@intentius/chant-lexicon-k8s 0.57.0 → 0.59.0

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAcrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGlI,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGxG,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAIhE,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,aAAa,EAAE,UAAU,EACzB,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAC7E,KAAK,EAAE,sBAAsB,EAC7B,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,GAC3D,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,cAAc,EAAE,aAAa,EAC7B,oBAAoB,EAAE,mBAAmB,EACzC,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,EACnD,WAAW,EAAE,UAAU,EAAE,WAAW,EACpC,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,mBAAmB,GAC5G,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAcrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGlI,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAMxD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAIjH,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGxG,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAIhE,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,aAAa,EAAE,UAAU,EACzB,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAC7E,KAAK,EAAE,sBAAsB,EAC7B,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,GAC3D,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,cAAc,EAAE,aAAa,EAC7B,oBAAoB,EAAE,mBAAmB,EACzC,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,EACnD,WAAW,EAAE,UAAU,EAAE,WAAW,EACpC,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,mBAAmB,GAC5G,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "59d95435bd997afca33caae5656b741b07bd149fff54c0e5526f50658fa89533",
+    "manifest.json": "e6462e0737c2379da42f1c15509b9170a0006a5dedacae41cedcd276b19847cb",
     "meta.json": "8b999bc142f448b0b627ecdc9e2388bbe672c8a1f7aae5303135624cf2fe65e3",
     "types/index.d.ts": "5f67de738adb455805e72600948940af9c664283785fb68c9fd8f5ea90d42cc3",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -54,7 +54,7 @@
     "rules/wk8502.ts": "c13813543b4ec42b9b87d2ebfe20bae3e6e954a8d7c4e9387581a753484aa778",
     "rules/wk8503.ts": "4ee80ded81a0b2cff24013b300ee3fcadbfd29e20346b964a97e557afa1147f3",
     "rules/wk8504.ts": "b1dd7689e37f788fb4524c42254d5d99048a38203643a405f25383ac21b74e36",
-    "rules/wk8505.ts": "4384b6ed92372d5995b1debdb0a7573ea342c40d16d94ffcd25b7abfbb3ea685",
+    "rules/wk8505.ts": "b866168e8c8ed55edb5d69666258cdb6c4a2e2db3e41951a59fe54fd7d5bda5b",
     "skills/chant-k8s.md": "222268f9e6b19912ece4b066d8897f009b90a3fe6f14e9c5059d0717e7ee0f82",
     "skills/chant-k8s-patterns.md": "683148e9f0f9da6879bd65d97c82cc29dbff897e31bc11b3c1de654cd6baeea3",
     "skills/chant-k8s-deployment-strategies.md": "c4cc93cba064230567baa755b5a3493dc69bfc6e74a62e1990d12039ffaaf5f8",
@@ -62,8 +62,8 @@
     "skills/chant-k8s-eks.md": "9e953d6a2c39518c4b797a2bf54ff5b4a33530503e5b6d66e35921e8f952432f",
     "skills/chant-k8s-gke.md": "8938840bf9ef5ed58d6333fdd773b3dd54ecaf25a9df35e58f7f5c3355d4928f",
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
-    "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5",
+    "skills/chant-k8s-argo.md": "24c9a85b78a2fc5c6657424baac9cc6d6caff6f47605b8146b2c0082133181cf",
     "skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
   },
-  "composite": "dd244a5bfdea037184159b9ec82b11c6047c37905a28f50ad9f88205e548338b"
+  "composite": "505afb4698c52323d63b02081ac0236e2f96367a213c0259d1b9e9527ba0a7f4"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAyCpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAgB,MAAM,gCAAgC,CAAC;AAGhI,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAyCpD,CAAC"}

package/dist/lint/audit-lineage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+export declare const k8sAuditLineage: Record<string, Lineage[]>;
+//# sourceMappingURL=audit-lineage.d.ts.map

package/dist/lint/audit-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAqHrD,CAAC"}

package/dist/lint/post-synth/wk8505.d.ts

@@ -15,7 +15,9 @@
  * invocations, so "no Kustomization in THIS build sets spec.decryption" can
  * mean "wired up in the other build" as easily as "forgotten" — the design
  * doc's §4 explains why no path-to-build-target join exists to tell those
- * apart. Promote to error if that join ever becomes available.
+ * apart. Single-build-root scoped, tracked by chant #1939 as a candidate for
+ * an opt-in project-level mode; promote to error if that join ever becomes
+ * available.
  *
  * Fires only on claims that actually resolved (`problems.length === 0`, via
  * `resolveEncryptedSecretClaims`), not on every raw declaration. An

package/dist/lint/post-synth/wk8505.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wk8505.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8505.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAa9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}
+{"version":3,"file":"wk8505.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8505.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAa9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/okf/index.md

