@intentius/chant-lexicon-fly 0.18.6 → 0.18.7

package/dist/index.d.ts

@@ -4,6 +4,6 @@ export { Fly, Region, OrgSlug, AppName, PseudoParameter } from "./pseudo.js";
 export { FLY_METADATA_OWNERSHIP_KEYS } from "./ownership.js";
 export { flyDeploy, flapsUp, flapsDown, flyApplyStep, LOCAL_FLAPS_ENDPOINT } from "./composites/fly-deploy.js";
 export type { FlyDeployOpts, FlyApplyStepOpts, FlapsStepOpts } from "./composites/fly-deploy.js";
-export { spriteCreate, spriteExec, spriteCheckpoint, spriteRestore, listCheckpoints, spriteDestroy, spritesUp, spritesDown, } from "@intentius/chant/op";
+export { spriteCreate, spriteExec, spriteCheckpoint, spriteRestore, listCheckpoints, spriteDestroy, spriteWriteFile, spriteReadFile, spriteListDir, spriteRemove, spriteApplyNetworkPolicy, spriteApplyServices, spriteTaskCreate, spriteTaskRefresh, spriteTaskRelease, spritesUp, spritesDown, } from "@intentius/chant/op";
 export * from "./generated/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAK1D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC5G,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAM9F,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,aAAa,EACb,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAK7B,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAK1D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC5G,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAM9F,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAK7B,cAAc,mBAAmB,CAAC"}

