@intentius/chant 0.28.0 → 0.30.0

package/dist/lifecycle/observe.d.ts

@@ -22,8 +22,10 @@ export interface ObserveResult {
  * `environment`. `owned` (default true for the managed-only diagram, epic #776)
  * restricts to resources carrying chant's ownership marker; a lexicon with no
  * marker channel logs and returns everything (its own contract). Plugins that
- * throw are collected into `errors` and skipped — one failing lexicon never
- * sinks the whole graph.
+ * throw are collected into `errors` — one failing lexicon never sinks the whole
+ * graph — and every entity they were asked about is recorded as NOT-OBSERVED
+ * (`read-failed`, #1089) rather than dropped, so a failed read is visibly a
+ * hole instead of a silent absence.
  *
  * `stacks` (#57) is for a multi-stack, per-component project (e.g. loomster)
  * where there is no single stack named after the environment — AWS's

package/dist/lifecycle/observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observe.d.ts","sourceRoot":"","sources":["../../src/lifecycle/observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC5C,OAAO,CAAC,aAAa,CAAC,CAgExB"}
+{"version":3,"file":"observe.d.ts","sourceRoot":"","sources":["../../src/lifecycle/observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAUnD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC5C,OAAO,CAAC,aAAa,CAAC,CAmFxB"}

package/dist/lifecycle/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/lifecycle/snapshot.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAsC,MAAM,YAAY,CAAC;AACzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAiEjD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,kBAAkB,CAAC,CAkH7B"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/lifecycle/snapshot.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAsC,MAAM,YAAY,CAAC;AACzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AA6DjD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,kBAAkB,CAAC,CA0I7B"}

package/dist/lifecycle/status.d.ts

@@ -21,6 +21,9 @@
  *    lower-confidence signal rather than silently treated as "reconciled".
  *  - **reconciled** — a release record exists and live evidence (via
  *    ownership) confirms the component is present and owned by chant.
+ *  - **unknown** — live evidence was requested and could not be read (#1089),
+ *    or was not requested at all. A component chant could not observe is never
+ *    reported `stale`: "the read failed" and "it is gone" are different facts.
  *
  * This is deliberately a light-touch reconciliation: chant's lexicons report
  * resource-level status (`ResourceMetadata`), not "the digest currently
@@ -35,6 +38,7 @@
 import type { ChangeSet, ChangeAction } from "./change-set.js";
 import { type ReleaseRecord } from "./release-ledger.js";
 import type { BuildLedgerEntry, ComponentBomSummary } from "./build-ledger.js";
+import { type UnobservedReason } from "../observation.js";
 /** One row of `chant components status [env]` — the per-component join of recorded vs live. */
 export interface ComponentStatusRow {
     component: string;
@@ -61,9 +65,21 @@ export interface ComponentStatusRow {
     /**
      * Machine-readable "observed live", when live evidence was gathered (`--live`).
      * A consumer joining this row onto a graph node should read this rather than
-     * string-matching `detail`. Absent when `--live` was not requested.
+     * string-matching `detail`. Absent when `--live` was not requested — and, since
+     * #1089, also absent when live state could not be read at all: `false` means
+     * "looked, not there", never "did not look". Read {@link unobserved} for that
+     * case; a consumer that treats absent as "unknown" already handles it.
      */
     live?: boolean;
+    /**
+     * Set when `--live` was requested and the observation could not read this
+     * component (#1089). `live` is absent alongside it and `reconciliation` is
+     * `unknown` — the row reports a hole rather than a verdict.
+     */
+    unobserved?: {
+        reason: UnobservedReason;
+        detail?: string;
+    };
     /**
      * The owning deploy unit's raw status, when a lexicon reported it (AWS: the
      * component's own CFN stack via `describeStackStatus`). Lets a renderer paint a
@@ -98,6 +114,15 @@ export interface ComponentStatusResult {
 export interface LiveComponentEvidence {
     /** True if this component name was observed live at all (declared+live, or orphan+live). */
     live: boolean;
+    /**
+     * Set when the observation could not read this component (#1089). `live` is
+     * `false` alongside it, but only because the boolean has nowhere else to go —
+     * every consumer must branch on this field before believing `live: false`.
+     */
+    unobserved?: {
+        reason: UnobservedReason;
+        detail?: string;
+    };
     /** The `ChangeSet` action chant's existing plan logic assigned, when the component maps to a tracked entity/resource name. */
     action?: ChangeAction;
     /** Ownership verdict, when known. */