@@ -279,4 +279,4 @@ okf_version: '0.2'
 * [WK8502](/rules/WK8502.md) - Custom resource spec field has the wrong type or a value outside its enum
 * [WK8503](/rules/WK8503.md) - Workload consumes a Secret nothing in the output produces — produce it (Secret, ExternalSecret, InfisicalSecret, Certificate) or declare its provenance with...
 * [WK8504](/rules/WK8504.md) - committed-encrypted secret declaration does not resolve — the declared file is missing, is not the named Secret, or is not encrypted
-* [WK8505](/rules/WK8505.md) - committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it
+* [WK8505](/rules/WK8505.md) - committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it. Sees one build roo...

package/dist/okf/rules/WK8505.md

@@ -1,14 +1,14 @@
 ---
 type: post-synth-check
 title: WK8505
-description: 'committed-encrypted secret with no Flux decryption wiring — add decryption: ''sops'' to the FluxAppFor reconciling the path that carries it'
+description: 'committed-encrypted secret with no Flux decryption wiring — add decryption: ''sops'' to the FluxAppFor reconciling the path that carries it. Sees one build root at a time, so it goes silent when that...'
 id: WK8505
 severity: error
 category: post-synth
 lexicon: k8s
 docs: https://intentius.io/chant/lexicons/k8s/rules/
 ---
-committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it
+committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it. Sees one build root at a time, so it goes silent when that Kustomization lives in a different build root (chant #1939).
 
 ## Applies to
 

package/dist/okf/types/Kustomization.md

@@ -18,4 +18,4 @@ resource_type: K8s::Flux::Kustomization
 - [FLUX001](/rules/FLUX001.md): GitRepository must pin spec.ref
 - [FLUX002](/rules/FLUX002.md): Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)
 - [FLUX003](/rules/FLUX003.md): Kustomization.spec.dependsOn entries should name Kustomizations declared in the build
-- [WK8505](/rules/WK8505.md): committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it
+- [WK8505](/rules/WK8505.md): committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it. Sees one build root at a time, so it goes silent when that Kustomization lives in a different build root (chant #1939).

package/dist/op/activities/argo.d.ts

@@ -10,8 +10,8 @@
  * `ResourceFetcher` for `waitForReady`.
  *
  * It stays **dependency-light** — primitives-only signature (app name /
- * namespace / server), no generated Argo CRD types — so a Temporal worker loads
- * it cheaply.
+ * namespace / server), no generated Argo CRD types — so importing the lexicon's
+ * activity module at run time stays cheap.
  */
 export interface WaitForArgoSyncArgs {
     /** Argo Application name. */
@@ -29,7 +29,7 @@ export interface WaitForArgoSyncArgs {
     insecure?: boolean;
     /** kubectl context (used when `server` is not set). */
     context?: string;
-    /** Poll interval in ms (default 15000). Heartbeats every poll. */
+    /** Poll interval in ms (default 15000). */
     intervalMs?: number;
 }
 /** The two status fields the activity gates on. */
@@ -52,7 +52,7 @@ export declare const defaultArgoStatusFetcher: ArgoStatusFetcher;
  * `ArgoSyncFailedError` if it reaches a terminal unhealthy state (Degraded /
  * Missing).
  *
- * Delegates the poll loop, heartbeat, and ready/terminal evaluation to the
+ * Delegates the poll loop and the ready/terminal evaluation to the
  * generic `waitForReady` using the shared `argoproj.io/Application` readiness
  * spec. The Argo `ArgoStatusFetcher` is adapted into a `ResourceFetcher` that
  * shapes `{health, sync}` into the `status.health.status` / `status.sync.status`

