { BuildOptions } from "../build.js";
+import type { OwnershipMarker } from "../ownership.js";
+import type { BuildParamProvenance } from "../provenance.js";
+/** The resolved fold/sandbox execution modes for one build. */
+export interface BuildModes {
+    /** #1022/#1134 — fold source modules statically; the default build path. */
+    fold: boolean;
+    /** #1045 Phase 2 — execute run-fallback files in a sandboxed child. */
+    sandbox: boolean;
+}
+/**
+ * Resolve this build's execution modes: an explicit CLI flag wins over
+ * `chant.config.ts`'s `build.fold`/`build.sandbox`, which wins over the default
+ * (fold on, sandbox off). Callers with no flags to offer (the `policyGate` step)
+ * pass no overrides and get the project's own answer.
+ */
+export declare function resolveBuildModes(config: ChantConfig, overrides?: {
+    fold?: boolean;
+    sandbox?: boolean;
+}): BuildModes;
+/** Inputs {@link resolveProjectBuildOptions} needs to assemble a build. */
+export interface ProjectBuildOptionsInput {
+    /** The project's resolved config, from `loadChantConfigUpward`. */
+    config: ChantConfig;
+    /** Directory the config was found in — build roots are rooted here, not at a (possibly sourceDir-scoped) build path. */
+    configDir: string;
+    /** The lexicon plugins loaded for this build. */
+    plugins?: readonly LexiconPlugin[];
+    /** Resolved execution modes, from {@link resolveBuildModes}. */
+    modes: BuildModes;
+    /** The resolved ownership marker, when marking is on. */
+    ownership?: OwnershipMarker;
+    /** This build's resolved build-time parameters (#1064). */
+    buildParams?: BuildParamProvenance[];
+}
+/**
+ * Assemble the option object `build()` takes for a project directory.
+ *
+ * Every option here is derived from the project (its config, its plugins, its
+ * resolved parameters) rather than from the command that asked, so two callers
+ * handing in the same project get byte-identical builds. A new option belongs
+ * in this function, never at a call site.
+ */
+export declare function resolveProjectBuildOptions(input: ProjectBuildOptionsInput): BuildOptions;
+//# sourceMappingURL=build-options.d.ts.map

package/dist/cli/build-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-options.d.ts","sourceRoot":"","sources":["../../src/cli/build-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D,+DAA+D;AAC/D,MAAM,WAAW,UAAU;IACzB,4EAA4E;IAC5E,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAChD,UAAU,CAKZ;AAED,2EAA2E;AAC3E,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,MAAM,EAAE,WAAW,CAAC;IACpB,wHAAwH;IACxH,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,gEAAgE;IAChE,KAAK,EAAE,UAAU,CAAC;IAClB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,2DAA2D;IAC3D,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,wBAAwB,GAAG,YAAY,CAgCxF"}

package/dist/cli/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAUnD,OAAO,EAAuC,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMrG;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2JAA2J;IAC3J,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CACjE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAooB9E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,CAMrF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAsBpF;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AASnD,OAAO,EAAuC,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMrG;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,2CAA2C;IAC3C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAoB/C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2JAA2J;IAC3J,WAAW,CAAC,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CACjE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAymB9E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,CAMrF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAsBpF;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIlD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAItD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,GACxC,MAAM,IAAI,CAmCZ"}

package/dist/cli/handlers/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAE9E;AAmCD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyH/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C3E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAmL3E;AAslBD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyO3E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2L/E;AAsBD;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1E;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAkBD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAE9E;AAmCD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyH/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C3E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAmL3E;AAslBD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgP3E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2L/E;AAsBD;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1E;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAkBD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E"}

