@intentius/chant 0.13.0 → 0.15.0

package/src/lint/rules/comp/comp004-gate-needs-temporal.ts

@@ -0,0 +1,66 @@
+/**
+ * COMP004: gate-needs-temporal
+ *
+ * Flags a `gate` step anywhere in a component's composition — a durable,
+ * human-approval wait that cannot run on the local in-process executor (see
+ * ../../../components/driver.ts's `DriverGateUnsupportedError` and
+ * docs/components/orchestration.mdx's "Temporal is optional" aside: "gates ...
+ * require the durable (Temporal) execution backend").
+ *
+ * The component contract has no per-component backend/executor field (the
+ * backend is chosen per *run*, via `chant run --temporal`, per epic #551 §8 —
+ * intentionally not part of the declaration, so the same component graduates
+ * to Temporal without changing its definition). That means lint cannot tell,
+ * from the declaration alone, whether a given `gate` will actually run under
+ * Temporal when this component is deployed — every `gate` is a standing
+ * "this component needs the durable backend" fact worth surfacing, not a
+ * mistake to silently allow. Acknowledge it explicitly with a **file-level**
+ * disable directive once the durable backend is genuinely intended (see
+ * lint-rules/disable-directives.mdx) — a COMP* diagnostic carries no real
+ * line/column (it is reported for the whole component; see
+ * ../../component-checks.ts), so only the file-level `chant-disable` form is
+ * honored for these rules — `-line`/`-next-line` do not suppress a COMP*
+ * diagnostic (see ../../../cli/commands/lint.ts's
+ * `runComponentCheckDiagnostics`):
+ *
+ * ```ts
+ * // chant-disable COMP004 -- graduates to --temporal for the human approval wait
+ * ```
+ *
+ * Triggers on: any `gate` step in `deploy`/`rollback` with no matching
+ * file-level disable directive.
+ * OK: a component with no `gate` steps at all, or a `gate` whose file-level
+ * disable directive documents the Temporal graduation.
+ */
+
+import type { ComponentCheck, ComponentCheckContext, ComponentCheckDiagnostic } from "../../component-checks";
+import { walkComponent } from "./support";
+
+export const comp004GateNeedsTemporalRule: ComponentCheck = {
+  id: "COMP004",
+  severity: "error",
+  category: "correctness",
+  description: "A gate step requires the durable (Temporal) execution backend — it cannot run on the local executor",
+  check(ctx: ComponentCheckContext): ComponentCheckDiagnostic[] {
+    const diagnostics: ComponentCheckDiagnostic[] = [];
+
+    for (const [name, { component, filePath }] of ctx.components) {
+      const { gates } = walkComponent(component);
+      for (const { gate, phaseName } of gates) {
+        diagnostics.push({
+          checkId: "COMP004",
+          severity: "error",
+          component: name,
+          file: filePath,
+          message:
+            `Component "${name}": gate "${gate.signalName}" (phase "${phaseName}") requires the durable (Temporal) ` +
+            `execution backend — it cannot run on the local in-process executor. If this component is meant to run ` +
+            `with "chant run --temporal", suppress with a file-level "// chant-disable COMP004 -- <reason>" comment ` +
+            `anywhere in this file to document that intent explicitly.`,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/comp/comp005-capability-kind-is-noun.ts