package/dist/op/activities/argo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"argo.d.ts","sourceRoot":"","sources":["../../../src/op/activities/argo.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mDAAmD;AACnD,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,4EAA4E;AAC5E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4CD,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,EAAE,iBACkC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,iBAA4C,GACpD,OAAO,CAAC,aAAa,CAAC,CAkCxB"}
+{"version":3,"file":"argo.d.ts","sourceRoot":"","sources":["../../../src/op/activities/argo.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mDAAmD;AACnD,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,4EAA4E;AAC5E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4CD,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,EAAE,iBACkC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,iBAA4C,GACpD,OAAO,CAAC,aAAa,CAAC,CAkCxB"}

package/dist/op/activities/index.d.ts

@@ -1,21 +1,23 @@
 /**
  * k8s Op activities — resolved by the core activity registry when a project's
- * `chant.config.ts` lists the `k8s` lexicon. Relocated from the temporal lexicon
+ * `chant.config.ts` lists the `k8s` lexicon. Relocated from the hosting lexicon
  * (#809) so Kubernetes-facing imperative activities live with their product:
  *   - kubectlApply — server-side apply a rendered manifest (and, since chant
  *     #1075, prune chant-owned objects it no longer declares; `applyManifest`
- *     is the same work with a report of what it did, which is what the
- *     Temporal lexicon's `nativeApply` dispatcher calls for a kubectl target)
+ *     is the same work with a report of what it did, which is what core's
+ *     `nativeApply` dispatcher calls for a kubectl target)
  *   - waitForArgoSync — block until an Argo CD Application is Healthy && Synced
  *
  * k3dUp / k3dDown moved again, to the k3d lexicon (chant #1410) — a lexicon
  * owns its own product's activities, and k3d is its own product now. Projects
  * using them list `k3d` in `lexicons`; loadActivities(["k3d"]) provides them.
  *
- * The step builders (kubectlApply, k3dUp, k3dDown) stay in core, re-exported from
- * the temporal Op-authoring barrel like the other core builders. Each activity is
- * dependency-light — it shells out to a CLI and does not import the k8s declarable
- * surface — so a Temporal worker loads it cheaply.
+ * The step builders (kubectlApply, k3dUp, k3dDown) stay in core and reach
+ * authors through `@intentius/chant/op` like the other core builders. Each
+ * activity is dependency-light — it shells out to a CLI and does not import the
+ * k8s declarable surface — so `loadActivities`
+ * (`packages/core/src/op/activity-registry.ts`), which imports this module at
+ * run time, pulls in nothing expensive.
  */
 export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl.js";
 export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl.js";
@@ -27,4 +29,10 @@ export { waitForReady, defaultResourceFetcher, apiResourceFetcher, ReadinessFail
 export type { WaitForReadyArgs, ResourceFetcher, ReadinessSpec, ReadinessMatch, ConditionMatch, PathMatch, } from "./wait-for-ready.js";
 export { resolveClusterTarget, ClusterBindingMismatchError } from "@intentius/chant/kubectl-context";
 export type { ResolvedClusterTarget, K8sClusterProfile, K8sConfigShape } from "@intentius/chant/kubectl-context";
+export declare const receiptRead: (args: import("@intentius/chant/op/receipt-store").ReceiptReadArgs, signal?: AbortSignal) => Promise<import("@intentius/chant/op/receipt-store").ReceiptReadResult>;
+export declare const receiptWrite: (args: import("@intentius/chant/op/receipt-store").ReceiptWriteArgs, signal?: AbortSignal) => Promise<{
+    written: true;
+    receipt: string;
+}>;
+export declare const receiptStaleness: (args: import("@intentius/chant/op/receipt-store").ReceiptStalenessArgs, signal?: AbortSignal) => Promise<import("@intentius/chant/op/receipt-store").ReceiptStalenessResult>;
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMpG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMpG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAYjH,eAAO,MAAM,WAAW,qKAAqC,CAAC;AAC9D,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,eAAO,MAAM,gBAAgB,+KAA0C,CAAC"}

