@intentius/chant-lexicon-fly 0.18.6 → 0.18.8

package/dist/index.d.ts

@@ -4,6 +4,6 @@ export { Fly, Region, OrgSlug, AppName, PseudoParameter } from "./pseudo.js";
 export { FLY_METADATA_OWNERSHIP_KEYS } from "./ownership.js";
 export { flyDeploy, flapsUp, flapsDown, flyApplyStep, LOCAL_FLAPS_ENDPOINT } from "./composites/fly-deploy.js";
 export type { FlyDeployOpts, FlyApplyStepOpts, FlapsStepOpts } from "./composites/fly-deploy.js";
-export { spriteCreate, spriteExec, spriteCheckpoint, spriteRestore, listCheckpoints, spriteDestroy, spritesUp, spritesDown, } from "@intentius/chant/op";
+export { spriteCreate, spriteExec, spriteCheckpoint, spriteRestore, listCheckpoints, spriteDestroy, spriteWriteFile, spriteReadFile, spriteListDir, spriteRemove, spriteApplyNetworkPolicy, spriteApplyServices, spriteTaskCreate, spriteTaskRefresh, spriteTaskRelease, spritesUp, spritesDown, } from "@intentius/chant/op";
 export * from "./generated/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAK1D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC5G,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAM9F,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,aAAa,EACb,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAK7B,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAK1D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC5G,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAM9F,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAK7B,cAAc,mBAAmB,CAAC"}

package/dist/op/activities/emulator-images.d.ts

@@ -16,5 +16,5 @@
 /** Pinned mudflaps (Fly Machines / flaps emulator) image. */
 export declare const MUDFLAPS_IMAGE = "ghcr.io/intentius/mudflaps:0.4.0";
 /** Pinned spritzer (Fly Sprites emulator) image. */
-export declare const SPRITZER_IMAGE = "ghcr.io/intentius/spritzer:0.3.1";
+export declare const SPRITZER_IMAGE = "ghcr.io/intentius/spritzer:0.4.0";
 //# sourceMappingURL=emulator-images.d.ts.map

