resource-type-registry git:20260630.d9e89dfA

Immutable. This exact content never changes and is served at /api/v1/blob/a50b14e0d006893e.

---
description: Guardrail for generated resource-type registry YAMLs and their sync scripts. Edit overrides + re-run sync; never hand-edit the generated file.
globs: src/indexers/*_resource_type_registry.yaml,scripts/azure/*_overrides.yaml,scripts/gcp/*_overrides.yaml,scripts/azure/sync_*.py,scripts/gcp/sync_*.py,scripts/azure/*_cloudquery_tables.txt,scripts/gcp/*_cloudquery_tables.txt
alwaysApply: false
---

# Resource-type registry is generated

`src/indexers/*_resource_type_registry.yaml` is produced by
`scripts/<platform>/sync_<platform>_resource_type_registry.py` from three
inputs. **Do not hand-edit the generated YAML.**

## To change a mapping

1. Edit the right input:
   - **Native-type wrong / missing** -> `*_overrides.yaml`
     (`arm_type_overrides` for Azure, `cai_type_overrides` for GCP; use `null`
     when there is no native API equivalent).
   - **Alternate name** -> `aliases` in the overrides. Aliases feed
     `match_names` automatically; add every name generation rules use for the
     type (including divergent forms like the Key Vault SINGULAR
     `azure_keyvault_keyvault`). Use the rarely-needed `match_names` override
     map only for an accepted name that is not a functional alias.
   - **Rich payload wanted** -> add the table to `typed_collectors`.
   - **Service -> API host remap** -> `service_api_hosts` (GCP).
   - **New parity tables** -> refresh the `*_cloudquery_tables.txt` snapshot
     from the CloudQuery hub (record source + version in its header).
2. Regenerate:

```bash
python scripts/gcp/sync_gcp_resource_type_registry.py      # or azure/...
```

3. Review the `added / removed / changed` summary and the YAML diff; commit the
   overrides AND the regenerated YAML together.

## Parity invariant

Every CloudQuery table for the platform must resolve via the registry by
canonical name or alias. The sync `--dry-run` must report 0 drift after your
change. Removing a table from parity requires an explicit reason, not
convenience.

## Accepted-name set (`match_names`) + alias-aware matching

Each entry exposes an explicit **accepted-name set** `match_names` =
`canonical CloudQuery name + aliases (+ optional match_names overrides)`,
generated by the sync script. This is the registry-driven, position-independent
replacement for relying on `aliases[0]` ordering. Both the generation-rule
matcher and selective discovery resolve names through it: a resource matches a
rule if the rule's requested type is **any** of the type's accepted names. The
indexer stores **one** canonical name per resource (today still the legacy
`aliases[0]`; see Phase 2 in
`docs/architecture/resource-type-naming-migration.md`) and matching expands to
the set at lookup. Names unknown to every cloud registry (Kubernetes, custom,
`azure_devops`) fall back to exact-string matching.

**Disjointness invariant:** the union of `match_names` across all entries of a
cloud must be pairwise unique — no accepted name may map to two types. This is
enforced at registry load (`ValueError` on collision) and asserted by
`test_match_names_are_pairwise_disjoint`. If a real collision exists, report it;
do not silently drop a name.