@intentius/chant 0.6.0 → 0.8.0

package/src/audit/catalog.ts

@@ -9,9 +9,10 @@
  *    diffed) vs `guidance` (needs human/LLM judgment — emit remediation text
  *    only; never auto-applied; never run by the hosted service).
  *
- * The catalog covers exactly the post-synth checks run by the audit (github
- * GHA*, gitlab WGL*, forgejo WFJ*). A drift-guard test asserts it stays in
- * sync with the lexicons.
+ * The catalog covers exactly the post-synth checks run by the audit across all
+ * lexicons (CI: GHA/WGL/WFJ; IaC and manifests: WK8/WAW/AZR/WGC/WHM/DKRD/ARGO).
+ * A drift-guard test asserts it stays in sync with the lexicons, and that every
+ * entry has a `category`.
  */
 
 export type Tier = "merge-worthy" | "report-only";
@@ -19,6 +20,15 @@ export type Tier = "merge-worthy" | "report-only";
 /** deterministic = safe auto-fix/diff; guidance = report text only (needs judgment). */
 export type FixKind = "deterministic" | "guidance";
 
+/**
+ * What kind of finding this is — orthogonal to `tier` (fix confidence). Lets the
+ * report say "N security, M best-practice, K correctness" instead of branding
+ * everything "security." `security` = exposure/vuln/supply-chain; `correctness`
+ * = a structural bug (broken reference, invalid schema, never-runs); everything
+ * else is `best-practice` (hygiene/style/deprecation/reliability).
+ */
+export type Category = "security" | "correctness" | "best-practice";
+
 export interface Authority {
   name: string;
   url: string;
@@ -28,6 +38,8 @@ export interface RuleMeta {
   id: string;
   tier: Tier;
   fixKind: FixKind;
+  /** What kind of finding this is (security / correctness / best-practice). */
+  category: Category;
   title: string;
   /** External backing so a finding isn't just chant's opinion. */
   authority?: Authority[];
@@ -86,6 +98,18 @@ const DOCKER_SEC: Authority = {
   name: "Docker — Security best practices",
   url: "https://docs.docker.com/develop/security-best-practices/",
 };
+const AWS_SEC: Authority = {
+  name: "AWS — Security Pillar (Well-Architected)",
+  url: "https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html",
+};
+const AZ_SEC: Authority = {
+  name: "Microsoft Cloud Security Benchmark",
+  url: "https://learn.microsoft.com/en-us/security/benchmark/azure/",
+};
+const GCP_SEC: Authority = {
+  name: "Google Cloud — Security best practices",
+  url: "https://cloud.google.com/security/best-practices",
+};
 
 function meta(
   id: string,
@@ -95,7 +119,12 @@ function meta(
   remediation: string,
   authority?: Authority[],
 ): RuleMeta {
-  return { id, tier, fixKind, title, remediation, authority, yamlBased: true };
+  // An authority citation is the strongest security signal, so it wins. Otherwise
+  // the curated RULE_CATEGORY map (defined below, before RULE_CATALOG runs)
+  // decides correctness vs best-practice vs security-without-authority; the drift
+  // test guarantees every id is mapped, so the fallback is only a type belt.
+  const category: Category = authority && authority.length > 0 ? "security" : RULE_CATEGORY[id] ?? "best-practice";
+  return { id, tier, fixKind, category, title, remediation, authority, yamlBased: true };
 }
 
 const M = "merge-worthy" as const;
@@ -103,6 +132,229 @@ const R = "report-only" as const;
 const D = "deterministic" as const;
 const G = "guidance" as const;
 