@@ -0,0 +1,113 @@
+/**
+ * COMP005: capability-kind-is-noun
+ *
+ * Flags a step `kind` that names a component rather than an operation — the
+ * "capability-per-component (renamed sprawl)" failure mode from epic #551
+ * §"Failure modes ... + guardrails": "Tell: capabilities named after nouns."
+ * Every starter-set verb is a verb-phrase describing an operation
+ * (`cfn-deploy`, `publish-image`, `wait-steady-state`, ...); a capability
+ * named after *this* component (or any other discovered component) is
+ * exactly the sprawl the capability model exists to remove — see
+ * docs/components/capabilities.mdx#the-discipline ("A capability describes
+ * an operation, never a component").
+ *
+ * Detection is structural, not NLP: a step `kind` is flagged when it equals,
+ * or is built from, a discovered component's own kebab-case `name` (e.g. a
+ * `search-service` component composing a `{ kind: "deploy-search-service" }`
+ * or `{ kind: "search-service" }` step) — the concrete, checkable form of
+ * "named after a component" the issue asks for, mirroring how
+ * ../../../components/capability.ts's own docstring defines the discipline
+ * ("never named after the component that happens to use it").
+ *
+ * Every registered `kind` is excluded from this check unconditionally,
+ * regardless of whether its dash-separated segments happen to overlap a
+ * component's name. The allowlist comes from `ctx.knownKinds` — the kinds the
+ * project's capability registry actually resolves, which `chant lint` builds
+ * from the project's config (core's starter set plus the active lexicons'
+ * leaves, e.g. `cfn-deploy`/`wait-for-stack` when `lexicons: ["aws"]`). Without
+ * this exclusion, a component literally named "stack", "job", "image", or
+ * "host" would falsely flag `wait-for-stack`/`emr-start-job-run`/`publish-image`/
+ * `load-image-on-host` — a real capability's verb-ness is an established fact of
+ * the registry, not something to re-adjudicate by substring match. When no
+ * registry was resolved (a direct unit test), it falls back to core's starter
+ * set (`CORE_STARTER_KINDS`).
+ *
+ * Triggers on: `{ kind: "search-service" }` or `{ kind: "deploy-search-service" }`
+ * in any component, when "search-service" is a discovered component's name and
+ * neither form is a registered verb.
+ * OK: `{ kind: "cfn-deploy" }`, `{ kind: "ecs-update-service" }`,
+ * `{ kind: "wait-for-stack" }` — verb-named, and/or a registered verb.
+ */
+
+import { STARTER_VERB_FAMILIES } from "../../../components/starter-plugin";
+import type { ComponentCheck, ComponentCheckContext, ComponentCheckDiagnostic } from "../../component-checks";
+import { walkComponent } from "./support";
+
+/**
+ * Fallback allowlist when the check runs without a resolved registry (e.g. a
+ * direct unit test): core's own starter verbs. The real `chant lint` run passes
+ * `ctx.knownKinds` — every kind the project's registry actually resolves,
+ * including the active lexicons' leaves (`cfn-deploy`, `wait-for-stack`, …) —
+ * so a real project never depends on this fallback for its cloud verbs.
+ */
+const CORE_STARTER_KINDS: ReadonlySet<string> = new Set(Object.values(STARTER_VERB_FAMILIES).flat());
+
+/** True if `kind` is exactly a component name, or that name embedded with `-`-joined affixes (e.g. "deploy-search-service", "search-service-apply"). */
+function kindNamesComponent(kind: string, componentName: string): boolean {
+  if (kind === componentName) return true;
+  const parts = kind.split("-");
+  const nameParts = componentName.split("-");
+  if (nameParts.length === 0) return false;
+  for (let i = 0; i + nameParts.length <= parts.length; i++) {
+    if (nameParts.every((p, j) => parts[i + j] === p)) return true;
+  }
+  return false;
+}
+
+export const comp005CapabilityKindIsNounRule: ComponentCheck = {
+  id: "COMP005",
+  severity: "error",
+  category: "style",
+  description: "A capability kind is named after a component (a noun) rather than an operation (a verb)",
+  check(ctx: ComponentCheckContext): ComponentCheckDiagnostic[] {
+    const diagnostics: ComponentCheckDiagnostic[] = [];
+    const componentNames = [...ctx.components.keys()];
+    if (componentNames.length === 0) return diagnostics;
+
+    // Every known verb — the project's registered kinds when `chant lint`
+    // resolved a registry (includes active lexicons' leaves), else core's
+    // starter set. A known verb is never a "noun named after the component",
+    // regardless of any substring overlap with a component's name.
+    const knownKinds = ctx.knownKinds ?? CORE_STARTER_KINDS;
+
+    for (const [name, { component, filePath }] of ctx.components) {
+      const { steps } = walkComponent(component);
+      const reported = new Set<string>();
+
+      for (const { step, phaseName } of steps) {
+        if (step.kind === "gate") continue;
+        if (knownKinds.has(step.kind)) continue;
+        const matchedComponent = componentNames.find((cn) => kindNamesComponent(step.kind, cn));
+        if (!matchedComponent) continue;
+
+        const dedupeKey = `${step.kind}:${phaseName}`;
+        if (reported.has(dedupeKey)) continue;
+        reported.add(dedupeKey);
+
+        diagnostics.push({
+          checkId: "COMP005",
+          severity: "error",
+          component: name,
+          file: filePath,
+          message:
+            `Component "${name}": step kind "${step.kind}" (phase "${phaseName}") is named after component ` +
+            `"${matchedComponent}" rather than an operation. A capability kind must be a verb ("cfn-deploy", ` +
+            `"publish-image", "wait-steady-state", ...), never a noun naming the component that uses it — see ` +
+            `docs/components/capabilities.mdx#the-discipline.`,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/comp/comp006-shell-needs-reason.ts

