@intentius/chant 0.6.0 → 0.8.0

package/dist/lifecycle/live-diff.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Live-state diff: compares declared vs observed-now vs observed-then.
+ *
+ * Produces structured drift signal — *what is in the cloud right now* against
+ * both *what was declared in source* and *what was observed at the last
+ * snapshot*. Pure function; all I/O happens in the caller.
+ *
+ * Two diff flavors:
+ *   - diffLive       — entity-keyed (declared ↔ observedNow ↔ observedThen)
+ *   - diffLiveArtifacts — context-keyed (observedNow ↔ observedThen only;
+ *                        no `declared` axis since artifacts aren't declared
+ *                        as chant entities — they're created by tooling
+ *                        outside chant's entity model)
+ */
+import type { ResourceMetadata, ArtifactMetadata } from "../lexicon.js";
+export interface AttributeChange {
+    /** Attribute path (e.g. "status", "physicalId", "attributes.tags.env"). */
+    path: string;
+    oldValue: unknown;
+    newValue: unknown;
+}
+export interface ResourceDrift {
+    name: string;
+    type: string;
+    changes: AttributeChange[];
+}
+export interface LiveDiffResult {
+    /** Declared in current build, but not observed in cloud right now. */
+    missing: string[];
+    /** Observed in cloud right now, but not declared. */
+    orphan: string[];
+    /** Was in last snapshot but isn't observed now. */
+    disappeared: string[];
+    /** Observed now and declared, but not in the previous snapshot. */
+    newlyObserved: string[];
+    /** Observed both then and now; metadata changed. */
+    driftedSinceSnapshot: ResourceDrift[];
+    /** Observed both then and now; metadata identical. */
+    unchanged: string[];
+}
+export interface DiffLiveInput {
+    /** Entity names from the current build. */
+    declared: Set<string>;
+    /** Resources returned by `plugin.describeResources()` right now. */
+    observedNow: Record<string, ResourceMetadata>;
+    /** Resources captured by the previous snapshot, if any. */
+    observedThen: Record<string, ResourceMetadata> | undefined;
+}
+export declare function diffLive(input: DiffLiveInput): LiveDiffResult;
+export interface LiveArtifactDiffResult {
+    /** Observed now, not in previous snapshot. */
+    added: string[];
+    /** In previous snapshot, not observed now. */
+    removed: string[];
+    /** In both; metadata changed. */
+    changed: ResourceDrift[];
+    /** In both; metadata identical. */
+    unchanged: string[];
+}
+export interface DiffLiveArtifactsInput {
+    /** Artifacts returned by `plugin.listArtifacts()` right now. */
+    observedNow: Record<string, ArtifactMetadata>;
+    /** Artifacts captured by the previous snapshot, if any. */
+    observedThen: Record<string, ArtifactMetadata> | undefined;
+}
+export declare function diffLiveArtifacts(input: DiffLiveArtifactsInput): LiveArtifactDiffResult;
+//# sourceMappingURL=live-diff.d.ts.map

package/dist/lifecycle/live-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-diff.d.ts","sourceRoot":"","sources":["../../src/lifecycle/live-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qDAAqD;IACrD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,mDAAmD;IACnD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mEAAmE;IACnE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,oBAAoB,EAAE,aAAa,EAAE,CAAC;IACtC,sDAAsD;IACtD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,CAAC;CAC5D;AAyCD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAiE7D;AAID,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,mCAAmC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,CAAC;CAC5D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,sBAAsB,CAmCvF"}

package/dist/lifecycle/snapshot.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Snapshot orchestration: queries plugins for deployed resource metadata,
+ * assembles LifecycleSnapshots, computes build digests, and writes to git.
+ */
+import type { ObservationLexicon } from "../lexicon.js";
+import type { BuildResult } from "../build.js";
+import type { LifecycleSnapshot } from "./types.js";
+export interface TakeSnapshotResult {
+    snapshots: LifecycleSnapshot[];
+    commit: string;
+    warnings: string[];
+    errors: string[];
+}
+/**
+ * Take state snapshots for all plugins that implement describeResources.
+ */
+export declare function takeSnapshot(environment: string, plugins: ObservationLexicon[], buildResult: BuildResult, opts?: {
+    cwd?: string;
+}): Promise<TakeSnapshotResult>;
+//# sourceMappingURL=snapshot.d.ts.map