package/dist/lifecycle/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/lifecycle/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,+IAA+I;IAC/I,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,gDAAgD;IAChD,cAAc,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9E,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,4GAA4G;IAC5G,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,4FAA4F;IAC5F,IAAI,EAAE,OAAO,CAAC;IACd,8HAA8H;IAC9H,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C;oFACgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,EACpD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAC7C,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAYpC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAEhE,4HAA4H;AAC5H,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,MAAM,EAAE,CAGvF;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,SAAS,EACb,WAAW,CAAC,EAAE,eAAe,GAC5B,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CA+BpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,aAAa,EAAE,EACxB,IAAI,CAAC,EAAE;IACL,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAClD,2DAA2D;IAC3D,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/C,+MAA+M;IAC/M,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACxD,6KAA6K;IAC7K,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,GACA,kBAAkB,EAAE,CAsDtB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,IAAI,EAAE,OAAO,CAAC;CACf;AAED,oGAAoG;AACpG,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,EAChD,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,GAC/C,kBAAkB,CAWpB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/lifecycle/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE7E,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,+IAA+I;IAC/I,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,gDAAgD;IAChD,cAAc,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9E,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D;;;;;OAKG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,4GAA4G;IAC5G,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,4FAA4F;IAC5F,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,8HAA8H;IAC9H,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C;oFACgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,EACpD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAC7C,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAgBpC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAEhE,4HAA4H;AAC5H,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,MAAM,EAAE,CAGvF;AA+BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,SAAS,EACb,WAAW,CAAC,EAAE,eAAe,GAC5B,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAyCpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,aAAa,EAAE,EACxB,IAAI,CAAC,EAAE;IACL,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAClD,2DAA2D;IAC3D,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/C,+MAA+M;IAC/M,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACxD,6KAA6K;IAC7K,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,GACA,kBAAkB,EAAE,CAmEtB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,IAAI,EAAE,OAAO,CAAC;CACf;AAED,oGAAoG;AACpG,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,EAChD,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,GAC/C,kBAAkB,CAWpB"}

package/dist/lifecycle/types.d.ts

@@ -1,4 +1,5 @@
 import type { ResourceMetadata, ArtifactMetadata } from "../lexicon.js";
+import type { UnobservedEntity } from "../observation.js";
 export type { ResourceMetadata, ArtifactMetadata } from "../lexicon.js";
 /**
  * State snapshot for a single lexicon in an environment.
@@ -16,6 +17,13 @@ export interface LifecycleSnapshot {
     timestamp: string;
     /** Resource metadata keyed by logical name */
     resources: Record<string, ResourceMetadata>;
+    /**
+     * Declared entities this observation could not read (#1089), keyed by logical
+     * name. Additive and optional: a snapshot without it observed everything it
+     * was asked about. Present so a later diff can tell "was not there when the
+     * snapshot was taken" from "was never looked at".
+     */
+    unobserved?: Record<string, UnobservedEntity>;
     /** Artifact metadata keyed by server-side identifier (lexicon-specific). */
     artifacts?: Record<string, ArtifactMetadata>;
     /** Build digest at snapshot time — what was declared when this snapshot was taken */

package/dist/lifecycle/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lifecycle/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB;;gFAE4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,iCAAiC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lifecycle/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB;;gFAE4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,iCAAiC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB"}

