@intentius/chant 0.6.0 → 0.8.0

package/src/cli/commands/__fixtures__/audit-mixed/.github/workflows/ci.yml

@@ -0,0 +1,5 @@
+on: push
+permissions: write-all
+jobs:
+  build:
+    runs-on: ubuntu-latest

package/src/cli/commands/__fixtures__/audit-mixed/Dockerfile

@@ -0,0 +1,2 @@
+FROM ubuntu
+RUN apt-get update

package/src/cli/commands/__fixtures__/audit-mixed/cfn/template.json

@@ -0,0 +1 @@
+{"AWSTemplateFormatVersion":"2010-09-09","Resources":{"B":{"Type":"AWS::S3::Bucket"}}}

package/src/cli/commands/__fixtures__/audit-mixed/k8s/deploy.yaml

@@ -0,0 +1,12 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: x
+spec:
+  template:
+    spec:
+      containers:
+        - name: c
+          image: nginx:latest
+          securityContext:
+            privileged: true

package/src/cli/commands/audit.test.ts

@@ -1,7 +1,13 @@
 import { describe, test, expect } from "vitest";
 import { fileURLToPath } from "url";
-import { auditCommand, discoverCiFiles, discoverManifests, discoverDocker, tokenForHost, coverageNotes } from "./audit";
-import { MissingLexiconError, type AuditInput } from "../../audit/core";
+import { auditCommand, tokenForHost, coverageNotes } from "./audit";
+import { discoverByDetection, loadAuditPlugins } from "../../audit/discover";
+import { MissingLexiconError, type AuditInput, type AuditLexicon } from "../../audit/core";
+
+/** Discover with all audit lexicons loaded, then keep one lexicon's inputs. */
+async function discoverLexicon(repo: string, lexicon: AuditLexicon): Promise<AuditInput[]> {
+  return discoverByDetection(repo, await loadAuditPlugins()).filter((i) => i.lexicon === lexicon);
+}
 import { readFileSync, existsSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
@@ -32,7 +38,7 @@ describe("auditCommand", () => {
 
   test("discovers and audits Kubernetes manifests", async () => {
     const repo = fileURLToPath(new URL("./__fixtures__/audit-k8s", import.meta.url));
-    const files = discoverManifests(repo);
+    const files = await discoverLexicon(repo, "k8s");
     expect(files.map((f) => f.path)).toContain("manifests/deploy.yaml");
     expect(files.every((f) => f.lexicon === "k8s")).toBe(true);
 
@@ -45,7 +51,7 @@ describe("auditCommand", () => {
 
   test("discovers and audits Docker artifacts (nested Dockerfile + compose)", async () => {
     const repo = fileURLToPath(new URL("./__fixtures__/audit-docker", import.meta.url));
-    const files = discoverDocker(repo);
+    const files = await discoverLexicon(repo, "docker");
     const paths = files.map((f) => f.path).sort();
     expect(paths).toContain("app/Dockerfile");
     expect(paths).toContain("docker-compose.yml");
@@ -58,8 +64,66 @@ describe("auditCommand", () => {
     expect(ids).toContain("DKRD003"); // compose exposes SSH port 22
   });
 