package/dist/lifecycle/snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/lifecycle/snapshot.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAsC,MAAM,YAAY,CAAC;AACzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAiEjD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,kBAAkB,CAAC,CA+G7B"}

package/dist/lifecycle/types.d.ts

@@ -0,0 +1,61 @@
+import type { ResourceMetadata, ArtifactMetadata } from "../lexicon.js";
+export type { ResourceMetadata, ArtifactMetadata } from "../lexicon.js";
+/**
+ * State snapshot for a single lexicon in an environment.
+ */
+export interface LifecycleSnapshot {
+    lexicon: string;
+    environment: string;
+    /** Main branch commit this corresponds to */
+    commit: string;
+    /** ISO timestamp when the snapshot was taken */
+    timestamp: string;
+    /** Resource metadata keyed by logical name */
+    resources: Record<string, ResourceMetadata>;
+    /** Artifact metadata keyed by server-side identifier (lexicon-specific). */
+    artifacts?: Record<string, ArtifactMetadata>;
+    /** Build digest at snapshot time — what was declared when this snapshot was taken */
+    digest?: BuildDigest;
+}
+/**
+ * Digest of a single resource declaration.
+ */
+export interface ResourceDigest {
+    /** Entity type (e.g. AWS::S3::Bucket) */
+    type: string;
+    /** Which lexicon owns this resource */
+    lexicon: string;
+    /** Hash of deterministically-serialized declaration props */
+    propsHash: string;
+}
+/**
+ * Digest of the entire build at a point in time.
+ */
+export interface BuildDigest {
+    /** Per-resource digest keyed by logical name */
+    resources: Record<string, ResourceDigest>;
+    /** Resource-level dependency graph */
+    dependencies: Record<string, string[]>;
+    /** Cross-lexicon output bridges from BuildManifest */
+    outputs: Record<string, {
+        source: string;
+        entity: string;
+        attribute: string;
+    }>;
+    /** Lexicon-level deploy order */
+    deployOrder: string[];
+}
+/**
+ * Result of comparing two build digests.
+ */
+export interface DigestDiff {
+    /** Resources in current build but not in previous digest */
+    added: string[];
+    /** Resources in previous digest but not in current build */
+    removed: string[];
+    /** Resources where propsHash differs */
+    changed: string[];
+    /** Resources where propsHash matches */
+    unchanged: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/lifecycle/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lifecycle/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,iCAAiC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB"}