package/dist/cli/handlers/run.d.ts

@@ -20,27 +20,6 @@ export declare function runOpLog(ctx: CommandContext): Promise<number>;
 export declare function runOpSignal(ctx: CommandContext): Promise<number>;
 /** `chant run cancel <name> [--components]` — cancels an Op workflow by default, or a component workflow when `--components` is passed (#589), mirroring `runOpSignal`'s id resolution. */
 export declare function runOpCancel(ctx: CommandContext): Promise<number>;
-/**
- * `chant run <name>` dispatcher.
- *
- * Local mode is the default — it runs the Op in-process with no Temporal
- * server. `--temporal` opts into a cluster (gates, schedules, durable resume).
- * `--report` reads a past durable run and is therefore Temporal-only.
- *
- * `chant run --components <name|all>` (#585) is a separate target: discovered
- * `Component` declarations dispatched through the interpret driver
- * (`../../components/driver.ts`) rather than a `*.op.ts` Op. Checked first,
- * mirroring `runGraph`'s `if (ctx.args.components) return
- * runComponentGraph(ctx)` branch (../handlers/graph.ts).
- *
- * chant #1116 — `--report` with `--components` is checked and hard-errored
- * before that dispatch. There is no preview/dry-run mode for the component
- * driver: unlike the Op path (where `--report` reads a past Temporal run),
- * `runOpComponents` has never read `ctx.args.report` at all, so the flag was
- * silently ignored and the command fell through to a real dispatch — observed
- * live reaching an actual cloud shell-out. Erroring here is the safe minimum
- * called out on the issue; a real preview is future work.
- */
 export declare function runOp(ctx: CommandContext): Promise<number>;
 /**
  * `chant run --components <name|all> [--env <env>] [--temporal]` (#585, and

package/dist/cli/handlers/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAA+C,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAO7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA8ClD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM;;;;GAO5F;AA8BD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgEpE;AAoFD,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CtE;AAwCD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CnE;AA2DD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCtE;AAID,2LAA2L;AAC3L,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BtE;AAiCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBhE;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuF1E;AA+OD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiFrE;AAyMD,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/run.ts"],"names":[],"mappings":"AAIA,OAAO,EAA+C,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAQ7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA8ClD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM;;;;GAO5F;AA8BD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgEpE;AAoFD,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CtE;AAwCD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CnE;AA2DD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCtE;AAID,2LAA2L;AAC3L,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BtE;AAgFD,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBhE;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuF1E;AA+OD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoFrE;AA+MD,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAMA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAoF9E;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CA2TpD;AAwmBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5E"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAMA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAoF9E;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CA2TpD;AA0mBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5E"}

package/dist/lifecycle/change-set.d.ts

@@ -187,6 +187,29 @@ export interface GitlabMrReport {
 }
 /** Project a change set onto the GitLab MR plan widget shape. Pure. */
 export declare function gitlabMrReport(cs: ChangeSet): GitlabMrReport;
+/**
+ * Warning a plan should print when it carries a hole — a declared entity the
+ * lexicon could not observe (#1089). The `--json` and `--report gitlab-mr`
+ * shapes have no column for `unobserved`, so both the CLI (on stderr) and the
+ * `markdown` report (in the body, since a reviewer never sees a job's stderr)
+ * read this same wording rather than drifting apart. Empty when the plan has
+ * no hole. Same discipline as {@link disruptionNotices} in `./disruption`.
+ */
+export declare function unobservedPlanNotice(cs: ChangeSet): string[];
 /** Human-readable render of a change set. Pure — returns a string. */
 export declare function renderChangeSet(cs: ChangeSet): string;
+/**
+ * Markdown projection of a change set (#1983) — sized for a PR/MR comment
+ * rather than a terminal. A scannable counts header, entries grouped by
+ * action and attributed to their lexicon, deltas in a fenced block, and any
+ * group past {@link MARKDOWN_FOLD_THRESHOLD} folded into a `<details>` so a
+ * large plan doesn't bury the comment. Pure — no ANSI, no I/O — and
+ * deterministic: same entry ordering as {@link renderChangeSet}.
+ *
+ * Both a hole (#1089) and an expensive verdict (#1665) are surfaced IN the
+ * body, not left to stderr the way `--json` and `--report gitlab-mr` leave
+ * them: a reviewer reading a comment never sees the job's log, so a plan
+ * carrying either must not read as clean.
+ */
+export declare function renderChangeSetMarkdown(cs: ChangeSet): string;
 //# sourceMappingURL=change-set.d.ts.map

