@intentius/chant 0.124.51 → 0.124.54

package/dist/lifecycle/snapshot.d.ts

@@ -5,11 +5,20 @@
 import type { ObservationLexicon } from "../lexicon.js";
 import type { BuildResult } from "../build.js";
 import type { LifecycleSnapshot } from "./types.js";
+import { type SnapshotStore, type StorePublish } from "./snapshot-store.js";
 export interface TakeSnapshotResult {
     snapshots: LifecycleSnapshot[];
+    /** The version the last write made: a commit on a git store, an object version on s3. Empty when nothing was written. */
     commit: string;
     warnings: string[];
     errors: string[];
+    /** Where the snapshots went (`refs/chant/snapshots`, a directory, `s3://...`), and whether they were kept (#4519). */
+    store?: {
+        kind: SnapshotStore["kind"];
+        where: string;
+        written: boolean;
+        publish?: StorePublish;
+    };
 }
 /**
  * Take state snapshots for all plugins that implement describeResources.
@@ -23,5 +32,7 @@ export declare function takeSnapshot(environment: string, plugins: ObservationLe
     /** Kinds the PROJECT manages, not just this stack — a region whose stack
      * declares no security group still has a default one (#1278). */
     ambientKinds?: string[];
+    /** The index store to write to (#4519). Default: the project's, from `snapshots` in chant.config.ts. */
+    store?: SnapshotStore;
 }): Promise<TakeSnapshotResult>;
 //# sourceMappingURL=snapshot.d.ts.map

package/dist/lifecycle/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/lifecycle/snapshot.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAsC,MAAM,YAAY,CAAC;AACzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,SAAS,CAAC;AAiEnE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;qEACiE;IACjE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,GACA,OAAO,CAAC,kBAAkB,CAAC,CAsN7B"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/lifecycle/snapshot.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAsC,MAAM,YAAY,CAAC;AACzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,SAAS,CAAC;AAMnE,OAAO,EAAwB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA4D/F,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,yHAAyH;IACzH,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sHAAsH;IACtH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,YAAY,CAAA;KAAE,CAAC;CAClG;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;qEACiE;IACjE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,wGAAwG;IACxG,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB,GACA,OAAO,CAAC,kBAAkB,CAAC,CAiO7B"}

package/dist/lifecycle/snapshot.js

@@ -1,7 +1,8 @@
 import { observeDeep } from "./deep-observe.js";
 import { computeBuildDigest } from "./digest.js";
 import { collectDependencies, collectAmbient } from "./observe.js";
-import { writeSnapshot, snapshotStorageKey, getHeadCommit, pushLifecycle } from "./git.js";
+import { snapshotStorageKey, getHeadCommit } from "./git.js";
+import { resolveSnapshotStore } from "./snapshot-store.js";
 import { sortedJsonReplacer } from "../utils.js";
 import { formatUnobserved, normalizeObservation, unobservedAll } from "../observation.js";
 // One list of secret-bearing property names for both observation depths
@@ -220,20 +221,32 @@ export async function takeSnapshot(environment, plugins, buildResult, opts) {
             }
         }
     }
-    // Write all successful snapshots to git
+    // Write every successful snapshot through the index store (#4519). Masking
+    // already happened above, so the store never sees a secret.
+    const store = opts?.store ?? (await resolveSnapshotStore({ cwd: opts?.cwd }));
     let commitSha = "";
+    let written = false;
     for (const snapshot of snapshots) {
         const json = JSON.stringify(snapshot, sortedJsonReplacer, 2);
-        commitSha = await writeSnapshot(snapshot.environment, snapshotStorageKey(snapshot.lexicon, snapshot.stack), json, opts);
+        const result = await store.write(snapshot.environment, snapshotStorageKey(snapshot.lexicon, snapshot.stack), json, opts?.cwd ? { cwd: opts.cwd } : undefined);
+        if (result.written) {
+            written = true;
+            commitSha = result.version ?? commitSha;
+        }
+        else if (result.reason) {
+            warnings.push(`${snapshot.lexicon}: snapshot not kept: ${result.reason}`);
+        }
     }
     // Push to remote
-    if (snapshots.length > 0) {
-        await pushLifecycle(opts);
+    const publish = written ? await store.publish() : undefined;
+    if (publish && (publish.status === "stale" || publish.status === "failed")) {
+        warnings.push(`snapshot kept locally in ${store.where}, not pushed: ${publish.detail ?? publish.status}`);
     }
     return {
         snapshots,
         commit: commitSha,
         warnings,
         errors,
+        store: { kind: store.kind, where: store.where, written, ...(publish ? { publish } : {}) },
     };
 }