package/dist/lint/config.d.ts

@@ -0,0 +1,100 @@
+import { z } from "zod";
+import type { Severity, RuleConfig } from "./rule.js";
+export declare const LintConfigSchema: z.ZodObject<{
+    rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
+        error: "error";
+        warning: "warning";
+        info: "info";
+        off: "off";
+    }>, z.ZodTuple<[z.ZodEnum<{
+        error: "error";
+        warning: "warning";
+        info: "info";
+        off: "off";
+    }>, z.ZodRecord<z.ZodString, z.ZodUnknown>], null>]>>>;
+    extends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    overrides: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        files: z.ZodArray<z.ZodString>;
+        rules: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
+            error: "error";
+            warning: "warning";
+            info: "info";
+            off: "off";
+        }>, z.ZodTuple<[z.ZodEnum<{
+            error: "error";
+            warning: "warning";
+            info: "info";
+            off: "off";
+        }>, z.ZodRecord<z.ZodString, z.ZodUnknown>], null>]>>;
+    }, z.core.$strip>>>;
+    plugins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    policies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Per-file rule override
+ */
+export interface LintOverride {
+    /** Glob patterns to match file paths */
+    files: string[];
+    /** Rule overrides for matched files */
+    rules: Record<string, RuleConfig>;
+}
+/**
+ * Lint configuration
+ */
+export interface LintConfig {
+    /** Rule configurations: rule ID -> severity string or [severity, options] tuple */
+    rules?: Record<string, RuleConfig>;
+    /** Array of config file paths to extend from */
+    extends?: string[];
+    /** Per-file rule overrides via glob patterns */
+    overrides?: LintOverride[];
+    /** Array of plugin file paths to load custom rules from (project-local, not inherited) */
+    plugins?: string[];
+    /**
+     * Array of file paths to load project-authored organizational policy checks
+     * from — each exporting one or more {@link PostSynthCheck} objects. They run
+     * during `chant build` over the resolved resources, with the current `env` in
+     * context. Distinct from `plugins` (declarative lint rules) by authorship and
+     * phase; same engine.
+     */
+    policies?: string[];
+}
+/**
+ * Parsed rule configuration with severity and optional options
+ */
+export interface ParsedRuleConfig {
+    severity: "off" | Severity;
+    options?: Record<string, unknown>;
+}
+/**
+ * Parse a rule config value into severity and options
+ */
+export declare function parseRuleConfig(value: RuleConfig): ParsedRuleConfig;
+/**
+ * Default configuration with all rules enabled at strict preset severities
+ */
+export declare const DEFAULT_CONFIG: LintConfig;
+/**
+ * Load lint configuration from a directory.
+ *
+ * Tries `chant.config.ts` first (extracts `lint` property from ChantConfig),
+ * then falls back to `chant.config.json` (legacy LintConfig format).
+ * Returns default configuration if neither exists.
+ *
+ * @param dir - Directory path to search for config file
+ * @returns Loaded and merged configuration, or default config if not found
+ */
+export declare function loadConfig(dir: string): LintConfig;
+/**
+ * Resolve the effective rules for a specific file path by applying overrides.
+ *
+ * Starts with the base config rules, then iterates through overrides in order.
+ * For each override whose file globs match the given path, merges override rules on top.
+ *
+ * @param config - The loaded lint configuration
+ * @param filePath - The file path to resolve rules for (relative to project root)
+ * @returns Merged rule configuration with overrides applied
+ */
+export declare function resolveRulesForFile(config: LintConfig, filePath: string): Record<string, RuleConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/lint/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAmBnD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAoClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG"}

package/dist/lint/declarative.d.ts

@@ -0,0 +1,56 @@
+import * as ts from "typescript";
+import type { LintRule, LintContext, Severity, Category } from "./rule.js";
+/**
+ * Condition for matching nodes within a selector result.
+ */
+export interface MatchCondition {
+    /** RegExp pattern to match the node's text */
+    pattern?: RegExp;
+    /** Selector name — only match if node is within a parent matching this selector */
+    within?: string;
+    /** Require specific child selector(s) to be present */
+    require?: string | string[];
+    /** Named check to evaluate */
+    check?: string;
+}
+/**
+ * Declarative fix description.
+ */
+export interface DeclarativeFix {
+    /** Kind of fix operation */
+    kind: "replace" | "insert-before" | "insert-after" | "delete";
+    /** Static replacement text */
+    text?: string;
+    /** Dynamic resolve function for the replacement text */
+    resolve?: (node: ts.Node, sf: ts.SourceFile) => string;
+}
+/**
+ * Specification for a declarative lint rule.
+ */
+export interface RuleSpec {
+    /** Unique rule ID */
+    id: string;
+    /** Severity level */
+    severity: Severity;
+    /** Category for grouping */
+    category: Category;
+    /** Human-readable description of what this rule checks */
+    description?: string;
+    /** Link to rule documentation */
+    helpUri?: string;
+    /** Selector name (or compound) to find target nodes */
+    selector: string;
+    /** Optional match condition to further filter nodes */
+    match?: MatchCondition;
+    /** Message template. `{node}` is replaced with the node's text. */
+    message: string;
+    /** Optional fix to apply */
+    fix?: DeclarativeFix;
+    /** Optional custom validation function */
+    validate?: (node: ts.Node, context: LintContext) => boolean;
+}
+/**
+ * Build a standard LintRule from a declarative RuleSpec.
+ */
+export declare function rule(spec: RuleSpec): LintRule;
+//# sourceMappingURL=declarative.d.ts.map

package/dist/lint/declarative.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declarative.d.ts","sourceRoot":"","sources":["../../src/lint/declarative.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAA2B,QAAQ,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAIjG;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,4BAA4B;IAC5B,IAAI,EAAE,SAAS,GAAG,eAAe,GAAG,cAAc,GAAG,QAAQ,CAAC;IAC9D,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,KAAK,MAAM,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,qBAAqB;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,4BAA4B;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;CAC7D;AAED;;GAEG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAgD7C"}

