@intentius/chant 0.13.0 → 0.15.0

package/src/lint/component-checks.ts

@@ -0,0 +1,148 @@
+/**
+ * Component composition checks — the COMP* rule family (#562, epic #551).
+ *
+ * COR/EVL rules (./rule.ts, ./engine.ts) check one `ts.SourceFile`'s AST in
+ * isolation, synchronously — no execution, no cross-file knowledge. A COMP*
+ * rule cannot work that way: "publishes but never applies", "`imageRef`
+ * points at a nonexistent phase", and "identical composition repeated across
+ * components" are all properties of the *discovered component graph*, which
+ * only exists after `*.component.ts` files are actually imported (mirroring
+ * `../components/discover.ts`'s `discoverComponents`, itself async for the
+ * same reason `../discovery/index.ts`'s `discover()` is).
+ *
+ * Rather than stretch `LintRule.check(context)` (sync, single-file, AST-only)
+ * to cover this, COMP* rules follow the precedent chant already has for
+ * "check something that needs real, resolved, whole-project data":
+ * `./post-synth.ts`'s `PostSynthCheck`/`PostSynthContext`/`runPostSynthChecks`,
+ * which wraps a real (async) build result for a sync `check(ctx)` call. This
+ * module is that same shape, one layer earlier in the pipeline — over the
+ * discovered `Component` graph instead of serialized resource output — so
+ * `chant lint` (not just `chant build`) can run it. See
+ * ../components/discover.ts's own docstring for why `Component` gets a
+ * parallel, purpose-built convention rather than reusing `Declarable`'s.
+ */
+
+import type { Component } from "../components/component";
+import type { DiscoveredComponent } from "../components/discover";
+import { discoverComponents } from "../components/discover";
+import type { RollbackPolicy } from "../components/capability";
+import type { Severity } from "./rule";
+
+/** One discovered component, keyed by its declared name, with the file it came from. */
+export interface ComponentCheckEntry {
+  component: Component;
+  filePath: string;
+}
+
+/** Context handed to a `ComponentCheck` — the whole discovered component graph for one project. */
+export interface ComponentCheckContext {
+  /** Every discovered component, keyed by `component.name`. */
+  components: Map<string, ComponentCheckEntry>;
+  /**
+   * Every capability `kind` registered for this project — core's starter set
+   * plus whatever the active lexicons contribute (e.g. `cfn-deploy` when
+   * `lexicons: ["aws"]`). Supplied by the `chant lint` CLI, which builds the
+   * registry from the project's config; undefined when a check runs without a
+   * resolved registry (e.g. a direct unit test), in which case a rule should
+   * fall back to core's starter set. Rules that key off "is this a known verb"
+   * (e.g. COMP005) read this rather than hard-coding a verb list.
+   */
+  knownKinds?: ReadonlySet<string>;
+  /**
+   * Each registered verb's rollback disposition (`native`/`none-by-design`/
+   * `needs-opt-out`), derived from the project's capability registry the same
+   * way `knownKinds` is. Read by COMP003 instead of a hard-coded verb list;
+   * undefined when no registry was resolved (a check then treats every kind as
+   * `none-by-design`, i.e. flags nothing).
+   */
+  rollbackPolicies?: ReadonlyMap<string, RollbackPolicy>;
+}
+
