@intentius/chant 0.17.0 → 0.18.1

package/dist/cli/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAiBzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAmBhC;AAgDD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAiND;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAyI3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/lint.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAkBzE;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAW5D;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAmBhC;AAgDD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qCAAqC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAsND;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAyI3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,GACtC,MAAM,IAAI,CAiCZ"}

package/dist/cli/handlers/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/graph.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAcnE"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/graph.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAcnE"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAiB9E;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAmLpD"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAiB9E;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAuLpD"}

package/dist/cli/registry.d.ts

@@ -60,6 +60,11 @@ export interface ParsedArgs {
     /** `chant graph --live --overlay` — classify the provisioned graph against
      * declared source: managed / foreign / pending (#780). */
     overlay?: boolean;
+    /** `chant graph --live --overlay --overlay-anchor <source|live>` (#821) — which
+     * graph is the canvas. `source` (default) keeps the declared edges (the
+     * cross-substrate topology) and joins live status per node; `live` keeps the
+     * provisioned graph's reconstructed edges (the pre-#821 behaviour). */
+    overlayAnchor?: "source" | "live";
     /** `chant list --components` / `chant graph --components` — surface discovered
      * `Component` declarations (#560) instead of/alongside lexicon resources. */
     components?: boolean;

package/dist/cli/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/cli/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;mFAC+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;iFAC6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;6DAEyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kHAAkH;IAClH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uKAAuK;IACvK,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0HAA0H;IAC1H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oJAAoJ;IACpJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8RAA8R;IAC9R,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,8NAA8N;IAC9N,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uTAAuT;IACvT,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAC;IAChB,4FAA4F;IAC5F,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,eAAe,GAAG,IAAI,CAiB/F"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/cli/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;mFAC+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;2EAGuE;IACvE,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC;iFAC6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;6DAEyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kHAAkH;IAClH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uKAAuK;IACvK,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0HAA0H;IAC1H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oJAAoJ;IACpJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8RAA8R;IAC9R,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,8NAA8N;IAC9N,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uTAAuT;IACvT,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAC;IAChB,4FAA4F;IAC5F,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,eAAe,GAAG,IAAI,CAiB/F"}

package/dist/codegen/rolling-upgrade.d.ts

@@ -21,7 +21,7 @@
  */
 import { type SurfaceDelta, type ChangeSeverity, type SurfaceSnapshot } from "./surface-snapshot.js";
 import { type RegenOptions, type RegenResult } from "./lexicon-regen.js";
-export type RollingLexicon = "aws" | "azure" | "github";
+export type RollingLexicon = "aws" | "azure" | "github" | "fly";
 /**
  * An API-version change for one Azure ARM provider.
  * Only populated for the azure lexicon.

package/dist/codegen/rolling-upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rolling-upgrade.d.ts","sourceRoot":"","sources":["../../src/codegen/rolling-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAmC,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAIvG,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAExD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,wFAAwF;IACxF,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,OAAO,EAAE,cAAc,CAAC;IACxB,mEAAmE;IACnE,UAAU,EAAE,OAAO,CAAC;IACpB,2EAA2E;IAC3E,QAAQ,EAAE,cAAc,CAAC;IACzB,gCAAgC;IAChC,KAAK,EAAE,YAAY,CAAC;IACpB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,YAAY,EAAE,OAAO,CAAC;IACtB,sCAAsC;IACtC,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClC,0EAA0E;IAC1E,eAAe,EAAE,qBAAqB,EAAE,CAAC;IACzC,wEAAwE;IACxE,aAAa,EAAE,eAAe,GAAG,IAAI,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,yFAAyF;IACzF,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACzD;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAoC/B;AA6BD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,eAAe,GACrB,qBAAqB,EAAE,CA6BzB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,qBAAqB,EAAE,CAmBzB;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,eAAe,GACrB,YAAY,CAEd;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG;IAClD,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAIA"}
+{"version":3,"file":"rolling-upgrade.d.ts","sourceRoot":"","sources":["../../src/codegen/rolling-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAmC,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAIvG,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEhE;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,wFAAwF;IACxF,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,OAAO,EAAE,cAAc,CAAC;IACxB,mEAAmE;IACnE,UAAU,EAAE,OAAO,CAAC;IACpB,2EAA2E;IAC3E,QAAQ,EAAE,cAAc,CAAC;IACzB,gCAAgC;IAChC,KAAK,EAAE,YAAY,CAAC;IACpB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,YAAY,EAAE,OAAO,CAAC;IACtB,sCAAsC;IACtC,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClC,0EAA0E;IAC1E,eAAe,EAAE,qBAAqB,EAAE,CAAC;IACzC,wEAAwE;IACxE,aAAa,EAAE,eAAe,GAAG,IAAI,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,yFAAyF;IACzF,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACzD;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAoC/B;AA+BD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,eAAe,GACrB,qBAAqB,EAAE,CA6BzB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,qBAAqB,EAAE,CAmBzB;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,eAAe,GACrB,YAAY,CAEd;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG;IAClD,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAIA"}