package/dist/op/activities/kubectl.d.ts

@@ -3,9 +3,9 @@
  *
  * chant #1074 moved this off `kubectl apply -f`. The activity contract is
  * unchanged (a manifest path, an optional context, `Promise<void>`, the
- * `longInfra` profile's 15s heartbeat) because Temporal workers register it by
- * that signature; what changed is underneath. The name is kept for the same
- * reason.
+ * `longInfra` profile) because an Op step names the activity by its export
+ * name and core's registry resolves it there; what changed is underneath. The
+ * name is kept for the same reason.
  *
  * chant #1075 finished the job on two axes:
  *
@@ -35,14 +35,14 @@ import { type K8sConnector } from "../../api/connect.js";
 /**
  * How the apply treats chant-owned objects that are no longer declared. The
  * same three values `nativeApply` has always taken; `gated` differs from
- * `owned-only` only in that the workflow pauses for approval first, which is
- * the composite's business, not this activity's.
+ * `owned-only` only in that an approval gate runs before this activity does,
+ * which is the composite's business, not this activity's.
  */
 export type ApplyDeleteMode = "never" | "owned-only" | "gated";
 export interface KubectlApplyArgs {
     /**
      * Path to a manifest file, or a directory of them. With `documents` given,
-     * this becomes only the human-facing label the heartbeats and logs carry
+     * this becomes only the human-facing label the step's log lines carry
      * (e.g. `kustomize:<dir>`), and nothing is read from disk.
      */
     manifest: string;
@@ -151,7 +151,7 @@ export declare function resolveFieldManager(args: KubectlApplyArgs): Promise<str
 export declare function applyManifest(args: KubectlApplyArgs, signal?: AbortSignal, connect?: K8sConnector): Promise<ApplyManifestResult>;
 /**
  * Apply every document in `args.manifest`.
- * Uses longInfra profile — 20m timeout, heartbeat every 15s.
+ * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
  */
 export declare function kubectlApply(args: KubectlApplyArgs, signal?: AbortSignal, connect?: K8sConnector): Promise<void>;
 //# sourceMappingURL=kubectl.d.ts.map

package/dist/op/activities/kubectl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAYH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAK3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAqHD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAkE9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAWH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAM3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAqHD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAqD9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/op/activities/wait-for-ready.d.ts

@@ -4,8 +4,8 @@ import { type K8sConnector } from "../../api/connect.js";
  * ready, driven by a data-only **readiness spec** rather than per-CRD code.
  *
  * Like `waitForArgoSync`, this activity is intentionally **dependency-light**:
- * its signature is primitives + a plain readiness spec, so a Temporal worker
- * loads it without importing the generated CRD declarable surface. It reads the
+ * its signature is primitives + a plain readiness spec, so the activity module
+ * loads without pulling in the generated CRD declarable surface. It reads the
  * resource and evaluates the spec's predicates. It generalizes the bespoke
  * `waitForArgoSync` / `waitForStack` waits — see #365.
  *
@@ -99,7 +99,7 @@ export interface WaitForReadyArgs {
     group?: string;
     /** Explicit readiness spec — wins over the registry/default. */
     spec?: ReadinessSpec;
-    /** Poll interval in ms (default 15000). Heartbeats every poll. */
+    /** Poll interval in ms (default 15000). */
     intervalMs?: number;
 }
 /** Pluggable resource reader — overridden in tests with a fake. */
@@ -121,8 +121,9 @@ export declare function apiResourceFetcher(connect?: K8sConnector): ResourceFetc
 export declare const defaultResourceFetcher: ResourceFetcher;
 /**
  * Poll until the resource satisfies its readiness spec. Throws
- * `ReadinessFailedError` on a terminal state. Heartbeats every poll so the
- * `k8sWait` profile's 60s heartbeat timeout never trips.
+ * `ReadinessFailedError` on a terminal state, which the `k8sWait` profile lists
+ * as non-retryable, so a resource that will never become ready fails on the
+ * first attempt instead of burning the profile's 15m timeout three times.
  *
  * @param fetcher injectable reader (defaults to kubectl). Tests pass a fake to
  *   drive not-ready → ready / terminal transitions.