+/**
+ * Finding category per rule (#415). Curated: security rules are those that
+ * cite an authority or guard an exposure; correctness rules flag structural
+ * bugs (broken references, invalid schema, never-runs); the rest are
+ * best-practice. A drift test asserts this covers every catalogued rule.
+ */
+export const RULE_CATEGORY: Record<string, Category> = {
+  ARGO002: "correctness",
+  ARGO003: "correctness",
+  ARGO005: "best-practice",
+  AZR010: "best-practice",
+  AZR011: "correctness",
+  AZR012: "best-practice",
+  AZR013: "correctness",
+  AZR014: "security",
+  AZR015: "security",
+  AZR016: "best-practice",
+  AZR017: "best-practice",
+  AZR018: "best-practice",
+  AZR019: "security",
+  AZR020: "best-practice",
+  AZR021: "security",
+  AZR022: "security",
+  AZR023: "best-practice",
+  AZR024: "best-practice",
+  AZR025: "best-practice",
+  AZR026: "best-practice",
+  AZR027: "security",
+  AZR028: "best-practice",
+  AZR029: "security",
+  COR020: "correctness",
+  DKRD001: "best-practice",
+  DKRD002: "best-practice",
+  DKRD003: "security",
+  DKRD010: "best-practice",
+  DKRD011: "best-practice",
+  DKRD012: "security",
+  EXT001: "correctness",
+  GHA006: "correctness",
+  GHA009: "correctness",
+  GHA011: "correctness",
+  GHA013: "security",
+  GHA017: "security",
+  GHA018: "security",
+  GHA019: "correctness",
+  GHA021: "security",
+  GHA022: "best-practice",
+  GHA023: "best-practice",
+  GHA024: "best-practice",
+  GHA025: "security",
+  GHA026: "best-practice",
+  GHA027: "best-practice",
+  GHA028: "correctness",
+  GHA029: "security",
+  GHA030: "security",
+  GHA031: "security",
+  GHA032: "security",
+  GHA033: "security",
+  GHA034: "security",
+  GHA035: "security",
+  GHA036: "security",
+  GHA037: "security",
+  GHA038: "security",
+  GHA039: "security",
+  GHA040: "security",
+  GHA041: "security",
+  GHA042: "security",
+  GHA043: "security",
+  GHA044: "security",
+  GHA045: "security",
+  GHA046: "correctness",
+  GHA047: "correctness",
+  GHA048: "correctness",
+  GHA049: "security",
+  GHA050: "security",
+  GHA051: "best-practice",
+  GHA052: "security",
+  GHA053: "security",
+  GHA054: "security",
+  GHA055: "best-practice",
+  GHA056: "best-practice",
+  GHA057: "security",
+  GHA058: "best-practice",
+  WAW010: "best-practice",
+  WAW011: "best-practice",
+  WAW013: "correctness",
+  WAW014: "best-practice",
+  WAW015: "correctness",
+  WAW016: "best-practice",
+  WAW017: "best-practice",
+  WAW018: "security",
+  WAW019: "security",
+  WAW020: "security",
+  WAW021: "security",
+  WAW022: "best-practice",
+  WAW023: "best-practice",
+  WAW024: "best-practice",
+  WAW025: "security",
+  WAW026: "security",
+  WAW027: "best-practice",
+  WAW028: "security",
+  WAW029: "correctness",
+  WAW030: "best-practice",
+  WAW031: "best-practice",
+  WAW032: "security",
+  WAW033: "correctness",
+  WAW034: "best-practice",
+  WAW035: "best-practice",
+  WAW036: "correctness",
+  WAW037: "correctness",
+  WFJ010: "correctness",
+  WFJ011: "correctness",
+  WGC101: "security",
+  WGC102: "security",
+  WGC103: "best-practice",
+  WGC104: "security",
+  WGC105: "security",
+  WGC106: "best-practice",
+  WGC107: "best-practice",
+  WGC108: "best-practice",
+  WGC109: "security",
+  WGC110: "security",
+  WGC111: "correctness",
+  WGC112: "correctness",
+  WGC113: "best-practice",
+  WGC201: "best-practice",
+  WGC202: "security",
+  WGC203: "security",
+  WGC204: "best-practice",
+  WGC301: "best-practice",
+  WGC302: "best-practice",