package/dist/discovery/files.d.ts

@@ -1,7 +1,16 @@
+/**
+ * Marker chant writes at the top of files it generates (worker/workflow/activities
+ * bootstrap for Temporal Ops, etc.). Discovery must not treat these as authored
+ * infra source: they hold no Declarables, they self-execute on import (the worker
+ * bootstrap calls `run()`), and they use runtime patterns the authored-source lint
+ * rules forbid (dynamic `process.env[...]` access, spreads). Skipping them keeps
+ * `chant lint`/`build` from importing or linting the tool's own output.
+ */
+export declare const GENERATED_MARKER = "Generated by chant \u2014 do not edit directly";
 /**
  * Recursively find all TypeScript infrastructure files in a directory
  * @param path - The directory path to search
- * @returns Array of file paths to .ts files (excluding test files)
+ * @returns Array of file paths to .ts files (excluding test files and chant-generated files)
  */
 export declare function findInfraFiles(path: string): Promise<string[]>;
 //# sourceMappingURL=files.d.ts.map

package/dist/discovery/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/discovery/files.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmDpE"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/discovery/files.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,mDAA8C,CAAC;AAgB5E;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoDpE"}

package/dist/graph-ir.d.ts

@@ -137,4 +137,22 @@ export declare function buildLiveGraphIr(observations: LiveObservation[]): Graph
  * no live edges). Sorted; the live groups pass through unchanged.
  */
 export declare function overlayGraphs(live: GraphIR, declared: GraphIR): GraphIR;
+/**
+ * Source-anchored overlay (#821) — the inverse of {@link overlayGraphs}. The
+ * **declared** graph is the canvas, so its edges are kept: cross-substrate edges
+ * (an ECS service wired to a k8s workload) are a source-graph property, since live
+ * reconstruction is per-substrate (identifier value-match) and never crosses
+ * providers. Use this when the overlay must keep the mixed topology; use
+ * `overlayGraphs` when the provisioned graph itself is the subject.
+ *
+ * Each declared node is classified against live observation and tagged `_status`:
+ *   - **managed** (declared + provisioned) → `good`, carrying the observed
+ *     `physicalId` / `ownership` onto the declared node
+ *   - **pending** (declared, not provisioned) → `accent`
+ * **Foreign** resources (provisioned, not declared) are appended and tagged
+ * `warn`, together with any live-reconstructed edges that touch them — a declared
+ * edge cannot describe an undeclared resource. Declared groups/exports pass
+ * through unchanged; nodes and edges are sorted for deterministic output.
+ */
+export declare function sourceOverlayGraphs(declared: GraphIR, live: GraphIR): GraphIR;
 //# sourceMappingURL=graph-ir.d.ts.map

package/dist/graph-ir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph-ir.d.ts","sourceRoot":"","sources":["../src/graph-ir.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mCAAmC;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,IAAI,EAAE,KAAK,CAAC;IACZ,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;iFAE6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;iFAI6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACxC;AAED;qFACqF;AACrF,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB;;uFAEmF;IACnF,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AA6ID;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CA6ET;AAQD;4EAC4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CA+BzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAUvE"}
+{"version":3,"file":"graph-ir.d.ts","sourceRoot":"","sources":["../src/graph-ir.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mCAAmC;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,IAAI,EAAE,KAAK,CAAC;IACZ,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;iFAE6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;iFAI6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACxC;AAED;qFACqF;AACrF,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB;;uFAEmF;IACnF,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AA6ID;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CA6ET;AAQD;4EAC4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CA+BzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAUvE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAgC7E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/lint.ts