-  test("discovers CI files under a repo root", () => {
-    const files = discoverCiFiles(REPO);
+  test("discovers and audits CloudFormation (JSON and YAML)", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-aws", import.meta.url));
+    const files = await discoverLexicon(repo, "aws");
+    const paths = files.map((f) => f.path).sort();
+    expect(paths).toContain("template.json");
+    expect(paths).toContain("stack.yaml");
+    // YAML is normalized to a JSON string the aws checks can JSON.parse.
+    expect(() => JSON.parse(files.find((f) => f.path === "stack.yaml")!.content)).not.toThrow();
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("WAW018"); // S3 missing public access block (JSON template)
+    expect(ids).toContain("WAW021"); // RDS not encrypted (JSON template)
+    expect(ids).toContain("WAW019"); // SG open SSH (YAML template — proves YAML works)
+  });
+
+  test("discovers and audits Azure ARM templates", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-azure", import.meta.url));
+    expect((await discoverLexicon(repo, "azure")).map((f) => f.path)).toContain("azuredeploy.json");
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("AZR014"); // storage allows public blob access
+  });
+
+  test("discovers and audits GCP Config Connector (not misclassified as k8s)", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-gcp", import.meta.url));
+    const gcp = await discoverLexicon(repo, "gcp");
+    expect(gcp.map((f) => f.path).sort()).toEqual(["bucket.yaml", "firewall.yaml"]);
+    // cnrm manifests must NOT also be picked up as k8s.
+    expect(await discoverLexicon(repo, "k8s")).toEqual([]);
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("WGC109"); // firewall open to 0.0.0.0/0
+    // k8s checks did not run on these.
+    expect([...ids].some((id) => id.startsWith("WK8"))).toBe(false);
+  });
+
+  test("discovers and audits a Helm chart (as a bundle, not loose manifests)", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-helm", import.meta.url));
+    const charts = await discoverLexicon(repo, "helm");
+    expect(charts).toHaveLength(1);
+    expect(charts[0].lexicon).toBe("helm");
+    expect(charts[0].files!["Chart.yaml"]).toContain("name: mychart");
+    expect(charts[0].files!["templates/deployment.yaml"]).toContain("privileged");
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("WHM401"); // :latest image in the chart
+    expect(ids).toContain("WHM404"); // privileged container in a template
+    // the chart's template was NOT double-audited as a loose k8s manifest
+    expect([...ids].some((id) => id.startsWith("WK8"))).toBe(false);
+  });
+
+  test("discovers CI files under a repo root", async () => {
+    const files = await discoverLexicon(REPO, "github");
     expect(files.map((f) => f.path)).toContain(".github/workflows/ci.yml");
     expect(files.every((f) => f.lexicon === "github")).toBe(true);
   });
@@ -110,7 +174,7 @@ describe("auditCommand", () => {
     expect(result.success).toBe(true);
     expect(result.wroteTo).toBe(out);
     expect(existsSync(out)).toBe(true);
-    expect(readFileSync(out, "utf-8")).toContain("# CI security audit");
+    expect(readFileSync(out, "utf-8")).toContain("# chant audit");
     rmSync(out);
   });
 
@@ -133,7 +197,7 @@ describe("auditCommand", () => {
     const result = await auditCommand({ path: tmp });
     expect(result.success).toBe(true);
     expect(result.exitCode).toBe(0);
-    expect(result.output).toContain("No CI files found");
+    expect(result.output).toContain("No auditable files found");
     rmSync(tmp, { recursive: true, force: true });
   });
 
@@ -142,12 +206,13 @@ describe("auditCommand", () => {
     const yaml = "name: CI\non:\n  push:\npermissions: write-all\njobs:\n  build:\n    runs-on: ubuntu-latest\n";
     const impl = (async (url: string | URL | Request) => {
       const u = String(url);
+      if (u.includes("/git/trees/")) {
+        return new Response(JSON.stringify({ tree: [{ path: ".github/workflows/ci.yml", type: "blob", size: 100 }] }), { status: 200 });
+      }
       if (u.includes("/contents/.github/workflows/ci.yml")) {
         return new Response(JSON.stringify({ name: "ci.yml", path: ".github/workflows/ci.yml", type: "file", content: b64(yaml), encoding: "base64" }), { status: 200 });
       }
-      if (u.includes("/contents/.github/workflows")) {
-        return new Response(JSON.stringify([{ name: "ci.yml", path: ".github/workflows/ci.yml", type: "file", size: 100 }]), { status: 200 });
-      }
+      if (/\/repos\/acme\/widgets(\?|$)/.test(u)) return new Response(JSON.stringify({ default_branch: "main" }), { status: 200 });
       return new Response("not found", { status: 404 });
     }) as unknown as typeof fetch;
 