+  WGC303: "best-practice",
+  WGC401: "correctness",
+  WGC402: "correctness",
+  WGC403: "correctness",
+  WGL010: "correctness",
+  WGL011: "correctness",
+  WGL012: "best-practice",
+  WGL013: "correctness",
+  WGL014: "correctness",
+  WGL015: "correctness",
+  WGL016: "security",
+  WGL017: "security",
+  WGL018: "best-practice",
+  WGL019: "best-practice",
+  WGL020: "correctness",
+  WGL021: "best-practice",
+  WGL022: "best-practice",
+  WGL023: "best-practice",
+  WGL024: "best-practice",
+  WGL025: "best-practice",
+  WGL026: "security",
+  WGL027: "correctness",
+  WGL028: "best-practice",
+  WGL029: "security",
+  WGL030: "security",
+  WGL031: "security",
+  WGL032: "security",
+  WGL033: "security",
+  WGL034: "security",
+  WGL035: "security",
+  WGL036: "security",
+  WGL037: "security",
+  WGL038: "security",
+  WGL039: "security",
+  WGL040: "security",
+  WGL041: "correctness",
+  WGL042: "best-practice",
+  WGL043: "security",
+  WGL044: "security",
+  WGL045: "security",
+  WGL046: "security",
+  WGL047: "security",
+  WGL048: "best-practice",
+  WHM005: "best-practice",
+  WHM101: "correctness",
+  WHM102: "best-practice",
+  WHM103: "correctness",
+  WHM104: "best-practice",
+  WHM105: "best-practice",
+  WHM201: "best-practice",
+  WHM202: "best-practice",
+  WHM203: "best-practice",
+  WHM204: "best-practice",
+  WHM301: "best-practice",
+  WHM302: "best-practice",
+  WHM401: "security",
+  WHM402: "security",
+  WHM403: "security",
+  WHM404: "security",
+  WHM405: "best-practice",
+  WHM406: "best-practice",
+  WHM407: "security",
+  WHM501: "best-practice",
+  WHM502: "correctness",
+  WK8005: "security",
+  WK8006: "best-practice",
+  WK8041: "security",
+  WK8042: "security",
+  WK8101: "correctness",
+  WK8102: "best-practice",
+  WK8103: "correctness",
+  WK8104: "best-practice",
+  WK8105: "best-practice",
+  WK8201: "best-practice",
+  WK8202: "security",
+  WK8203: "security",
+  WK8204: "security",
+  WK8205: "security",
+  WK8207: "security",
+  WK8208: "security",
+  WK8209: "security",
+  WK8301: "best-practice",
+  WK8302: "best-practice",
+  WK8303: "best-practice",
+  WK8304: "best-practice",
+  WK8305: "correctness",
+  WK8306: "correctness",
+  WK8401: "correctness",
+  WK8402: "best-practice",
+  WK8403: "best-practice",
+};
+
 /** Every audited post-synth check, keyed by id. */
 export const RULE_CATALOG: Record<string, RuleMeta> = {
   // ── GitHub Actions (GHA) ───────────────────────────────────────────
@@ -235,6 +487,107 @@ export const RULE_CATALOG: Record<string, RuleMeta> = {
   DKRD010: meta("DKRD010", R, G, "apt-get install without --no-install-recommends", "Add --no-install-recommends to keep images small."),
   DKRD011: meta("DKRD011", R, G, "ADD used where COPY would do", "Prefer COPY unless fetching a URL or extracting an archive."),
   DKRD012: meta("DKRD012", M, G, "No USER instruction — container runs as root", "Add a non-root USER instruction.", [DOCKER_SEC]),
+
+  // ── AWS CloudFormation (WAW / COR / EXT) ───────────────────────────
+  COR020: meta("COR020", M, G, "Circular resource dependency", "Break the dependency cycle between resources."),
+  EXT001: meta("EXT001", M, G, "Extension constraint violation", "Fix the cross-property constraint flagged by the cfn-lint extension schema."),
+  WAW010: meta("WAW010", R, G, "Redundant DependsOn", "Remove DependsOn already implied by a Ref/GetAtt."),
+  WAW011: meta("WAW011", R, G, "Deprecated Lambda runtime", "Upgrade to a supported Lambda runtime."),