@@ -13,6 +13,7 @@ import type { RollbackPolicy } from "../../components/capability";
 import { rule } from "../../lint/declarative";
 import { watchDirectory, formatTimestamp, formatChangedFiles } from "../watch";
 import { formatError, formatInfo } from "../format";
+import { GENERATED_MARKER } from "../../discovery/files";
 
 // Import config loader
 import { loadConfig, resolveRulesForFile, parseRuleConfig } from "../../lint/config";
@@ -156,6 +157,11 @@ function getTypeScriptFiles(dir: string): string[] {
           scan(fullPath);
         }
       } else if (entry.endsWith(".ts") && !entry.endsWith(".test.ts") && !entry.endsWith(".spec.ts")) {
+        // Skip chant-generated files (worker/workflow/activities bootstrap): they
+        // hold no authored source and use runtime patterns the EVL* rules forbid.
+        if (readFileSync(fullPath, "utf-8").slice(0, 256).includes(GENERATED_MARKER)) {
+          continue;
+        }
         files.push(fullPath);
       }
     }

package/src/cli/handlers/graph.test.ts

@@ -26,6 +26,28 @@ vi.mock("../../graph-layout", () => ({
   getLayoutEngine: (name?: string) => ({ name: name ?? "dagre", layout: (input: unknown) => layoutMock(input) }),
 }));
 
+// --live path deps. `graph` isn't `requiresPlugins`, so the live handler loads
+// plugins itself; mock that plus observation/build/config (existing tests only
+// hit the Op-graph and source-view modes, so these mocks don't touch them).
+const loadPluginsMock = vi.fn();
+const resolveLexMock = vi.fn();
+vi.mock("../plugins", () => ({
+  loadPlugins: (...a: unknown[]) => loadPluginsMock(...a),
+  resolveProjectLexicons: (...a: unknown[]) => resolveLexMock(...a),
+}));
+const observeMock = vi.fn();
+vi.mock("../../lifecycle/observe", () => ({
+  observeResources: (...a: unknown[]) => observeMock(...a),
+}));
+vi.mock("../../config", () => ({
+  loadChantConfig: () => Promise.resolve({ config: {} }),
+}));
+vi.mock("../../build", () => ({
+  build: () => Promise.resolve({ errors: [] }),
+  partitionByLexicon: () => ({}),
+  computeStackGraph: () => ({}),
+}));
+
 const { runGraph } = await import("./graph");
 
 function makeArgs(overrides: Partial<ParsedArgs> = {}): ParsedArgs {
@@ -204,4 +226,26 @@ describe("runGraph", () => {
       expect(stderrBuf.join("\n")).toContain("boom");
     });
   });
+
+  describe("live graph (--live)", () => {
+    // Regression: `graph` is not `requiresPlugins`, so `ctx.plugins` is empty. The
+    // live path must load the project's plugins itself — otherwise it wrongly
+    // reports "No lexicons implement describeResources" and observes nothing.
+    test("loads plugins for --live when ctx.plugins is empty", async () => {
+      resolveLexMock.mockResolvedValue(["aws"]);
+      loadPluginsMock.mockResolvedValue([
+        { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+      ]);
+      observeMock.mockResolvedValue({
+        observations: [{ lexicon: "aws", resources: { "web-vpc": { type: "AWS::EC2::VPC", status: "OK" } } }],
+        errors: [],
+      });
+      const exit = await runGraph({ args: makeArgs({ format: "ir", live: true, env: "prod" }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      expect(loadPluginsMock).toHaveBeenCalled();
+      const out = stdoutBuf.join("\n");
+      expect(out).not.toContain("No lexicons implement describeResources");
+      expect(out).toContain("web-vpc");
+    });
+  });
 });