@@ -0,0 +1,55 @@
+/**
+ * COMP006: shell-needs-reason
+ *
+ * Flags a `shell` step with no (or empty/blank) `reason` — the escape-hatch
+ * discipline from epic #551 §7 and §"What chant adds": "raw `shell` without a
+ * declared reason" gets flagged. `shell` is the deliberate escape hatch
+ * (../../../components/verbs/shell.ts) for reaching past the capability set;
+ * `ShellInput.reason` is already a required field on the typed
+ * `createShellCapability` input, but a hand-authored/JSON-only component (the
+ * contract's whole point — see component-contract.mdx's "portable, not
+ * chant-only" framing) is not type-checked against that interface, so the raw
+ * JSON contract's `Step` (open `additionalProperties`) does not itself
+ * enforce it. This rule enforces the same discipline at the composition
+ * level, for every authoring form.
+ *
+ * Triggers on: `{ kind: "shell", cmd: "..." }` with no `reason`, or
+ * `reason: ""` / `reason: "   "`.
+ * OK: `{ kind: "shell", cmd: "...", reason: "no capability covers <x> yet" }`.
+ */
+
+import type { ComponentCheck, ComponentCheckContext, ComponentCheckDiagnostic } from "../../component-checks";
+import { walkComponent } from "./support";
+
+export const comp006ShellNeedsReasonRule: ComponentCheck = {
+  id: "COMP006",
+  severity: "error",
+  category: "correctness",
+  description: 'A raw "shell" escape-hatch step has no declared reason',
+  check(ctx: ComponentCheckContext): ComponentCheckDiagnostic[] {
+    const diagnostics: ComponentCheckDiagnostic[] = [];
+
+    for (const [name, { component, filePath }] of ctx.components) {
+      const { steps } = walkComponent(component);
+
+      for (const { step, phaseName } of steps) {
+        if (step.kind !== "shell") continue;
+        const reason = (step as { reason?: unknown }).reason;
+        const hasReason = typeof reason === "string" && reason.trim().length > 0;
+        if (hasReason) continue;
+
+        diagnostics.push({
+          checkId: "COMP006",
+          severity: "error",
+          component: name,
+          file: filePath,
+          message:
+            `Component "${name}": "shell" step (phase "${phaseName}") is the escape hatch and must declare why no ` +
+            `capability covers this case — add a non-empty "reason" property (e.g. "reason: \\"no capability for X yet\\"").`,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/comp/comp007-composition-sprawl.ts