package/dist/live-endpoint.d.ts

@@ -0,0 +1,92 @@
+/**
+ * chant #1166 — let a declared `environment` carry its own endpoint so
+ * `--live --env <name>` is self-sufficient.
+ *
+ * The bug this closes: `chant graph --live --env floci` (and `lifecycle
+ * diff`/`plan`) observe a stack by shelling out through each lexicon's
+ * `describeResources()`. For AWS that shell-out honors the ambient
+ * `AWS_ENDPOINT_URL` env var — when a project's `floci` environment is a local
+ * emulator (`http://localhost:4566`) but the invoking shell never exported
+ * that var, the AWS CLI silently targets real AWS instead. The stack named
+ * after the environment doesn't exist there, so `describeResources` hits its
+ * `stackDoesNotExist` branch and returns an empty, unremarkable "nothing is
+ * deployed" — indistinguishable from the truthful answer. This cost real
+ * debugging time validating #1162's live overlay: the observation code was
+ * right, the manual repro just never set the var.
+ *
+ * The fix: `environments` in `chant.config.ts` can name an endpoint per
+ * environment (`config.ts`'s `EnvironmentDeclaration`), and {@link
+ * applyLiveEndpoint} injects it into the ambient env var each observing
+ * lexicon's CLI shell-out actually reads — but only for a var that isn't
+ * already set. Ambient always wins: a shell that already exports
+ * `AWS_ENDPOINT_URL` sees no change in behavior.
+ *
+ * Audited (#1166) which lexicons have an ambient-env-var endpoint knob at
+ * all, since that's the specific footgun — a lexicon whose environment
+ * binding is resolved from `chant.config` itself (not an ambient var) has
+ * nothing to inject here:
+ *
+ *   - **aws**  — `AWS_ENDPOINT_URL`, read directly by
+ *     `lexicons/aws/src/components/cloud-executor.ts` / `plugin.ts` before
+ *     every `aws …` shell-out (`applyAwsEndpoint`/`applyAwsEndpointArgv`).
+ *   - **fly**  — `FLY_FLAPS_BASE_URL`, read by `resolveEndpoint()` in
+ *     `lexicons/fly/src/op/activities/fly-apply.ts`, the same seam
+ *     `describeResources` (`../describe-resources.ts`) calls through.
+ *   - **gcp**, **k8s** — resolve their live target from `chant.config` itself
+ *     (`k8s.profiles.<env>.context` via `resolveClusterTarget`,
+ *     `packages/core/src/kubectl-context.ts`), not an ambient var. Nothing to
+ *     inject: the config *is* the binding already.
+ *   - **azure** — resolves via the `az` CLI's own logged-in
+ *     subscription/session context; no ambient endpoint var exists to miss.
+ *   - **temporal** — resolves its connection from `temporal.profiles.<env>`
+ *     (`resolveProfile`, `lexicons/temporal/src/describe-resources.ts`), the
+ *     same "config is the binding" shape as k8s/gcp.
+ */
+import { type EnvironmentDeclaration } from "./config.js";
+/**
+ * Per-lexicon ambient env var a `--live` read honors for its endpoint. Only
+ * lexicons with a genuine ambient-var footgun are listed — see the module doc
+ * for the full audit (gcp/k8s/azure/temporal resolve their target from
+ * `chant.config` instead, so they have nothing to inject).
+ */
+export declare const LEXICON_ENDPOINT_ENV_VAR: Record<string, string>;
+/** Result of {@link applyLiveEndpoint} — always call `restore()`, even when nothing was applied (it is then a no-op). */
+export interface AppliedEndpoint {
+    /**
+     * One line describing what happened, or `undefined` when the environment
+     * declares no endpoint at all (nothing to say). Present whether the
+     * declared endpoint was applied OR an ambient var already won — #1166's
+     * "no silent anything" stance: an operator should never have to guess which
+     * target a `--live` read actually used.
+     */
+    notice?: string;
+    /** Undo whatever ambient env vars this call set. Always safe to call. */
+    restore: () => void;
+}
+/**
+ * Resolve `environment`'s declared endpoint (if any) from `config.environments`
+ * and apply it to the ambient env var of every lexicon in `lexicons` that has
+ * one ({@link LEXICON_ENDPOINT_ENV_VAR}) — but only when that var isn't
+ * already set. Ambient always wins (#1166): behavior for a shell that already
+ * exports `AWS_ENDPOINT_URL` is unchanged.
+ *
+ * Call before a `--live` describe/enrich pass; `restore()` in a `finally` so
+ * the injected value never leaks into a later invocation in the same process
+ * (tests, or a long-lived host like the MCP server).
+ */
+export declare function applyLiveEndpoint(environments: EnvironmentDeclaration[] | undefined, environment: string, lexicons: readonly string[], env?: NodeJS.ProcessEnv): AppliedEndpoint;
+/**
+ * #1166 acceptance: when a `--live` describe comes back with zero resources
+ * for a lexicon that had declared entities to look for, and nothing was
+ * already reported NOT-OBSERVED (#1089) either, that is either "genuinely
+ * nothing is deployed yet" or a misconfigured endpoint/credentials — the two
+ * are visually identical, so a caller must say so rather than stay quiet.
+ * Returns `undefined` when there is nothing to declare (no declared entities
+ * to have asked about, or the emptiness is already explained by #1089's
+ * `unobserved`).
+ */
+export declare function zeroResourcesWarning(lexicon: string, environment: string, declaredCount: number, observed: {
+    resources: Record<string, unknown>;
+    unobserved: Record<string, unknown>;
+}): string | undefined;
+//# sourceMappingURL=live-endpoint.d.ts.map