package/src/cli/handlers/graph.ts

@@ -2,7 +2,7 @@ import { resolve } from "node:path";
 import { discoverOps } from "../../op/discover";
 import { discover } from "../../discovery/index";
 import { partitionByLexicon, computeStackGraph, build } from "../../build";
-import { buildGraphIr, buildLiveGraphIr, overlayGraphs, type GraphIR } from "../../graph-ir";
+import { buildGraphIr, buildLiveGraphIr, overlayGraphs, sourceOverlayGraphs, type GraphIR } from "../../graph-ir";
 import { reconstructEdges, mergeCatalogs, containmentGroups, type ReferenceCatalog, type ContainmentPair } from "../../graph-refs";
 import { observeResources } from "../../lifecycle/observe";
 import { loadChantConfig } from "../../config";
@@ -12,6 +12,7 @@ import { toMermaid } from "../../graph-mermaid";
 import { toDot } from "../../graph-dot";
 import { getLayoutEngine, toLayoutInput, type NodeSize } from "../../graph-layout";
 import { lintCommand } from "../commands/lint";
+import { loadPlugins, resolveProjectLexicons } from "../plugins";
 import { readFileSync } from "node:fs";
 import { formatError, formatWarning, formatBold } from "../format";
 import type { CommandContext } from "../registry";
@@ -53,7 +54,7 @@ async function runGraphLive(
   ctx: CommandContext,
   format: "ir" | "mermaid" | "dot" | "layout",
 ): Promise<number> {
-  const { args, plugins } = ctx;
+  const { args } = ctx;
   const environment = args.env;
   if (!environment) {
     console.error(formatError({ message: "chant graph --live needs an environment: --live --env <name>" }));
@@ -62,6 +63,10 @@ async function runGraphLive(
 
   const projectPath = resolve(".");
   const { config } = await loadChantConfig(projectPath);
+  // `graph` is not `requiresPlugins` (Op/source-graph modes must work without a
+  // lexicon), so `ctx.plugins` is empty. The live path needs the project's
+  // observation plugins — load them here, mirroring the lifecycle handlers.
+  const plugins = ctx.plugins.length > 0 ? ctx.plugins : await loadPlugins(await resolveProjectLexicons(projectPath));
   if (config.environments && !config.environments.includes(environment)) {
     console.error(formatError({
       message: `Unknown environment "${environment}"`,
@@ -117,12 +122,19 @@ async function runGraphLive(
     containment = reconstructed.containment;
   }
 
-  // Drift overlay (#780): classify the provisioned graph against declared source
-  // (managed / foreign / pending) so a renderer colours the drift.
+  // Drift overlay: classify each resource against declared source (managed /
+  // foreign / pending) so a renderer colours the drift. Two anchorings:
+  //   - source (default, #821): declared graph is the canvas — keeps its edges,
+  //     so cross-substrate topology survives; live status joined per node.
+  //   - live (#780): provisioned graph is the canvas — reconstructed live edges.
   if (args.overlay) {
     const declared = await discover(resolve(args.src ?? config.sourceDir ?? "."));
     if (declared.errors.length === 0) {
-      ir = overlayGraphs(ir, buildGraphIr(declared.entities, projectPath));
+      const declaredIr = buildGraphIr(declared.entities, projectPath);
+      ir =
+        args.overlayAnchor === "live"
+          ? overlayGraphs(ir, declaredIr)
+          : sourceOverlayGraphs(declaredIr, ir);
     } else {
       console.error(formatWarning({ message: "overlay: source has discovery errors — showing the provisioned graph without the declared overlay" }));
     }

package/src/cli/main.ts

@@ -94,6 +94,10 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.live = true;
     } else if (arg === "--overlay") {
       result.overlay = true;
+    } else if (arg === "--overlay-anchor") {
+      const v = args[++i];
+      if (v !== "source" && v !== "live") throw new Error(`--overlay-anchor must be 'source' or 'live', got '${v}'`);
+      result.overlayAnchor = v;
     } else if (arg === "--from") {
       // Shared by `migrate --from <lexicon>` and `import --from <env>`; the
       // two commands never run together, so one field carries both.

package/src/cli/registry.ts

@@ -61,6 +61,11 @@ export interface ParsedArgs {
   /** `chant graph --live --overlay` — classify the provisioned graph against
    * declared source: managed / foreign / pending (#780). */
   overlay?: boolean;
+  /** `chant graph --live --overlay --overlay-anchor <source|live>` (#821) — which
+   * graph is the canvas. `source` (default) keeps the declared edges (the
+   * cross-substrate topology) and joins live status per node; `live` keeps the
+   * provisioned graph's reconstructed edges (the pre-#821 behaviour). */
+  overlayAnchor?: "source" | "live";
   /** `chant list --components` / `chant graph --components` — surface discovered
    * `Component` declarations (#560) instead of/alongside lexicon resources. */
   components?: boolean;

package/src/codegen/rolling-upgrade.test.ts

@@ -211,6 +211,65 @@ describe("checkRollingUpgrade — surface changed vs unchanged", () => {
   });
 });
 