package/dist/op/activities/index.d.ts

@@ -11,6 +11,12 @@ export { flapsUp, flapsDown, flapsRunCommand, flapsRmCommand, flapsExistsCommand
 export type { FlapsUpArgs, FlapsDownArgs } from "./flaps.js";
 export { spriteCreate, spriteExec, spriteCheckpoint, spriteRestore, listCheckpoints, spriteDestroy, resolveSpritesEndpoint, defaultSpritesHttp, spriteCreateBody, parseCreateResponse, accumulateExecFrames, parseCheckpointNdjson, pickCheckpointByComment, splitCommand, spriteExecWsUrl, DEFAULT_SPRITES_BASE_URL, } from "./sprites.js";
 export type { SpritesHttp, SpriteCreateArgs, SpriteCreateResult, SpriteExecArgs, SpriteExecResult, SpriteCheckpointArgs, SpriteCheckpointResult, SpriteRestoreArgs, ListCheckpointsArgs, Checkpoint, SpriteDestroyArgs, } from "./sprites.js";
+export { spriteWriteFile, spriteReadFile, spriteListDir, spriteRemove, spriteFsUrl, defaultSpritesRawHttp, } from "./sprite-fs.js";
+export type { SpritesRawHttp, SpriteWriteFileArgs, SpriteReadFileArgs, SpriteReadFileResult, SpriteListDirArgs, SpriteDirEntry, SpriteRemoveArgs, } from "./sprite-fs.js";
+export { spriteApplyNetworkPolicy, spriteApplyServices, validateNetworkRules, networkRulesEqual, validateServices, serviceConfigEqual, } from "./sprite-config.js";
+export type { NetworkRule, SpriteApplyNetworkPolicyArgs, SpriteApplyNetworkPolicyResult, ServiceSpec, SpriteApplyServicesArgs, SpriteApplyServicesResult, } from "./sprite-config.js";
+export { spriteTaskCreate, spriteTaskRefresh, spriteTaskRelease, spriteTasksUrl, spriteTaskUrl, } from "./sprite-tasks.js";
+export type { SpriteTaskCreateArgs, SpriteTaskRefreshArgs, SpriteTaskReleaseArgs, } from "./sprite-tasks.js";
 export { spritesUp, spritesDown, spritesRunCommand, spritesRmCommand, spritesExistsCommand, spritesHealthUrl, spritesEndpoint, } from "./sprites-emulator.js";
 export type { SpritesUpArgs, SpritesDownArgs } from "./sprites-emulator.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,eAAe,EACf,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIlH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAQ1D,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAMnB,OAAO,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,eAAe,EACf,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIlH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAQ1D,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAInB,OAAO,EACL,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,WAAW,EACX,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAMrB,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,WAAW,EACX,4BAA4B,EAC5B,8BAA8B,EAC9B,WAAW,EACX,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/op/activities/sprite-config.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Sprite config reconcile activities (#849) — the two pieces of genuine
+ * desired-state a Sprite carries: its outbound network policy and its background
+ * services. Unlike the sprite itself (an Op primitive with no reconcilable
+ * create body), these are set after create and persist across cold boots, so
+ * chant reconciles typed config against the live Sprite — the `flyApply`
+ * plan→CRUD pattern scoped to one Sprite, not a declarable resource.
+ *
+ * Both use the JSON `SpritesHttp` client from `sprites.ts`; endpoint + bearer
+ * resolution is shared. Validation is pure and runs before any HTTP (invalid
+ * rules / a `needs` cycle throw up front), so a bad config fails the step
+ * cleanly rather than half-applying.
+ *
+ * Scope (v1): network policy is a whole-object replace (converges by