package/dist/live-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-endpoint.d.ts","sourceRoot":"","sources":["../src/live-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAuB,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAG3D,CAAC;AAEF,yHAAyH;AACzH,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAClD,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,CAqCjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACpF,MAAM,GAAG,SAAS,CAKpB"}

package/dist/observation.d.ts

@@ -0,0 +1,123 @@
+/**
+ * The observation contract (#1089) — what a lexicon's `describeResources()`
+ * is allowed to mean.
+ *
+ * Before this module there were two ways for an observation to return nothing
+ * for a declared entity and no way to tell them apart:
+ *
+ *   1. The provider was asked and said the resource does not exist.
+ *   2. The lexicon never looked — no reader for that kind, the read errored,
+ *      no credentials, no cluster/subscription binding.
+ *
+ * Both arrived at the change set as "absent", and absent + declared classifies
+ * as `create`. So `chant lifecycle plan` proposed creating a Kubernetes CRD
+ * that already existed in the cluster, with nothing in the plan to say the tool
+ * had simply not looked (a warn on stderr is not a signal in a change set).
+ *
+ * The contract is a tri-state, per declared entity:
+ *
+ *   - **OBSERVED-PRESENT** — a key in `resources`. The provider returned it.
+ *   - **OBSERVED-ABSENT** — in neither map. The lexicon looked and the provider
+ *     reported it missing. This is the only shape that may become a `create`.
+ *   - **NOT-OBSERVED** — a key in `unobserved`, carrying a total
+ *     {@link UnobservedReason}. Never a `create`, never a `delete`; consumers
+ *     surface it and stop.
+ *
+ * Compatibility: `describeResources()` may still return the bare
+ * `name → ResourceMetadata` map it always did — that means "everything I was
+ * asked about, I looked at" and normalizes to an empty `unobserved`. Reporting
+ * NOT-OBSERVED requires the explicitly versioned {@link ObservationResult}
+ * envelope, which is discriminated by its literal `observation: "v1"` field (a
+ * bare map's value at any key is a `ResourceMetadata` object, never that
+ * string, so the two shapes can never be confused).
+ */
+import type { ResourceMetadata } from "./lexicon.js";
+/**
+ * Why a declared entity was not observed. Total: a lexicon that cannot observe
+ * an entity must pick one of these, and consumers may switch exhaustively.
+ *
+ * - `read-failed` — the provider was reached and the read errored (a non-zero
+ *   CLI exit, a 5xx, an unparseable response).
+ * - `no-credentials` — no usable credentials/authorization for the target.
+ * - `no-binding` — the environment resolves to no concrete target (no kubectl
+ *   context, no subscription, no stack, no endpoint).
+ * - `unsupported-kind` — the lexicon has no reader for this entity type (the
+ *   K8s CRD case, Azure's nested ARM types). The resource may well exist.
+ * - `filtered` — the entity was reached but withheld by a caller-requested
+ *   filter (`owned: true` against a resource carrying no chant marker). The
+ *   result deliberately says nothing about it, which is still not absence: a
+ *   declared resource that exists but is foreign must not classify as `create`.
+ */
+export type UnobservedReason = "read-failed" | "no-credentials" | "no-binding" | "unsupported-kind" | "filtered";
+/** Every legal {@link UnobservedReason}, for validation and conformance checks. */
+export declare const UNOBSERVED_REASONS: readonly UnobservedReason[];
+/** True when `value` is a legal {@link UnobservedReason}. */
+export declare function isUnobservedReason(value: unknown): value is UnobservedReason;