+// ── fly lexicon detection (rolls off the live Fly Machines OpenAPI) ────
+
+function baselineFly(): SurfaceSnapshot {
+  return {
+    schemaVersion: 1,
+    generatedAt: "2026-01-01T00:00:00.000Z",
+    entries: {
+      Machine: {
+        kind: "resource",
+        resourceType: "Fly::Machines::Machine",
+        props: ["name:false", "region:false", "config:false"],
+      },
+    },
+  };
+}
+
+/** Adds a new resource → additive upgrade. */
+function freshFlyAdditive(): SurfaceSnapshot {
+  const s = baselineFly();
+  s.entries.Volume = {
+    kind: "resource",
+    resourceType: "Fly::Machines::Volume",
+    props: ["name:false", "size_gb:false"],
+  };
+  return s;
+}
+
+describe("checkRollingUpgrade — fly", () => {
+  test("detects fly lexicon by package name", async () => {
+    const dir = makeLexiconDir("fly", baselineFly());
+    try {
+      const res = await checkRollingUpgrade({
+        lexiconDir: dir,
+        _regenFn: makeRegen(baselineFly(), baselineFly()),
+      });
+      expect(res.lexicon).toBe("fly");
+      expect(res.hasUpgrade).toBe(false);
+      expect(res.apiVersionDelta).toEqual([]); // fly has no ARM-style version delta
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("a new resource in the Machines surface is an additive upgrade", async () => {
+    const dir = makeLexiconDir("fly", baselineFly());
+    try {
+      const res = await checkRollingUpgrade({
+        lexiconDir: dir,
+        _regenFn: makeRegen(freshFlyAdditive(), baselineFly()),
+      });
+      expect(res.lexicon).toBe("fly");
+      expect(res.hasUpgrade).toBe(true);
+      expect(res.severity).toBe("additive");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
 // ── azure lexicon detection + apiVersionDelta ─────────────────────────
 
 describe("checkRollingUpgrade — azure", () => {

package/src/codegen/rolling-upgrade.ts

@@ -34,7 +34,7 @@ import { regenLexicon, SNAPSHOT_FILENAME, type RegenOptions, type RegenResult }
 
 // ── Public types ──────────────────────────────────────────────────────
 
-export type RollingLexicon = "aws" | "azure" | "github";
+export type RollingLexicon = "aws" | "azure" | "github" | "fly";
 
 /**
  * An API-version change for one Azure ARM provider.
@@ -157,6 +157,7 @@ function detectLexicon(lexiconDir: string): RollingLexicon {
       const name = pkg.name ?? "";
       if (name.includes("azure")) return "azure";
       if (name.includes("github")) return "github";
+      if (name.includes("fly")) return "fly";
     }
   } catch {
     // Fall through to directory-based detection
@@ -165,6 +166,7 @@ function detectLexicon(lexiconDir: string): RollingLexicon {
   const normalized = lexiconDir.replace(/\\/g, "/");
   if (/\/azure(\/|$)/.test(normalized)) return "azure";
   if (/\/github(\/|$)/.test(normalized)) return "github";
+  if (/\/fly(\/|$)/.test(normalized)) return "fly";
   return "aws";
 }
 

package/src/discovery/files.test.ts

@@ -151,4 +151,21 @@ describe("findInfraFiles", () => {
       expect(files).toEqual([]);
     });
   });
+
+  test("skips chant-generated files (marker header)", async () => {
+    await withTestDir(async (testDir) => {
+      await writeFile(join(testDir, "app.ts"), "export const app = {};");
+      // A generated worker bootstrap: self-executes on import and uses runtime
+      // patterns the EVL* rules forbid — discovery must not pick it up.
+      await writeFile(
+        join(testDir, "worker.ts"),
+        "// Generated by chant — do not edit directly.\nrun();",
+      );
+
+      const files = await findInfraFiles(testDir);
+      expect(files).toHaveLength(1);
+      expect(files[0]).toMatch(/app\.ts$/);
+      expect(files.some((f) => f.endsWith("worker.ts"))).toBe(false);
+    });
+  });
 });

package/src/discovery/files.ts

@@ -1,11 +1,35 @@
-import { readdir, stat } from "node:fs/promises";
+import { readdir, stat, open } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { join, relative } from "node:path";
 