+ * construction); services reconcile is additive + update (create-or-update each
+ * desired service, optionally start). Owned-only prune of stale services is out
+ * of scope — the documented Services REST surface exposes no delete.
+ */
+import { type SpritesHttp } from "./sprites.js";
+/** One outbound rule. Ordered — specificity is positional, so order is significant. */
+export interface NetworkRule {
+    domain: string;
+    action: "allow" | "deny";
+}
+export interface SpriteApplyNetworkPolicyArgs {
+    id: string;
+    /** The complete desired ruleset (whole-object replace). */
+    rules: NetworkRule[];
+    endpoint?: string;
+    token?: string;
+}
+export interface SpriteApplyNetworkPolicyResult {
+    /** True when the live policy differed and was replaced; false when already converged. */
+    changed: boolean;
+}
+/**
+ * Validate a ruleset: every rule needs a non-empty `domain` and an `allow`/`deny`
+ * `action`. Pure; throws on the first offender.
+ */
+export declare function validateNetworkRules(rules: NetworkRule[]): void;
+/** Order-sensitive equality of two rulesets (position is significant). Pure. */
+export declare function networkRulesEqual(a: NetworkRule[], b: NetworkRule[]): boolean;
+/**
+ * Reconcile a Sprite's outbound network policy. GET the live ruleset, and POST
+ * the desired set only when it differs (`GET`/`POST /policy/network`). Returns
+ * whether a change was applied.
+ */
+export declare function spriteApplyNetworkPolicy(args: SpriteApplyNetworkPolicyArgs, signal?: AbortSignal, http?: SpritesHttp): Promise<SpriteApplyNetworkPolicyResult>;
+/** A desired background service. Keyed by `name`; PUT is create-or-update. */
+export interface ServiceSpec {
+    name: string;
+    cmd: string;
+    args?: string[];
+    env?: Record<string, string>;
+    dir?: string;
+    /** Names of services that must start first. */
+    needs?: string[];
+    /** Route the Sprite's public URL to this port. */
+    http_port?: number;
+}
+export interface SpriteApplyServicesArgs {
+    id: string;
+    services: ServiceSpec[];
+    /** Start each service after applying (in dependency order). Default: false. */
+    start?: boolean;
+    endpoint?: string;
+    token?: string;
+}
+export interface SpriteApplyServicesResult {
+    /** Names that were created or updated (converged services are skipped). */
+    applied: string[];
+    /** Names that were started (empty unless `start`). */
+    started: string[];
+}
+/**
+ * Validate a service set: names are unique, every `needs` target exists, and the
+ * dependency graph is acyclic. Pure; throws on the first violation. Returns the
+ * names in a valid start order (dependencies first).
+ */
+export declare function validateServices(services: ServiceSpec[]): string[];
+/** Comparable service config (the fields the reconcile diffs on). Pure. */
+export declare function serviceConfigEqual(a: Partial<ServiceSpec>, b: Partial<ServiceSpec>): boolean;
+/**
+ * Reconcile a Sprite's background services (additive + update). Lists the live
+ * services, then `PUT`s each desired service that is new or changed
+ * (create-or-update by name); when `start` is set, `POST .../start`s them in
+ * dependency order. Converged services are skipped. Owned-only prune is out of
+ * scope (no delete in the Services REST surface).
+ */
+export declare function spriteApplyServices(args: SpriteApplyServicesArgs, signal?: AbortSignal, http?: SpritesHttp): Promise<SpriteApplyServicesResult>;
+//# sourceMappingURL=sprite-config.d.ts.map