package/dist/op/activities/wait-for-ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wait-for-ready.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait-for-ready.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AAIH,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACnC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAEhC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AA4CF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA2C7D,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnF;AAyDD,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAE3F;AAID,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,YAAkC,GAAG,eAAe,CAmC/F;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAAsE,CAAC;AAE5G;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,eAAsC,GAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuBlC"}
+{"version":3,"file":"wait-for-ready.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait-for-ready.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AAIH,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACnC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAEhC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AA4CF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA2C7D,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnF;AAyDD,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAE3F;AAID,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,YAAkC,GAAG,eAAe,CAmC/F;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAAsE,CAAC;AAE5G;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,eAAsC,GAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsBlC"}

package/dist/op/builders.d.ts

@@ -18,20 +18,20 @@
  * earlier step's declared output.
  *
  * `core`'s own `kubectlApply`/`waitForReady`/`ensureSecret` (in
- * `@intentius/chant/op`, re-exported from `@intentius/chant-lexicon-temporal`
- * for lexicon-agnostic single-import convenience) are UNCHANGED and produce
- * byte-identical `ActivityStep` output for the same inputs — these are purely
- * additive. Deliberately not swapped into the temporal barrel: that would
- * make `@intentius/chant-lexicon-temporal` depend on this package (and on
- * helm, for `helmInstall`) at runtime, which is exactly the "a worker image
- * needs no kubectl binary" / "temporal stays product-agnostic" property the
+ * `@intentius/chant/op`, the lexicon-agnostic single-import barrel) are
+ * UNCHANGED and produce byte-identical `ActivityStep` output for the same
+ * inputs — these are purely additive. Deliberately not swapped into core's
+ * barrel: that would make `@intentius/chant` depend on this package (and on
+ * helm, for `helmInstall`) at runtime, so a project that never touches
+ * Kubernetes would install both just to import anything from `op`. That is
+ * exactly the "core stays product-agnostic" property the
  * `op/activities/index.ts` module docs across this repo call out on purpose
- * (activities were moved OUT of temporal into per-product lexicons for this
- * reason; the step-builder layer shouldn't reintroduce the coupling from the
- * other direction). An author who wants the typed surface imports it from
- * here — `@intentius/chant-lexicon-k8s` — which a project using `kubectlApply`
- * already depends on; existing `@intentius/chant-lexicon-temporal` imports
- * keep working exactly as before, opting in only if the import is changed.
+ * (activities live in per-product lexicons for this reason; the step-builder
+ * layer shouldn't reintroduce the coupling from the other direction). An
+ * author who wants the typed surface imports it from here —
+ * `@intentius/chant-lexicon-k8s` — which a project using `kubectlApply`
+ * already depends on; existing `@intentius/chant/op` imports keep working
+ * exactly as before, opting in only if the import is changed.
  */
 import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";
 import type { KubectlApplyArgs } from "./activities/kubectl.js";

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA6BjG,eAAO,MAAM,SAAS,EAAE,aA8sBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA6BjG,eAAO,MAAM,SAAS,EAAE,aA6tBvB,CAAC"}