+/** A diagnostic from a component composition check. Shaped like `PostSynthDiagnostic`, plus a `file` so it can be merged into `LintDiagnostic`s and reported per-file like every other lint diagnostic. */
+export interface ComponentCheckDiagnostic {
+  /** ID of the check that produced this diagnostic (e.g. "COMP001"). */
+  checkId: string;
+  severity: Severity;
+  message: string;
+  /** File the discovered component was declared in — where the diagnostic is reported. */
+  file: string;
+  /** The component name this diagnostic concerns. */
+  component: string;
+}
+
+/** A composition-level lint check over the whole discovered component graph. */
+export interface ComponentCheck {
+  /** Unique identifier, e.g. "COMP001". */
+  id: string;
+  description: string;
+  severity: Severity;
+  category: "correctness" | "style" | "performance" | "security";
+  /** Execute the check and return diagnostics. */
+  check(ctx: ComponentCheckContext): ComponentCheckDiagnostic[];
+}
+
+/**
+ * Discover every component under `path` and run every `ComponentCheck`
+ * against the resulting graph. Mirrors `runPostSynthChecks`'s shape
+ * (async discovery/build once, then every check runs sync over the result),
+ * except the input is `discoverComponents`'s result rather than a build's
+ * serialized output.
+ *
+ * Discovery errors (e.g. a duplicate component name, a `*.component.ts` file
+ * that throws on import) are surfaced as a single synthetic diagnostic per
+ * error under the pseudo-check id "COMP000" rather than silently dropped —
+ * matching how `discoverComponents`'s caller (`../components/cli-support.ts`)
+ * always surfaces `result.errors` rather than ignoring them.
+ */
+export async function runComponentChecks(
+  path: string,
+  checks: ComponentCheck[],
+  registryContext?: Pick<ComponentCheckContext, "knownKinds" | "rollbackPolicies">,
+): Promise<ComponentCheckDiagnostic[]> {
+  if (checks.length === 0) return [];
+
+  const result = await discoverComponents(path);
+  const diagnostics: ComponentCheckDiagnostic[] = [];
+
+  for (const err of result.errors) {
+    diagnostics.push({
+      checkId: "COMP000",
+      severity: "error",
+      message: `Component discovery error: ${err.message}`,
+      file: err.file,
+      component: "(unknown)",
+    });
+  }
+
+  const components = new Map<string, ComponentCheckEntry>();
+  for (const [name, discovered] of result.components) {
+    components.set(name, { component: discovered.component, filePath: discovered.filePath });
+  }
+
+  const ctx: ComponentCheckContext = {
+    components,
+    knownKinds: registryContext?.knownKinds,
+    rollbackPolicies: registryContext?.rollbackPolicies,
+  };
+  for (const check of checks) {
+    diagnostics.push(...check.check(ctx));
+  }
+
+  return diagnostics;
+}
+
+/** Structural type guard, mirroring `isPostSynthCheck` — used by rule discovery/registry code. */
+export function isComponentCheck(value: unknown): value is ComponentCheck {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value as Record<string, unknown>;
+  return (
+    typeof v.id === "string" &&
+    typeof v.description === "string" &&
+    typeof v.severity === "string" &&
+    typeof v.category === "string" &&
+    typeof v.check === "function"
+  );
+}
+
+/** Re-exported for rule modules that need the discovered shape without importing `../components/discover` directly. */
+export type { DiscoveredComponent };