+  WAW013: meta("WAW013", M, G, "Child stack exports nothing", "Add stackOutput() exports the parent can reference."),
+  WAW014: meta("WAW014", R, G, "Nested stack outputs never referenced", "Reference the outputs or split into a separate build."),
+  WAW015: meta("WAW015", M, G, "Circular dependency between nested stacks", "Break the cycle between nested stacks."),
+  WAW016: meta("WAW016", R, G, "Deprecated property", "Replace the deprecated CloudFormation property."),
+  WAW017: meta("WAW017", R, G, "Missing tags on a taggable resource", "Add tags for cost allocation and compliance."),
+  WAW018: meta("WAW018", M, G, "S3 bucket missing public access block", "Add a PublicAccessBlockConfiguration blocking all public access.", [AWS_SEC]),
+  WAW019: meta("WAW019", M, G, "Security group allows unrestricted ingress on a sensitive port", "Restrict the CIDR on SSH/RDP/database ports to known sources.", [AWS_SEC]),
+  WAW020: meta("WAW020", M, G, "IAM policy uses a wildcard Action", "Scope the policy to specific actions (least privilege).", [AWS_SEC]),
+  WAW021: meta("WAW021", M, G, "RDS storage not encrypted", "Enable StorageEncrypted for encryption at rest.", [AWS_SEC]),
+  WAW022: meta("WAW022", R, G, "Lambda has no VpcConfig", "Consider a VpcConfig for network isolation if the function needs VPC resources."),
+  WAW023: meta("WAW023", R, G, "CloudFront has no WAF web ACL", "Consider attaching a WAF web ACL."),
+  WAW024: meta("WAW024", R, G, "ALB access logging disabled", "Enable access logging for audit trails."),
+  WAW025: meta("WAW025", M, G, "SNS topic not encrypted", "Set KmsMasterKeyId for encryption at rest.", [AWS_SEC]),
+  WAW026: meta("WAW026", M, G, "SQS queue not encrypted", "Enable SqsManagedSseEnabled or set KmsMasterKeyId.", [AWS_SEC]),
+  WAW027: meta("WAW027", R, G, "DynamoDB point-in-time recovery disabled", "Enable PITR for recovery."),
+  WAW028: meta("WAW028", M, G, "EBS volume not encrypted", "Enable encryption at rest.", [AWS_SEC]),
+  WAW029: meta("WAW029", M, G, "Invalid DependsOn target", "Fix the dangling/self DependsOn reference."),
+  WAW030: meta("WAW030", R, G, "Missing DependsOn for a known ordering pattern", "Add the DependsOn the pattern requires."),
+  WAW031: meta("WAW031", R, G, "EKS Addon missing ServiceAccountRoleArn", "Set ServiceAccountRoleArn (IRSA) for addons that need it."),
+  WAW032: meta("WAW032", M, G, "EFS transit encryption disabled on Fargate", "Enable transit encryption for the EFS volume.", [AWS_SEC]),
+  WAW033: meta("WAW033", M, G, "Solr heap exceeds Fargate task memory", "Lower SOLR_HEAP or raise task memory."),
+  WAW034: meta("WAW034", R, G, "Fargate Solr task under-provisioned", "Allocate >= 2048MB for the Solr task."),
+  WAW035: meta("WAW035", R, G, "Solr container missing nofile ulimit", "Set a nofile ulimit >= 65535."),
+  WAW036: meta("WAW036", M, G, "Non-ASCII characters in resource properties", "Remove non-ASCII characters rejected at changeset time."),
+  WAW037: meta("WAW037", M, G, "Null values in resource properties", "Fix the invalid AttrRef producing null property values."),
+
+  // ── Azure ARM (AZR) ────────────────────────────────────────────────
+  AZR010: meta("AZR010", R, G, "Redundant dependsOn", "Remove dependsOn already implied by reference()/resourceId()."),
+  AZR011: meta("AZR011", M, G, "Missing or invalid apiVersion", "Set a valid YYYY-MM-DD apiVersion on every resource."),
+  AZR012: meta("AZR012", R, G, "Deprecated API version", "Move to a current apiVersion."),