@@ -0,0 +1,71 @@
+/**
+ * COMP007: composition-sprawl
+ *
+ * Flags two or more components whose `deploy` composition is structurally
+ * identical (same phases, same `parallel`/nesting shape, same step kinds in
+ * the same order) — the "composition copy-paste (declaration sprawl)"
+ * failure mode from epic #551 §"Failure modes ... + guardrails": "Guard:
+ * presets (Level 2) + a lint hint when an identical composition repeats
+ * across components." This is a *hint*, not a hard error (severity:
+ * "warning") — the epic frames it as "reach for a preset"
+ * (docs/components/capabilities.mdx#presets--reuse-without-a-closed-set),
+ * not a correctness defect.
+ *
+ * The fingerprint (../comp/support.ts's `compositionFingerprint`) compares
+ * phase names, `parallel` flags, nesting, and step *kinds* only — never
+ * `name`/`dependsOn`/literal wiring values/params, so two components that
+ * both do "build -> publish -> apply -> verify" with the same capability
+ * kinds but different templates/clusters/images still match (that is exactly
+ * the "own destiny is in the params, not the shape" case a preset should
+ * absorb).
+ *
+ * Triggers on: three components (arbitrary example) that all compose
+ * `docker-build` -> `publish-image` -> `cfn-deploy` + `ecs-update-service` ->
+ * `wait-steady-state` + `health-gate` with no meaningful structural
+ * difference.
+ * OK: components whose phase/step-kind shape differs (a different archetype,
+ * a different apply family, fan-out vs. no fan-out, etc.) — like the four
+ * real pilots, which were deliberately chosen to be structurally distinct
+ * (see ../../../components/SPRAWL-VALIDATION.md).
+ */
+
+import type { ComponentCheck, ComponentCheckContext, ComponentCheckDiagnostic } from "../../component-checks";
+import { compositionFingerprint } from "./support";
+
+export const comp007CompositionSprawlRule: ComponentCheck = {
+  id: "COMP007",
+  severity: "warning",
+  category: "style",
+  description: "An identical composition shape is repeated across components — a declaration-sprawl hint to reach for a preset",
+  check(ctx: ComponentCheckContext): ComponentCheckDiagnostic[] {
+    const diagnostics: ComponentCheckDiagnostic[] = [];
+
+    const byFingerprint = new Map<string, string[]>();
+    for (const [name, { component }] of ctx.components) {
+      const fp = compositionFingerprint(component);
+      byFingerprint.set(fp, [...(byFingerprint.get(fp) ?? []), name]);
+    }
+
+    for (const names of byFingerprint.values()) {
+      if (names.length < 2) continue;
+      const sorted = [...names].sort();
+
+      for (const name of sorted) {
+        const others = sorted.filter((n) => n !== name);
+        const { filePath } = ctx.components.get(name)!;
+        diagnostics.push({
+          checkId: "COMP007",
+          severity: "warning",
+          component: name,
+          file: filePath,
+          message:
+            `Component "${name}" composes an identical phase/step shape to ${others.map((n) => `"${n}"`).join(", ")} ` +
+            `— consider extracting a shared preset (docs/components/capabilities.mdx#presets) instead of repeating ` +
+            `the composition per component.`,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/comp/index.ts