package/src/lint/config.test.ts

@@ -415,6 +415,13 @@ describe("loadConfig", () => {
       COR013: "info",
       COR014: "warning",
       COR015: "warning",
+      COMP001: "error",
+      COMP002: "error",
+      COMP003: "error",
+      COMP004: "error",
+      COMP005: "error",
+      COMP006: "error",
+      COMP007: "warning",
     });
   });
 
@@ -458,6 +465,13 @@ describe("loadConfig", () => {
       COR013: "off",
       COR014: "off",
       COR015: "off",
+      COMP001: "warning",
+      COMP002: "warning",
+      COMP003: "off",
+      COMP004: "warning",
+      COMP005: "off",
+      COMP006: "off",
+      COMP007: "off",
     });
   });
 
@@ -488,6 +502,13 @@ describe("loadConfig", () => {
       COR013: "info",
       COR014: "warning",
       COR015: "warning",
+      COMP001: "error",
+      COMP002: "error",
+      COMP003: "error",
+      COMP004: "error",
+      COMP005: "error",
+      COMP006: "error",
+      COMP007: "warning",
     });
   });
 

package/src/lint/engine.ts

@@ -15,7 +15,7 @@ export interface LintRunResult {
 /**
  * Represents a disable directive found in source code comments
  */
-interface DisableDirective {
+export interface DisableDirective {
   /** Line number where the directive appears (1-based) */
   line: number;
   /** Type of directive */
@@ -90,7 +90,16 @@ function parseDirectiveText(afterDirective: string | undefined): {
   };
 }
 
-function parseDisableComments(content: string): DisableDirective[] {
+/**
+ * Parse `chant-disable`/`chant-disable-line`/`chant-disable-next-line`
+ * comments out of raw file content. Exported (in addition to being used
+ * internally by `runLint`) so other diagnostic sources that are not plain
+ * per-file AST `LintRule`s — e.g. ../lint/rules/comp's component composition
+ * checks, which produce whole-component diagnostics rather than
+ * exact-line ones — can still honor at least the file-level directive form
+ * without duplicating this parsing.
+ */
+export function parseDisableComments(content: string): DisableDirective[] {
   const directives: DisableDirective[] = [];
   const lines = content.split("\n");
 

package/src/lint/presets/relaxed.json

@@ -14,6 +14,13 @@
     "COR012": "off",
     "COR013": "off",
     "COR014": "off",
-    "COR015": "off"
+    "COR015": "off",
+    "COMP001": "warning",
+    "COMP002": "warning",
+    "COMP003": "off",
+    "COMP004": "warning",
+    "COMP005": "off",
+    "COMP006": "off",
+    "COMP007": "off"
   }
 }

package/src/lint/presets/strict.json

@@ -14,6 +14,13 @@
     "COR012": "warning",
     "COR013": "info",
     "COR014": "warning",
-    "COR015": "warning"
+    "COR015": "warning",
+    "COMP001": "error",
+    "COMP002": "error",
+    "COMP003": "error",
+    "COMP004": "error",
+    "COMP005": "error",
+    "COMP006": "error",
+    "COMP007": "warning"
   }
 }

package/src/lint/rules/__fixtures__/comp/comp000-discovery-error/broken-a.component.ts

@@ -0,0 +1,9 @@
+import type { Component } from "../../../../../components/component";
+import { phase } from "../../../../../components/component";
+
+/** Duplicate component name (see broken-b.component.ts) — exercises the COMP000 discovery-error surfacing path in component-checks.ts. */
+export const dup: Component = {
+  name: "duplicate-name",
+  dependsOn: [],
+  deploy: [phase("Apply", [{ kind: "cfn-deploy", template: "a.json" }])],
+};

package/src/lint/rules/__fixtures__/comp/comp000-discovery-error/broken-b.component.ts

@@ -0,0 +1,9 @@
+import type { Component } from "../../../../../components/component";
+import { phase } from "../../../../../components/component";
+
+/** Duplicate component name (see broken-a.component.ts) — exercises the COMP000 discovery-error surfacing path in component-checks.ts. */
+export const dup: Component = {
+  name: "duplicate-name",
+  dependsOn: [],
+  deploy: [phase("Apply", [{ kind: "cfn-deploy", template: "b.json" }])],
+};

package/src/lint/rules/__fixtures__/comp/comp001/fail/orphan-lib.component.ts

@@ -0,0 +1,11 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP001 fail case: publishes an artifact nothing ever consumes — no other component references it, and no later step in this component references the Publish phase's output. */
+export const orphanLib: Component = {
+  name: "orphan-lib",
+  archetype: "producer-library",
+  dependsOn: [],
+  build: { kind: "jvm-build", context: ".", into: "archive" },
+  deploy: [phase("Publish", [{ kind: "publish-artifact", from: "archive", to: "$env.s3" }])],
+};

package/src/lint/rules/__fixtures__/comp/comp001/pass/emr-job.component.ts

@@ -0,0 +1,13 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** Consumer that references jar-lib's published artifact — makes jar-lib's publish step "consumed" for COMP001. */
+export const emrJob: Component = {
+  name: "emr-job",
+  archetype: "infra",
+  dependsOn: ["jar-lib"],
+  deploy: [
+    phase("Submit", [{ kind: "emr-start-job-run", jar: "@jar-lib.publish.uri", args: ["--input", "$env.inputPath"] }]),
+    phase("Verify", [{ kind: "wait-job", runId: "@Submit.runId" }]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp001/pass/jar-lib.component.ts