+  AZR013: meta("AZR013", M, G, "Resource missing location", "Add the required location property."),
+  AZR014: meta("AZR014", M, G, "Storage account allows public blob access", "Set allowBlobPublicAccess to false.", [AZ_SEC]),
+  AZR015: meta("AZR015", M, G, "Storage account missing encryption", "Enable encryption services for data at rest.", [AZ_SEC]),
+  AZR016: meta("AZR016", R, G, "Key Vault soft-delete not enabled", "Enable soft-delete."),
+  AZR017: meta("AZR017", R, G, "Key Vault purge protection not enabled", "Enable purge protection."),
+  AZR018: meta("AZR018", R, G, "SQL Server missing auditing", "Enable auditing for compliance and threat detection."),
+  AZR019: meta("AZR019", M, G, "SQL database missing TDE", "Enable Transparent Data Encryption.", [AZ_SEC]),
+  AZR020: meta("AZR020", R, G, "App Service missing managed identity", "Enable a system- or user-assigned identity."),
+  AZR021: meta("AZR021", M, G, "App Service not HTTPS-only", "Set httpsOnly to true.", [AZ_SEC]),
+  AZR022: meta("AZR022", M, G, "App Service min TLS below 1.2", "Set minTlsVersion to 1.2+.", [AZ_SEC]),
+  AZR023: meta("AZR023", R, G, "VM not using a managed disk", "Use a managed disk."),
+  AZR024: meta("AZR024", R, G, "VM missing boot diagnostics", "Enable boot diagnostics."),
+  AZR025: meta("AZR025", R, G, "AKS cluster missing RBAC", "Enable Kubernetes RBAC."),
+  AZR026: meta("AZR026", R, G, "AKS cluster missing network policy", "Configure a networkPolicy."),
+  AZR027: meta("AZR027", M, G, "Container Registry admin user enabled", "Disable the admin user; use Azure AD / service principals.", [AZ_SEC]),
+  AZR028: meta("AZR028", R, G, "Network interface missing NSG", "Associate an NSG to control traffic."),
+  AZR029: meta("AZR029", M, G, "Managed disk missing encryption", "Enable encryption for data at rest.", [AZ_SEC]),
+
+  // ── GCP Config Connector (WGC) ─────────────────────────────────────
+  WGC101: meta("WGC101", M, G, "Storage/SQL without encryption configuration", "Configure encryption (e.g. a CMEK key) for data at rest.", [GCP_SEC]),
+  WGC102: meta("WGC102", M, G, "Public IAM member (allUsers/allAuthenticatedUsers)", "Remove allUsers/allAuthenticatedUsers bindings.", [GCP_SEC]),
+  WGC103: meta("WGC103", R, G, "Missing project-id annotation", "Add the cnrm.cloud.google.com/project-id annotation."),
+  WGC104: meta("WGC104", M, G, "Bucket without uniform bucket-level access", "Enable uniformBucketLevelAccess.", [GCP_SEC]),
+  WGC105: meta("WGC105", M, G, "Cloud SQL open to 0.0.0.0/0", "Restrict authorizedNetworks to known sources.", [GCP_SEC]),
+  WGC106: meta("WGC106", R, G, "Missing deletion-policy annotation", "Add the cnrm.cloud.google.com/deletion-policy annotation."),
+  WGC107: meta("WGC107", R, G, "Bucket versioning disabled", "Enable object versioning."),
+  WGC108: meta("WGC108", R, G, "Cloud SQL backups disabled", "Enable backup configuration."),
+  WGC109: meta("WGC109", M, G, "Firewall open to 0.0.0.0/0", "Restrict sourceRanges to known sources.", [GCP_SEC]),
+  WGC110: meta("WGC110", M, G, "KMS key without rotation", "Set a rotationPeriod on the CryptoKey.", [GCP_SEC]),
+  WGC111: meta("WGC111", M, G, "Reference to an undefined resource", "Point the reference at a resource in the output."),
+  WGC112: meta("WGC112", M, G, "Missing or invalid apiVersion", "Set a valid cnrm.cloud.google.com apiVersion."),
+  WGC113: meta("WGC113", R, G, "Alpha API version", "Move to a beta/GA API version."),
+  WGC201: meta("WGC201", R, G, "Missing managed-by label", "Add the app.kubernetes.io/managed-by label."),