package/dist/lifecycle/type-listing.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Typed nodes for indexed resources (#4521, tier 1 of INTENTIUS/behold#1025).
+ *
+ * behold#1029's cloud lister reads one account, subscription, project or
+ * cluster through that cloud's inventory API and returns a
+ * {@link ListingResult}. {@link typeListing} turns it into an
+ * {@link IndexDocument}: each listed object becomes an `IRNode` whose `kind`
+ * is the lexicon kind that describes it, with its properties normalized by
+ * that lexicon's own deep-observe hooks, so an indexed tree has the shape an
+ * observed one has and the capability catalog (#4375) applies to it.
+ *
+ * Pure: no I/O and no clock. The lexicons come in as data (each plugin's
+ * `listedTypes` and `deepNormalizationHooks`), so behold passes the plugins
+ * it already loads and a test passes a table.
+ *
+ * Rules:
+ * - a listed type no lexicon maps stays a node of unknown kind: `kind` is
+ *   the listed type, `lexicon` the substrate, `unmappedKind: true`. It is
+ *   never dropped, and a note names each such type once;
+ * - secret-bearing values are masked with the one list the snapshot path
+ *   uses (`isSensitiveKey`, ../sensitive-key.ts). The lister masked already;
+ *   masking again here means no listing reaches the index unmasked;
+ * - a node id is the path-style id ruled on behold#1025 (Q2):
+ *   `<substrate>/<scopeId>/<location>/<listedType>/<nativeId>`.
+ *
+ * Edges are #4522's (./derive-edges.ts); this module leaves `edges` empty.
+ */
+import type { DeepNormalizationHooks } from "../deep-observation.js";
+import type { EngineFacts } from "../engine-facts.js";
+import type { GraphIR, IRNode } from "../graph-ir.js";
+import { type CloudIndexScope, type CoverageEntry, type IndexDocument, type IndexNote } from "./index-document.js";
+/** The four substrates the lister reads, one per run (behold#1025 Q6). */
+export type ListingSubstrate = CloudIndexScope["substrate"];
+/** One run's scope, as the lister names it. `"*"` means every location or type. */
+export interface CloudScope {
+    substrate: ListingSubstrate;
+    scopeId: string;
+    locations: readonly string[] | "*";
+    types: readonly string[] | "*";
+    tagFilter?: Readonly<Record<string, string>>;
+}
+/** A cloud id, kinds as #4520 ruled them (`EngineFacts.cloudIds`). */
+export interface ListedCloudId {
+    kind: "import-id" | "arn" | "provider-id" | "self-link" | "k8s-uid";
+    value: string;
+}
+/** The facts a cloud listing can supply: markers read off tags, cloud ids, when it was read. */
+export interface ListedFacts {
+    markers?: EngineFacts["markers"];
+    cloudIds: ListedCloudId[];
+    observedAt: string;
+}
+/** One listed object (behold#1025 `ListedResource`). */
+export interface ListedResource {
+    /** The path-style id; recomputed by {@link listedNodeId}, so a listing may leave it out. */
+    id?: string;
+    listedType: string;
+    location: string;
+    nativeId: string;
+    cloudIds: ListedCloudId[];
+    tags: Record<string, string>;
+    /** As returned, unnormalized, already masked by the lister. */
+    properties: Record<string, unknown>;
+    observedAt: string;
+    facts?: ListedFacts;
+}
+/** A lister note: a type with no lister, a disabled API, a tag filter. */
+export interface ListingNote {
+    code: string;
+    message: string;
+    listedType?: string;
+    location?: string;
+    command?: string;
+}