+/** One declared entity the lexicon could not observe, and why. */
+export interface UnobservedEntity {
+    /** Declared entity type, when the lexicon knows it (it usually does — the entity is declared). */
+    type?: string;
+    /** Total verdict. */
+    reason: UnobservedReason;
+    /** Human-readable detail: the command that failed, the missing binding key, the unsupported kind. */
+    detail?: string;
+}
+/**
+ * The observation envelope — a `describeResources()` return value that can say
+ * "I did not look at this one". Explicitly versioned: `observation: "v1"`.
+ */
+export interface ObservationResult {
+    /** Discriminant + wire version. Distinguishes the envelope from the bare `name → ResourceMetadata` map. */
+    readonly observation: "v1";
+    /** OBSERVED-PRESENT, keyed by chant entity name. */
+    resources: Record<string, ResourceMetadata>;
+    /** NOT-OBSERVED, keyed by chant entity name. Omit or leave empty when everything asked about was looked at. */
+    unobserved?: Record<string, UnobservedEntity>;
+}
+/**
+ * What `describeResources()` may return: the bare map (pre-#1089, still valid —
+ * "I looked at everything") or the {@link ObservationResult} envelope.
+ */
+export type DescribeResourcesResult = Record<string, ResourceMetadata> | ObservationResult;
+/** Normalized form every consumer works with. Both maps always present. */
+export interface NormalizedObservation {
+    resources: Record<string, ResourceMetadata>;
+    unobserved: Record<string, UnobservedEntity>;
+}
+/** True when `value` is the versioned {@link ObservationResult} envelope. */
+export declare function isObservationResult(value: unknown): value is ObservationResult;
+/**
+ * Build an {@link ObservationResult}. Lexicons use this rather than writing the
+ * discriminant by hand.
+ */
+export declare function observation(resources: Record<string, ResourceMetadata>, unobserved?: Record<string, UnobservedEntity>): ObservationResult;
+/**
+ * Normalize either accepted return shape. `undefined` (a lexicon that returned
+ * nothing at all) normalizes to two empty maps — which reads as "everything was
+ * observed absent", so callers that mean "the read failed" must say so with
+ * {@link unobservedAll} rather than returning nothing.
+ */
+export declare function normalizeObservation(value: DescribeResourcesResult | undefined): NormalizedObservation;
+/**
+ * Mark every named entity NOT-OBSERVED with one reason — the whole-lexicon
+ * failure case (the provider CLI is missing, the cluster binding refused, the
+ * credentials are gone). Core applies this when `describeResources()` throws,
+ * so a thrown read degrades to an honest "did not look" for each declared
+ * entity instead of an empty map that classifies as N creates.
+ */
+export declare function unobservedAll(names: Iterable<string>, reason: UnobservedReason, detail?: string, types?: Map<string, {
+    entityType: string;
+}> | Record<string, string>): Record<string, UnobservedEntity>;
+/**
+ * Union several observations of the same lexicon (the multi-stack read, where
+ * `describeResources` runs once per stack). Precedence is
+ * present > not-observed > absent: a resource found in any stack is present; an
+ * entity nobody could look at stays not-observed; an entity every reader looked
+ * for and did not find is absent.
+ */
+export declare function mergeObservations(parts: Iterable<NormalizedObservation>): NormalizedObservation;
+/** One-line human phrasing of a reason, for CLI output. */
+export declare function unobservedReasonText(reason: UnobservedReason): string;
+/** `name — reason (detail)`, the shared rendering for CLI and plan output. */
+export declare function formatUnobserved(name: string, entry: UnobservedEntity): string;
+//# sourceMappingURL=observation.d.ts.map