package/dist/lifecycle/change-set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../../src/lifecycle/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAY,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAEvF;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,kEAAkE;IAClE,QAAQ,EAAE;QACR,oCAAoC;QACpC,QAAQ,EAAE,OAAO,CAAC;QAClB,oCAAoC;QACpC,UAAU,EAAE,OAAO,CAAC;QACpB,qDAAqD;QACrD,IAAI,EAAE,OAAO,CAAC;QACd;;;;;WAKG;QACH,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,6CAA6C;IAC7C,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,oDAAoD;IACpD,SAAS,EAAE,SAAS,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CA6GvG;AAID,gCAAgC;AAChC,wBAAgB,SAAS,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAarE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,EAAE,EAAE,SAAS,GAAG,cAAc,CAG5D;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAqDrD"}
+{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../../src/lifecycle/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAY,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAEvF;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,kEAAkE;IAClE,QAAQ,EAAE;QACR,oCAAoC;QACpC,QAAQ,EAAE,OAAO,CAAC;QAClB,oCAAoC;QACpC,UAAU,EAAE,OAAO,CAAC;QACpB,qDAAqD;QACrD,IAAI,EAAE,OAAO,CAAC;QACd;;;;;WAKG;QACH,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,6CAA6C;IAC7C,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,oDAAoD;IACpD,SAAS,EAAE,SAAS,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CA6GvG;AAID,gCAAgC;AAChC,wBAAgB,SAAS,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAarE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,EAAE,EAAE,SAAS,GAAG,cAAc,CAG5D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,EAAE,CAO5D;AAwBD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CA2CrD;AA0CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAsC7D"}

package/dist/lint/policy.d.ts

@@ -25,12 +25,28 @@ export interface PolicyEvaluation {
      * of the finding just vanishing.
      */
     suppressed: PostSynthDiagnostic[];
+    /**
+     * chant #2002 — divergences between this evaluation and what `chant build`
+     * would do, named rather than left silent. Today that is a project whose
+     * resolved `build.sandbox` is `true`: the gate builds unsandboxed, because
+     * running it inside the boundary needs the per-execution arming decision
+     * tracked on #1157. Also written to stderr — the gate's caller is an
+     * activity wrapper that surfaces output, not a structured result.
+     */
+    warnings: string[];
 }
 /**
  * Build a project and run its `lint.policies` over the resolved resources,
  * standalone — used by the `policyGate` Op step to gate an apply on the same
  * organizational policy `chant build` enforces. Loads the project's lexicons,
  * builds, then runs the policy pack with `env` (explicit, else `ownership.env`).
+ *
+ * chant #2002 — "the same organizational policy `chant build` enforces" only
+ * holds if it is the same build. The build options are assembled by
+ * `../cli/build-options.ts`'s `resolveProjectBuildOptions`, the single function
+ * `chant build` also calls, rather than by a second list here; a build option
+ * added for one caller and not the other is what let a gate pass a build
+ * `chant build` fails.
  */
 export declare function evaluateProjectPolicies(opts: {
     path: string;

package/dist/lint/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAIxE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAuBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2FAA2F;IAC3F,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA6C5B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAIxE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAuBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2FAA2F;IAC3F,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAwE5B"}

package/dist/op/local-executor.d.ts

@@ -10,7 +10,7 @@
  * implementations and profiles are passed in (loaded dynamically by the CLI),
  * so core never statically depends on `@intentius/chant-lexicon-temporal`.
  */
-import type { OpConfig, GateStep } from "./types.js";
+import type { OpConfig, ActivityStep, GateStep } from "./types.js";
 import { type ActivityFn, type ActivityProfile } from "./activity-registry.js";
 export interface StepRecord {
     phase: string;
@@ -51,6 +51,20 @@ export declare function parseDuration(s: string): number;
 /** Find the first gate step anywhere in the Op (phases + onFailure, including
  * gates nested inside effect steps), if any. */
 export declare function findGate(config: OpConfig): GateStep | undefined;
+/**
+ * Find the first `policyGate` step anywhere in the Op (phases + `onFailure`,
+ * including steps nested inside effect steps), if any.
+ *
+ * chant #2003 — `--sandbox` is a GLOBAL flag (`../cli/registry.ts`), and
+ * `../cli/main.ts` arms the process-wide policy latch off it for every command,
+ * `chant run` included. A `policyGate` step then reaches `loadPolicyChecks`,
+ * which refuses while armed with a message written for a chant maintainer —
+ * shown to a user who passed a documented flag. The combination cannot be
+ * honoured until the gate can build and load policies inside the boundary
+ * (#1157), so both `chant run` paths pre-flight it with this and refuse before
+ * any phase executes, the same shape as {@link findGate}'s pre-flight.
+ */
+export declare function findPolicyGateStep(config: OpConfig): ActivityStep | undefined;
 /**
  * Execute an Op locally. Resolves with the run result on success; rejects with
  * `OpRunFailure` (carrying the partial result) on terminal failure, after