@@ -164,12 +229,13 @@ describe("auditCommand", () => {
     const impl = (async (url: string | URL | Request) => {
       const u = String(url);
       if (u.includes("/commits/v4")) return new Response(JSON.stringify({ sha }), { status: 200 });
+      if (u.includes("/git/trees/")) {
+        return new Response(JSON.stringify({ tree: [{ path: ".github/workflows/ci.yml", type: "blob", size: 100 }] }), { status: 200 });
+      }
       if (u.includes("/contents/.github/workflows/ci.yml")) {
         return new Response(JSON.stringify({ name: "ci.yml", path: ".github/workflows/ci.yml", type: "file", content: b64(yaml), encoding: "base64" }), { status: 200 });
       }
-      if (u.includes("/contents/.github/workflows")) {
-        return new Response(JSON.stringify([{ name: "ci.yml", path: ".github/workflows/ci.yml", type: "file", size: 100 }]), { status: 200 });
-      }
+      if (/\/repos\/acme\/widgets(\?|$)/.test(u)) return new Response(JSON.stringify({ default_branch: "main" }), { status: 200 });
       return new Response("not found", { status: 404 });
     }) as unknown as typeof fetch;
 

package/src/cli/commands/audit.ts

@@ -1,19 +1,18 @@
 /**
- * `chant audit` — run chant's CI security checks against an existing repo's
+ * `chant audit` — run chant's security, correctness, and best-practice checks against an existing repo's
  * pipeline YAML and emit a tiered report. Does not require a chant project;
  * it reads `.github/workflows`, `.gitlab-ci.yml`, and `.forgejo/workflows`
  * directly and runs the real post-synth checks via the audit core.
  */
 
-import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
-import { join, relative, basename } from "path";
-import { parseYAML } from "../../yaml";
-import { auditFiles, type AuditInput, type AuditFinding, type AuditLexicon, type ChecksProvider } from "../../audit/core";
+import { existsSync, statSync, writeFileSync } from "fs";
+import { auditFiles, type AuditInput, type AuditFinding, type ChecksProvider } from "../../audit/core";
+import { discoverByDetection, classifyFiles, loadAuditPlugins, AUDIT_LEXICONS } from "../../audit/discover";
 import { RULE_CATALOG } from "../../audit/catalog";
 import { renderMarkdown } from "../../audit/report";
 import { renderHtml, type ReportTheme } from "../../audit/report-html";
 import { buildReportJson, type AuditSnapshot } from "../../audit/report-model";
-import { fetchCiFiles, resolveActionSha, resolveImageDigest, resolveRepoCommit, parseRepoUrl, FetchError } from "../../audit/fetch";
+import { fetchRepoFiles, resolveActionSha, resolveImageDigest, resolveRepoCommit, parseRepoUrl, FetchError } from "../../audit/fetch";
 import { extractUnpinnedActions, extractUnpinnedImages } from "../../audit/proof";
 import type { ProveOptions } from "../../audit/proof";
 import type { Severity } from "../../lint/rule";
@@ -89,122 +88,6 @@ function githubToken(env: NodeJS.ProcessEnv = process.env): string | undefined {
   return env.GITHUB_TOKEN ?? env.CHANT_AUDIT_GITHUB_TOKEN;
 }
 