package/dist/lint/discover.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Auto-discovery for lint rules and post-synth checks.
+ *
+ * Scans directories for .ts files and loads exported rules/checks,
+ * eliminating the need to manually list every rule in plugin.ts.
+ */
+import type { LintRule } from "./rule.js";
+import type { PostSynthCheck } from "./post-synth.js";
+/**
+ * Discover lint rules from a directory.
+ *
+ * Scans the directory for .ts files (excluding tests, helpers, and index files),
+ * loads each module, and collects any exported objects that look like a LintRule
+ * (has `id`, `severity`, `category`, and `check` function).
+ *
+ * @param dir - Absolute path to the rules directory
+ * @param importMetaUrl - The caller's import.meta.url (for createRequire)
+ */
+export declare function discoverLintRules(dir: string, importMetaUrl: string): LintRule[];
+/**
+ * Discover post-synth checks from a directory.
+ *
+ * Scans the directory for .ts files (excluding tests, helpers, and index files),
+ * loads each module, and collects any exported objects that look like a PostSynthCheck
+ * (has `id`, `description`, and `check` function).
+ *
+ * @param dir - Absolute path to the post-synth rules directory
+ * @param importMetaUrl - The caller's import.meta.url (for createRequire)
+ */
+export declare function discoverPostSynthChecks(dir: string, importMetaUrl: string): PostSynthCheck[];
+/**
+ * List rule files in a directory (excluding tests, helpers, index).
+ */
+export declare function listRuleFiles(dir: string): string[];
+//# sourceMappingURL=discover.d.ts.map

package/dist/lint/discover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/lint/discover.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAYnD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,QAAQ,EAAE,CAkBhF;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,EAAE,CAkB5F;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAYnD"}

package/dist/lint/engine.d.ts

@@ -0,0 +1,21 @@
+import type { LintRule, LintDiagnostic } from "./rule.js";
+/**
+ * Result of a lint run, separating active diagnostics from suppressed ones.
+ */
+export interface LintRunResult {
+    /** Diagnostics that were not suppressed by disable directives */
+    diagnostics: LintDiagnostic[];
+    /** Diagnostics that were suppressed by disable directives, with optional reason */
+    suppressed: Array<LintDiagnostic & {
+        reason?: string;
+    }>;
+}
+/**
+ * Execute lint rules on a set of files
+ * @param files - Array of file paths to lint
+ * @param rules - Array of lint rules to execute
+ * @param ruleOptions - Optional map of rule ID to options object
+ * @returns LintRunResult with diagnostics and suppressed items
+ */
+export declare function runLint(files: string[], rules: LintRule[], ruleOptions?: Map<string, Record<string, unknown>>): Promise<LintRunResult>;
+//# sourceMappingURL=engine.d.ts.map

package/dist/lint/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/lint/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAe,MAAM,QAAQ,CAAC;AAIpE;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,mFAAmF;IACnF,UAAU,EAAE,KAAK,CAAC,cAAc,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAyKD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,KAAK,EAAE,MAAM,EAAE,EACf,KAAK,EAAE,QAAQ,EAAE,EACjB,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACjD,OAAO,CAAC,aAAa,CAAC,CAqDxB"}

package/dist/lint/named-checks.d.ts

@@ -0,0 +1,19 @@
+import type * as ts from "typescript";
+import type { LintContext } from "./rule.js";
+/**
+ * A named check function that evaluates a condition on a node.
+ */
+export type NamedCheckFn = (node: ts.Node, context: LintContext) => boolean;
+/**
+ * Register a named check function.
+ */
+export declare function registerCheck(name: string, fn: NamedCheckFn): void;
+/**
+ * Get a named check by name. Returns undefined if not found.
+ */
+export declare function getNamedCheck(name: string): NamedCheckFn | undefined;
+/**
+ * List all registered check names.
+ */
+export declare function listChecks(): string[];
+//# sourceMappingURL=named-checks.d.ts.map