package/dist/op/activities/index.d.ts

@@ -11,6 +11,12 @@ export { flapsUp, flapsDown, flapsRunCommand, flapsRmCommand, flapsExistsCommand
 export type { FlapsUpArgs, FlapsDownArgs } from "./flaps.js";
 export { spriteCreate, spriteExec, spriteCheckpoint, spriteRestore, listCheckpoints, spriteDestroy, resolveSpritesEndpoint, defaultSpritesHttp, spriteCreateBody, parseCreateResponse, accumulateExecFrames, parseCheckpointNdjson, pickCheckpointByComment, splitCommand, spriteExecWsUrl, DEFAULT_SPRITES_BASE_URL, } from "./sprites.js";
 export type { SpritesHttp, SpriteCreateArgs, SpriteCreateResult, SpriteExecArgs, SpriteExecResult, SpriteCheckpointArgs, SpriteCheckpointResult, SpriteRestoreArgs, ListCheckpointsArgs, Checkpoint, SpriteDestroyArgs, } from "./sprites.js";
+export { spriteWriteFile, spriteReadFile, spriteListDir, spriteRemove, spriteFsUrl, defaultSpritesRawHttp, } from "./sprite-fs.js";
+export type { SpritesRawHttp, SpriteWriteFileArgs, SpriteReadFileArgs, SpriteReadFileResult, SpriteListDirArgs, SpriteDirEntry, SpriteRemoveArgs, } from "./sprite-fs.js";
+export { spriteApplyNetworkPolicy, spriteApplyServices, validateNetworkRules, networkRulesEqual, validateServices, serviceConfigEqual, } from "./sprite-config.js";
+export type { NetworkRule, SpriteApplyNetworkPolicyArgs, SpriteApplyNetworkPolicyResult, ServiceSpec, SpriteApplyServicesArgs, SpriteApplyServicesResult, } from "./sprite-config.js";
+export { spriteTaskCreate, spriteTaskRefresh, spriteTaskRelease, spriteTasksUrl, spriteTaskUrl, } from "./sprite-tasks.js";
+export type { SpriteTaskCreateArgs, SpriteTaskRefreshArgs, SpriteTaskReleaseArgs, } from "./sprite-tasks.js";
 export { spritesUp, spritesDown, spritesRunCommand, spritesRmCommand, spritesExistsCommand, spritesHealthUrl, spritesEndpoint, } from "./sprites-emulator.js";
 export type { SpritesUpArgs, SpritesDownArgs } from "./sprites-emulator.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,eAAe,EACf,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIlH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAQ1D,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAMnB,OAAO,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,eAAe,EACf,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIlH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAQ1D,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAInB,OAAO,EACL,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,WAAW,EACX,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAMrB,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,WAAW,EACX,4BAA4B,EAC5B,8BAA8B,EAC9B,WAAW,EACX,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/op/activities/sprite-config.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Sprite config reconcile activities (#849) — the two pieces of genuine
+ * desired-state a Sprite carries: its outbound network policy and its background
+ * services. Unlike the sprite itself (an Op primitive with no reconcilable
+ * create body), these are set after create and persist across cold boots, so
+ * chant reconciles typed config against the live Sprite — the `flyApply`
+ * plan→CRUD pattern scoped to one Sprite, not a declarable resource.
+ *
+ * Both use the JSON `SpritesHttp` client from `sprites.ts`; endpoint + bearer
+ * resolution is shared. Validation is pure and runs before any HTTP (invalid
+ * rules / a `needs` cycle throw up front), so a bad config fails the step
+ * cleanly rather than half-applying.
+ *
+ * Scope (v1): network policy is a whole-object replace (converges by