@@ -0,0 +1,37 @@
+/**
+ * COMP* composition lint rules (#562, epic #551) — the long-term entropy
+ * guards over the discovered `Component` graph. See ../../component-checks.ts
+ * for why these are `ComponentCheck`s (whole-project, post-discovery) rather
+ * than `LintRule`s (single-file AST), and docs/lint-rules/composition.mdx for
+ * the user-facing reference.
+ */
+
+import type { ComponentCheck } from "../../component-checks";
+import { comp001PublishesNeverAppliesRule } from "./comp001-publishes-never-applies";
+import { comp002DanglingWiringRefRule } from "./comp002-dangling-wiring-ref";
+import { comp003MutatingNoRollbackRule } from "./comp003-mutating-no-rollback";
+import { comp004GateNeedsTemporalRule } from "./comp004-gate-needs-temporal";
+import { comp005CapabilityKindIsNounRule } from "./comp005-capability-kind-is-noun";
+import { comp006ShellNeedsReasonRule } from "./comp006-shell-needs-reason";
+import { comp007CompositionSprawlRule } from "./comp007-composition-sprawl";
+
+export { comp001PublishesNeverAppliesRule } from "./comp001-publishes-never-applies";
+export { comp002DanglingWiringRefRule } from "./comp002-dangling-wiring-ref";
+export { comp003MutatingNoRollbackRule } from "./comp003-mutating-no-rollback";
+export { comp004GateNeedsTemporalRule } from "./comp004-gate-needs-temporal";
+export { comp005CapabilityKindIsNounRule } from "./comp005-capability-kind-is-noun";
+export { comp006ShellNeedsReasonRule } from "./comp006-shell-needs-reason";
+export { comp007CompositionSprawlRule } from "./comp007-composition-sprawl";
+
+/** All seven COMP* checks, sorted by id. */
+export function loadComponentChecks(): ComponentCheck[] {
+  return [
+    comp001PublishesNeverAppliesRule,
+    comp002DanglingWiringRefRule,
+    comp003MutatingNoRollbackRule,
+    comp004GateNeedsTemporalRule,
+    comp005CapabilityKindIsNounRule,
+    comp006ShellNeedsReasonRule,
+    comp007CompositionSprawlRule,
+  ];
+}