+  WGC202: meta("WGC202", M, G, "Cluster without Workload Identity", "Enable Workload Identity on the ContainerCluster.", [GCP_SEC]),
+  WGC203: meta("WGC203", M, G, "Node pool uses broad cloud-platform scope", "Use narrowly-scoped OAuth scopes instead of cloud-platform.", [GCP_SEC]),
+  WGC204: meta("WGC204", R, G, "Compute instance without Shielded VM", "Enable Shielded VM configuration."),
+  WGC301: meta("WGC301", R, G, "No IAMAuditConfig found", "Configure audit logging via IAMAuditConfig."),
+  WGC302: meta("WGC302", R, G, "No Service (enabled APIs) found", "Declare the GCP APIs you depend on."),
+  WGC303: meta("WGC303", R, G, "No VPC Service Controls perimeter", "Consider an AccessContextManager ServicePerimeter."),
+  WGC401: meta("WGC401", M, G, "Unknown field in resource spec", "Remove the unknown spec field."),
+  WGC402: meta("WGC402", M, G, "Missing required spec field", "Add the required spec field."),
+  WGC403: meta("WGC403", M, G, "Spec field has wrong type/structure", "Fix the field's type/structure."),
+
+  // ── Helm (WHM) ─────────────────────────────────────────────────────
+  WHM005: meta("WHM005", R, G, "Sub-chart wrapper with no templates", "Deploy the upstream chart directly instead of an empty wrapper."),
+  WHM101: meta("WHM101", M, G, "Chart.yaml missing required fields", "Set apiVersion (v2), name, and version in Chart.yaml."),
+  WHM102: meta("WHM102", R, G, "Missing values.schema.json", "Add a values.schema.json to validate values."),
+  WHM103: meta("WHM103", M, G, "Invalid Go template syntax", "Fix the unbalanced template braces."),
+  WHM104: meta("WHM104", R, G, "Missing NOTES.txt", "Add templates/NOTES.txt for application charts."),
+  WHM105: meta("WHM105", R, G, "Missing _helpers.tpl", "Add templates/_helpers.tpl."),
+  WHM201: meta("WHM201", R, G, "Missing standard Helm labels", "Add the recommended app.kubernetes.io labels."),
+  WHM202: meta("WHM202", R, G, "Hook weights undefined", "Define hook weights when multiple hooks exist."),
+  WHM203: meta("WHM203", R, G, "Undocumented values", "Document values via schema or comments."),
+  WHM204: meta("WHM204", R, G, "Dependencies pinned, not ranged", "Use semver ranges for chart dependencies."),
+  WHM301: meta("WHM301", R, G, "No Helm test", "Add at least one Helm test for application charts."),
+  WHM302: meta("WHM302", R, G, "Container resources not set", "Set limits/requests via values or defaults."),
+  WHM401: meta("WHM401", M, G, "Container image uses :latest or no tag", "Pin the image to an explicit version tag.", [SCORECARD_PINNED]),
+  WHM402: meta("WHM402", M, G, "Container may run as root", "Set runAsNonRoot in the security context.", [K8S_PSS]),
+  WHM403: meta("WHM403", M, G, "Root filesystem writable", "Set readOnlyRootFilesystem.", [K8S_PSS]),
+  WHM404: meta("WHM404", M, G, "Privileged container", "Remove privileged mode.", [K8S_PSS]),
+  WHM405: meta("WHM405", R, G, "Resource specs missing cpu/memory", "Set cpu and memory in limits/requests."),
+  WHM406: meta("WHM406", R, G, "CRDs in crds/ are never upgraded", "Manage CRD upgrades outside Helm or via a separate chart."),
+  WHM407: meta("WHM407", M, G, "Inline Secret data", "Use ExternalSecret/SealedSecret instead of inline Secret data.", [K8S_SECRETS]),
+  WHM501: meta("WHM501", R, G, "Unused values key", "Remove values defined but never referenced."),
+  WHM502: meta("WHM502", M, G, "Deprecated/invalid Kubernetes API version", "Update to a supported apiVersion."),
 };
 