+/**
+ * Marker chant writes at the top of files it generates (worker/workflow/activities
+ * bootstrap for Temporal Ops, etc.). Discovery must not treat these as authored
+ * infra source: they hold no Declarables, they self-execute on import (the worker
+ * bootstrap calls `run()`), and they use runtime patterns the authored-source lint
+ * rules forbid (dynamic `process.env[...]` access, spreads). Skipping them keeps
+ * `chant lint`/`build` from importing or linting the tool's own output.
+ */
+export const GENERATED_MARKER = "Generated by chant — do not edit directly";
+
+/** True when a file's header carries the {@link GENERATED_MARKER}. Reads only the head. */
+async function isGeneratedFile(file: string): Promise<boolean> {
+  let fh;
+  try {
+    fh = await open(file, "r");
+    const { buffer, bytesRead } = await fh.read({ buffer: Buffer.alloc(256), position: 0 });
+    return buffer.toString("utf8", 0, bytesRead).includes(GENERATED_MARKER);
+  } catch {
+    return false;
+  } finally {
+    await fh?.close();
+  }
+}
+
 /**
  * Recursively find all TypeScript infrastructure files in a directory
  * @param path - The directory path to search
- * @returns Array of file paths to .ts files (excluding test files)
+ * @returns Array of file paths to .ts files (excluding test files and chant-generated files)
  */
 export async function findInfraFiles(path: string): Promise<string[]> {
   const files: string[] = [];
@@ -44,11 +68,12 @@ export async function findInfraFiles(path: string): Promise<string[]> {
         }
         await scanDirectory(fullPath);
       } else if (entry.isFile()) {
-        // Include only .ts files, exclude test files
+        // Include only .ts files, exclude test files and chant-generated files
         if (
           entry.name.endsWith(".ts") &&
           !entry.name.endsWith(".test.ts") &&
-          !entry.name.endsWith(".spec.ts")
+          !entry.name.endsWith(".spec.ts") &&
+          !(await isGeneratedFile(fullPath))
         ) {
           files.push(fullPath);
         }

package/src/graph-ir-live.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { buildLiveGraphIr, overlayGraphs, type LiveObservation, type GraphIR } from "./graph-ir";
+import { buildLiveGraphIr, overlayGraphs, sourceOverlayGraphs, type LiveObservation, type GraphIR } from "./graph-ir";
 
 // A fixture "snapshot" — what a lexicon's describeResources() returns for a live
 // environment (managed-only). Two AWS resources; the subnet references the VPC by
@@ -86,3 +86,58 @@ describe("overlayGraphs (#780 drift overlay)", () => {
     expect(ir.edges).toHaveLength(1);
   });
 });
+
+describe("sourceOverlayGraphs (#821 source-anchored overlay)", () => {
+  const n = (id: string, lexicon = "aws") => ({ id, kind: "K", lexicon, attrs: {} });
+  // Declared graph carries a *cross-substrate* edge (a k8s ingress → an aws vpc)
+  // that live reconstruction — per-substrate identifier matching — can never make.
+  const declared: GraphIR = {
+    nodes: [n("web-vpc", "aws"), n("app-ingress", "k8s"), n("planned-db", "aws")],
+    edges: [{ from: "app-ingress", to: "web-vpc", kind: "ref", viaAttr: "vpcId" }],
+    groups: { byLexicon: { aws: ["planned-db", "web-vpc"], k8s: ["app-ingress"] } },
+  };
+  const live: GraphIR = {
+    nodes: [
+      { id: "web-vpc", kind: "AWS::EC2::VPC", lexicon: "aws", attrs: {}, physicalId: "vpc-0a1b", ownership: "owned" },
+      n("app-ingress", "k8s"),
+      n("rogue-sg", "aws"),
+    ],
+    edges: [{ from: "rogue-sg", to: "web-vpc", kind: "ref", viaAttr: "sg" }],
+    groups: {},
+  };
+  const statusOf = (ir: GraphIR, id: string) =>
+    (ir.nodes.find((x) => x.id === id)!.attrs as { _status?: string })._status;
+
+  it("classifies managed / pending / foreign via _status", () => {
+    const ir = sourceOverlayGraphs(declared, live);
+    expect(statusOf(ir, "web-vpc")).toBe("good"); // declared + provisioned
+    expect(statusOf(ir, "app-ingress")).toBe("good"); // declared + provisioned
+    expect(statusOf(ir, "planned-db")).toBe("accent"); // declared, not provisioned
+    expect(statusOf(ir, "rogue-sg")).toBe("warn"); // provisioned, not declared → foreign
+  });
+
+  it("keeps the declared cross-substrate edge (the whole point of source-anchoring)", () => {
+    const ir = sourceOverlayGraphs(declared, live);
+    expect(ir.edges).toContainEqual({ from: "app-ingress", to: "web-vpc", kind: "ref", viaAttr: "vpcId" });
+  });
+
+  it("carries the observed physicalId/ownership onto a managed declared node", () => {
+    const ir = sourceOverlayGraphs(declared, live);
+    const vpc = ir.nodes.find((x) => x.id === "web-vpc")!;
+    expect(vpc.physicalId).toBe("vpc-0a1b");
+    expect(vpc.ownership).toBe("owned");
+  });
+
+  it("appends foreign nodes with their live edges, and keeps declared groups", () => {
+    const ir = sourceOverlayGraphs(declared, live);
+    expect(ir.nodes.map((x) => x.id)).toContain("rogue-sg");
+    expect(ir.edges).toContainEqual({ from: "rogue-sg", to: "web-vpc", kind: "ref", viaAttr: "sg" }); // foreign-touching
+    expect(ir.groups.byLexicon).toEqual({ aws: ["planned-db", "web-vpc"], k8s: ["app-ingress"] });
+  });
+
+  it("drops a live edge between two managed nodes — declared edges already cover it", () => {
+    const liveDup: GraphIR = { ...live, edges: [{ from: "app-ingress", to: "web-vpc", kind: "ref", viaAttr: "live-label" }] };
+    const ir = sourceOverlayGraphs(declared, liveDup);
+    expect(ir.edges.filter((e) => e.from === "app-ingress" && e.to === "web-vpc")).toHaveLength(1);
+  });
+});