package/src/lint/rules/comp/support.ts

@@ -0,0 +1,173 @@
+/**
+ * Shared walking/wiring helpers for the COMP* composition rules (#562, epic
+ * #551). Every COMP rule operates over the real, discovered `Component`
+ * graph (see ../../component-checks.ts), not raw TypeScript source — these
+ * helpers flatten a component's `deploy`/`rollback` phases into steps and
+ * parse the wiring reference forms `../../../components/driver.ts` already
+ * resolves at runtime, so lint can check the same references before
+ * anything runs (per docs/components/orchestration.mdx).
+ */
+
+import type { Component, Gate, Phase, Step } from "../../../components/component";
+
+/** True if a step/gate/nested-phase entry is a `Gate` (`kind: "gate"`). */
+export function isGateEntry(entry: Step | Gate | Phase): entry is Gate {
+  return (entry as { kind?: unknown }).kind === "gate";
+}
+
+/** True if a step/gate/nested-phase entry is itself a nested `Phase` (a fan-out unit) — see `component.ts`'s `isNestedPhase`. */
+export function isPhaseEntry(entry: Step | Gate | Phase): entry is Phase {
+  return typeof (entry as Phase).phase === "string" && Array.isArray((entry as Phase).steps);
+}
+
+/** True if a step/gate/nested-phase entry is a plain capability `Step` (neither a gate nor a nested phase). */
+export function isStepEntry(entry: Step | Gate | Phase): entry is Step {
+  return !isGateEntry(entry) && !isPhaseEntry(entry);
+}
+
+/** One step found while walking a component, together with the (possibly nested) phase it lives directly under. */
+export interface WalkedStep {
+  step: Step;
+  phaseName: string;
+  /**
+   * The exact `Phase` object this step lives directly under — object
+   * identity, not just `phaseName`, since two different nested fan-out
+   * phases (or a nested phase and its parent) can share the same display
+   * name. Rules that need "another step in this same phase" (e.g. COMP003's
+   * compensation-sibling check) should group by this reference, not by name.
+   */
+  phase: Phase;
+}
+
+/** One gate found while walking a component, together with the phase it lives directly under. */
+export interface WalkedGate {
+  gate: Gate;
+  phaseName: string;
+  phase: Phase;
+}
+
+/**
+ * Flatten every step and gate across a list of phases (including nested
+ * fan-out phases and `onFailure` compensation phases), matching
+ * `component.ts`'s own `allSteps` walk but keeping the immediate phase
+ * alongside each entry (needed for `@Phase.field` reference checks and for
+ * "same phase" sibling checks) and separating gates out explicitly.
+ */
+export function walkPhases(phases: Phase[] | undefined): { steps: WalkedStep[]; gates: WalkedGate[] } {
+  const steps: WalkedStep[] = [];
+  const gates: WalkedGate[] = [];
+
+  const walk = (ps: Phase[]) => {
+    for (const p of ps) {
+      for (const entry of p.steps) {
+        if (isPhaseEntry(entry)) {
+          walk([entry]);
+        } else if (isGateEntry(entry)) {
+          gates.push({ gate: entry, phaseName: p.phase, phase: p });
+        } else {
+          steps.push({ step: entry, phaseName: p.phase, phase: p });
+        }
+      }
+      if (p.onFailure) walk(p.onFailure);
+    }
+  };
+  walk(phases ?? []);
+
+  return { steps, gates };
+}
+
+/** Every step and gate across a component's `deploy` plus its top-level `rollback` phases. */
+export function walkComponent(component: Component): { steps: WalkedStep[]; gates: WalkedGate[] } {
+  const deployWalk = walkPhases(component.deploy);
+  const rollbackWalk = walkPhases(component.rollback);
+  return {
+    steps: [...deployWalk.steps, ...rollbackWalk.steps],
+    gates: [...deployWalk.gates, ...rollbackWalk.gates],
+  };
+}
+
+/** Every distinct phase name declared directly in a component's `deploy` (top-level only, not nested fan-out phase names — those are addressed by the fan-out's own phase name, never the parent's). */
+export function topLevelPhaseNames(component: Component): Set<string> {
+  return new Set((component.deploy ?? []).map((p) => p.phase));
+}
+
+// ── Wiring reference parsing (mirrors ../../../components/driver.ts) ────────
+
+/** `@Phase.field[...]` — a prior step's output within the same component, keyed by phase name. */
+const PRIOR_STEP_REF = /^@([A-Za-z0-9_ ]+)\.([A-Za-z0-9_.]+)$/;
+/** `@<component>.publish.uri|digest|key` — a cross-component artifact reference. */
+const COMPONENT_ARTIFACT_REF = /^@([a-z0-9]+(?:-[a-z0-9]+)*)\.publish\.(uri|digest|key)$/;
+
+export interface PriorStepRef {
+  kind: "prior-step";
+  phaseName: string;
+  field: string;
+}
+
+export interface ComponentArtifactRef {
+  kind: "component-artifact";
+  componentName: string;
+  field: "uri" | "digest" | "key";
+}
+
+export type WiringRef = PriorStepRef | ComponentArtifactRef;
+
+/** Parse a single string value as one of the two name-bearing wiring reference forms (`@Phase.field`, `@component.publish.*`). Returns `undefined` for a plain literal, an `$env.*` reference, or a malformed `@` reference (schema validation, not lint, is responsible for rejecting malformed references). */
+export function parseWiringRef(value: unknown): WiringRef | undefined {
+  if (typeof value !== "string") return undefined;
+
+  const artifactMatch = value.match(COMPONENT_ARTIFACT_REF);
+  if (artifactMatch) {
+    return { kind: "component-artifact", componentName: artifactMatch[1], field: artifactMatch[2] as "uri" | "digest" | "key" };
+  }
+
+  const priorStepMatch = value.match(PRIOR_STEP_REF);
+  if (priorStepMatch) {
+    return { kind: "prior-step", phaseName: priorStepMatch[1], field: priorStepMatch[2] };
+  }
+
+  return undefined;
+}
+
+/** Recursively collect every wiring-reference-shaped string found anywhere in a step's fields (imageRef, jar, revision, inputs, and any other open capability-specific property), matching how ../../../components/driver.ts's `resolveStepInput` walks a step's input. */
+export function collectWiringRefs(step: Step): WiringRef[] {
+  const refs: WiringRef[] = [];
+  const walk = (value: unknown): void => {
+    if (typeof value === "string") {
+      const ref = parseWiringRef(value);
+      if (ref) refs.push(ref);
+      return;
+    }
+    if (Array.isArray(value)) {
+      for (const v of value) walk(v);
+      return;
+    }
+    if (value && typeof value === "object") {
+      // `{ stackOutput: { stack, name } }` is a cross-stack reference, resolved
+      // by the graph, not a same-project component/phase reference — out of
+      // scope for this reference check (see component-contract.mdx).
+      if ("stackOutput" in value) return;
+      for (const v of Object.values(value as Record<string, unknown>)) walk(v);
+    }
+  };
+  const { kind: _kind, ...rest } = step;
+  walk(rest);
+  return refs;
+}
+
+/** A structural fingerprint of a component's composition shape, ignoring `name`/`dependsOn`/wiring literal values — two components with the same fingerprint compose the exact same phase/step-kind shape (see COMP007, "identical composition repeated across components"). */
+export function compositionFingerprint(component: Component): string {
+  const shape = (component.deploy ?? []).map((p) => fingerprintPhase(p));
+  return JSON.stringify(shape);
+}
+
+function fingerprintPhase(phase: Phase): unknown {
+  return {
+    parallel: phase.parallel ?? false,
+    steps: phase.steps.map((entry) => {
+      if (isPhaseEntry(entry)) return fingerprintPhase(entry);
+      if (isGateEntry(entry)) return { kind: "gate" };
+      return { kind: entry.kind };
+    }),
+  };
+}