+ * construction); services reconcile is additive + update (create-or-update each
+ * desired service, optionally start). Owned-only prune of stale services is out
+ * of scope — the documented Services REST surface exposes no delete.
+ */
+import { type SpritesHttp } from "./sprites.js";
+/** One outbound rule. Ordered — specificity is positional, so order is significant. */
+export interface NetworkRule {
+    domain: string;
+    action: "allow" | "deny";
+}
+export interface SpriteApplyNetworkPolicyArgs {
+    id: string;
+    /** The complete desired ruleset (whole-object replace). */
+    rules: NetworkRule[];
+    endpoint?: string;
+    token?: string;
+}
+export interface SpriteApplyNetworkPolicyResult {
+    /** True when the live policy differed and was replaced; false when already converged. */
+    changed: boolean;
+}
+/**
+ * Validate a ruleset: every rule needs a non-empty `domain` and an `allow`/`deny`
+ * `action`. Pure; throws on the first offender.
+ */
+export declare function validateNetworkRules(rules: NetworkRule[]): void;
+/** Order-sensitive equality of two rulesets (position is significant). Pure. */
+export declare function networkRulesEqual(a: NetworkRule[], b: NetworkRule[]): boolean;
+/**
+ * Reconcile a Sprite's outbound network policy. GET the live ruleset, and POST
+ * the desired set only when it differs (`GET`/`POST /policy/network`). Returns
+ * whether a change was applied.
+ */
+export declare function spriteApplyNetworkPolicy(args: SpriteApplyNetworkPolicyArgs, signal?: AbortSignal, http?: SpritesHttp): Promise<SpriteApplyNetworkPolicyResult>;
+/** A desired background service. Keyed by `name`; PUT is create-or-update. */
+export interface ServiceSpec {
+    name: string;
+    cmd: string;
+    args?: string[];
+    env?: Record<string, string>;
+    dir?: string;
+    /** Names of services that must start first. */
+    needs?: string[];
+    /** Route the Sprite's public URL to this port. */
+    http_port?: number;
+}
+export interface SpriteApplyServicesArgs {
+    id: string;
+    services: ServiceSpec[];
+    /** Start each service after applying (in dependency order). Default: false. */
+    start?: boolean;
+    endpoint?: string;
+    token?: string;
+}
+export interface SpriteApplyServicesResult {
+    /** Names that were created or updated (converged services are skipped). */
+    applied: string[];
+    /** Names that were started (empty unless `start`). */
+    started: string[];
+}
+/**
+ * Validate a service set: names are unique, every `needs` target exists, and the
+ * dependency graph is acyclic. Pure; throws on the first violation. Returns the
+ * names in a valid start order (dependencies first).
+ */
+export declare function validateServices(services: ServiceSpec[]): string[];
+/** Comparable service config (the fields the reconcile diffs on). Pure. */
+export declare function serviceConfigEqual(a: Partial<ServiceSpec>, b: Partial<ServiceSpec>): boolean;
+/**
+ * Reconcile a Sprite's background services (additive + update). Lists the live
+ * services, then `PUT`s each desired service that is new or changed
+ * (create-or-update by name); when `start` is set, `POST .../start`s them in
+ * dependency order. Converged services are skipped. Owned-only prune is out of
+ * scope (no delete in the Services REST surface).
+ */
+export declare function spriteApplyServices(args: SpriteApplyServicesArgs, signal?: AbortSignal, http?: SpritesHttp): Promise<SpriteApplyServicesResult>;
+//# sourceMappingURL=sprite-config.d.ts.map