package/dist/op/local-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-executor.d.ts","sourceRoot":"","sources":["../../src/op/local-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAiC,QAAQ,EAA8B,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAmB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAM7F,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;CACb;AAID,kFAAkF;AAClF,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAO/C;AAED,mFAAmF;AACnF,qBAAa,YAAa,SAAQ,KAAK;aACT,MAAM,EAAE,WAAW;gBAAnB,MAAM,EAAE,WAAW;CAIhD;AAmBD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAU/C;AA8BD;gDACgD;AAChD,wBAAgB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAY/D;AAiSD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EACzC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAgDtB"}
+{"version":3,"file":"local-executor.d.ts","sourceRoot":"","sources":["../../src/op/local-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAmB,YAAY,EAAE,QAAQ,EAA8B,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAmB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAM7F,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;CACb;AAID,kFAAkF;AAClF,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAO/C;AAED,mFAAmF;AACnF,qBAAa,YAAa,SAAQ,KAAK;aACT,MAAM,EAAE,WAAW;gBAAnB,MAAM,EAAE,WAAW;CAIhD;AAmBD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAU/C;AA8BD;gDACgD;AAChD,wBAAgB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAY/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAa7E;AAiSD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EACzC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAgDtB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/build-options.test.ts

@@ -0,0 +1,101 @@
+/**
+ * chant #2002 — the shared build-option assembler. `chant build` and the
+ * `policyGate` step both call this; `../lint/policy-build-parity.test.ts`
+ * proves they stay in step, this file pins what the function itself resolves.
+ */
+import { describe, test, expect } from "vitest";
+import { createMockPlugin } from "@intentius/chant-test-utils";
+import type { LexiconPlugin } from "../lexicon";
+import type { ChantConfig } from "../config";
+import { resolveBuildModes, resolveProjectBuildOptions } from "./build-options";
+
+const config = (over: Record<string, unknown> = {}): ChantConfig => over as ChantConfig;
+
+describe("resolveBuildModes", () => {
+  test("fold defaults on, sandbox defaults off (#1134 / #1045)", () => {
+    expect(resolveBuildModes(config())).toEqual({ fold: true, sandbox: false });
+  });
+
+  test("the project config decides when no flag is given", () => {
+    expect(resolveBuildModes(config({ build: { fold: false, sandbox: true } })))
+      .toEqual({ fold: false, sandbox: true });
+  });
+
+  test("an explicit flag wins over the config, in both directions", () => {
+    expect(resolveBuildModes(config({ build: { fold: false } }), { fold: true }).fold).toBe(true);
+    expect(resolveBuildModes(config({ build: { fold: true } }), { fold: false }).fold).toBe(false);
+    expect(resolveBuildModes(config(), { sandbox: true }).sandbox).toBe(true);
+  });
+});
+
+describe("resolveProjectBuildOptions", () => {
+  const modes = { fold: true, sandbox: false };
+
+  test("threads the project config through to the serializers", () => {
+    const projectConfig = config({ forgejo: { runnerLabels: { "ubuntu-latest": "docker-arm" } } });
+    const options = resolveProjectBuildOptions({ config: projectConfig, configDir: "/p", modes });
+    expect(options.config).toEqual(projectConfig);
+  });
+
+  test("collects intrinsics and lexicon names from the loaded plugins", () => {
+    const intrinsic = { tag: "Sub", lexicon: "aws" } as never;
+    const plugins: LexiconPlugin[] = [
+      { ...createMockPlugin({ name: "aws" }), intrinsics: () => [intrinsic] },
+      createMockPlugin({ name: "k8s" }),
+    ];
+    const options = resolveProjectBuildOptions({ config: config(), configDir: "/p", plugins, modes });
+    expect(options.lexicons).toEqual(["aws", "k8s"]);
+    expect(options.intrinsics).toEqual([intrinsic]);
+  });
+
+  test("binds each plugin's buildRoots hook to the CONFIG dir, not the build path", async () => {
+    let seenRoot: string | undefined;
+    const plugins: LexiconPlugin[] = [
+      {
+        ...createMockPlugin({ name: "cedar" }),
+        buildRoots: async (ctx) => {
+          seenRoot = ctx.projectRoot;
+          return { entities: new Map() };
+        },
+      },
+    ];
+    const options = resolveProjectBuildOptions({ config: config(), configDir: "/project", plugins, modes });
+    expect(options.buildRoots).toHaveLength(1);
+    await options.buildRoots![0]({ entities: new Map() });
+    expect(seenRoot).toBe("/project");
+  });
+
+  test("a plugin without a buildRoots hook contributes nothing", () => {
+    const options = resolveProjectBuildOptions({
+      config: config(),
+      configDir: "/p",
+      plugins: [createMockPlugin({ name: "k8s" })],
+      modes,
+    });
+    expect(options.buildRoots).toEqual([]);
+  });
+
+  test("no plugins at all is empty, never undefined-by-accident", () => {
+    const options = resolveProjectBuildOptions({ config: config(), configDir: "/p", modes });
+    expect(options.lexicons).toEqual([]);
+    expect(options.intrinsics).toEqual([]);
+    expect(options.buildRoots).toEqual([]);
+    expect(options.lexiconVersions).toEqual({});
+  });
+
+  test("carries the resolved modes, ownership and build parameters verbatim", () => {
+    const ownership = { stack: "s", env: "prod" } as never;
+    const buildParams = [{ name: "env", value: "prod", source: "default" }] as never;
+    const options = resolveProjectBuildOptions({
+      config: config(),
+      configDir: "/p",
+      modes: { fold: false, sandbox: true },
+      ownership,
+      buildParams,
+    });
+    expect(options.fold).toBe(false);
+    expect(options.sandbox).toBe(true);
+    expect(options.ownership).toBe(ownership);
+    expect(options.buildParams).toBe(buildParams);
+  });
+});