-function isYaml(name: string): boolean {
-  return name.endsWith(".yml") || name.endsWith(".yaml");
-}
-
-function collectDir(root: string, dir: string, lexicon: AuditLexicon, out: AuditInput[]): void {
-  const abs = join(root, dir);
-  if (!existsSync(abs) || !statSync(abs).isDirectory()) return;
-  for (const name of readdirSync(abs).sort()) {
-    if (!isYaml(name)) continue;
-    const full = join(abs, name);
-    if (!statSync(full).isFile()) continue;
-    out.push({ path: relative(root, full), content: readFileSync(full, "utf-8"), lexicon });
-  }
-}
-
-/** Discover CI files under a repo root. */
-export function discoverCiFiles(root: string): AuditInput[] {
-  const inputs: AuditInput[] = [];
-  collectDir(root, ".github/workflows", "github", inputs);
-  collectDir(root, ".forgejo/workflows", "forgejo", inputs);
-  const gitlab = join(root, ".gitlab-ci.yml");
-  if (existsSync(gitlab) && statSync(gitlab).isFile()) {
-    inputs.push({ path: ".gitlab-ci.yml", content: readFileSync(gitlab, "utf-8"), lexicon: "gitlab" });
-  }
-  return inputs;
-}
-
-const WALK_SKIP = new Set(["node_modules", ".git", "dist", ".github", ".forgejo"]);
-const MAX_WALK_FILES = 1000;
-
-/** Recursively collect file paths under a root, skipping noise/dot dirs. */
-function walkFiles(dir: string, out: string[]): void {
-  if (out.length >= MAX_WALK_FILES) return;
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const e of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
-    if (out.length >= MAX_WALK_FILES) return;
-    if (e.name.startsWith(".") && e.isDirectory()) continue;
-    if (WALK_SKIP.has(e.name)) continue;
-    const full = join(dir, e.name);
-    if (e.isDirectory()) walkFiles(full, out);
-    else out.push(full);
-  }
-}
-
-function readSafe(full: string): string | undefined {
-  try {
-    return readFileSync(full, "utf-8");
-  } catch {
-    return undefined;
-  }
-}
-
-/** True if any YAML document in the content is a Kubernetes manifest. */
-function looksLikeK8s(content: string): boolean {
-  for (const doc of content.split(/\n---\n/)) {
-    const t = doc.trim();
-    if (!t) continue;
-    try {
-      const obj = parseYAML(t) as Record<string, unknown>;
-      if (obj && typeof obj.apiVersion === "string" && typeof obj.kind === "string") return true;
-    } catch {
-      // not parseable as a single doc — skip
-    }
-  }
-  return false;
-}
-
-/** Discover Kubernetes manifest files under a repo root (content-detected). */
-export function discoverManifests(root: string): AuditInput[] {
-  const files: string[] = [];
-  walkFiles(root, files);
-  const inputs: AuditInput[] = [];
-  for (const full of files) {
-    if (!isYaml(basename(full))) continue;
-    const content = readSafe(full);
-    if (content !== undefined && looksLikeK8s(content)) {
-      inputs.push({ path: relative(root, full), content, lexicon: "k8s" });
-    }
-  }
-  return inputs;
-}
-
-function isDockerfileName(name: string): boolean {
-  return name === "Dockerfile" || name.startsWith("Dockerfile.") || name.endsWith(".Dockerfile") || name.endsWith(".dockerfile");
-}
-
-function looksLikeCompose(content: string): boolean {
-  try {
-    const obj = parseYAML(content) as Record<string, unknown>;
-    return Boolean(obj) && typeof obj === "object" && "services" in obj;
-  } catch {
-    return false;
-  }
-}
-
-/** Discover Docker artifacts: Dockerfiles (by name) and Compose files (by `services:`). */
-export function discoverDocker(root: string): AuditInput[] {
-  const files: string[] = [];
-  walkFiles(root, files);
-  const inputs: AuditInput[] = [];
-  for (const full of files) {
-    const name = basename(full);
-    const content = readSafe(full);
-    if (content === undefined) continue;
-    if (isDockerfileName(name) || (isYaml(name) && looksLikeCompose(content))) {
-      inputs.push({ path: relative(root, full), content, lexicon: "docker" });
-    }
-  }
-  return inputs;
-}
-
 function isMergeWorthy(f: AuditFinding): boolean {
   return RULE_CATALOG[f.checkId]?.tier === "merge-worthy";
 }
@@ -240,7 +123,7 @@ function renderStylish(findings: AuditFinding[], scanned: string[], notes: strin
   const mw = findings.filter(isMergeWorthy);
   const ro = findings.filter((f) => !isMergeWorthy(f));
   lines.push(
-    `Audited ${scanned.length} CI file${scanned.length === 1 ? "" : "s"} — ` +
+    `Audited ${scanned.length} file${scanned.length === 1 ? "" : "s"} — ` +
       `${findings.length} finding${findings.length === 1 ? "" : "s"} ` +
       `(${mw.length} merge-worthy, ${ro.length} report-only).`,
   );
@@ -323,12 +206,19 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
   const isUrl = /^https?:\/\//.test(options.path);
 