package/dist/op/activities/sprite-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sprite-config.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprite-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAA8C,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAYzF,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,8BAA8B;IAC7C,yFAAyF;IACzF,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CAS/D;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,OAAO,CAG7E;AAKD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,4BAA4B,EAClC,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAA4C,GACjD,OAAO,CAAC,8BAA8B,CAAC,CAiBzC;AAID,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sDAAsD;IACtD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,CA0BlE;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAW5F;AAkBD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,uBAAuB,EAC7B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAA4C,GACjD,OAAO,CAAC,yBAAyB,CAAC,CAsCpC"}

package/dist/op/activities/sprite-fs.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Sprite filesystem activities (#848) — imperative file-I/O primitives over the
+ * Sprites filesystem API (`/v1/sprites/{id}/fs/*`). Same category as the
+ * lifecycle activities in `sprites.ts`: runtime-orchestration primitives, no
+ * desired state. They let an Op stage an input file into a sprite and read a
+ * result out without shelling it through `spriteExec` + `cat`/`tee`.
+ *
+ * read/write move raw file bytes in the body (not JSON), so these use a small
+ * raw HTTP client (`SpritesRawHttp`) rather than the JSON `SpritesHttp` the
+ * lifecycle activities use; path/mode/mkdir/recursive ride as query params.
+ * Endpoint + bearer resolution mirror `sprites.ts` — an explicit `endpoint` /
+ * `token` wins, then `SPRITES_BASE_URL` / `SPRITES_API_TOKEN`.
+ */
+/**
+ * Build a `/v1/sprites/{id}/fs/{op}?...` URL. `params` values that are undefined
+ * or empty are dropped so the query only carries what the caller set. Pure.
+ */
+export declare function spriteFsUrl(base: string, id: string, op: "read" | "write" | "list" | "delete", params: Record<string, string | boolean | undefined>): string;
+/**
+ * Injectable raw HTTP client — like `SpritesHttp` but the body is sent verbatim
+ * (a file's bytes as a string), not JSON-encoded, and the response `text` is the
+ * raw body. Tests inject a fake; the default hits `fetch`.
+ */
+export type SpritesRawHttp = (method: string, url: string, body?: string, headers?: Record<string, string>, signal?: AbortSignal) => Promise<{
+    status: number;
+    text: string;
+}>;
+/**
+ * Default `fetch`-based raw client. Sends the body as-is with an
+ * `application/octet-stream` content-type and `Authorization: Bearer <token>`
+ * when a token is set (real Sprites); the fake ignores the token. The token
+ * defaults to `SPRITES_API_TOKEN` at call time. `fetchImpl` is injectable.
+ */
+export declare function defaultSpritesRawHttp(token?: string, fetchImpl?: typeof fetch): SpritesRawHttp;
+export interface SpriteWriteFileArgs {
+    /** Target sprite id (the `name` passed to `spriteCreate`). */
+    id: string;
+    /** Absolute path (or relative to `workingDir`) to write. */
+    path: string;
+    /** File contents. */
+    content: string;
+    /** Octal file mode, e.g. `"0644"`. */
+    mode?: string;
+    /** Create missing parent directories. */
+    mkdir?: boolean;
+    /** Base directory for a relative `path`. */
+    workingDir?: string;
+    endpoint?: string;
+    token?: string;
+}
+export interface SpriteReadFileArgs {
+    id: string;
+    path: string;
+    workingDir?: string;
+    endpoint?: string;
+    token?: string;
+}
+export interface SpriteReadFileResult {
+    content: string;
+}
+export interface SpriteListDirArgs {
+    id: string;
+    path: string;
+    workingDir?: string;
+    endpoint?: string;
+    token?: string;
+}
+/** One directory entry. `type` is `file` or `dir`. */
+export interface SpriteDirEntry {
+    name: string;
+    type: "file" | "dir";
+    size?: number;
+}
+export interface SpriteRemoveArgs {
+    id: string;
+    path: string;
+    /** Remove a directory and its contents. */
+    recursive?: boolean;
+    /** Perform the delete as root. */
+    asRoot?: boolean;
+    workingDir?: string;
+    endpoint?: string;
+    token?: string;
+}
+/** Write a file into the sprite. `PUT /v1/sprites/{id}/fs/write` with raw body. */
+export declare function spriteWriteFile(args: SpriteWriteFileArgs, signal?: AbortSignal, http?: SpritesRawHttp): Promise<Record<string, never>>;
+/** Read a file from the sprite. `GET /v1/sprites/{id}/fs/read` → raw body. */
+export declare function spriteReadFile(args: SpriteReadFileArgs, signal?: AbortSignal, http?: SpritesRawHttp): Promise<SpriteReadFileResult>;
+/** List a directory in the sprite. `GET /v1/sprites/{id}/fs/list` → entry array. */
+export declare function spriteListDir(args: SpriteListDirArgs, signal?: AbortSignal, http?: SpritesRawHttp): Promise<SpriteDirEntry[]>;
+/**
+ * Remove a path in the sprite. `DELETE /v1/sprites/{id}/fs/delete`. Idempotent:
+ * a 404 (already gone) is a no-op, matching `rm -f` and the destroy activity.
+ */
+export declare function spriteRemove(args: SpriteRemoveArgs, signal?: AbortSignal, http?: SpritesRawHttp): Promise<Record<string, never>>;
+//# sourceMappingURL=sprite-fs.d.ts.map

package/dist/op/activities/sprite-fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sprite-fs.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprite-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,EACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,GACnD,MAAM,CAQR;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,cAAc,CAcrG;AAID,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kCAAkC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,mFAAmF;AACnF,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,cAAkD,GACvD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAchC;AAED,8EAA8E;AAC9E,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,cAAkD,GACvD,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED,oFAAoF;AACpF,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,cAAkD,GACvD,OAAO,CAAC,cAAc,EAAE,CAAC,CAU3B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,cAAkD,GACvD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAchC"}