+/** The lister's whole output for one run (behold#1025 `ListingResult`, behold#1029). */
+export interface ListingResult {
+    listing: "v1";
+    source?: {
+        name: string;
+        version?: string;
+    };
+    scope: CloudScope;
+    startedAt: string;
+    completedAt: string;
+    resources: ListedResource[];
+    coverage: CoverageEntry[];
+    notes: ListingNote[];
+}
+/**
+ * How a lexicon reads one substrate's listed types (a plugin's
+ * `listedTypes`). Data plus two pure functions.
+ */
+export interface ListedTypeMapping {
+    substrate: ListingSubstrate;
+    /** The lexicon kind for a listed type, or undefined when the lexicon has none. */
+    kindFor(listedType: string): string | undefined;
+    /**
+     * The listed properties reshaped into the tree this lexicon's deep reader
+     * returns, before the hooks run: Azure flattens `properties.*` beside
+     * `location` and `sku`, Kubernetes drops `apiVersion` and `kind`. Absent
+     * means the listing's shape already is that tree (Cloud Control's
+     * CloudFormation model).
+     */
+    observedTree?(properties: Record<string, unknown>, context: {
+        listedType: string;
+        kind: string;
+    }): Record<string, unknown>;
+}
+/** What {@link typeListing} needs from a lexicon. A `LexiconPlugin` is one. */
+export interface ListingLexicon {
+    name: string;
+    listedTypes?: ListedTypeMapping;
+    deepNormalizationHooks?: DeepNormalizationHooks;
+}
+/**
+ * `<substrate>/<scopeId>/<location>/<listedType>/<nativeId>` (behold#1025
+ * Q2), exactly as behold's lister writes it (src/cloud-lister/ids.ts): `%`
+ * and `/` are escaped in the first four parts, and the native id is last and
+ * unescaped, so everything after the fourth `/` is it.
+ */
+export declare function listedNodeId(parts: {
+    substrate: string;
+    scopeId: string;
+    location: string;
+    listedType: string;
+    nativeId: string;
+}): string;
+/** The lexicon (and kind) for one listed type: the first mapping, by lexicon name, that answers. */
+export declare function resolveListedKind(substrate: ListingSubstrate, listedType: string, lexicons: readonly ListingLexicon[]): {
+    lexicon: ListingLexicon;
+    kind: string;
+} | undefined;
+/** One listed object as a typed (or unknown-kind) node. */
+export declare function typeListedResource(scope: CloudScope, resource: ListedResource, lexicons: readonly ListingLexicon[]): IRNode;
+/** The listing's scope as the index stamp's cloud scope. */
+export declare function listingIndexScope(scope: CloudScope): CloudIndexScope;
+/** Every listed object as a node, sorted by id. */
+export declare function typeListingNodes(listing: ListingResult, lexicons: readonly ListingLexicon[]): IRNode[];
+/**
+ * The listing as one index version (behold#1025 schema). `graph.edges` is
+ * empty; chant#4522's `deriveEdges` fills it. Coverage passes through as the
+ * lister wrote it, wildcards included. The lister's notes keep their code as
+ * `kind`, and each unmapped listed type gets one `unmapped-type` note.
+ */
+export declare function typeListing(listing: ListingResult, lexicons: readonly ListingLexicon[]): IndexDocument;
+/** Stamp a graph, coverage and notes read from `listing` as one index version. */
+export declare function assembleIndexDocument(listing: ListingResult, graph: GraphIR, coverage: CoverageEntry[], notes: IndexNote[]): IndexDocument;
+//# sourceMappingURL=type-listing.d.ts.map