package/src/lsp/lexicon-providers.test.ts

@@ -0,0 +1,55 @@
+import { describe, test, expect } from "vitest";
+import { LexiconIndex, lexiconCompletions, type LexiconEntry } from "./lexicon-providers";
+import type { CompletionContext } from "./types";
+
+function resourceEntry(resourceType: string): LexiconEntry {
+  return { resourceType, kind: "resource", lexicon: "test" };
+}
+
+/**
+ * Index with 80 "Sample*" resources plus a common "StorageBucket" inserted
+ * LAST — so in raw index order it lands well past the old 50-item cap. This is
+ * the shape that made gcp v1.152 drop StorageBucket from a "new S" completion.
+ */
+function largeSPrefixIndex(): LexiconIndex {
+  const entries: Record<string, LexiconEntry> = {};
+  for (let i = 0; i < 80; i++) {
+    entries[`Sample${String(i).padStart(3, "0")}`] = resourceEntry(`Test::Sample::N${i}`);
+  }
+  entries["StorageBucket"] = resourceEntry("Test::Storage::Bucket");
+  return new LexiconIndex(entries);
+}
+
+const newCtx = (linePrefix: string, wordAtCursor: string): CompletionContext =>
+  ({
+    uri: "file:///t.ts",
+    content: linePrefix,
+    linePrefix,
+    wordAtCursor,
+    position: { line: 0, character: linePrefix.length },
+  }) as unknown as CompletionContext;
+
+describe("lexiconCompletions resource ranking (#600)", () => {
+  test("a prefix returns every match — a common resource isn't truncated by a cap", () => {
+    const items = lexiconCompletions(newCtx("const x = new S", "S"), largeSPrefixIndex(), "Test resource");
+    const labels = items.map((i) => i.label);
+    // 81 resources start with "S"; StorageBucket (inserted 81st, past the old
+    // slice(0,50)) must still be present.
+    expect(labels).toContain("StorageBucket");
+    expect(labels.length).toBe(81);
+  });
+
+  test("results are sorted deterministically (alphabetical)", () => {
+    const labels = lexiconCompletions(newCtx("const x = new S", "S"), largeSPrefixIndex(), "Test resource").map(
+      (i) => i.label,
+    );
+    expect(labels).toEqual([...labels].sort((a, b) => a.localeCompare(b)));
+  });
+
+  test("the unfiltered `new ` dump stays capped at 100", () => {
+    const entries: Record<string, LexiconEntry> = {};
+    for (let i = 0; i < 200; i++) entries[`R${String(i).padStart(3, "0")}`] = resourceEntry(`T::R::${i}`);
+    const items = lexiconCompletions(newCtx("const x = new ", ""), new LexiconIndex(entries), "Test resource");
+    expect(items.length).toBe(100);
+  });
+});