package/dist/op/activities/sprite-tasks.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Sprite keep-alive Tasks activities (#847) — a hold that prevents a Sprite from
+ * pausing while a session runs. While at least one task exists the Sprite stays
+ * active; the hold is refreshed on an interval and released on exit.
+ *
+ * Per the Sprites docs a task carries an `expire` (seconds or a duration string
+ * like `"5m"`/`"1h"`) with a **1-hour max per task**, so a session longer than
+ * that must refresh. The recommended shape is a short expiry refreshed on a
+ * shorter interval — 5-minute expiry / 60-second refresh — released on exit.
+ *
+ * These are the three primitives, not a magic looping hold: a phased Op creates
+ * the task around a session (`spriteTaskCreate`) and releases it after (in the
+ * happy path and in `onFailure`). A worker whose session can outlast the 1-hour
+ * cap wraps its own run in a `spriteTaskRefresh` loop (that ambient loop lives in
+ * the long-running caller, not a single serializable activity — a phased Op has
+ * no single step to hang it on). `spriteTaskRelease` is idempotent so a crash
+ * still frees the Sprite (and the task auto-expires if the release never lands).
+ *
+ * The task REST path is provisional (S6, #766); it mirrors the other endpoints'
+ * `/v1/sprites/{id}/...` shape. URL building is a pure helper so the path can
+ * move without touching callers.
+ */
+import { type SpritesHttp } from "./sprites.js";
+/** The task REST base for a sprite. Pure. */
+export declare function spriteTasksUrl(base: string, id: string): string;
+export declare function spriteTaskUrl(base: string, id: string, name: string): string;
+export interface SpriteTaskCreateArgs {
+    id: string;
+    /** Task name (the key later refresh/release use). */
+    name: string;
+    /** Expiry: seconds (number) or a duration string (`"5m"`, `"1h"`). Max 1h. */
+    expire?: number | string;
+    endpoint?: string;
+    token?: string;
+}
+export interface SpriteTaskRefreshArgs extends SpriteTaskCreateArgs {
+}
+export interface SpriteTaskReleaseArgs {
+    id: string;
+    name: string;
+    endpoint?: string;
+    token?: string;
+}
+/** Create a keep-alive task. `POST /v1/sprites/{id}/tasks`. */
+export declare function spriteTaskCreate(args: SpriteTaskCreateArgs, signal?: AbortSignal, http?: SpritesHttp): Promise<{
+    name: string;
+}>;
+/** Refresh a task's expiry. `PUT /v1/sprites/{id}/tasks/{name}`. */
+export declare function spriteTaskRefresh(args: SpriteTaskRefreshArgs, signal?: AbortSignal, http?: SpritesHttp): Promise<{
+    name: string;
+}>;
+/** Release a task (idempotent; a 404 means already gone). `DELETE /v1/sprites/{id}/tasks/{name}`. */
+export declare function spriteTaskRelease(args: SpriteTaskReleaseArgs, signal?: AbortSignal, http?: SpritesHttp): Promise<Record<string, never>>;
+//# sourceMappingURL=sprite-tasks.d.ts.map

package/dist/op/activities/sprite-tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sprite-tasks.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprite-tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAA8C,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEzF,6CAA6C;AAC7C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAE/D;AACD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;CAAG;AAEtE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+DAA+D;AAC/D,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAA4C,GACjD,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAM3B;AAED,oEAAoE;AACpE,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAA4C,GACjD,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAM3B;AAED,qGAAqG;AACrG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAA4C,GACjD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAOhC"}

package/dist/op/activities/sprites-contract.d.ts

@@ -5,8 +5,8 @@
  * the fly resource surface generates + drift-checks against. The Sprites API
  * (api.sprites.dev) ships no such spec at any conventional path, so there is
  * nothing to diff automatically. This module is the manual stand-in: the exact
- * endpoint set the fly sprite activities (./sprites.ts) depend on, maintained by
- * hand from https://docs.sprites.dev.
+ * endpoint set the fly sprite activities (lifecycle, filesystem, config, tasks)
+ * depend on, maintained by hand from https://docs.sprites.dev.
  *
  * It anchors two fidelity checks:
  *   1. Coverage — every endpoint here must be served by the pinned spritzer
@@ -23,15 +23,19 @@
 /** One endpoint the fly sprite activities call. */
 export interface SpritesEndpoint {
     /** HTTP method, or "WS" for the control-WebSocket exec channel. */
-    method: "GET" | "POST" | "DELETE" | "WS";
+    method: "GET" | "POST" | "PUT" | "DELETE" | "WS";
     /** Path template under the Sprites base, e.g. `/v1/sprites/{id}/checkpoint`. */
     path: string;
-    /** The fly activity that calls it (./sprites.ts export). */
+    /** The fly activity that calls it (an activity module export). */
     activity: string;
 }
 /**
- * The Sprites endpoints ./sprites.ts depends on. Keep in sync with the activity
- * implementations — the unit test asserts every sprite activity is represented.
+ * The Sprites endpoints the fly sprite activities depend on, across the lifecycle
+ * (./sprites.ts), filesystem (./sprite-fs.ts), config reconcile
+ * (./sprite-config.ts), and keep-alive tasks (./sprite-tasks.ts) modules. Keep in
+ * sync with the activity implementations — the unit test asserts every sprite
+ * activity is represented, and the coverage test asserts the pinned spritzer
+ * serves each one.
  */
 export declare const SPRITES_CONTRACT: readonly SpritesEndpoint[];
 /**