@@ -0,0 +1,11 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** Producer whose published artifact IS consumed downstream (by emr-job.component.ts) — COMP001 must not flag this. */
+export const jarLib: Component = {
+  name: "jar-lib",
+  archetype: "producer-library",
+  dependsOn: [],
+  build: { kind: "jvm-build", context: ".", into: "archive" },
+  deploy: [phase("Publish", [{ kind: "publish-artifact", from: "archive", to: "$env.s3" }])],
+};

package/src/lint/rules/__fixtures__/comp/comp002/fail/search-service.component.ts

@@ -0,0 +1,27 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/**
+ * COMP002 fail case: two dangling wiring references.
+ *  - "@Build.digest" names a phase ("Build") that does not exist in this
+ *    component's deploy (the actual phase is named "Publish").
+ *  - "@missing-lib.publish.uri" names a component that was never discovered
+ *    at all in this fixture directory.
+ */
+export const searchService: Component = {
+  name: "search-service",
+  archetype: "service",
+  dependsOn: [],
+  build: { kind: "docker-build", context: ".", into: "archive" },
+  deploy: [
+    phase("Publish", [{ kind: "publish-image", from: "archive", to: "$env.registry" }]),
+    phase("Apply", [
+      {
+        kind: "cfn-deploy",
+        template: "archive:search.template.json",
+        imageRef: "@Build.digest",
+        inputs: { jarUri: "@missing-lib.publish.uri" },
+      },
+    ]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp002/pass/jar-lib.component.ts

@@ -0,0 +1,10 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+export const jarLib: Component = {
+  name: "jar-lib",
+  archetype: "producer-library",
+  dependsOn: [],
+  build: { kind: "jvm-build", context: ".", into: "archive" },
+  deploy: [phase("Publish", [{ kind: "publish-artifact", from: "archive", to: "$env.s3" }])],
+};

package/src/lint/rules/__fixtures__/comp/comp002/pass/search-service.component.ts

@@ -0,0 +1,23 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP002 pass case: every wiring reference resolves — "@Publish.digest" points at this component's own "Publish" phase, and "@jar-lib.publish.uri" points at a discovered component listed in dependsOn. */
+export const searchService: Component = {
+  name: "search-service",
+  archetype: "service",
+  dependsOn: ["jar-lib"],
+  build: { kind: "docker-build", context: ".", into: "archive" },
+  deploy: [
+    phase("Publish", [{ kind: "publish-image", from: "archive", to: "$env.registry" }]),
+    phase("Apply", [
+      {
+        kind: "cfn-deploy",
+        template: "archive:search.template.json",
+        imageRef: "@Publish.digest",
+        inputs: { jarUri: "@jar-lib.publish.uri" },
+      },
+      { kind: "ecs-update-service", cluster: "$env.cluster", service: "search" },
+    ]),
+    phase("Verify", [{ kind: "wait-steady-state", service: "search" }]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp003/fail/migrator.component.ts

@@ -0,0 +1,10 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP003 fail case: "run-migration" has no native rollback, no noRollback opt-out, no component-level rollback, and no compensation sibling step. */
+export const migrator: Component = {
+  name: "migrator",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [phase("Apply", [{ kind: "run-migration", tool: "flyway", target: "ecs-task:migrate" }])],
+};

package/src/lint/rules/__fixtures__/comp/comp003/pass/migrator.component.ts

@@ -0,0 +1,19 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP003 pass case: "run-migration" is a needs-opt-out kind, but declares an explicit noRollback reason. */
+export const migrator: Component = {
+  name: "migrator",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [
+    phase("Apply", [
+      {
+        kind: "run-migration",
+        tool: "flyway",
+        target: "ecs-task:migrate",
+        noRollback: "forward-only schema migration; rolling back would drop columns already backfilled",
+      },
+    ]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp003/pass/orders-table.component.ts