package/src/graph-ir.ts

@@ -421,3 +421,54 @@ export function overlayGraphs(live: GraphIR, declared: GraphIR): GraphIR {
 
   return { ...live, nodes };
 }
+
+/**
+ * Source-anchored overlay (#821) — the inverse of {@link overlayGraphs}. The
+ * **declared** graph is the canvas, so its edges are kept: cross-substrate edges
+ * (an ECS service wired to a k8s workload) are a source-graph property, since live
+ * reconstruction is per-substrate (identifier value-match) and never crosses
+ * providers. Use this when the overlay must keep the mixed topology; use
+ * `overlayGraphs` when the provisioned graph itself is the subject.
+ *
+ * Each declared node is classified against live observation and tagged `_status`:
+ *   - **managed** (declared + provisioned) → `good`, carrying the observed
+ *     `physicalId` / `ownership` onto the declared node
+ *   - **pending** (declared, not provisioned) → `accent`
+ * **Foreign** resources (provisioned, not declared) are appended and tagged
+ * `warn`, together with any live-reconstructed edges that touch them — a declared
+ * edge cannot describe an undeclared resource. Declared groups/exports pass
+ * through unchanged; nodes and edges are sorted for deterministic output.
+ */
+export function sourceOverlayGraphs(declared: GraphIR, live: GraphIR): GraphIR {
+  const liveById = new Map(live.nodes.map((n) => [n.id, n]));
+  const declaredIds = new Set(declared.nodes.map((n) => n.id));
+  const foreignIds = new Set(live.nodes.filter((n) => !declaredIds.has(n.id)).map((n) => n.id));
+  const tagged = (n: IRNode, status: "good" | "warn" | "accent"): IRNode => ({ ...n, attrs: { ...n.attrs, _status: status } });
+
+  const nodes: IRNode[] = declared.nodes.map((n) => {
+    const obs = liveById.get(n.id);
+    if (!obs) return tagged(n, "accent"); // pending — declared, not provisioned
+    const merged: IRNode = { ...n }; // managed — carry the observed identity
+    if (obs.physicalId) merged.physicalId = obs.physicalId;
+    if (obs.ownership) merged.ownership = obs.ownership;
+    return tagged(merged, "good");
+  });
+  for (const n of live.nodes) if (foreignIds.has(n.id)) nodes.push(tagged(n, "warn")); // foreign
+  nodes.sort((a, b) => a.id.localeCompare(b.id));
+
+  // Declared edges are the canvas (the cross-substrate topology). Add only the
+  // live edges that touch a foreign node — declared edges already cover every
+  // declared relationship, so keeping all live edges would double managed ones.
+  const seen = new Set(declared.edges.map(edgeKey));
+  const edges = [...declared.edges];
+  for (const e of live.edges) {
+    if (!(foreignIds.has(e.from) || foreignIds.has(e.to))) continue;
+    const k = edgeKey(e);
+    if (seen.has(k)) continue;
+    seen.add(k);
+    edges.push(e);
+  }
+  edges.sort((a, b) => edgeKey(a).localeCompare(edgeKey(b)));
+
+  return { ...declared, nodes, edges };
+}