package/dist/lifecycle/type-listing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-listing.d.ts","sourceRoot":"","sources":["../../src/lifecycle/type-listing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAE1B,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;AAE5D,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;IACnC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;IAC/B,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC9C;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,GAAG,KAAK,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;IACpE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gGAAgG;AAChG,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,4FAA4F;IAC5F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,kFAAkF;IAClF,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAChD;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5H;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;CACjD;AAMD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQ1I;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,gBAAgB,EAC3B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQvD;AAUD,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,MAAM,CA4CR;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,eAAe,CASpE;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,EAAE,CAItG;AAQD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,aAAa,CA0BtG;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,aAAa,EAAE,EACzB,KAAK,EAAE,SAAS,EAAE,GACjB,aAAa,CAgBf"}

package/dist/lifecycle/type-listing.js

@@ -0,0 +1,166 @@
+import { MASKED, isSensitiveKey, normalizeDeepProperties } from "../deep-observation.js";
+import { canonicalScope, indexDocumentDigest, indexScopeKey, } from "./index-document.js";
+function escapeSegment(s) {
+    return s.replace(/%/g, "%25").replace(/\//g, "%2F");
+}
+/**
+ * `<substrate>/<scopeId>/<location>/<listedType>/<nativeId>` (behold#1025
+ * Q2), exactly as behold's lister writes it (src/cloud-lister/ids.ts): `%`
+ * and `/` are escaped in the first four parts, and the native id is last and
+ * unescaped, so everything after the fourth `/` is it.
+ */
+export function listedNodeId(parts) {
+    return [
+        escapeSegment(parts.substrate),
+        escapeSegment(parts.scopeId),
+        escapeSegment(parts.location),
+        escapeSegment(parts.listedType),
+        parts.nativeId,
+    ].join("/");
+}
+/** The lexicon (and kind) for one listed type: the first mapping, by lexicon name, that answers. */
+export function resolveListedKind(substrate, listedType, lexicons) {
+    for (const lexicon of lexicons) {
+        const mapping = lexicon.listedTypes;
+        if (!mapping || mapping.substrate !== substrate)
+            continue;
+        const kind = mapping.kindFor(listedType);
+        if (kind !== undefined)
+            return { lexicon, kind };
+    }
+    return undefined;
+}
+function maskTags(tags) {
+    const out = {};
+    for (const k of Object.keys(tags).sort())
+        out[k] = isSensitiveKey(k) ? MASKED : tags[k];
+    return out;
+}
+const byName = (a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+/** One listed object as a typed (or unknown-kind) node. */
+export function typeListedResource(scope, resource, lexicons) {
+    const sorted = [...lexicons].sort(byName);
+    const resolved = resolveListedKind(scope.substrate, resource.listedType, sorted);
+    const id = listedNodeId({
+        substrate: scope.substrate,
+        scopeId: scope.scopeId,
+        location: resource.location,
+        listedType: resource.listedType,
+        nativeId: resource.nativeId,
+    });
+    let kind;
+    let lexicon;
+    let attrs;
+    if (resolved) {
+        kind = resolved.kind;
+        lexicon = resolved.lexicon.name;
+        const reshape = resolved.lexicon.listedTypes?.observedTree;
+        const tree = reshape ? reshape(resource.properties, { listedType: resource.listedType, kind }) : resource.properties;
+        attrs = normalizeDeepProperties(tree, { entityType: kind, side: "live", hooks: resolved.lexicon.deepNormalizationHooks });
+    }
+    else {
+        kind = resource.listedType;
+        lexicon = scope.substrate;
+        // No lexicon, so no hooks: the listing's properties as returned, key-sorted and masked.