package/dist/receipt-store.d.ts

@@ -0,0 +1,113 @@
+/**
+ * The k8s `ReceiptStore` (#2074, epic #1703): core's injectable receipt seam
+ * (#1834, `@intentius/chant/op/receipt-store`) implemented over a core
+ * `ConfigMap`, at the address ./effect-receipt-row.ts derives from the
+ * ownership marker fields, plus the plan-side live read of the same rows.
+ *
+ * The transport is the lexicon's own typed client (./api/connect.ts), so a
+ * receipt read and write take the same environment-to-cluster binding
+ * (#1100/#1155), the same credential policy and the same field manager as
+ * every other k8s mutation. No `kubectl` binary is involved.
+ *
+ * Write discipline (epic decision 3): `write` exists for the `effect()` step
+ * alone, because the step's read-compare-run-write is the only path that reaches it,
+ * on success, last. It is a server-side apply as `chant:<stack>`, stamping the
+ * ownership marker labels and {@link RECEIPT_LABEL_KEY}, so a later write
+ * updates the value in place and the owned-only prune retains rather than
+ * deletes it (./op/activities/kubectl.ts).
+ *
+ * Identity: the ConfigMap name needs `<stack>` and `<env>`, which the activity
+ * args deliberately do not carry (the `EffectReceiptRef` is
+ * identity-of-the-effect, not identity-of-the-deployment). The store resolves
+ * them once, lazily, at first use: an explicit option, else `CHANT_ENV` (what
+ * `chant run --env` sets) and the project's `ownership` block, the same fields
+ * that stamp markers (epic decision 4). Nothing resolving is an error, never a
+ * guessed segment.
+ *
+ * Not exported from the package entry point. Like ./secret-store.ts and
+ * ./teardown.ts, this module names the API client, which must stay off the
+ * build path (chant #1074, examples/k8s-client-boundary.test.ts). Consumers
+ * reach it by subpath: `@intentius/chant-lexicon-k8s/receipt-store`.
+ */
+import type { ReceiptStore } from "@intentius/chant/op/receipt-store";
+import type { ResourceMetadata, UnobservedEntity } from "@intentius/chant/lexicon";
+import type { DeepResourceObservation } from "@intentius/chant/deep-observation";
+import type { K8sClient, K8sObject } from "@intentius/chant-k8s-client";
+import { type K8sConnector } from "./api/connect.js";
+import { type RenderedReceiptRow } from "./effect-receipt-row.js";
+/** Options for {@link k8sReceiptStore}. All optional: the default store reads
+ * its identity and its namespace from the project, and its cluster from the
+ * environment binding. */
+export interface K8sReceiptStoreOptions {
+    /** The name's `<stack>` segment. Omitted, the project's `ownership.stack`
+     * (chant.config.ts, found upward from `cwd`) answers. */
+    stack?: string;
+    /** The name's `<env>` segment, explicit by decision 4. Omitted, `CHANT_ENV`
+     * (set by `chant run --env`) answers, then a literal `ownership.env`. */
+    environment?: string;
+    /** Namespace the receipts live in. Omitted, `k8s.receipts.namespace`
+     * answers, then `default`. */
+    namespace?: string;
+    /** Where to look for chant.config.ts. Defaults to the working directory. */
+    cwd?: string;
+    /** Explicit kubectl context, for a caller that already resolved one. */
+    context?: string;
+    /** The connector to build a client with. Test seam. */
+    connect?: K8sConnector;
+    /** Environment record the identity fallback reads. Defaults to `process.env`. */
+    env?: Record<string, string | undefined>;
+}
+/** The stored expectation on a live receipt ConfigMap, or undefined when the
+ * object holds none. */
+export declare function receiptValueOf(object: K8sObject | undefined): string | undefined;
+/**
+ * The `ReceiptStore` over ConfigMaps. Bind it once in the op activities barrel
+ * as `receiptActivities(k8sReceiptStore())`, and the registry resolves
+ * `receiptRead`/`receiptWrite`/`receiptStaleness` by name, exactly like
+ * `ensureSecret` (#1830). Identity and cluster resolve lazily at first use, so
+ * module load never reads the project or connects to anything.
+ */
+export declare function k8sReceiptStore(options?: K8sReceiptStoreOptions): ReceiptStore;
+/** What the observation leg learned about the declared receipt rows. */
+export interface ReceiptRowObservation {
+    resources: Record<string, ResourceMetadata>;
+    unobserved: Record<string, UnobservedEntity>;
+}
+/** The receipt rows a build output carries, keyed by entity name. Only the
+ * entities this observation was asked about. */
+export declare function receiptRowsFor(entityNames: readonly string[], buildOutput: string | undefined): Map<string, RenderedReceiptRow>;
+/**
+ * The plan-side live read of the receipt rows (#2074's observation leg).
+ *
+ * A receipt is not a document the applier ever wrote (#1832), and it carries
+ * no `props` on the declared side, so the generic declared-entity sweep in
+ * ./describe-resources.ts has neither a `metadata.name` to query by nor an
+ * honest verdict to give. The serializer rendered each receipt's derived
+ * ConfigMap address into the build output's receipt comment, so this leg reads
+ * the addresses back from there, one derivation, decision 4, and asks the
+ * cluster for each.
+ *
+ * Present maps the stored value onto `attributes.value` (core's
+ * `RECEIPT_VALUE_ATTRIBUTE`); a genuine 404 is a real absence and stays one; a
+ * failed read is an `unobserved` hole, never a wrong answer: a receipt nobody
+ * could read must not arrive downstream as "the effect never ran".
+ */
+export declare function observeReceiptRows(client: K8sClient, rows: ReadonlyMap<string, RenderedReceiptRow>): Promise<ReceiptRowObservation>;
+/**
+ * The deep read's answer for the receipt rows.
+ *
+ * A receipt is read back here for the same reason the thin path reads it: a
+ * declared entity nobody looked at is a hole, and a hole in the deep read is
+ * noise on every `lifecycle diff --live --deep` a project with receipts runs.
+ * What it deliberately contributes is an EMPTY property tree: the declaration
+ * has no `props`, so every live path would land outside the claimed-field set
+ * (`@intentius/chant/claimed-fields`) and be reported unclaimed, and the
+ * receipt's stored value is not drift on any reading, because a stale receipt is an
+ * `effect` row from `planReceipts` (#1832), never an update. Presence and the
+ * uid are the whole of what the deep read has to say about a receipt.
+ */
+export declare function observeReceiptRowsDeep(client: K8sClient, rows: ReadonlyMap<string, RenderedReceiptRow>): Promise<{
+    resources: Record<string, DeepResourceObservation>;
+    unobserved: Record<string, UnobservedEntity>;
+}>;
+//# sourceMappingURL=receipt-store.d.ts.map