package/dist/op/activities/sprites-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sprites-contract.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprites-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IACzC,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAO7C,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAItE;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC,CAE1C"}
+{"version":3,"file":"sprites-contract.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprites-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC;IACjD,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAwB7C,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAItE;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC,CAE1C"}

package/dist/op/activities/sprites-fake.d.ts

@@ -26,6 +26,21 @@ interface StoredCheckpoint {
     is_auto: boolean;
     fs: Record<string, string>;
 }
+interface StoredService {
+    name: string;
+    cmd: string;
+    args?: string[];
+    env?: Record<string, string>;
+    dir?: string;
+    needs?: string[];
+    http_port?: number;
+    state: {
+        name: string;
+        pid: number;
+        status: string;
+        started_at?: string;
+    };
+}
 interface SpriteState {
     id: string;
     status: SpriteStatus;
@@ -37,6 +52,18 @@ interface SpriteState {
     /** Monotonic version counter for `v<N>` ids. */
     version: number;
     policy?: unknown;
+    /** Outbound network policy (whole-object replace via /policy/network). */
+    netPolicy: Array<{
+        domain: string;
+        action: string;
+    }>;
+    /** Background services keyed by name (create-or-update via PUT). */
+    services: Record<string, StoredService>;
+    /** Keep-alive tasks keyed by name; while any exists the sprite stays active. */
+    tasks: Record<string, {
+        name: string;
+        expire?: number | string;
+    }>;
 }
 interface ExecResult {
     stdout: string;
@@ -50,6 +77,16 @@ interface ExecResult {
  * `;` run in order; the exit code is the last segment's (shell `;` semantics).
  */
 export declare function fakeExec(sprite: SpriteState, cmd: string): ExecResult;
+/**
+ * Immediate children of `dir` in a flat `path → contents` map: a key
+ * `${dir}/name` is a file; `${dir}/name/...` contributes the dir `name` once.
+ * Pure — the filesystem-list model for the fake.
+ */
+export declare function fakeListDir(fs: Record<string, string>, dir: string): Array<{
+    name: string;
+    type: "file" | "dir";
+    size?: number;
+}>;
 /**
  * Start the in-process Sprites fake on an ephemeral port. Returns its base
  * `url` (feed it to `SPRITES_BASE_URL`) and a `close()`.

package/dist/op/activities/sprites-fake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sprites-fake.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprites-fake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,KAAK,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpE,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,kFAAkF;IAClF,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAwCrE;AAqCD;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CA4KpF"}
+{"version":3,"file":"sprites-fake.d.ts","sourceRoot":"","sources":["../../../src/op/activities/sprites-fake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,KAAK,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpE,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,kFAAkF;IAClF,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,SAAS,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxC,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CA6CrE;AA4CD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBjI;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CA+TpF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-fly",
-  "version": "0.18.6",
+  "version": "0.18.8",
   "type": "module",
   "files": [
     "src/",
@@ -57,7 +57,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.18.6"
+    "@intentius/chant": "^0.18.8"
   },
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",

package/src/index.ts

@@ -28,6 +28,15 @@ export {
   spriteRestore,
   listCheckpoints,
   spriteDestroy,
+  spriteWriteFile,
+  spriteReadFile,
+  spriteListDir,
+  spriteRemove,
+  spriteApplyNetworkPolicy,
+  spriteApplyServices,
+  spriteTaskCreate,
+  spriteTaskRefresh,
+  spriteTaskRelease,
   spritesUp,
   spritesDown,
 } from "@intentius/chant/op";

package/src/op/activities/emulator-images.ts

@@ -18,4 +18,4 @@
 export const MUDFLAPS_IMAGE = "ghcr.io/intentius/mudflaps:0.4.0";
 