package/dist/op/activities/sprite-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sprite-config.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprite-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAA8C,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAYzF,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,8BAA8B;IAC7C,yFAAyF;IACzF,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CAS/D;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,OAAO,CAG7E;AAKD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,4BAA4B,EAClC,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAA4C,GACjD,OAAO,CAAC,8BAA8B,CAAC,CAiBzC;AAID,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sDAAsD;IACtD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,CA0BlE;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAW5F;AAkBD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,uBAAuB,EAC7B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAA4C,GACjD,OAAO,CAAC,yBAAyB,CAAC,CAsCpC"}

package/dist/op/activities/sprite-fs.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Sprite filesystem activities (#848) — imperative file-I/O primitives over the
+ * Sprites filesystem API (`/v1/sprites/{id}/fs/*`). Same category as the
+ * lifecycle activities in `sprites.ts`: runtime-orchestration primitives, no
+ * desired state. They let an Op stage an input file into a sprite and read a
+ * result out without shelling it through `spriteExec` + `cat`/`tee`.
+ *
+ * read/write move raw file bytes in the body (not JSON), so these use a small
+ * raw HTTP client (`SpritesRawHttp`) rather than the JSON `SpritesHttp` the
+ * lifecycle activities use; path/mode/mkdir/recursive ride as query params.
+ * Endpoint + bearer resolution mirror `sprites.ts` — an explicit `endpoint` /
+ * `token` wins, then `SPRITES_BASE_URL` / `SPRITES_API_TOKEN`.
+ */
+/**
+ * Build a `/v1/sprites/{id}/fs/{op}?...` URL. `params` values that are undefined
+ * or empty are dropped so the query only carries what the caller set. Pure.
+ */
+export declare function spriteFsUrl(base: string, id: string, op: "read" | "write" | "list" | "delete", params: Record<string, string | boolean | undefined>): string;
+/**
+ * Injectable raw HTTP client — like `SpritesHttp` but the body is sent verbatim
+ * (a file's bytes as a string), not JSON-encoded, and the response `text` is the
+ * raw body. Tests inject a fake; the default hits `fetch`.
+ */
+export type SpritesRawHttp = (method: string, url: string, body?: string, headers?: Record<string, string>, signal?: AbortSignal) => Promise<{
+    status: number;
+    text: string;
+}>;
+/**
+ * Default `fetch`-based raw client. Sends the body as-is with an
+ * `application/octet-stream` content-type and `Authorization: Bearer <token>`
+ * when a token is set (real Sprites); the fake ignores the token. The token
+ * defaults to `SPRITES_API_TOKEN` at call time. `fetchImpl` is injectable.
+ */
+export declare function defaultSpritesRawHttp(token?: string, fetchImpl?: typeof fetch): SpritesRawHttp;
+export interface SpriteWriteFileArgs {
+    /** Target sprite id (the `name` passed to `spriteCreate`). */
+    id: string;
+    /** Absolute path (or relative to `workingDir`) to write. */
+    path: string;
+    /** File contents. */
+    content: string;
+    /** Octal file mode, e.g. `"0644"`. */
+    mode?: string;
+    /** Create missing parent directories. */
+    mkdir?: boolean;
+    /** Base directory for a relative `path`. */
+    workingDir?: string;
+    endpoint?: string;
+    token?: string;
+}
+export interface SpriteReadFileArgs {
+    id: string;
+    path: string;
+    workingDir?: string;
+    endpoint?: string;
+    token?: string;
+}
+export interface SpriteReadFileResult {
+    content: string;
+}
+export interface SpriteListDirArgs {
+    id: string;
+    path: string;
+    workingDir?: string;
+    endpoint?: string;
+    token?: string;
+}
+/** One directory entry. `type` is `file` or `dir`. */
+export interface SpriteDirEntry {
+    name: string;
+    type: "file" | "dir";
+    size?: number;
+}
+export interface SpriteRemoveArgs {
+    id: string;
+    path: string;
+    /** Remove a directory and its contents. */
+    recursive?: boolean;
+    /** Perform the delete as root. */
+    asRoot?: boolean;
+    workingDir?: string;
+    endpoint?: string;
+    token?: string;
+}
+/** Write a file into the sprite. `PUT /v1/sprites/{id}/fs/write` with raw body. */
+export declare function spriteWriteFile(args: SpriteWriteFileArgs, signal?: AbortSignal, http?: SpritesRawHttp): Promise<Record<string, never>>;
+/** Read a file from the sprite. `GET /v1/sprites/{id}/fs/read` → raw body. */
+export declare function spriteReadFile(args: SpriteReadFileArgs, signal?: AbortSignal, http?: SpritesRawHttp): Promise<SpriteReadFileResult>;
+/** List a directory in the sprite. `GET /v1/sprites/{id}/fs/list` → entry array. */
+export declare function spriteListDir(args: SpriteListDirArgs, signal?: AbortSignal, http?: SpritesRawHttp): Promise<SpriteDirEntry[]>;
+/**
+ * Remove a path in the sprite. `DELETE /v1/sprites/{id}/fs/delete`. Idempotent:
+ * a 404 (already gone) is a no-op, matching `rm -f` and the destroy activity.
+ */
+export declare function spriteRemove(args: SpriteRemoveArgs, signal?: AbortSignal, http?: SpritesRawHttp): Promise<Record<string, never>>;
+//# sourceMappingURL=sprite-fs.d.ts.map