package/src/op/activity-registry.test.ts

@@ -12,7 +12,7 @@ describe("loadActivities", () => {
     // Real export names from lexicons/temporal/src/op/activities.
     expect(activities.has("shellCmd")).toBe(true);
     expect(activities.has("chantBuild")).toBe(true);
-    expect(activities.has("kubectlApply")).toBe(true);
+    expect(activities.has("waitForStack")).toBe(true);
     expect(activities.has("lifecycleDiff")).toBe(true);
     expect(typeof activities.get("shellCmd")).toBe("function");
   });
@@ -49,12 +49,12 @@ describe("resolveActivity", () => {
 
 describe("loadActivities — heartbeat-shim safety", () => {
   test("the activity library loads without @temporalio/activity installed", async () => {
-    // kubectlApply/helmInstall/waitForStack/gitlabPipeline heartbeat via the
-    // lazy shim; if the shim statically required the SDK, this import would
-    // throw (the SDK is not installed in this environment).
+    // waitForStack (and the relocated kubectlApply/helmInstall/gitlabPipeline)
+    // heartbeat via the lazy shim; if the shim statically required the SDK, this
+    // import would throw (the SDK is not installed in this environment).
     const activities = await loadActivities();
-    expect(activities.has("kubectlApply")).toBe(true);
     expect(activities.has("waitForStack")).toBe(true);
+    expect(activities.has("chantBuild")).toBe(true);
   });
 });
 
@@ -62,10 +62,12 @@ describe("loadActivities — heartbeat-shim safety", () => {
 // lexicons (#706); the loader pulls them in per the project's configured
 // `lexicons`. Proves the relocation resolves end-to-end.
 describe("loadActivities — multi-lexicon (#706)", () => {
-  test("base (no lexicons): temporal activities present, cloud appliers absent", async () => {
+  test("base (no lexicons): temporal activities present, product activities absent", async () => {
     const a = await loadActivities();
-    expect(a.has("kubectlApply")).toBe(true); // temporal base
-    expect(a.has("k3dUp")).toBe(true); // cloud-agnostic, stays in temporal
+    expect(a.has("waitForStack")).toBe(true); // temporal base
+    expect(a.has("shellCmd")).toBe(true); // temporal base
+    expect(a.has("kubectlApply")).toBe(false); // relocated to k8s (#809)
+    expect(a.has("k3dUp")).toBe(false); // relocated to k8s (#809)
     expect(a.has("gcpApply")).toBe(false); // relocated to gcp
     expect(a.has("flociUp")).toBe(false); // relocated to aws
     expect(a.has("azGroupEnsure")).toBe(false); // relocated to azure
@@ -74,7 +76,16 @@ describe("loadActivities — multi-lexicon (#706)", () => {
   test("gcp lexicon contributes the GCP applier", async () => {
     const a = await loadActivities(["gcp"]);
     expect(a.has("gcpApply")).toBe(true);
-    expect(a.has("kubectlApply")).toBe(true); // base still loaded alongside
+    expect(a.has("waitForStack")).toBe(true); // base still loaded alongside
+  });
+
+  test("k8s lexicon contributes kubectl / k3d / argo activities (#809)", async () => {
+    const a = await loadActivities(["k8s"]);
+    expect(a.has("kubectlApply")).toBe(true);
+    expect(a.has("k3dUp")).toBe(true);
+    expect(a.has("k3dDown")).toBe(true);
+    expect(a.has("waitForArgoSync")).toBe(true);
+    expect(a.has("waitForStack")).toBe(true); // base still loaded alongside
   });
 
   test("aws lexicon contributes the Floci lifecycle", async () => {
@@ -92,6 +103,6 @@ describe("loadActivities — multi-lexicon (#706)", () => {
 
   test("unknown lexicon is skipped without throwing", async () => {
     const a = await loadActivities(["definitely-not-a-lexicon"]);
-    expect(a.has("kubectlApply")).toBe(true);
+    expect(a.has("waitForStack")).toBe(true); // temporal base still loads
   });
 });