package/dist/observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observation.d.ts","sourceRoot":"","sources":["../src/observation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,UAAU,CAAC;AAEf,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAMzD,CAAC;AAEF,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qBAAqB;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,qGAAqG;IACrG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,+GAA+G;IAC/G,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,iBAAiB,CAAC;AAE3F,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC9C;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAM9E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC5C,iBAAiB,CAMnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,GAAG,qBAAqB,CAMtG;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EACvB,MAAM,EAAE,gBAAgB,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACnE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAYlC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,qBAAqB,CAAC,GAAG,qBAAqB,CAW/F;AAED,2DAA2D;AAC3D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAarE;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAG9E"}

package/dist/stack-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAG1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;wEACoE;IACpE,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;gFAC4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAqBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,EACjC,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACxE,WAAW,CA0Cb"}
+{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAgB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAG1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;wEACoE;IACpE,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;gFAC4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2CD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,EACjC,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACxE,WAAW,CAyCb"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/handlers/components.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, vi, beforeEach } from "vitest";
+import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
 import { createMockPlugin, staticDescribeResources } from "@intentius/chant-test-utils";
 import type { LexiconPlugin, ResourceMetadata } from "../../lexicon";
 import type { BuildResult } from "../../build";
@@ -38,9 +38,13 @@ vi.mock("../../lifecycle/release-ledger", async () => {
   };
 });
 
-vi.mock("../../config", () => ({
-  loadChantConfig: (...args: unknown[]) => loadChantConfigMock(...args),
-}));
+vi.mock("../../config", async () => {
+  const actual = await vi.importActual<typeof import("../../config")>("../../config");
+  return {
+    ...actual,
+    loadChantConfig: (...args: unknown[]) => loadChantConfigMock(...args),
+  };
+});
 
 vi.mock("../../build", () => ({
   build: (...args: unknown[]) => buildMock(...args),
@@ -267,6 +271,61 @@ describe("components handlers", () => {
       expect(rows[0]).toMatchObject({ component: "svc", reconciliation: "reconciled" });
     });
 
+    // #1166 — an environment can declare its own endpoint (a local emulator
+    // like Floci), applied here unless the ambient shell already set it, so
+    // `--live` status doesn't silently read the wrong account.
+    describe("declared endpoint (#1166)", () => {
+      const prevEndpoint = process.env.AWS_ENDPOINT_URL;
+
+      afterEach(() => {
+        if (prevEndpoint === undefined) delete process.env.AWS_ENDPOINT_URL;
+        else process.env.AWS_ENDPOINT_URL = prevEndpoint;
+      });
+
+      test("applies the declared endpoint to AWS_ENDPOINT_URL for the live describe, then restores it", async () => {
+        delete process.env.AWS_ENDPOINT_URL;
+        readReleaseLedgerMock.mockResolvedValue({
+          records: [{
+            version: 1,
+            component: "svc",
+            env: "floci",
+            digest: "sha256:abc",
+            gitSha: "sha1",
+            runId: "run-1",
+            timestamp: "2026-01-01T00:00:00.000Z",
+            actor: "alice",
+          }],
+          malformed: 0,
+        });
+        buildMock.mockResolvedValue(makeBuildResult({ aws: ["svc"] }));
+        loadChantConfigMock.mockResolvedValue({
+          config: { environments: [{ name: "floci", endpoint: "http://localhost:4566" }] },
+        });
+
+        let seenDuringDescribe: string | undefined;
+        const plugins: LexiconPlugin[] = [
+          createMockPlugin({
+            name: "aws",
+            describeResources: async () => {
+              seenDuringDescribe = process.env.AWS_ENDPOINT_URL;
+              return { svc: meta() };
+            },
+          }),
+        ];
+
+        const ctx = {
+          args: makeArgs({ extraPositional: "floci", live: true, json: true }),
+          plugins,
+          serializers: plugins.map((p) => p.serializer),
+        };
+        const exit = await runComponentsStatus(ctx);
+        expect(exit).toBe(0);
+        expect(seenDuringDescribe).toBe("http://localhost:4566");
+        expect(process.env.AWS_ENDPOINT_URL).toBeUndefined();
+        expect(stderrBuf.join("\n")).toMatch(/environment "floci" declares endpoint http:\/\/localhost:4566/);
+      });
+    });
+
     test("--live flags an unrecorded live+owned component", async () => {
       readReleaseLedgerMock.mockResolvedValue({ records: [], malformed: 0 });
       listReleaseEnvironmentsMock.mockResolvedValue(["prod"]);