package/dist/lint/named-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-checks.d.ts","sourceRoot":"","sources":["../../src/lint/named-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE1C;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;AAO5E;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,GAAG,IAAI,CAElE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEpE;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,MAAM,EAAE,CAErC"}

package/dist/lint/parser.d.ts

@@ -0,0 +1,9 @@
+import * as ts from "typescript";
+/**
+ * Parse a TypeScript file into an AST
+ * @param path - Absolute or relative path to the TypeScript file
+ * @returns Parsed TypeScript SourceFile
+ * @throws Error if the file cannot be read or parsed
+ */
+export declare function parseFile(path: string): ts.SourceFile;
+//# sourceMappingURL=parser.d.ts.map

package/dist/lint/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/lint/parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAGjC;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,UAAU,CAgCrD"}

package/dist/lint/policy.d.ts

@@ -0,0 +1,22 @@
+import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth.js";
+/** Load project policy checks (one or more `PostSynthCheck` exports) from files. */
+export declare function loadPolicyChecks(paths: string[], configDir: string): Promise<PostSynthCheck[]>;
+export interface PolicyEvaluation {
+    /** All policy diagnostics (errors + warnings). */
+    diagnostics: PostSynthDiagnostic[];
+    /** The error-severity subset — these are policy *violations* that gate. */
+    violations: PostSynthDiagnostic[];
+    /** The environment policies were evaluated against (if any). */
+    env?: string;
+}
+/**
+ * Build a project and run its `lint.policies` over the resolved resources,
+ * standalone — used by the `policyGate` Op step to gate an apply on the same
+ * organizational policy `chant build` enforces. Loads the project's lexicons,
+ * builds, then runs the policy pack with `env` (explicit, else `ownership.env`).
+ */
+export declare function evaluateProjectPolicies(opts: {
+    path: string;
+    env?: string;
+}): Promise<PolicyEvaluation>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/lint/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/lint/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExE,oFAAoF;AACpF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,2EAA2E;IAC3E,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8B5B"}

package/dist/lint/post-synth.d.ts

@@ -0,0 +1,69 @@
+import type { Declarable } from "../declarable.js";
+import type { SerializerResult } from "../serializer.js";
+import type { Severity } from "./rule.js";
+/**
+ * Context provided to post-synthesis checks.
+ */
+export interface PostSynthContext {
+    /** The build result outputs (lexicon name → serialized output) */
+    outputs: Map<string, string | SerializerResult>;
+    /** Map of entity name to Declarable entity */
+    entities: Map<string, Declarable>;
+    /**
+     * The environment/stack being built, if known (from `--env` or the project's
+     * `ownership.env`). Lets an organizational policy branch on environment —
+     * e.g. "no public buckets in prod". Undefined when no environment is set.
+     */
+    env?: string;
+    /** Raw build result object */
+    buildResult: {
+        outputs: Map<string, string | SerializerResult>;
+        entities: Map<string, Declarable>;
+        warnings: string[];
+        errors: Array<{
+            message: string;
+            name: string;
+        }>;
+        sourceFileCount: number;
+    };
+}
+/**
+ * Extract the primary content string from a serializer output.
+ */
+export declare function getPrimaryOutput(output: string | SerializerResult): string;
+/**
+ * A diagnostic from a post-synthesis check.
+ */
+export interface PostSynthDiagnostic {
+    /** ID of the check that produced this diagnostic */
+    checkId: string;
+    /** Severity level */
+    severity: Severity;
+    /** Human-readable message */
+    message: string;
+    /** Optional entity name related to this diagnostic */
+    entity?: string;
+    /** Optional lexicon related to this diagnostic */
+    lexicon?: string;
+}
+/**
+ * A post-synthesis check that validates build output. Lexicons ship these as
+ * domain rules; projects author them as organizational policy (see the
+ * `lint.policies` config and the Organizational Policy guide).
+ */
+export interface PostSynthCheck {
+    /** Unique identifier for this check */
+    id: string;
+    /** Human-readable description */
+    description: string;
+    /** Execute the check and return diagnostics */
+    check(ctx: PostSynthContext): PostSynthDiagnostic[];
+}
+/** Structural type guard — used to collect project-authored policy checks. */
+export declare function isPostSynthCheck(value: unknown): value is PostSynthCheck;
+/**
+ * Run a set of post-synthesis checks against a build result. `env` is threaded
+ * into the context so a check can branch on the current environment/stack.
+ */
+export declare function runPostSynthChecks(checks: PostSynthCheck[], buildResult: PostSynthContext["buildResult"], env?: string): PostSynthDiagnostic[];
+//# sourceMappingURL=post-synth.d.ts.map