package/src/cli/build-options.ts

@@ -0,0 +1,109 @@
+/**
+ * The one place chant assembles `build()`'s options for a project directory.
+ *
+ * chant #2002 — `chant build` (./commands/build.ts) and the `policyGate` Op
+ * step (../lint/policy.ts's `evaluateProjectPolicies`) both build the same
+ * directory, and each used to assemble that option object itself. The two lists
+ * drifted to nine options against two: the gate built with fold off (the path
+ * `chant build` retired as its default in #1134), without the project's config
+ * (so serializers lost their lexicon-scoped dialect settings and a policy
+ * reading `ctx.docs` inspected different documents), and without `buildRoots`
+ * (so config-declared roots contributed no entities at all). A gate can only
+ * decide on a build `chant build` would produce if the two are assembled from
+ * one place, so they are.
+ *
+ * Two functions rather than one because the *modes* are needed earlier than the
+ * rest: `chant build` arms sandboxed policy execution from the resolved
+ * `sandbox` before it loads any policy module, which happens before build-time
+ * parameters and the ownership marker exist. {@link resolveBuildModes} is that
+ * early half; {@link resolveProjectBuildOptions} takes its result and assembles
+ * everything `build()` is given.
+ */
+import { resolveFoldEnabled, resolveSandboxEnabled, type ChantConfig } from "../config";
+import { collectBuildRootContributors, resolveLexiconVersions } from "./plugins";
+import type { LexiconPlugin } from "../lexicon";
+import type { BuildOptions } from "../build";
+import type { OwnershipMarker } from "../ownership";
+import type { BuildParamProvenance } from "../provenance";
+
+/** The resolved fold/sandbox execution modes for one build. */
+export interface BuildModes {
+  /** #1022/#1134 — fold source modules statically; the default build path. */
+  fold: boolean;
+  /** #1045 Phase 2 — execute run-fallback files in a sandboxed child. */
+  sandbox: boolean;
+}
+
+/**
+ * Resolve this build's execution modes: an explicit CLI flag wins over
+ * `chant.config.ts`'s `build.fold`/`build.sandbox`, which wins over the default
+ * (fold on, sandbox off). Callers with no flags to offer (the `policyGate` step)
+ * pass no overrides and get the project's own answer.
+ */
+export function resolveBuildModes(
+  config: ChantConfig,
+  overrides?: { fold?: boolean; sandbox?: boolean },
+): BuildModes {
+  return {
+    fold: resolveFoldEnabled(config, overrides?.fold),
+    sandbox: resolveSandboxEnabled(config, overrides?.sandbox),
+  };
+}
+
+/** Inputs {@link resolveProjectBuildOptions} needs to assemble a build. */
+export interface ProjectBuildOptionsInput {
+  /** The project's resolved config, from `loadChantConfigUpward`. */
+  config: ChantConfig;
+  /** Directory the config was found in — build roots are rooted here, not at a (possibly sourceDir-scoped) build path. */
+  configDir: string;
+  /** The lexicon plugins loaded for this build. */
+  plugins?: readonly LexiconPlugin[];
+  /** Resolved execution modes, from {@link resolveBuildModes}. */
+  modes: BuildModes;
+  /** The resolved ownership marker, when marking is on. */
+  ownership?: OwnershipMarker;
+  /** This build's resolved build-time parameters (#1064). */
+  buildParams?: BuildParamProvenance[];
+}
+
+/**
+ * Assemble the option object `build()` takes for a project directory.
+ *
+ * Every option here is derived from the project (its config, its plugins, its
+ * resolved parameters) rather than from the command that asked, so two callers
+ * handing in the same project get byte-identical builds. A new option belongs
+ * in this function, never at a call site.
+ */
+export function resolveProjectBuildOptions(input: ProjectBuildOptionsInput): BuildOptions {
+  const { config, configDir, plugins, modes, ownership, buildParams } = input;
+
+  // #1039 — each loaded plugin's registered intrinsics (e.g. AWS's `Sub`), so
+  // a file using a registered intrinsic tagged template folds instead of
+  // unconditionally falling back to run. `intrinsics` is an optional plugin
+  // extension, hence the guard.
+  const intrinsics = plugins?.flatMap((plugin) => plugin.intrinsics?.() ?? []) ?? [];
+
+  // #1063 — the same loaded plugins, by NAME, are this build's allowlist for
+  // following a bare import specifier into a lexicon package (so `Azure`,
+  // `GCP`, `S3Actions`, `CI` fold as values).
+  const lexicons = plugins?.map((plugin) => plugin.name) ?? [];
+
+  return {
+    ownership,
+    config: config as unknown as Record<string, unknown>,
+    fold: modes.fold,
+    sandbox: modes.sandbox,
+    intrinsics,
+    lexicons,
+    // chant #1442 — which lexicon VERSION interpreted each declaration.
+    lexiconVersions: resolveLexiconVersions(lexicons),
+    buildParams,
+    // #1548 piece 3 — config-declared build roots (kustomize dirs, committed
+    // ciphertext), rendered into entities by the owning lexicon's hook.
+    buildRoots: collectBuildRootContributors(
+      plugins,
+      config as unknown as Record<string, unknown>,
+      configDir,
+    ),
+  };
+}