 /** Look up catalog metadata for a check id, if known. */

package/src/audit/core.test.ts

@@ -128,6 +128,21 @@ describe("auditFiles", () => {
     expect(findings.map((f) => f.file).sort()).toEqual(["a.yml", "b.yml"]);
   });
 
+  test("accepts a lexicon name outside the built-in set (open AuditLexicon)", async () => {
+    const fake: PostSynthCheck = {
+      id: "CUSTOM001",
+      description: "fake",
+      check: () => [{ checkId: "CUSTOM001", severity: "error", message: "hit" }],
+    };
+    // "terraform" isn't in the built-in union — the open type must still accept it,
+    // and the injected provider resolves its checks.
+    const findings = await auditFiles([{ path: "main.tf.json", content: "{}", lexicon: "terraform" }], {
+      checksProvider: async (lexicon) => (lexicon === "terraform" ? [fake] : []),
+    });
+    expect(findings.map((f) => f.checkId)).toEqual(["CUSTOM001"]);
+    expect(findings[0].lexicon).toBe("terraform");
+  });
+
   test("resolves a cross-file relationship (ARGO002 sees the AppProject in another file)", async () => {
     // The Application alone → ARGO002 fires (project not declared here).
     const alone = await auditFiles([{ path: "app.yaml", content: ARGO_APP, lexicon: "k8s" }]);

package/src/audit/detect-bundle.test.ts

@@ -0,0 +1,35 @@
+import { describe, test, expect } from "vitest";
+import { build } from "esbuild";
+import { fileURLToPath } from "url";
+
+/**
+ * #426: the per-lexicon `detect` modules must be importable on the edge — i.e.
+ * bundling them pulls in NO `typescript` (the compiler that `plugin.ts` drags via
+ * declarative rules) and NOT `plugin.ts` itself. This is what lets the hosted
+ * service content-detect all lexicons on Workers.
+ */
+const repoRoot = fileURLToPath(new URL("../../../../", import.meta.url));
+const LEXICONS = ["k8s", "docker", "aws", "azure", "gcp", "helm"];
+
+describe("detectTemplate modules are edge-bundle clean", () => {
+  test("importing every lexicon's /detect pulls in no typescript or plugin.ts", async () => {
+    const contents =
+      LEXICONS.map((l, i) => `import { detectTemplate as d${i} } from "@intentius/chant-lexicon-${l}/detect";`).join("\n") +
+      `\nexport const detectors = [${LEXICONS.map((_, i) => `d${i}`).join(", ")}];\n`;
+
+    const result = await build({
+      stdin: { contents, resolveDir: repoRoot, loader: "ts" },
+      bundle: true,
+      format: "esm",
+      platform: "node",
+      metafile: true,
+      write: false,
+      outfile: "out.js",
+      logLevel: "silent",
+    });
+
+    const inputs = Object.keys(result.metafile.inputs);
+    expect(inputs.some((p) => p.includes("node_modules/typescript"))).toBe(false);
+    expect(inputs.some((p) => p.endsWith("/plugin.ts"))).toBe(false);
+  }, 30_000);
+});

