@intentius/chant-lexicon-temporal 0.1.18 → 0.1.19

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "ece9208dea0d260b5cd4f98f60ca94899c926f0feba151144ad3744cead23709",
+    "manifest.json": "f2aa4d7464c549279a3a981fec57d9984500a487d1320188f7dd5c0bb4dd194a",
     "meta.json": "c77a3c415993bed3865e07fa6db4fb7b9e87de0afa8d8675f64eadf50f914077",
     "types/index.d.ts": "5216f5256321f084a7c8211ef66ab599f621c74751cc3485cfc2a62502b81e2f",
     "rules/tmp001.ts": "689222211a93716a7e4432f6dd6a2a2ab54020b232049fb602893872585f9978",
@@ -11,5 +11,5 @@
     "skills/chant-temporal.md": "ff929983b33bb420c49ab61851f3799c5610256cb972d6c584792bb98b0cfb22",
     "skills/chant-temporal-ops.md": "7e83bc3e6e63af4ab14b8dc07aa00132d51991cf35b1bca29560d48934bff6dc"
   },
-  "composite": "85f39f3f056d72a2e84243e18a7f9294d0ac12e118c02a08b4a3164068e711bb"
+  "composite": "996205d7000bcb6cddb88e9d6383a5195fc7504010952a727dc550425f186e2e"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "temporal",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "chantVersion": ">=0.1.0",
   "namespace": "Temporal",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-temporal",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "Temporal lexicon for chant — server deployment, namespaces, search attributes, and schedules",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/config.ts

@@ -143,6 +143,16 @@ export const TEMPORAL_ACTIVITY_PROFILES = {
       nonRetryableErrorTypes: ["ArgoSyncFailedError"],
     },
   },
+
+  /**
+   * Organizational policy gate (`policyGate`): build the project and evaluate
+   * `lint.policies`. Deterministic — a violation is the same on every attempt —
+   * so a single attempt, short timeout, no retry. Fails fast in both executors.
+   */
+  policyCheck: {
+    startToCloseTimeout: "5m",
+    retry: { maximumAttempts: 1 },
+  },
 } as const satisfies Record<string, TemporalActivityProfile>;
 
 export interface TemporalWorkerProfile {

package/src/index.ts

@@ -48,5 +48,6 @@ export {
   lifecycleSnapshot,
   shell,
   teardown,
+  policyGate,
 } from "@intentius/chant/op";
 export type { OpConfig, PhaseDefinition, StepDefinition, ActivityStep, GateStep } from "@intentius/chant/op";

package/src/op/activities/index.ts

@@ -30,3 +30,6 @@ export type { NativeApplyArgs, CompensateApplyArgs, ApplyTarget, DeleteMode } fr
 
 export { waitForArgoSync, defaultArgoStatusFetcher, ArgoSyncFailedError } from "./argo";
 export type { WaitForArgoSyncArgs, ArgoAppStatus, ArgoStatusFetcher } from "./argo";
+
+export { policyGate } from "./policy";
+export type { PolicyGateArgs } from "./policy";

package/src/op/activities/policy.test.ts

@@ -0,0 +1,19 @@
+import { describe, test, expect } from "vitest";
+import { resolve } from "node:path";
+import { policyGate } from "./policy";
+
+// The #201 org-policy example: a compliant workload + a policy pack
+// (ORG-COST-CENTER all-envs, ORG-PROD-TLS prod-only). policyGate builds it and
+// runs the policies — passing in dev, blocking in prod.
+const orgPolicySrc = resolve(import.meta.dirname, "../../../../k8s/examples/org-policy/src");
+
+describe("policyGate activity (#201 T4 — gate an apply on policy)", () => {
+  test("passes when policy is satisfied (no env, and dev)", async () => {
+    await expect(policyGate({ path: orgPolicySrc })).resolves.toBeUndefined();
+    await expect(policyGate({ path: orgPolicySrc, env: "dev" })).resolves.toBeUndefined();
+  }, 30_000);
+
+  test("blocks the apply on a prod policy violation", async () => {
+    await expect(policyGate({ path: orgPolicySrc, env: "prod" })).rejects.toThrow(/ORG-PROD-TLS/);
+  }, 30_000);
+});

package/src/op/activities/policy.ts

@@ -0,0 +1,32 @@
+import { ApplicationFailure } from "@temporalio/common";
+import { evaluateProjectPolicies } from "@intentius/chant/lint/policy";
+
+export interface PolicyGateArgs {
+  /** Project/source directory to build and evaluate. Default ".". */
+  path?: string;
+  /** Environment for policy evaluation (falls back to `ownership.env`). */
+  env?: string;
+}
+
+/**
+ * Gate an apply on organizational policy: build the project, run its
+ * `lint.policies` over the resolved resources, and **block** on any violation.
+ * Place it as a step before the apply phase — a violation fails the workflow
+ * (non-retryable; the `policyCheck` profile is single-attempt) so nothing is
+ * applied. A clean evaluation passes through.
+ *
+ * Runs in both executors — it is a plain activity, not a Temporal gate.
+ */
+export async function policyGate(args: PolicyGateArgs, _signal?: AbortSignal): Promise<void> {
+  const { violations, env } = await evaluateProjectPolicies({ path: args.path ?? ".", env: args.env });
+  if (violations.length > 0) {
+    const summary = violations
+      .map((v) => `[${v.checkId}]${v.entity ? ` ${v.entity}:` : ""} ${v.message}`)
+      .join("; ");
+    throw ApplicationFailure.nonRetryable(
+      `Organizational policy blocked the apply — ${violations.length} violation(s): ${summary}`,
+      "PolicyViolation",
+    );
+  }
+  console.log(`[policy] ${env ? `env=${env}: ` : ""}no violations — apply may proceed`);
+}