package/dist/op/activities/sprite-fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sprite-fs.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprite-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,EACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,GACnD,MAAM,CAQR;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,cAAc,CAcrG;AAID,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kCAAkC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,mFAAmF;AACnF,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,cAAkD,GACvD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAchC;AAED,8EAA8E;AAC9E,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,cAAkD,GACvD,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED,oFAAoF;AACpF,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,cAAkD,GACvD,OAAO,CAAC,cAAc,EAAE,CAAC,CAU3B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,cAAkD,GACvD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAchC"}

package/dist/op/activities/sprite-tasks.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Sprite keep-alive Tasks activities (#847) — a hold that prevents a Sprite from
+ * pausing while a session runs. While at least one task exists the Sprite stays
+ * active; the hold is refreshed on an interval and released on exit.
+ *
+ * Per the Sprites docs a task carries an `expire` (seconds or a duration string
+ * like `"5m"`/`"1h"`) with a **1-hour max per task**, so a session longer than
+ * that must refresh. The recommended shape is a short expiry refreshed on a
+ * shorter interval — 5-minute expiry / 60-second refresh — released on exit.
+ *
+ * These are the three primitives, not a magic looping hold: a phased Op creates
+ * the task around a session (`spriteTaskCreate`) and releases it after (in the
+ * happy path and in `onFailure`). A worker whose session can outlast the 1-hour
+ * cap wraps its own run in a `spriteTaskRefresh` loop (that ambient loop lives in
+ * the long-running caller, not a single serializable activity — a phased Op has
+ * no single step to hang it on). `spriteTaskRelease` is idempotent so a crash
+ * still frees the Sprite (and the task auto-expires if the release never lands).
+ *
+ * The task REST path is provisional (S6, #766); it mirrors the other endpoints'
+ * `/v1/sprites/{id}/...` shape. URL building is a pure helper so the path can
+ * move without touching callers.
+ */
+import { type SpritesHttp } from "./sprites.js";
+/** The task REST base for a sprite. Pure. */
+export declare function spriteTasksUrl(base: string, id: string): string;
+export declare function spriteTaskUrl(base: string, id: string, name: string): string;
+export interface SpriteTaskCreateArgs {
+    id: string;
+    /** Task name (the key later refresh/release use). */
+    name: string;
+    /** Expiry: seconds (number) or a duration string (`"5m"`, `"1h"`). Max 1h. */
+    expire?: number | string;
+    endpoint?: string;
+    token?: string;
+}
+export interface SpriteTaskRefreshArgs extends SpriteTaskCreateArgs {
+}
+export interface SpriteTaskReleaseArgs {
+    id: string;
+    name: string;
+    endpoint?: string;
+    token?: string;
+}
+/** Create a keep-alive task. `POST /v1/sprites/{id}/tasks`. */
+export declare function spriteTaskCreate(args: SpriteTaskCreateArgs, signal?: AbortSignal, http?: SpritesHttp): Promise<{
+    name: string;
+}>;
+/** Refresh a task's expiry. `PUT /v1/sprites/{id}/tasks/{name}`. */
+export declare function spriteTaskRefresh(args: SpriteTaskRefreshArgs, signal?: AbortSignal, http?: SpritesHttp): Promise<{
+    name: string;
+}>;
+/** Release a task (idempotent; a 404 means already gone). `DELETE /v1/sprites/{id}/tasks/{name}`. */
+export declare function spriteTaskRelease(args: SpriteTaskReleaseArgs, signal?: AbortSignal, http?: SpritesHttp): Promise<Record<string, never>>;
+//# sourceMappingURL=sprite-tasks.d.ts.map

package/dist/op/activities/sprite-tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sprite-tasks.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprite-tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAA8C,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEzF,6CAA6C;AAC7C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAE/D;AACD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;CAAG;AAEtE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+DAA+D;AAC/D,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAA4C,GACjD,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAM3B;AAED,oEAAoE;AACpE,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAA4C,GACjD,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAM3B;AAED,qGAAqG;AACrG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAA4C,GACjD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAOhC"}

package/dist/op/activities/sprites-fake.d.ts

@@ -26,6 +26,21 @@ interface StoredCheckpoint {
     is_auto: boolean;
     fs: Record<string, string>;
 }
+interface StoredService {
+    name: string;
+    cmd: string;
+    args?: string[];
+    env?: Record<string, string>;
+    dir?: string;
+    needs?: string[];
+    http_port?: number;
+    state: {
+        name: string;
+        pid: number;
+        status: string;
+        started_at?: string;
+    };
+}
 interface SpriteState {
     id: string;
     status: SpriteStatus;
@@ -37,6 +52,18 @@ interface SpriteState {
     /** Monotonic version counter for `v<N>` ids. */
     version: number;
     policy?: unknown;
+    /** Outbound network policy (whole-object replace via /policy/network). */
+    netPolicy: Array<{
+        domain: string;
+        action: string;
+    }>;
+    /** Background services keyed by name (create-or-update via PUT). */
+    services: Record<string, StoredService>;
+    /** Keep-alive tasks keyed by name; while any exists the sprite stays active. */
+    tasks: Record<string, {
+        name: string;
+        expire?: number | string;
+    }>;
 }
 interface ExecResult {
     stdout: string;
@@ -50,6 +77,16 @@ interface ExecResult {
  * `;` run in order; the exit code is the last segment's (shell `;` semantics).
  */
 export declare function fakeExec(sprite: SpriteState, cmd: string): ExecResult;
+/**
+ * Immediate children of `dir` in a flat `path → contents` map: a key
+ * `${dir}/name` is a file; `${dir}/name/...` contributes the dir `name` once.
+ * Pure — the filesystem-list model for the fake.
+ */
+export declare function fakeListDir(fs: Record<string, string>, dir: string): Array<{
+    name: string;
+    type: "file" | "dir";
+    size?: number;
+}>;
 /**
  * Start the in-process Sprites fake on an ephemeral port. Returns its base
  * `url` (feed it to `SPRITES_BASE_URL`) and a `close()`.