+        attrs = normalizeDeepProperties(resource.properties, { entityType: resource.listedType, side: "live" });
+    }
+    const cloudIds = resource.cloudIds.length > 0 ? resource.cloudIds : resource.facts?.cloudIds ?? [];
+    const facts = {
+        ...(resource.facts?.markers ? { markers: resource.facts.markers } : {}),
+        ...(cloudIds.length > 0 ? { cloudIds: cloudIds.map((c) => ({ kind: c.kind, value: c.value })) } : {}),
+        observedAt: resource.facts?.observedAt ?? resource.observedAt,
+    };
+    return {
+        id,
+        kind,
+        lexicon,
+        attrs,
+        physicalId: resource.nativeId,
+        facts,
+        listedType: resource.listedType,
+        location: resource.location,
+        nativeId: resource.nativeId,
+        tags: maskTags(resource.tags ?? {}),
+        ...(resolved ? {} : { unmappedKind: true }),
+    };
+}
+/** The listing's scope as the index stamp's cloud scope. */
+export function listingIndexScope(scope) {
+    return canonicalScope({
+        kind: "cloud",
+        substrate: scope.substrate,
+        scopeId: scope.scopeId,
+        locations: scope.locations,
+        types: scope.types,
+        ...(scope.tagFilter ? { tagFilter: scope.tagFilter } : {}),
+    });
+}
+/** Every listed object as a node, sorted by id. */
+export function typeListingNodes(listing, lexicons) {
+    const nodes = listing.resources.map((r) => typeListedResource(listing.scope, r, lexicons));
+    nodes.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    return nodes;
+}
+const compareNotes = (a, b) => {
+    const ka = `${a.kind}\u0000${a.listedType ?? ""}\u0000${a.location ?? ""}\u0000${a.message}`;
+    const kb = `${b.kind}\u0000${b.listedType ?? ""}\u0000${b.location ?? ""}\u0000${b.message}`;
+    return ka < kb ? -1 : ka > kb ? 1 : 0;
+};
+/**
+ * The listing as one index version (behold#1025 schema). `graph.edges` is
+ * empty; chant#4522's `deriveEdges` fills it. Coverage passes through as the
+ * lister wrote it, wildcards included. The lister's notes keep their code as
+ * `kind`, and each unmapped listed type gets one `unmapped-type` note.
+ */
+export function typeListing(listing, lexicons) {
+    const nodes = typeListingNodes(listing, lexicons);
+    const graph = {
+        version: 1,
+        nodes,
+        edges: [],
+        groups: { byLexicon: groupByLexicon(nodes) },
+    };
+    const coverage = [...listing.coverage].map((c) => ({ ...c }));
+    const notes = listing.notes.map((n) => ({
+        kind: n.code,
+        message: n.message,
+        ...(n.listedType !== undefined ? { listedType: n.listedType } : {}),
+        ...(n.location !== undefined ? { location: n.location } : {}),
+        ...(n.command !== undefined ? { command: n.command } : {}),
+    }));
+    const unmapped = [...new Set(nodes.filter((n) => n.unmappedKind).map((n) => n.listedType))].sort();
+    for (const t of unmapped) {
+        notes.push({
+            kind: "unmapped-type",
+            listedType: t,
+            message: `no lexicon kind maps the listed type ${t}; its objects are kept as nodes of unknown kind, with the listing's properties masked`,
+        });
+    }
+    notes.sort(compareNotes);
+    return assembleIndexDocument(listing, graph, coverage, notes);
+}
+/** Stamp a graph, coverage and notes read from `listing` as one index version. */
+export function assembleIndexDocument(listing, graph, coverage, notes) {
+    const scope = listingIndexScope(listing.scope);
+    return {
+        index: "v1",
+        stamp: {
+            source: { kind: "cloud", name: listing.source?.name ?? "behold-lister", ...(listing.source?.version ? { version: listing.source.version } : {}) },
+            scope,
+            scopeKey: indexScopeKey(scope),
+            observedAt: listing.startedAt,
+            completedAt: listing.completedAt,
+            digest: indexDocumentDigest({ graph, coverage }),
+        },
+        coverage,
+        graph,
+        ...(notes.length > 0 ? { notes } : {}),
+    };
+}
+function groupByLexicon(nodes) {
+    var _a;
+    const out = {};
+    for (const n of nodes)
+        (out[_a = n.lexicon] ?? (out[_a] = [])).push(n.id);
+    return Object.fromEntries(Object.keys(out).sort().map((k) => [k, out[k].sort()]));
+}