   let inputs: AuditInput[];
+  // Content-detected lexicons whose package isn't installed can't be detected
+  // (detection needs the plugin's `detectTemplate`), so a local audit would
+  // silently find nothing. Track the missing packages to turn that into a hint.
+  let missingHint = "";
   if (isUrl) {
     try {
-      inputs = await fetchCiFiles(options.path, {
+      // Fetch the whole repo's candidate files (all lexicons, not just CI) and
+      // run them through the same classifier the local path uses (#420).
+      const files = await fetchRepoFiles(options.path, {
         token: options.token ?? tokenForHost(options.path),
         fetchImpl: options.fetchImpl,
       });
+      inputs = classifyFiles(files, await loadAuditPlugins());
     } catch (err) {
       const msg = err instanceof FetchError ? err.message : err instanceof Error ? err.message : String(err);
       return { success: false, output: "", findings: [], scanned: [], exitCode: 1, error: msg };
@@ -337,13 +227,25 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
     if (!existsSync(options.path)) {
       return { success: false, output: "", findings: [], scanned: [], exitCode: 1, error: `Path not found: ${options.path}` };
     }
-    inputs = [...discoverCiFiles(options.path), ...discoverManifests(options.path), ...discoverDocker(options.path)];
+    // One walk, plugin-delegated detection. Each lexicon plugin's own
+    // `detectTemplate` classifies the files it recognizes; CI (path), Dockerfiles
+    // (name), and Helm charts (bundle) are handled by discoverByDetection's
+    // special-cases since content shape alone can't disambiguate them.
+    const plugins = await loadAuditPlugins();
+    const loaded = new Set(plugins.map((p) => p.name));
+    const missing = AUDIT_LEXICONS.filter((n) => !loaded.has(n));
+    if (missing.length > 0) {
+      missingHint =
+        ` Some lexicon packages are not installed, so files of those types were not detected: ${missing.join(", ")}.` +
+        ` Install what you need, e.g. npm i ${missing.map((n) => `@intentius/chant-lexicon-${n}`).join(" ")}`;
+    }
+    inputs = discoverByDetection(options.path, plugins);
   }
 
   const scanned = inputs.map((i) => i.path);
 
   if (inputs.length === 0) {
-    return { success: true, output: `No CI files found under ${options.path}.`, findings: [], scanned: [], exitCode: 0 };
+    return { success: true, output: `No auditable files found under ${options.path}.${missingHint}`, findings: [], scanned: [], exitCode: 0 };
   }
 
   let findings: AuditFinding[];