package/dist/op/activities/sprites-fake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sprites-fake.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprites-fake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,KAAK,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpE,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,kFAAkF;IAClF,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAwCrE;AAqCD;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CA4KpF"}
+{"version":3,"file":"sprites-fake.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprites-fake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,KAAK,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpE,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,kFAAkF;IAClF,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,SAAS,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxC,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CA6CrE;AA4CD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBjI;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CA+TpF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-fly",
-  "version": "0.18.6",
+  "version": "0.18.7",
   "type": "module",
   "files": [
     "src/",
@@ -57,7 +57,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.18.6"
+    "@intentius/chant": "^0.18.7"
   },
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",

package/src/index.ts

@@ -28,6 +28,15 @@ export {
   spriteRestore,
   listCheckpoints,
   spriteDestroy,
+  spriteWriteFile,
+  spriteReadFile,
+  spriteListDir,
+  spriteRemove,
+  spriteApplyNetworkPolicy,
+  spriteApplyServices,
+  spriteTaskCreate,
+  spriteTaskRefresh,
+  spriteTaskRelease,
   spritesUp,
   spritesDown,
 } from "@intentius/chant/op";

package/src/op/activities/index.ts

@@ -85,6 +85,62 @@ export type {
   SpriteDestroyArgs,
 } from "./sprites";
 
+// Sprite filesystem activities (#848) — imperative file I/O over the fs API.
+// `loadActivities(["fly"])` binds these; the step builders live in core.
+export {
+  spriteWriteFile,
+  spriteReadFile,
+  spriteListDir,
+  spriteRemove,
+  spriteFsUrl,
+  defaultSpritesRawHttp,
+} from "./sprite-fs";
+export type {
+  SpritesRawHttp,
+  SpriteWriteFileArgs,
+  SpriteReadFileArgs,
+  SpriteReadFileResult,
+  SpriteListDirArgs,
+  SpriteDirEntry,
+  SpriteRemoveArgs,
+} from "./sprite-fs";
+
+// Sprite config reconcile activities (#849) — the desired-state a Sprite carries:
+// its outbound network policy and its background services. `loadActivities(["fly"])`
+// binds these; the step builders live in core. Apply-activities, not a declarable
+// resource — a Sprite has no build→plan→apply pipeline.
+export {
+  spriteApplyNetworkPolicy,
+  spriteApplyServices,
+  validateNetworkRules,
+  networkRulesEqual,
+  validateServices,
+  serviceConfigEqual,
+} from "./sprite-config";
+export type {
+  NetworkRule,
+  SpriteApplyNetworkPolicyArgs,
+  SpriteApplyNetworkPolicyResult,
+  ServiceSpec,
+  SpriteApplyServicesArgs,
+  SpriteApplyServicesResult,
+} from "./sprite-config";
+
+// Sprite keep-alive Tasks activities (#847) — a hold that stops a Sprite pausing
+// mid-session. `loadActivities(["fly"])` binds these; step builders live in core.
+export {
+  spriteTaskCreate,
+  spriteTaskRefresh,
+  spriteTaskRelease,
+  spriteTasksUrl,
+  spriteTaskUrl,
+} from "./sprite-tasks";
+export type {
+  SpriteTaskCreateArgs,
+  SpriteTaskRefreshArgs,
+  SpriteTaskReleaseArgs,
+} from "./sprite-tasks";
+
 // spritzer (the Sprites API emulator) Docker lifecycle — the twin of mudflaps
 // above. `spritesUp`/`spritesDown` resolve by name so an Op can boot/tear down
 // the emulator as a modeled step; the sprite activities target it via