package/src/cli/commands/build.ts

@@ -5,17 +5,15 @@ import {
   resolveOwnershipEnv,
   ownershipEnvDisagreement,
   isOwnershipParamRef,
-  resolveFoldEnabled,
-  resolveSandboxEnabled,
   resolveKnowledgeDir,
 } from "../../config";
+import { resolveBuildModes, resolveProjectBuildOptions } from "../build-options";
 import { loadOkfBundle } from "../../okf-read";
 import { unknownEnvError } from "../../env";
 import type { OwnershipMarker } from "../../ownership";
 import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
-import { resolveLexiconVersions, collectBuildRootContributors } from "../plugins";
 import { runPostSynthChecks } from "../../lint/post-synth";
 import { coreReceiptChecks } from "../../lint/receipt-checks";
 import { coreOutputChecks } from "../../lint/output-checks";
@@ -182,15 +180,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   const configDir = loaded.configPath ? dirname(loaded.configPath) : infraPath;
   const policies = config.lint?.policies ?? [];
 
-  // #1022/#1134 — fold is the default build path: an explicit CLI flag
-  // (--fold/--no-fold) wins over `chant.config.ts`'s `build.fold`, which
-  // wins over the default of `true`.
-  const fold = resolveFoldEnabled(config, options.fold);
-
-  // #1045 Phase 2 — opt-in sandboxed execution of run-fallback files (or,
-  // without --fold, every file). Same CLI-flag-wins-over-config precedence
-  // as fold, resolved independently.
-  const sandbox = resolveSandboxEnabled(config, options.sandbox);
+  // #1022/#1134 (fold) and #1045 Phase 2 (sandbox) — an explicit CLI flag
+  // (--fold/--no-fold, --sandbox) wins over `chant.config.ts`'s
+  // `build.fold`/`build.sandbox`, which wins over the defaults (fold on,
+  // sandbox off). Resolved here rather than with the rest of the build
+  // options below because arming sandboxed policy execution has to happen
+  // before any policy module could be loaded — see #2002 in ../build-options.ts.
+  const modes = resolveBuildModes(config, { fold: options.fold, sandbox: options.sandbox });
+  const { fold, sandbox } = modes;
 