package/src/codegen/bound-property-types.test.ts

@@ -0,0 +1,57 @@
+import { describe, test, expect } from "vitest";
+import { boundPropertyTypes, type BoundablePropertyType } from "./bound-property-types";
+
+interface Prop {
+  name: string;
+  tsType: string;
+}
+interface PT extends BoundablePropertyType {
+  name: string;
+  specType: string;
+  properties: Prop[];
+}
+
+function pt(name: string, props: Array<[string, string]>): PT {
+  return { name, specType: name.split("_")[1] ?? name, properties: props.map(([n, t]) => ({ name: n, tsType: t })) };
+}
+
+describe("boundPropertyTypes", () => {
+  test("drops property types unreachable from resource props", () => {
+    const props: Prop[] = [{ name: "sku", tsType: "R_Sku" }];
+    const types = [pt("R_Sku", [["name", "string"]]), pt("R_Unused", [["x", "string"]])];
+    const kept = boundPropertyTypes("R", props, types, new Set(), { maxDepth: 2 });
+    expect(kept.map((t) => t.name)).toEqual(["R_Sku"]);
+  });
+
+  test("caps nesting depth and loosens references beyond the cap", () => {
+    const props: Prop[] = [{ name: "a", tsType: "R_A" }];
+    const types = [
+      pt("R_A", [["b", "R_B"]]),
+      pt("R_B", [["c", "R_C"]]),
+      pt("R_C", [["d", "string"]]),
+    ];
+    const kept = boundPropertyTypes("R", props, types, new Set(), { maxDepth: 1 });
+    // depth 1: R_A kept, its child R_B not expanded -> loosened, R_C dropped
+    expect(kept.map((t) => t.name)).toEqual(["R_A"]);
+    expect(kept[0].properties[0].tsType).toBe("Record<string, unknown>");
+    expect(props[0].tsType).toBe("R_A"); // resource prop ref to a kept type is preserved
+  });
+
+  test("force-keeps curated property types by substring regardless of reachability", () => {
+    const props: Prop[] = [];
+    const types = [pt("R_SecurityRulePropertiesFormat", [["x", "string"]]), pt("R_Other", [["y", "string"]])];
+    const kept = boundPropertyTypes("R", props, types, new Set(), {
+      maxDepth: 1,
+      curatedDefs: ["SecurityRule"],
+    });
+    expect(kept.map((t) => t.name)).toEqual(["R_SecurityRulePropertiesFormat"]);
+  });
+
+  test("preserves enum references when loosening", () => {
+    const props: Prop[] = [{ name: "a", tsType: "R_A" }];
+    const types = [pt("R_A", [["mode", "R_ModeEnum"], ["nested", "R_Deep"]]), pt("R_Deep", [["x", "string"]])];
+    const kept = boundPropertyTypes("R", props, types, new Set(["R_ModeEnum"]), { maxDepth: 1 });
+    expect(kept[0].properties[0].tsType).toBe("R_ModeEnum"); // enum kept
+    expect(kept[0].properties[1].tsType).toBe("Record<string, unknown>"); // deep type loosened
+  });
+});