package/dist/lint/component-checks.d.ts

@@ -53,6 +53,20 @@ export interface ComponentCheckContext {
      * `none-by-design`, i.e. flags nothing).
      */
     rollbackPolicies?: ReadonlyMap<string, RollbackPolicy>;
+    /**
+     * The project's `terraform.roots` entries marked `signalOnly` (#4484),
+     * keyed by root name. Supplied by `chant lint` from the project's config
+     * (`signalOnlyRootsOf` in ./rules/comp/comp008-applies-signal-only-root.ts);
+     * undefined when none was resolved, in which case COMP008 flags nothing.
+     */
+    signalOnlyRoots?: ReadonlyMap<string, SignalOnlyRoot>;
+}
+/** One `terraform.roots` entry marked `signalOnly` (#4490). */
+export interface SignalOnlyRoot {
+    /** The root's `dir` as the config writes it. */
+    dir: string;
+    /** The workspace member whose directory holds the root, when the workspace reads. */
+    owner?: string;
 }
 /** A diagnostic from a component composition check. Shaped like `PostSynthDiagnostic`, plus a `file` so it can be merged into `LintDiagnostic`s and reported per-file like every other lint diagnostic. */
 export interface ComponentCheckDiagnostic {
@@ -94,7 +108,7 @@ export interface ComponentCheck {
  * COMP* checks exist precisely because they need the discovered `Component`
  * graph, which does mean importing `*.component.ts` files.
  */
-export declare function runComponentChecks(path: string, checks: ComponentCheck[], registryContext?: Pick<ComponentCheckContext, "knownKinds" | "rollbackPolicies">, sandbox?: boolean, buildParams?: BuildParamProvenance[]): Promise<ComponentCheckDiagnostic[]>;
+export declare function runComponentChecks(path: string, checks: ComponentCheck[], registryContext?: Pick<ComponentCheckContext, "knownKinds" | "rollbackPolicies" | "signalOnlyRoots">, sandbox?: boolean, buildParams?: BuildParamProvenance[]): Promise<ComponentCheckDiagnostic[]>;
 /** Structural type guard, mirroring `isPostSynthCheck` — used by rule discovery/registry code. */
 export declare function isComponentCheck(value: unknown): value is ComponentCheck;
 /** Re-exported for rule modules that need the discovered shape without importing `../components/discover` directly. */

package/dist/lint/component-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"component-checks.d.ts","sourceRoot":"","sources":["../../src/lint/component-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEvC,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC7C;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACxD;AAED,2MAA2M;AAC3M,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,aAAa,GAAG,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC;IAC/D,gDAAgD;IAChD,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,wBAAwB,EAAE,CAAC;CAC/D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,EAAE,EACxB,eAAe,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,GAAG,kBAAkB,CAAC,EAChF,OAAO,CAAC,EAAE,OAAO,EACjB,WAAW,CAAC,EAAE,oBAAoB,EAAE,GACnC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAoCrC;AAED,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAUxE;AAED,uHAAuH;AACvH,YAAY,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"component-checks.d.ts","sourceRoot":"","sources":["../../src/lint/component-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEvC,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC7C;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACvD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACvD;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2MAA2M;AAC3M,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,aAAa,GAAG,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC;IAC/D,gDAAgD;IAChD,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,wBAAwB,EAAE,CAAC;CAC/D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,EAAE,EACxB,eAAe,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,EACpG,OAAO,CAAC,EAAE,OAAO,EACjB,WAAW,CAAC,EAAE,oBAAoB,EAAE,GACnC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAqCrC;AAED,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAUxE;AAED,uHAAuH;AACvH,YAAY,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/lint/component-checks.js

@@ -68,6 +68,7 @@ export async function runComponentChecks(path, checks, registryContext, sandbox,
         components,
         knownKinds: registryContext?.knownKinds,
         rollbackPolicies: registryContext?.rollbackPolicies,
+        signalOnlyRoots: registryContext?.signalOnlyRoots,
     };
     for (const check of checks) {
         diagnostics.push(...check.check(ctx));

package/dist/lint/presets/relaxed.json

@@ -21,6 +21,7 @@
     "COMP004": "warning",
     "COMP005": "off",
     "COMP006": "off",
-    "COMP007": "off"
+    "COMP007": "off",
+    "COMP008": "warning"
   }
 }

package/dist/lint/presets/strict.json

@@ -21,6 +21,7 @@
     "COMP004": "error",
     "COMP005": "error",
     "COMP006": "error",
-    "COMP007": "warning"
+    "COMP007": "warning",
+    "COMP008": "warning"
   }
 }

package/dist/lint/rules/__fixtures__/comp/comp008/fail/dns.component.d.ts

@@ -0,0 +1,4 @@
+import type { Component } from "../../../../../../components/component.js";
+/** COMP008 fail case: a terraform-apply step deploys "azure", which the test marks signalOnly. */
+export declare const dns: Component;
+//# sourceMappingURL=dns.component.d.ts.map