@@ -0,0 +1,10 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP003 pass case: cfn-deploy has a known native rollback, so no opt-out is required. */
+export const ordersTable: Component = {
+  name: "orders-table",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [phase("Apply", [{ kind: "cfn-deploy", template: "archive:orders-table.template.json", onReplace: "block" }])],
+};

package/src/lint/rules/__fixtures__/comp/comp004/fail/neo4j-cluster.component.ts

@@ -0,0 +1,20 @@
+import type { Component } from "../../../../../../components/component";
+import { gate, phase } from "../../../../../../components/component";
+
+/** COMP004 fail case: a gate step with no disable directive — flagged, since the local executor cannot run it. */
+export const neo4jCluster: Component = {
+  name: "neo4j-cluster",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [
+    phase("Seed", [
+      { kind: "cfn-deploy", template: "archive:neo4j-az0-0.template.json" },
+      { kind: "wait-cluster-healthy", size: 1 },
+    ]),
+    phase("Node 1", [
+      gate("approve-neo4j-node-1", { description: "Confirm the seed node is healthy before rolling to node 1" }),
+      { kind: "cfn-deploy", template: "archive:neo4j-1.template.json" },
+      { kind: "wait-cluster-healthy", quorum: true },
+    ]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp004/pass/neo4j-cluster.component.ts

@@ -0,0 +1,23 @@
+// chant-disable COMP004 -- graduates to `chant run --temporal`; the Node 1 gate is a deliberate human-approval wait, see docs/components/orchestration.mdx
+import type { Component } from "../../../../../../components/component";
+import { gate, phase } from "../../../../../../components/component";
+
+/** COMP004 pass case: a genuine gate, opted out via a file-level disable directive with a documented reason — the intended path for a component that graduates to the Temporal backend. */
+export const neo4jCluster: Component = {
+  name: "neo4j-cluster",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [
+    phase("Seed", [
+      { kind: "cfn-deploy", template: "archive:neo4j-az0-0.template.json" },
+      { kind: "code-deploy", instance: 0, revision: "@Seed.templateUri" },
+      { kind: "wait-cluster-healthy", size: 1 },
+    ]),
+    phase("Node 1", [
+      gate("approve-neo4j-node-1", { description: "Confirm the seed node is healthy before rolling to node 1", timeout: "24h" }),
+      { kind: "cfn-deploy", template: "archive:neo4j-1.template.json" },
+      { kind: "code-deploy", instance: 1, revision: "@Seed.templateUri" },
+      { kind: "wait-cluster-healthy", quorum: true },
+    ]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp004/pass/orders-table.component.ts

@@ -0,0 +1,10 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP004 pass case: no gate step anywhere — nothing requires the durable backend. */
+export const ordersTable: Component = {
+  name: "orders-table",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [phase("Apply", [{ kind: "cfn-deploy", template: "archive:orders-table.template.json" }])],
+};

package/src/lint/rules/__fixtures__/comp/comp005/fail/search-service.component.ts

@@ -0,0 +1,14 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP005 fail case: the Apply step's kind is named after this very component ("deploy-search-service") — a noun, not an operation. */
+export const searchService: Component = {
+  name: "search-service",
+  archetype: "service",
+  dependsOn: [],
+  build: { kind: "docker-build", context: ".", into: "archive" },
+  deploy: [
+    phase("Publish", [{ kind: "publish-image", from: "archive", to: "$env.registry" }]),
+    phase("Apply", [{ kind: "deploy-search-service", imageRef: "@Publish.digest" }]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp005/pass/search-service.component.ts