package/src/op/activities/sprite-config.test.ts

@@ -0,0 +1,159 @@
+import { describe, test, expect, beforeAll, afterAll } from "vitest";
+import { loadActivities, type ActivityFn } from "@intentius/chant/op";
+import { createSpritesFake } from "./sprites-fake";
+import { spriteCreate as createImpl } from "./sprites";
+import {
+  spriteApplyNetworkPolicy,
+  spriteApplyServices,
+  validateNetworkRules,
+  networkRulesEqual,
+  validateServices,
+  serviceConfigEqual,
+  type NetworkRule,
+  type ServiceSpec,
+} from "./sprite-config";
+
+// Config reconcile (#849) — pure validators + end-to-end against the in-process
+// fake (S7), no Docker. Network policy is a whole-object replace; services are
+// additive + update, started in dependency order.
+
+let fake: { url: string; close(): Promise<void> };
+let prevBaseUrl: string | undefined;
+
+beforeAll(async () => {
+  fake = await createSpritesFake();
+  prevBaseUrl = process.env.SPRITES_BASE_URL;
+  process.env.SPRITES_BASE_URL = fake.url;
+});
+
+afterAll(async () => {
+  if (prevBaseUrl === undefined) delete process.env.SPRITES_BASE_URL;
+  else process.env.SPRITES_BASE_URL = prevBaseUrl;
+  await fake?.close();
+});
+
+async function inspect(id: string): Promise<{
+  netPolicy: NetworkRule[];
+  services: Record<string, { name: string; needs?: string[]; state: { status: string } }>;
+}> {
+  const res = await fetch(`${fake.url}/v1/sprites/${id}`);
+  return (await res.json()) as never;
+}
+
+describe("network policy validators (pure)", () => {
+  test("validateNetworkRules rejects a bad action / empty domain", () => {
+    expect(() => validateNetworkRules([{ domain: "", action: "allow" }])).toThrow(/missing domain/);
+    expect(() => validateNetworkRules([{ domain: "x", action: "nope" as never }])).toThrow(/allow.*deny/);
+    expect(() => validateNetworkRules([{ domain: "github.com", action: "allow" }])).not.toThrow();
+  });
+  test("networkRulesEqual is order-sensitive", () => {
+    const a: NetworkRule[] = [{ domain: "a", action: "allow" }, { domain: "b", action: "deny" }];
+    expect(networkRulesEqual(a, [...a])).toBe(true);
+    expect(networkRulesEqual(a, [a[1], a[0]])).toBe(false);
+    expect(networkRulesEqual(a, [a[0]])).toBe(false);
+  });
+});
+
+describe("service validators (pure)", () => {
+  test("validateServices returns a dependency-first order", () => {
+    const svcs: ServiceSpec[] = [
+      { name: "web", cmd: "run-web", needs: ["db"] },
+      { name: "db", cmd: "run-db" },
+    ];
+    expect(validateServices(svcs)).toEqual(["db", "web"]);
+  });
+  test("rejects a dangling needs and a cycle and a duplicate", () => {
+    expect(() => validateServices([{ name: "web", cmd: "x", needs: ["db"] }])).toThrow(/not defined/);
+    expect(() =>
+      validateServices([
+        { name: "a", cmd: "x", needs: ["b"] },
+        { name: "b", cmd: "x", needs: ["a"] },
+      ]),
+    ).toThrow(/cycle/);
+    expect(() =>
+      validateServices([
+        { name: "a", cmd: "x" },
+        { name: "a", cmd: "y" },
+      ]),
+    ).toThrow(/duplicate/);
+  });
+  test("serviceConfigEqual ignores undefined-vs-empty noise", () => {
+    expect(serviceConfigEqual({ cmd: "x" }, { cmd: "x", args: [], env: {} })).toBe(true);
+    expect(serviceConfigEqual({ cmd: "x", http_port: 80 }, { cmd: "x" })).toBe(false);