package/src/codegen/bound-property-types.ts

@@ -0,0 +1,110 @@
+/**
+ * Bound the set of generated property-type interfaces a lexicon emits.
+ *
+ * Cloud provider schemas (ARM, CloudFormation, …) embed a named definition for
+ * every nested object. Fully expanding all of them per-resource produces huge
+ * `.d.ts` declarations (azure was ~273MB — see #438). This helper keeps only
+ * the property types reachable from a resource's top-level properties within a
+ * depth bound, plus a curated force-keep set; references that fall outside the
+ * kept set are rewritten to `Record<string, unknown>`. Enum references are
+ * preserved. The input property refs are mutated in place. (#438, #440)
+ */
+
+/** A reference carrying a TypeScript type string, mutated in place when loosened. */
+export interface BoundablePropertyRef {
+  tsType: string;
+}
+
+/** A generated property type (named interface) and its properties. */
+export interface BoundablePropertyType {
+  name: string;
+  specType: string;
+  properties: BoundablePropertyRef[];
+}
+
+export interface BoundPropertyTypeOptions {
+  /** Maximum nesting depth of emitted property-type interfaces. */
+  maxDepth: number;
+  /**
+   * Definition-name substrings to always keep regardless of reachability/depth
+   * (e.g. common nested shapes worth typing for authoring ergonomics). Matched
+   * by substring against each property type's `specType`.
+   */
+  curatedDefs?: Iterable<string>;
+}
+
+function escapeRegExp(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** Extract `${shortName}_Ident` type-reference tokens from a tsType string. */
+function referencedTypeNames(tsType: string, shortName: string): string[] {
+  const re = new RegExp("\\b" + escapeRegExp(shortName) + "_[A-Za-z0-9_]+", "g");
+  return tsType.match(re) ?? [];
+}
+
+/**
+ * Filter `propertyTypes` to the bounded set and loosen out-of-set references.
+ * Mutates the `tsType` of `resourceProps` and retained property types; returns
+ * the retained property types.
+ */
+export function boundPropertyTypes<PT extends BoundablePropertyType>(
+  shortName: string,
+  resourceProps: BoundablePropertyRef[],
+  propertyTypes: PT[],
+  enumNames: Set<string>,
+  options: BoundPropertyTypeOptions,
+): PT[] {
+  const { maxDepth } = options;
+  const curated = options.curatedDefs ? [...options.curatedDefs] : [];
+  const byName = new Map(propertyTypes.map((pt) => [pt.name, pt] as const));
+  const reached = new Set<string>();
+  const queue: Array<{ name: string; depth: number }> = [];
+
+  const seed = (tsType: string, depth: number) => {
+    for (const n of referencedTypeNames(tsType, shortName)) {
+      if (byName.has(n) && !reached.has(n)) {
+        reached.add(n);
+        queue.push({ name: n, depth });
+      }
+    }
+  };
+
+  for (const p of resourceProps) seed(p.tsType, 1);
+  // Force-keep curated property types (depth-1 seeds), matched by substring so
+  // schema variant names (e.g. "SecurityRulePropertiesFormat") are retained.
+  if (curated.length > 0) {
+    for (const pt of propertyTypes) {
+      if (!reached.has(pt.name) && curated.some((c) => pt.specType.includes(c))) {
+        reached.add(pt.name);
+        queue.push({ name: pt.name, depth: 1 });
+      }
+    }
+  }
+  while (queue.length) {
+    const { name, depth } = queue.shift()!;
+    if (depth >= maxDepth) continue; // do not expand children beyond the cap
+    const pt = byName.get(name);
+    if (!pt) continue;
+    for (const p of pt.properties) seed(p.tsType, depth + 1);
+  }
+
+  // Rewrite references to property types we are not emitting (keep enums).
+  const loosen = (tsType: string): string => {
+    let out = tsType;
+    for (const n of referencedTypeNames(tsType, shortName)) {
+      if (reached.has(n) || enumNames.has(n) || !byName.has(n)) continue;
+      out = out.replace(new RegExp("\\b" + escapeRegExp(n) + "\\b", "g"), "Record<string, unknown>");
+    }
+    return out;
+  };
+
+  for (const p of resourceProps) p.tsType = loosen(p.tsType);
+  const retained: PT[] = [];
+  for (const pt of propertyTypes) {
+    if (!reached.has(pt.name)) continue;
+    for (const p of pt.properties) p.tsType = loosen(p.tsType);
+    retained.push(pt);
+  }
+  return retained;
+}

package/src/codegen/generate-post-synth-barrel.test.ts

@@ -0,0 +1,37 @@
+import { describe, test, expect } from "vitest";
+import { generatePostSynthBarrel, type BarrelEntry } from "./generate-post-synth-barrel";
+
+describe("generatePostSynthBarrel", () => {
+  test("emits a DO NOT EDIT banner, static imports, and an id-sorted array", () => {
+    const entries: BarrelEntry[] = [
+      { module: "./gha021", exportName: "gha021", id: "GHA021" },
+      { module: "./apt-no-recommends", exportName: "dkrd010", id: "DKRD010" },
+      { module: "./gha006", exportName: "gha006", id: "GHA006" },
+    ];
+    const out = generatePostSynthBarrel(entries);
+
+    expect(out).toContain("// Code generated by chant generate. DO NOT EDIT.");
+    expect(out).toContain('import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";');
+    // Export name may differ from the module name (docker/helm/temporal).
+    expect(out).toContain('import { dkrd010 } from "./apt-no-recommends";');
+    // Array is ordered by id, not insertion order.
+    const arrayBody = out.slice(out.indexOf("postSynthChecks: PostSynthCheck[] = ["));
+    expect(arrayBody.indexOf("dkrd010")).toBeLessThan(arrayBody.indexOf("gha006"));
+    expect(arrayBody.indexOf("gha006")).toBeLessThan(arrayBody.indexOf("gha021"));
+  });
+
+  test("is deterministic regardless of input order", () => {
+    const a: BarrelEntry[] = [
+      { module: "./b", exportName: "b", id: "X2" },
+      { module: "./a", exportName: "a", id: "X1" },
+    ];
+    const b = [...a].reverse();
+    expect(generatePostSynthBarrel(a)).toBe(generatePostSynthBarrel(b));
+  });
+
+  test("empty input yields an empty array, still valid", () => {
+    const out = generatePostSynthBarrel([]);
+    expect(out).toContain("export const postSynthChecks: PostSynthCheck[] = [");
+    expect(out).toContain("];");
+  });
+});