package/src/cli/handlers/components.ts

@@ -40,11 +40,13 @@ import { buildLedgerEntries, componentBomSummary, type BuildLedgerEntry } from "
 import { findBuildManifestByArtifactDigest } from "../../lifecycle/build-ledger-store";
 import type { ComponentBomSummary } from "../../lifecycle/build-ledger";
 import { loadChantConfig } from "../../config";
+import { applyLiveEndpoint } from "../../live-endpoint";
 import { build } from "../../build";
 import { discoverComponents } from "../../components/discover";
 import { formatError, formatWarning, formatSuccess, formatBold } from "../format";
 import type { CommandContext } from "../registry";
-import type { ResourceMetadata, LexiconPlugin } from "../../lexicon";
+import type { LexiconPlugin } from "../../lexicon";
+import { normalizeObservation, unobservedAll, type NormalizedObservation } from "../../observation";
 import type { Phase, Component } from "../../components/component";
 
 /**
@@ -177,7 +179,10 @@ interface StatusJsonRow {
   } | null;
   reconciliation: string;
   detail: string;
+  /** Present only when live state was requested AND read (#1089) — see `unobserved`. */
   live?: boolean;
+  /** Why live state could not be read for this component (#1089). Mutually exclusive with `live`. */
+  unobserved?: { reason: string; detail?: string };
   stack?: { name: string; status?: string; healthy?: boolean };
 }
 
@@ -248,7 +253,20 @@ async function observeComponentStacks(
       stacks.map((stack) => observer.describeStackStatus!({ environment, stack }).catch(() => null)),
     );
     const determinate = observed.filter((o): o is NonNullable<typeof o> => o !== null);
-    if (determinate.length === 0) continue;
+    if (determinate.length === 0) {
+      // Every stack read came back indeterminate (the lexicon's own "I cannot
+      // tell" — see describeStackStatus). Record the hole rather than dropping
+      // the component, which would leave a recorded component reading `stale`
+      // (#1089).
+      evidence.set(name, {
+        live: false,
+        unobserved: {
+          reason: "read-failed",
+          detail: `no determinate status for stack(s): ${stacks.join(", ")}`,
+        },
+      });
+      continue;
+    }
     const present = determinate.every((o) => o.present);
     // Surface the (first present, else first) stack's raw status for a richer
     // palette than the reconciliation verdict. One cfn-deploy stack per component
@@ -310,42 +328,66 @@ export async function runComponentsStatus(ctx: CommandContext): Promise<number>
 