package/dist/receipt-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-store.d.ts","sourceRoot":"","sources":["../src/receipt-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AASH,OAAO,KAAK,EAAoB,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAQL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAE9B;;0BAE0B;AAC1B,MAAM,WAAW,sBAAsB;IACrC;6DACyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;6EACyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;kCAC8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AA+CD;wBACwB;AACxB,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIhF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,YAAY,CAuClF;AAED,wEAAwE;AACxE,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC9C;AAED;gDACgD;AAChD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAUjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAC5C,OAAO,CAAC,qBAAqB,CAAC,CAsChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAC5C,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;CAAE,CAAC,CAW/G"}

package/dist/rules/wk8505.ts

@@ -15,7 +15,9 @@
  * invocations, so "no Kustomization in THIS build sets spec.decryption" can
  * mean "wired up in the other build" as easily as "forgotten" — the design
  * doc's §4 explains why no path-to-build-target join exists to tell those
- * apart. Promote to error if that join ever becomes available.
+ * apart. Single-build-root scoped, tracked by chant #1939 as a candidate for
+ * an opt-in project-level mode; promote to error if that join ever becomes
+ * available.
  *
  * Fires only on claims that actually resolved (`problems.length === 0`, via
  * `resolveEncryptedSecretClaims`), not on every raw declaration. An
@@ -39,7 +41,7 @@ function fluxKustomizations(manifests: K8sManifest[]): K8sManifest[] {
 export const wk8505: PostSynthCheck = {
   id: "WK8505",
   description:
-    "committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it",
+    "committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it. Sees one build root at a time, so it goes silent when that Kustomization lives in a different build root (chant #1939).",
 
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const kustomizations = fluxKustomizations(allManifests(ctx));

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA+MlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAiN3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAyRlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAkO3B,CAAC"}

package/dist/skills/chant-k8s-argo.md

@@ -1,6 +1,6 @@
 ---
 skill: chant-k8s-argo
-description: Argo CD composites for GitOps reconciliation — ArgoAppFor, ArgoAppSetForRegions, AppProject scoping, cluster registration, and the Argo-vs-Temporal split
+description: Argo CD composites for GitOps reconciliation — ArgoAppFor, ArgoAppSetForRegions, AppProject scoping, cluster registration, and how a deploy splits between Argo and a chant Op
 user-invocable: true
 ---
 