package/src/audit/discover.test.ts

@@ -0,0 +1,72 @@
+import { describe, test, expect } from "vitest";
+import { fileURLToPath } from "url";
+import { discoverByDetection, loadAuditPlugins } from "./discover";
+import type { AuditInput } from "./core";
+
+const fixture = (name: string) => fileURLToPath(new URL(`../cli/commands/__fixtures__/${name}`, import.meta.url));
+
+/** Compare on (lexicon, path) pairs — content normalization differs in spelling, not target. */
+const targets = (inputs: AuditInput[]) => inputs.map((i) => `${i.lexicon}:${i.path}`).sort();
+
+describe("discoverByDetection (unified, detectTemplate-driven)", () => {
+  test("detects Kubernetes manifests", async () => {
+    const plugins = await loadAuditPlugins();
+    expect(targets(discoverByDetection(fixture("audit-k8s"), plugins))).toEqual(["k8s:manifests/deploy.yaml"]);
+  });
+
+  test("detects Docker artifacts (nested Dockerfile by name + compose by content)", async () => {
+    const plugins = await loadAuditPlugins();
+    expect(targets(discoverByDetection(fixture("audit-docker"), plugins))).toEqual([
+      "docker:app/Dockerfile",
+      "docker:docker-compose.yml",
+    ]);
+  });
+
+  test("detects CloudFormation (JSON + YAML), normalizing to JSON", async () => {
+    const plugins = await loadAuditPlugins();
+    const found = discoverByDetection(fixture("audit-aws"), plugins);
+    expect(targets(found)).toEqual(["aws:stack.yaml", "aws:template.json"]);
+    // YAML template is normalized to a JSON string the aws checks can JSON.parse.
+    expect(() => JSON.parse(found.find((f) => f.path === "stack.yaml")!.content)).not.toThrow();
+  });
+
+  test("detects Azure ARM templates", async () => {
+    const plugins = await loadAuditPlugins();
+    expect(targets(discoverByDetection(fixture("audit-azure"), plugins))).toEqual(["azure:azuredeploy.json"]);
+  });
+
+  test("gcp wins over k8s for Config Connector resources (no double-audit)", async () => {
+    const plugins = await loadAuditPlugins();
+    const found = discoverByDetection(fixture("audit-gcp"), plugins);
+    expect(targets(found)).toEqual(["gcp:bucket.yaml", "gcp:firewall.yaml"]);
+    expect(found.some((i) => i.lexicon === "k8s")).toBe(false);
+  });
+
+  test("detects a Helm chart as a bundle, not loose manifests", async () => {
+    const plugins = await loadAuditPlugins();
+    const found = discoverByDetection(fixture("audit-helm"), plugins);
+    const helm = found.filter((i) => i.lexicon === "helm");
+    expect(helm).toHaveLength(1);
+    expect(helm[0].path).toBe("mychart");
+    expect(helm[0].files!["Chart.yaml"]).toContain("name: mychart");
+    expect(helm[0].files!["templates/deployment.yaml"]).toContain("privileged");
+    // chart-internal templates are NOT also picked up as loose k8s manifests.
+    expect(found.some((i) => i.lexicon === "k8s")).toBe(false);
+  });
+
+  test("detects CI workflows by path (github)", async () => {
+    const plugins = await loadAuditPlugins();
+    const found = discoverByDetection(fixture("audit-repo"), plugins);
+    expect(targets(found)).toEqual(["github:.github/workflows/ci.yml"]);
+  });
+
+  test("scopes detection to the provided plugins (k8s omitted → no k8s findings)", async () => {
+    const plugins = await loadAuditPlugins(["github", "gitlab", "forgejo", "docker", "aws", "azure", "gcp", "helm"]);
+    expect(discoverByDetection(fixture("audit-k8s"), plugins).some((i) => i.lexicon === "k8s")).toBe(false);
+  });
+
+  test("loadAuditPlugins skips an uninstalled lexicon instead of throwing", async () => {
+    const plugins = await loadAuditPlugins(["github", "definitely-not-a-real-lexicon"]);
+    expect(plugins.map((p) => p.name)).toEqual(["github"]);
+  });
+});