     let liveEvidence;
     if (args.live) {
-      const targetSerializers = serializers;
-      const buildResult = await build(resolve(args.src ?? config.sourceDir ?? "."), targetSerializers);
-      const merged: { env: string; entries: import("../../lifecycle/change-set").ChangeSetEntry[] } = { env: environment, entries: [] };
-      for (const plugin of plugins) {
-        if (!plugin.describeResources) continue;
-        const declared = new Set<string>();
-        const entities = new Map<string, { entityType: string; props: Record<string, unknown> }>();
-        for (const [name, entity] of buildResult.entities) {
-          if (entity.lexicon === plugin.name) {
-            declared.add(name);
-            entities.set(name, {
-              entityType: entity.entityType,
-              props: ("props" in entity && entity.props != null ? entity.props : {}) as Record<string, unknown>,
-            });
+      // #1166 — an environment can declare its own endpoint (a local emulator
+      // like Floci), applied here unless the ambient shell already set it, so
+      // `--live` status doesn't silently read the wrong account per environment.
+      const endpointResult = applyLiveEndpoint(
+        config.environments,
+        environment,
+        plugins.filter((p) => p.describeResources || p.describeStackStatus).map((p) => p.name),
+      );
+      if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
+      try {
+        const targetSerializers = serializers;
+        const buildResult = await build(resolve(args.src ?? config.sourceDir ?? "."), targetSerializers);
+        const merged: { env: string; entries: import("../../lifecycle/change-set").ChangeSetEntry[] } = { env: environment, entries: [] };
+        for (const plugin of plugins) {
+          if (!plugin.describeResources) continue;
+          const declared = new Set<string>();
+          const entities = new Map<string, { entityType: string; props: Record<string, unknown> }>();
+          for (const [name, entity] of buildResult.entities) {
+            if (entity.lexicon === plugin.name) {
+              declared.add(name);
+              entities.set(name, {
+                entityType: entity.entityType,
+                props: ("props" in entity && entity.props != null ? entity.props : {}) as Record<string, unknown>,
+              });
+            }
           }
+          let observed: NormalizedObservation;
+          try {
+            observed = normalizeObservation(
+              await plugin.describeResources({ environment, buildOutput: "", entityNames: Array.from(declared), entities }),
+            );
+          } catch (err) {
+            // A failed read is not an empty environment (#1089): mark every
+            // declared entity NOT-OBSERVED so the status rows say "unknown"
+            // rather than "stale" (recorded, and nothing live).
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(formatWarning({ message: `${plugin.name}: describeResources failed — ${message} (components in this lexicon report unknown, not stale)` }));
+            observed = { resources: {}, unobserved: unobservedAll(declared, "read-failed", message, entities) };
+          }
+          const cs = buildChangeSet(environment, {
+            declared,
+            observedNow: observed.resources,
+            observedThen: undefined,
+            unobserved: observed.unobserved,
+          });
+          merged.entries.push(...cs.entries);
         }
-        let observedNow: Record<string, ResourceMetadata>;
-        try {
-          observedNow = await plugin.describeResources({ environment, buildOutput: "", entityNames: Array.from(declared), entities });
-        } catch (err) {
-          console.error(formatWarning({ message: `${plugin.name}: describeResources failed — ${err instanceof Error ? err.message : String(err)}` }));
-          continue;
-        }
-        const cs = buildChangeSet(environment, { declared, observedNow, observedThen: undefined });
-        merged.entries.push(...cs.entries);
-      }
-      liveEvidence = liveEvidenceFromChangeSet(merged, liveNameMapping);
+        liveEvidence = liveEvidenceFromChangeSet(merged, liveNameMapping);
 
-      // Multi-stack component projects (each component owns its own stack) are
-      // invisible to the entity-keyed, single-stack `describeResources` above —
-      // observe each component's own cfn-deploy stack directly and overlay it as
-      // the authoritative presence signal (#57).
-      const stackObserver = plugins.find((p) => p.describeStackStatus);
-      if (stackObserver) {
-        const stackEvidence = await observeComponentStacks(discovery.components, stackObserver, environment);
-        liveEvidence = mergeLiveEvidence(liveEvidence, stackEvidence);
+        // Multi-stack component projects (each component owns its own stack) are
+        // invisible to the entity-keyed, single-stack `describeResources` above —
+        // observe each component's own cfn-deploy stack directly and overlay it as
+        // the authoritative presence signal (#57).
+        const stackObserver = plugins.find((p) => p.describeStackStatus);
+        if (stackObserver) {
+          const stackEvidence = await observeComponentStacks(discovery.components, stackObserver, environment);
+          liveEvidence = mergeLiveEvidence(liveEvidence, stackEvidence);
+        }
+      } finally {
+        endpointResult.restore();
       }
     }
 
@@ -420,6 +462,7 @@ export async function runComponentsStatus(ctx: CommandContext): Promise<number>
         reconciliation: row.reconciliation,
         detail: row.detail,
         ...(row.live !== undefined ? { live: row.live } : {}),
+        ...(row.unobserved ? { unobserved: row.unobserved } : {}),
         ...(row.stack ? { stack: row.stack } : {}),
       });
     }