package/src/codegen/generate-post-synth-barrel.ts

@@ -0,0 +1,75 @@
+/**
+ * Generate a static, importable barrel of a lexicon's post-synth checks.
+ *
+ * The runtime loader (`discoverPostSynthChecks`) readdir-globs the directory and
+ * `require()`s each file via tsx — fs- and tsx-coupled, so it can't run in a
+ * bundle or on an edge runtime (Cloudflare Workers). This generator produces a
+ * committed `lint/post-synth/index.ts` with explicit static imports + an exported
+ * `postSynthChecks` array, which bundlers can follow with no fs/tsx/require. See #409.
+ *
+ * Detection reuses the runtime's own `isPostSynthCheck`, so the barrel contains
+ * exactly the checks discovery would — including files whose export name differs
+ * from the filename (docker/helm/temporal) and excluding helper modules
+ * (cf-refs, arm-refs, …) that export no check.
+ */
+
+import { createRequire } from "module";
+import { listRuleFiles } from "../lint/discover";
+import { isPostSynthCheck } from "../lint/post-synth";
+
+export interface BarrelEntry {
+  /** Module specifier relative to the barrel, e.g. "./gha021" or "./apt-no-recommends". */
+  module: string;
+  /** Exported binding holding the check, e.g. "gha021" or "dkrd010". */
+  exportName: string;
+  /** The check's id (e.g. "GHA021"), used for stable ordering. */
+  id: string;
+}
+
+/**
+ * Scan a post-synth directory and return one entry per exported check.
+ * Runs at codegen time on Node (tsx-powered require), never in the shipped path.
+ */
+export function scanPostSynthChecks(dir: string, importMetaUrl: string): BarrelEntry[] {
+  const require = createRequire(importMetaUrl);
+  const entries: BarrelEntry[] = [];
+  for (const file of listRuleFiles(dir)) {
+    const base = file.replace(/\.ts$/, "");
+    let mod: Record<string, unknown>;
+    try {
+      mod = require(`${dir}/${base}`) as Record<string, unknown>;
+    } catch {
+      continue; // a file that fails to load contributes nothing
+    }
+    for (const [exportName, value] of Object.entries(mod)) {
+      if (isPostSynthCheck(value)) {
+        entries.push({ module: `./${base}`, exportName, id: value.id });
+      }
+    }
+  }
+  return entries;
+}
+
+/** Render the barrel file content from scanned entries (pure — easy to unit test). */
+export function generatePostSynthBarrel(entries: BarrelEntry[]): string {
+  const sorted = [...entries].sort((a, b) => a.id.localeCompare(b.id));
+  const lines: string[] = [];
+  lines.push("// Code generated by chant generate. DO NOT EDIT.");
+  lines.push('import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";');
+  for (const e of sorted) {
+    lines.push(`import { ${e.exportName} } from ${JSON.stringify(e.module)};`);
+  }
+  lines.push("");
+  lines.push("export const postSynthChecks: PostSynthCheck[] = [");
+  for (const e of sorted) {
+    lines.push(`  ${e.exportName},`);
+  }
+  lines.push("];");
+  lines.push("");
+  return lines.join("\n");
+}
+
+/** Scan a directory and render its barrel in one step. */
+export function renderPostSynthBarrelForDir(dir: string, importMetaUrl: string): string {
+  return generatePostSynthBarrel(scanPostSynthChecks(dir, importMetaUrl));
+}