package/src/lsp/lexicon-providers.ts

@@ -94,11 +94,21 @@ export function lexiconCompletions(
   // After `new ` — suggest resource class names
   if (/\bnew\s+\w*$/.test(linePrefix)) {
     const resources = index.getResourceNames();
-    const filtered = wordAtCursor
-      ? resources.filter((r) => r.className.toLowerCase().startsWith(wordAtCursor.toLowerCase()))
+    const prefix = wordAtCursor?.toLowerCase();
+    const filtered = prefix
+      ? resources.filter((r) => r.className.toLowerCase().startsWith(prefix))
       : resources;
 
-    return filtered.slice(0, 50).map((r) => ({
+    // Deterministic ordering (the raw index order is arbitrary).
+    const sorted = [...filtered].sort((a, b) => a.className.localeCompare(b.className));
+
+    // When the user has typed a prefix, the set is already narrowed — return
+    // every match so a common resource never gets truncated out of a short
+    // prefix on a large lexicon (e.g. StorageBucket for "S" on gcp/aws, #600).
+    // Only cap the unfiltered `new ` dump, to bound the payload.
+    const items = prefix ? sorted : sorted.slice(0, 100);
+
+    return items.map((r) => ({
       label: r.className,
       insertText: r.className,
       kind: "resource" as const,

package/src/op/activity-registry.test.ts

@@ -57,3 +57,41 @@ describe("loadActivities — heartbeat-shim safety", () => {
     expect(activities.has("waitForStack")).toBe(true);
   });
 });
+
+// Cloud appliers were relocated out of the temporal lexicon into their own
+// lexicons (#706); the loader pulls them in per the project's configured
+// `lexicons`. Proves the relocation resolves end-to-end.
+describe("loadActivities — multi-lexicon (#706)", () => {
+  test("base (no lexicons): temporal activities present, cloud appliers absent", async () => {
+    const a = await loadActivities();
+    expect(a.has("kubectlApply")).toBe(true); // temporal base
+    expect(a.has("k3dUp")).toBe(true); // cloud-agnostic, stays in temporal
+    expect(a.has("gcpApply")).toBe(false); // relocated to gcp
+    expect(a.has("flociUp")).toBe(false); // relocated to aws
+    expect(a.has("azGroupEnsure")).toBe(false); // relocated to azure
+  });
+
+  test("gcp lexicon contributes the GCP applier", async () => {
+    const a = await loadActivities(["gcp"]);
+    expect(a.has("gcpApply")).toBe(true);
+    expect(a.has("kubectlApply")).toBe(true); // base still loaded alongside
+  });
+
+  test("aws lexicon contributes the Floci lifecycle", async () => {
+    const a = await loadActivities(["aws"]);
+    expect(a.has("flociUp")).toBe(true);
+    expect(a.has("flociDown")).toBe(true);
+  });
+
+  test("azure lexicon contributes the resource-group lifecycle + ARM applier", async () => {
+    const a = await loadActivities(["azure"]);
+    expect(a.has("azGroupEnsure")).toBe(true);
+    expect(a.has("azGroupDelete")).toBe(true);
+    expect(a.has("azApply")).toBe(true);
+  });
+
+  test("unknown lexicon is skipped without throwing", async () => {
+    const a = await loadActivities(["definitely-not-a-lexicon"]);
+    expect(a.has("kubectlApply")).toBe(true);
+  });
+});