 /** Pinned spritzer (Fly Sprites emulator) image. */
-export const SPRITZER_IMAGE = "ghcr.io/intentius/spritzer:0.3.1";
+export const SPRITZER_IMAGE = "ghcr.io/intentius/spritzer:0.4.0";

package/src/op/activities/index.ts

@@ -85,6 +85,62 @@ export type {
   SpriteDestroyArgs,
 } from "./sprites";
 
+// Sprite filesystem activities (#848) — imperative file I/O over the fs API.
+// `loadActivities(["fly"])` binds these; the step builders live in core.
+export {
+  spriteWriteFile,
+  spriteReadFile,
+  spriteListDir,
+  spriteRemove,
+  spriteFsUrl,
+  defaultSpritesRawHttp,
+} from "./sprite-fs";
+export type {
+  SpritesRawHttp,
+  SpriteWriteFileArgs,
+  SpriteReadFileArgs,
+  SpriteReadFileResult,
+  SpriteListDirArgs,
+  SpriteDirEntry,
+  SpriteRemoveArgs,
+} from "./sprite-fs";
+
+// Sprite config reconcile activities (#849) — the desired-state a Sprite carries:
+// its outbound network policy and its background services. `loadActivities(["fly"])`
+// binds these; the step builders live in core. Apply-activities, not a declarable
+// resource — a Sprite has no build→plan→apply pipeline.
+export {
+  spriteApplyNetworkPolicy,
+  spriteApplyServices,
+  validateNetworkRules,
+  networkRulesEqual,
+  validateServices,
+  serviceConfigEqual,
+} from "./sprite-config";
+export type {
+  NetworkRule,
+  SpriteApplyNetworkPolicyArgs,
+  SpriteApplyNetworkPolicyResult,
+  ServiceSpec,
+  SpriteApplyServicesArgs,
+  SpriteApplyServicesResult,
+} from "./sprite-config";
+
+// Sprite keep-alive Tasks activities (#847) — a hold that stops a Sprite pausing
+// mid-session. `loadActivities(["fly"])` binds these; step builders live in core.
+export {
+  spriteTaskCreate,
+  spriteTaskRefresh,
+  spriteTaskRelease,
+  spriteTasksUrl,
+  spriteTaskUrl,
+} from "./sprite-tasks";
+export type {
+  SpriteTaskCreateArgs,
+  SpriteTaskRefreshArgs,
+  SpriteTaskReleaseArgs,
+} from "./sprite-tasks";
+
 // spritzer (the Sprites API emulator) Docker lifecycle — the twin of mudflaps
 // above. `spritesUp`/`spritesDown` resolve by name so an Op can boot/tear down
 // the emulator as a modeled step; the sprite activities target it via