   // #1131 — arm sandboxed policy execution from the RESOLVED value, before any
   // policy module could be loaded. Resolved, not `options.sandbox`, because
@@ -301,48 +298,22 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
     }
   }
 
-  // #1039 — thread each loaded plugin's registered intrinsics (e.g. AWS's
-  // `Sub`) through to the fold path, so a file using a registered intrinsic
-  // tagged template folds instead of unconditionally falling back to run.
-  // `intrinsics` is an optional plugin extension (not every lexicon defines
-  // any), hence the guard.
-  const intrinsics = options.plugins?.flatMap((plugin) => plugin.intrinsics?.() ?? []) ?? [];
-
-  // #1063 — the same loaded plugins, by NAME, are this build's allowlist for
-  // following a bare import specifier into a lexicon package (so `Azure`,
-  // `GCP`, `S3Actions`, `CI` fold as values). A plugin's `name` is the
-  // lexicon name `loadPlugin()` was called with, which is exactly what
-  // `@intentius/chant-lexicon-<name>` was imported from — see
-  // ../plugins.ts and fold-import.ts's `lexiconPackageName`.
-  const lexicons = options.plugins?.map((plugin) => plugin.name) ?? [];
-
-  // chant #1442 — which lexicon VERSION interpreted each declaration. The
-  // declaration is fingerprinted by `hashProps`; the thing that turned it into
-  // output was not recorded at all, so a lexicon bump that changed emitted
-  // output left the build digest identical. Captured here because this is the
-  // layer that knows which lexicons were loaded — `build()` is given only
-  // their names.
-  const lexiconVersions = resolveLexiconVersions(lexicons);
-
-  // Run the build
-  const result = await build(infraPath, options.serializers, undefined, {
-    ownership,
-    config: config as unknown as Record<string, unknown>,
-    fold,
-    sandbox,
-    intrinsics,
-    lexicons,
-    lexiconVersions,
-    buildParams: paramsResolution.provenance,
-    // #1548 piece 3 — config-declared build roots (kustomize dirs), rendered
-    // into entities by the owning lexicon's hook. Rooted at the config dir,
-    // not the (possibly sourceDir-scoped) infra path.
-    buildRoots: collectBuildRootContributors(
-      options.plugins,
-      config as unknown as Record<string, unknown>,
+  // Run the build. #2002 — every option comes from the shared assembler
+  // (../build-options.ts), which `evaluateProjectPolicies` calls too, so the
+  // `policyGate` step decides on the same project this command builds.
+  const result = await build(
+    infraPath,
+    options.serializers,
+    undefined,
+    resolveProjectBuildOptions({
+      config,
       configDir,
-    ),
-  });
+      plugins: options.plugins,
+      modes,
+      ownership,
+      buildParams: paramsResolution.provenance,
+    }),
+  );
 
   // #1022 — report per-file fold vs run so it's visible what still runs.
   // #1424 — one line by default; the per-file lines and their reasons are

package/src/cli/handlers/lifecycle.test.ts

@@ -753,6 +753,25 @@ describe("runLifecyclePlan", () => {
     expect(stdoutBuf.join("\n")).toContain("bucket");
   });
 
+  // #1983 — `--report markdown` emits the reviewer-facing projection instead
+  // of the human render, same as `--report gitlab-mr` swaps in the widget JSON.
+  test("--report markdown emits the markdown projection instead of the human render", async () => {
+    buildMock.mockResolvedValue(makeBuildResult({ aws: ["bucket"] }));
+    const plugins: LexiconPlugin[] = [
+      createMockPlugin({ name: "aws", emulator: awsEmulatorStub, describeResources: staticDescribeResources({}) }),
+    ];
+    const exit = await runLifecyclePlan({
+      args: makeArgs({ path: "plan", extraPositional: "prod", reportFile: "markdown" }),
+      plugins,
+      serializers: plugins.map((p) => p.serializer),
+    });
+    expect(exit).toBe(0);
+    const out = stdoutBuf.join("\n");
+    expect(out).toContain("## Plan for `prod`");
+    expect(out).toContain("### CREATE");
+    expect(out).toContain("- `bucket`");
+  });
+
   // #1620 — the resolved read address rides plan entries the same way it rides
   // the live diff. Regression: the plan path dropped the observation's queried
   // map, so only unobserved rows ever carried an address while the docs