package/dist/lint/post-synth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,EAAE,CAavB"}

package/dist/lint/presets/strict.json

@@ -0,0 +1,19 @@
+{
+    "rules": {
+        "COR001": "error",
+        "COR002": "error",
+        "COR003": "warning",
+        "COR004": "warning",
+        "COR005": "warning",
+        "COR006": "error",
+        "COR007": "warning",
+        "COR008": "error",
+        "COR009": "warning",
+        "COR010": "warning",
+        "COR011": "error",
+        "COR012": "warning",
+        "COR013": "info",
+        "COR014": "warning",
+        "COR015": "warning"
+    }
+}

package/dist/lint/rule-loader.d.ts

@@ -0,0 +1,16 @@
+import type { LintRule } from "./rule.js";
+/**
+ * Load local lint rules from `.chant/rules/`.
+ *
+ * Scans for `.ts` files in the nearest `.chant/rules/` directory found by
+ * walking up from `projectDir` (stopping at the closest `package.json` to
+ * avoid leaking into unrelated parent projects). Dynamically imports each
+ * file and collects all exports that conform to the LintRule interface.
+ *
+ * @param projectDir - Directory the lint command was invoked against. May be
+ *                     a sub-stack of a larger project — the rules dir is
+ *                     resolved by walking up.
+ * @returns Array of LintRule objects found in the discovered `.chant/rules/`.
+ */
+export declare function loadLocalRules(projectDir: string): Promise<LintRule[]>;
+//# sourceMappingURL=rule-loader.d.ts.map

package/dist/lint/rule-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-loader.d.ts","sourceRoot":"","sources":["../../src/lint/rule-loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AA+CvC;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAqC5E"}

package/dist/lint/rule-registry.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Rule registry — collects metadata from all rule sources into a flat, sortable array.
+ * Used for documentation generation and programmatic rule introspection.
+ */
+import type { LintRule, Severity, Category } from "./rule.js";
+import type { PostSynthCheck } from "./post-synth.js";
+export interface RuleEntry {
+    /** Unique rule ID (e.g. "COR001", "WAW018") */
+    id: string;
+    /** Human-readable description of what this rule checks */
+    description: string;
+    /** Rule category */
+    category: Category;
+    /** Default severity level */
+    defaultSeverity: Severity;
+    /** Source of the rule ("core" or lexicon name) */
+    source: "core" | string;
+    /** Phase the rule runs in */
+    phase: "pre-synth" | "post-synth";
+    /** Whether this rule provides automatic fixes */
+    hasAutoFix: boolean;
+    /** Link to rule documentation */
+    helpUri?: string;
+}
+/**
+ * Build a rule registry from core rules and plugin-provided rules/checks.
+ *
+ * @param coreRules - Core LintRules (COR/EVL rules from packages/core)
+ * @param plugins - Array of plugin contributions with name, rules, and post-synth checks
+ * @returns Flat array of RuleEntry sorted by ID
+ */
+export declare function buildRuleRegistry(coreRules: LintRule[], plugins?: Array<{
+    name: string;
+    rules?: LintRule[];
+    postSynthChecks?: PostSynthCheck[];
+}>): RuleEntry[];
+//# sourceMappingURL=rule-registry.d.ts.map

package/dist/lint/rule-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-registry.d.ts","sourceRoot":"","sources":["../../src/lint/rule-registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,WAAW,SAAS;IACxB,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,eAAe,EAAE,QAAQ,CAAC;IAC1B,kDAAkD;IAClD,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,6BAA6B;IAC7B,KAAK,EAAE,WAAW,GAAG,YAAY,CAAC;IAClC,iDAAiD;IACjD,UAAU,EAAE,OAAO,CAAC;IACpB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,QAAQ,EAAE,EACrB,OAAO,GAAE,KAAK,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;CACpC,CAAM,GACN,SAAS,EAAE,CAmDb"}