@@ -14,9 +14,9 @@ Chant authors typed infrastructure into manifests. Argo CD continuously reconcil
 |---|---|---|
 | **Chant** | Authoring typed infra → manifests | the lexicons |
 | **Argo CD** | Continuously reconciling declarative manifests (the apply layer) | `ArgoAppFor` / `ArgoAppSetForRegions` |
-| **Temporal** | Procedural steps Argo can't express — ordering, signals, human gates, one-shot RPCs | the temporal lexicon + `waitForArgoSync` |
+| **A chant Op** | Procedural steps Argo can't express: ordering, human gates, one-shot RPCs | an `Op` in the project, plus this lexicon's `waitForArgoSync` |
 
-Rule of thumb: **if it's declarative and converges, let Argo reconcile it. If it's a procedure with ordering, gates, or out-of-band steps, orchestrate it in Temporal.** Prefer Argo CD over Argo Workflows — the procedural layer stays Temporal.
+Rule of thumb: **if it's declarative and converges, let Argo reconcile it. If it's a procedure with ordering, gates, or out-of-band steps, write it as a chant Op and run it from CI or a steward.** Prefer Argo CD over Argo Workflows; the procedural layer stays an Op.
 
 ## Prerequisites
 
@@ -138,9 +138,9 @@ Produces a `Secret` labelled `argocd.argoproj.io/secret-type: cluster`. After th
 
 ---
 
-## The Argo-vs-Temporal split
+## Splitting a deploy between Argo and an Op
 
-When a deploy has both declarative and procedural parts, let each layer own what it's good at. Example — the multi-region CockroachDB deploy:
+When a deploy has both declarative and procedural parts, let each layer own what it's good at. Example, the multi-region CockroachDB deploy:
 
 | Step | Owner | Why |
 |---|---|---|
@@ -148,16 +148,30 @@ When a deploy has both declarative and procedural parts, let each layer own what
 | Install ESO / operators (Helm) | **Argo** | Declarative Helm source |
 | Apply per-cluster K8s manifests | **Argo** (`ApplicationSet`) | One App per workload cluster |
 | Wait for workloads Healthy | **Argo** (`Health=Healthy`) | Subsumed by Application health |
-| Wait for DNS delegation | **Temporal** | Signal/update/auto-poll race — out of band |
-| Generate + push TLS certs | **Temporal** | One-shot procedure, secrets not in git |
-| `cockroach init`, configure regions | **Temporal** | Ordered one-shot RPCs |
-
-From a Temporal workflow, gate procedural steps on Argo finishing a declarative apply with the `waitForArgoSync` activity (temporal lexicon, `argoSync` profile):
+| Wait for DNS delegation | **an Op** | Out of band, and a human confirms it |
+| Generate + push TLS certs | **an Op** | One-shot procedure, secrets not in git |
+| `cockroach init`, configure regions | **an Op** | Ordered one-shot RPCs |
+
+Argo owns the sync. The Op owns the ordering and the gates: its phases run in
+sequence in one process (`packages/core/src/op/local-executor.ts`), and a `gate`
+step reads the gate ledger, so a run that reaches a gate nobody has approved
+records the pending fact, ends with status `gated` and exits 3. Someone runs
+`chant approve <op> <gate>`, the next run reads the resolution and walks
+through. CI is what runs the Op, on whatever cadence the Op's `schedule`
+names.
+
+To make a step wait on Argo, use this lexicon's `waitForArgoSync` activity. It is
+exported from `lexicons/k8s/src/op/activities/index.ts`, and the core activity
+registry resolves it by export name once `k8s` is in the project's `lexicons`.
+Give the step core's `argoSync` profile
+(`packages/core/src/op/activity-profiles.ts`): a 30m timeout, five attempts
+backing off from 10s, and `ArgoSyncFailedError` marked non-retryable so a
+terminally unhealthy Application fails fast instead of polling to the cap.
 
 ```typescript
-// In a Temporal Op workflow:
-await waitForArgoSync({ appName: "east-crdb", namespace: "argocd" });
-// ...now run the procedural steps that depend on the workloads being Healthy.
+// In an Op phase:
+activity("waitForArgoSync", { appName: "east-crdb", namespace: "argocd" }, "argoSync"),
+// Later steps in the phase run once the workloads are Healthy.
 ```
 
 `waitForArgoSync` is dependency-free — it polls the Application's status (`health=Healthy && sync=Synced`) and never imports the Argo CRD types.