+  });
+});
+
+describe("spriteApplyNetworkPolicy reconcile", () => {
+  test("applies once, converges on re-apply, replaces on change", async () => {
+    await createImpl({ name: "np-1", endpoint: fake.url });
+    const rules: NetworkRule[] = [
+      { domain: "*.github.com", action: "allow" },
+      { domain: "*", action: "deny" },
+    ];
+    expect((await spriteApplyNetworkPolicy({ id: "np-1", rules, endpoint: fake.url })).changed).toBe(true);
+    expect((await inspect("np-1")).netPolicy).toEqual(rules);
+
+    // Idempotent: same ruleset → no change.
+    expect((await spriteApplyNetworkPolicy({ id: "np-1", rules, endpoint: fake.url })).changed).toBe(false);
+
+    // Changed ruleset → replaced.
+    const tighter: NetworkRule[] = [{ domain: "github.com", action: "allow" }, { domain: "*", action: "deny" }];
+    expect((await spriteApplyNetworkPolicy({ id: "np-1", rules: tighter, endpoint: fake.url })).changed).toBe(true);
+    expect((await inspect("np-1")).netPolicy).toEqual(tighter);
+  });
+
+  test("invalid rules throw before any HTTP", async () => {
+    await expect(
+      spriteApplyNetworkPolicy({ id: "np-1", rules: [{ domain: "", action: "allow" }], endpoint: fake.url }),
+    ).rejects.toThrow(/missing domain/);
+  });
+});
+
+describe("spriteApplyServices reconcile", () => {
+  test("creates services, starts them in dependency order, converges on re-apply", async () => {
+    await createImpl({ name: "svc-1", endpoint: fake.url });
+    const services: ServiceSpec[] = [
+      { name: "web", cmd: "run-web", needs: ["db"], http_port: 8080 },
+      { name: "db", cmd: "run-db" },
+    ];
+    const r1 = await spriteApplyServices({ id: "svc-1", services, start: true, endpoint: fake.url });
+    expect(new Set(r1.applied)).toEqual(new Set(["web", "db"]));
+    // Started dependency-first.
+    expect(r1.started).toEqual(["db", "web"]);
+
+    const state = await inspect("svc-1");
+    expect(Object.keys(state.services).sort()).toEqual(["db", "web"]);
+    expect(state.services.web.state.status).toBe("running");
+
+    // Re-apply unchanged → nothing applied.
+    const r2 = await spriteApplyServices({ id: "svc-1", services, endpoint: fake.url });
+    expect(r2.applied).toEqual([]);
+
+    // Change one → only it is re-applied.
+    const changed = services.map((s) => (s.name === "web" ? { ...s, http_port: 9090 } : s));
+    const r3 = await spriteApplyServices({ id: "svc-1", services: changed, endpoint: fake.url });
+    expect(r3.applied).toEqual(["web"]);
+  });
+
+  test("a dependency cycle throws before any HTTP", async () => {
+    await createImpl({ name: "svc-2", endpoint: fake.url });
+    await expect(
+      spriteApplyServices({
+        id: "svc-2",
+        services: [
+          { name: "a", cmd: "x", needs: ["b"] },
+          { name: "b", cmd: "x", needs: ["a"] },
+        ],
+        endpoint: fake.url,
+      }),
+    ).rejects.toThrow(/cycle/);
+  });
+});
+
+describe("config activities resolve by name", () => {
+  test("loadActivities([\"fly\"]) exposes the reconcile activities", async () => {
+    const activities: Map<string, ActivityFn> = await loadActivities(["fly"]);
+    expect(typeof activities.get("spriteApplyNetworkPolicy")).toBe("function");
+    expect(typeof activities.get("spriteApplyServices")).toBe("function");
+  });
+});