package/src/op/activities/sprite-config.docker.integration.test.ts

@@ -0,0 +1,98 @@
+import { describe, test, expect, beforeAll, afterAll } from "vitest";
+import { spritesUp, spritesDown } from "./sprites-emulator";
+import { spriteCreate } from "./sprites";
+import { spriteWriteFile, spriteReadFile, spriteListDir, spriteRemove } from "./sprite-fs";
+import { spriteApplyNetworkPolicy, spriteApplyServices } from "./sprite-config";
+import { spriteTaskCreate, spriteTaskRelease } from "./sprite-tasks";
+
+// The filesystem / config-reconcile / keep-alive activities driven against the
+// REAL spritzer image (ghcr.io/intentius/spritzer), booted via `spritesUp` — the
+// twin of the lifecycle docker test. Proves the image serves these endpoints
+// with the same wire shape the in-process fake does. Docker required;
+// deterministically skipped in CI unless SPRITES_DOCKER=1.
+
+const CONTAINER = "chant-spritzer-config-it";
+const PORT = 4294;
+
+let available = false;
+let endpoint = "";
+
+async function inspect(id: string): Promise<{
+  fs: Record<string, string>;
+  netPolicy: Array<{ domain: string; action: string }>;
+  services: Record<string, { state: { status: string } }>;
+  tasks: Record<string, unknown>;
+}> {
+  const res = await fetch(`${endpoint}/v1/sprites/${id}`);
+  return (await res.json()) as never;
+}
+
+beforeAll(async () => {
+  if (process.env.CI && !process.env.SPRITES_DOCKER) {
+    available = false;
+    return;
+  }
+  try {
+    const up = await spritesUp({ name: CONTAINER, port: PORT, timeoutMs: 30_000 });
+    endpoint = up.endpoint;
+    available = true;
+  } catch {
+    available = false;
+  }
+}, 60_000);
+
+afterAll(async () => {
+  if (available) await spritesDown({ name: CONTAINER });
+});
+
+describe("fs / config / tasks activities against real spritzer", () => {
+  test("filesystem round-trips (write → read → list → remove)", async (ctx) => {
+    if (!available) ctx.skip();
+    await spriteCreate({ name: "d-fs", endpoint });
+    await spriteWriteFile({ id: "d-fs", path: "/work/input", content: "hello", endpoint });
+    expect((await spriteReadFile({ id: "d-fs", path: "/work/input", endpoint })).content).toBe("hello");
+    await spriteWriteFile({ id: "d-fs", path: "/work/notes/a", content: "x", endpoint });
+    const list = await spriteListDir({ id: "d-fs", path: "/work", endpoint });
+    expect(list.map((e) => e.name).sort()).toEqual(["input", "notes"]);
+    await spriteRemove({ id: "d-fs", path: "/work/input", endpoint });
+    await expect(spriteReadFile({ id: "d-fs", path: "/work/input", endpoint })).rejects.toThrow(/not found/);
+  });
+
+  test("network policy reconcile converges", async (ctx) => {
+    if (!available) ctx.skip();
+    await spriteCreate({ name: "d-np", endpoint });
+    const rules = [
+      { domain: "api.anthropic.com", action: "allow" as const },
+      { domain: "*", action: "deny" as const },
+    ];
+    expect((await spriteApplyNetworkPolicy({ id: "d-np", rules, endpoint })).changed).toBe(true);
+    expect((await spriteApplyNetworkPolicy({ id: "d-np", rules, endpoint })).changed).toBe(false);
+    expect((await inspect("d-np")).netPolicy).toEqual(rules);
+  });
+
+  test("services reconcile creates + starts in dependency order", async (ctx) => {
+    if (!available) ctx.skip();
+    await spriteCreate({ name: "d-svc", endpoint });
+    const r = await spriteApplyServices({
+      id: "d-svc",
+      start: true,
+      endpoint,
+      services: [
+        { name: "web", cmd: "run-web", needs: ["db"], http_port: 8080 },
+        { name: "db", cmd: "run-db" },
+      ],
+    });
+    expect(r.started).toEqual(["db", "web"]);
+    expect((await inspect("d-svc")).services.web.state.status).toBe("running");
+  });
+
+  test("keep-alive task holds then releases (idempotent)", async (ctx) => {
+    if (!available) ctx.skip();
+    await spriteCreate({ name: "d-task", endpoint });
+    await spriteTaskCreate({ id: "d-task", name: "session", expire: "5m", endpoint });
+    expect(Object.keys((await inspect("d-task")).tasks)).toEqual(["session"]);
+    await spriteTaskRelease({ id: "d-task", name: "session", endpoint });
+    expect(Object.keys((await inspect("d-task")).tasks)).toEqual([]);
+    await expect(spriteTaskRelease({ id: "d-task", name: "session", endpoint })).resolves.toBeDefined();
+  });
+});