package/dist/lint/rules/__fixtures__/comp/comp008/fail/dns.component.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns.component.d.ts","sourceRoot":"","sources":["../../../../../../../src/lint/rules/__fixtures__/comp/comp008/fail/dns.component.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE,kGAAkG;AAClG,eAAO,MAAM,GAAG,EAAE,SAUjB,CAAC"}

package/dist/lint/rules/__fixtures__/comp/comp008/fail/dns.component.js

@@ -0,0 +1,13 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP008 fail case: a terraform-apply step deploys "azure", which the test marks signalOnly. */
+export const dns = {
+    name: "dns",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [
+        phase("Apply", [
+            { kind: "terraform-apply", root: "dns" },
+            { kind: "terraform-apply", root: "azure" },
+        ]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp008/pass/dns.component.d.ts

@@ -0,0 +1,4 @@
+import type { Component } from "../../../../../../components/component.js";
+/** COMP008 pass case: the component deploys only its own root, "dns". */
+export declare const dns: Component;
+//# sourceMappingURL=dns.component.d.ts.map

package/dist/lint/rules/__fixtures__/comp/comp008/pass/dns.component.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns.component.d.ts","sourceRoot":"","sources":["../../../../../../../src/lint/rules/__fixtures__/comp/comp008/pass/dns.component.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE,yEAAyE;AACzE,eAAO,MAAM,GAAG,EAAE,SAKjB,CAAC"}

package/dist/lint/rules/__fixtures__/comp/comp008/pass/dns.component.js

@@ -0,0 +1,8 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP008 pass case: the component deploys only its own root, "dns". */
+export const dns = {
+    name: "dns",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [phase("Apply", [{ kind: "terraform-apply", root: "dns" }])],
+};

package/dist/lint/rules/comp/comp008-applies-signal-only-root.d.ts

@@ -0,0 +1,33 @@
+/**
+ * COMP008: applies-signal-only-root (#4490)
+ *
+ * Flags a component whose `terraform-apply` step deploys a root the project
+ * marks `signalOnly: true` in `terraform.roots` (#4484). Such a root belongs
+ * to another workspace member and is declared here only so a change to it
+ * brings this project into the change: the build skips it, so this
+ * project's graph does not draw it, and the live reads skip it too. A
+ * component that applies it would apply a root chant otherwise treats as
+ * the other member's, so the warning names the root and the member that
+ * owns it (the workspace member whose directory holds the root's `dir`).
+ *
+ * The roots come from the project's chant config, resolved by `chant lint`
+ * ({@link signalOnlyRootsOf}) and handed to the check on
+ * `ComponentCheckContext.signalOnlyRoots`. A check run without them (a
+ * direct unit test, a project with no terraform roots) flags nothing.
+ *
+ * Triggers on: `{ kind: "terraform-apply", root: "azure" }` where
+ * `terraform.roots.azure.signalOnly` is `true`.
+ * OK: the same step on a root without the marker, or no `terraform-apply`
+ * step naming the marked root.
+ */
+import type { ComponentCheck, SignalOnlyRoot } from "../../component-checks.js";
+export declare const comp008AppliesSignalOnlyRootRule: ComponentCheck;
+/**
+ * The roots a project's `terraform.roots` marks `signalOnly`, keyed by root
+ * name, each with its `dir` as written and the workspace member whose
+ * directory holds it. `projectDir` is the directory holding the chant
+ * config. Tolerant: a config that does not load, or no marked root, gives an
+ * empty map; a workspace declaration that does not read leaves `owner` off.
+ */
+export declare function signalOnlyRootsOf(projectDir: string): Promise<Map<string, SignalOnlyRoot>>;
+//# sourceMappingURL=comp008-applies-signal-only-root.d.ts.map

package/dist/lint/rules/comp/comp008-applies-signal-only-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comp008-applies-signal-only-root.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/comp008-applies-signal-only-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAmD,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG9H,eAAO,MAAM,gCAAgC,EAAE,cAuC9C,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAyBhG"}