@@ -0,0 +1,18 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP005 pass case: every step kind is a verb (an operation), never the component's own name. */
+export const searchService: Component = {
+  name: "search-service",
+  archetype: "service",
+  dependsOn: [],
+  build: { kind: "docker-build", context: ".", into: "archive" },
+  deploy: [
+    phase("Publish", [{ kind: "publish-image", from: "archive", to: "$env.registry" }]),
+    phase("Apply", [
+      { kind: "cfn-deploy", template: "archive:search.template.json", imageRef: "@Publish.digest" },
+      { kind: "ecs-update-service", cluster: "$env.cluster", service: "search" },
+    ]),
+    phase("Verify", [{ kind: "wait-steady-state", service: "search" }]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp006/fail/legacy-tool.component.ts

@@ -0,0 +1,10 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP006 fail case: a raw "shell" step with no "reason" at all. */
+export const legacyTool: Component = {
+  name: "legacy-tool",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [phase("Apply", [{ kind: "shell", cmd: "./legacy-deploy.sh" }])],
+};

package/src/lint/rules/__fixtures__/comp/comp006/pass/legacy-tool.component.ts

@@ -0,0 +1,14 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP006 pass case: the "shell" escape hatch declares a non-empty reason. */
+export const legacyTool: Component = {
+  name: "legacy-tool",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [
+    phase("Apply", [
+      { kind: "shell", cmd: "./legacy-deploy.sh", reason: "no capability wraps this vendor's proprietary CLI yet" },
+    ]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp007/fail/inventory-table.component.ts

@@ -0,0 +1,13 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP007 fail case: identical phase/step-kind shape to orders-table.component.ts. */
+export const inventoryTable: Component = {
+  name: "inventory-table",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [
+    phase("Apply", [{ kind: "cfn-deploy", template: "archive:inventory-table.template.json" }]),
+    phase("Verify", [{ kind: "wait-for-stack", stack: "inventory-table" }]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp007/fail/orders-table.component.ts

@@ -0,0 +1,13 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP007 fail case: identical phase/step-kind shape to inventory-table.component.ts — a declaration-sprawl hint (should reach for a preset). */
+export const ordersTable: Component = {
+  name: "orders-table",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [
+    phase("Apply", [{ kind: "cfn-deploy", template: "archive:orders-table.template.json" }]),
+    phase("Verify", [{ kind: "wait-for-stack", stack: "orders-table" }]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp007/pass/orders-table.component.ts

@@ -0,0 +1,12 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+export const ordersTable: Component = {
+  name: "orders-table",
+  archetype: "infra",
+  dependsOn: [],
+  deploy: [
+    phase("Apply", [{ kind: "cfn-deploy", template: "archive:orders-table.template.json", onReplace: "block" }]),
+    phase("Verify", [{ kind: "wait-for-stack", stack: "orders-table" }]),
+  ],
+};

package/src/lint/rules/__fixtures__/comp/comp007/pass/search-service.component.ts

@@ -0,0 +1,18 @@
+import type { Component } from "../../../../../../components/component";
+import { phase } from "../../../../../../components/component";
+
+/** COMP007 pass case: structurally distinct from orders-table.component.ts (service: build+publish+apply+verify vs. infra: apply+verify only) — no sprawl hint expected. */
+export const searchService: Component = {
+  name: "search-service",
+  archetype: "service",
+  dependsOn: [],
+  build: { kind: "docker-build", context: ".", into: "archive" },
+  deploy: [
+    phase("Publish", [{ kind: "publish-image", from: "archive", to: "$env.registry" }]),
+    phase("Apply", [
+      { kind: "cfn-deploy", template: "archive:search.template.json", imageRef: "@Publish.digest" },
+      { kind: "ecs-update-service", cluster: "$env.cluster", service: "search" },
+    ]),
+    phase("Verify", [{ kind: "wait-steady-state", service: "search" }]),
+  ],
+};