@intentius/chant-lexicon-temporal 0.7.0 → 0.8.0

package/dist/config.d.ts

@@ -0,0 +1,197 @@
+/**
+ * Temporal worker profile — connection configuration for `chant run`.
+ *
+ * Add this to `chant.config.ts` to define how chant connects to Temporal:
+ *
+ * ```ts
+ * import type { TemporalChantConfig } from "@intentius/chant-lexicon-temporal";
+ *
+ * export default {
+ *   lexicons: ["temporal"],
+ *   temporal: {
+ *     profiles: {
+ *       local: {
+ *         address: "localhost:7233",
+ *         namespace: "default",
+ *         taskQueue: "my-deploy",
+ *         autoStart: true,
+ *       },
+ *       cloud: {
+ *         address: "myns.a2dd6.tmprl.cloud:7233",
+ *         namespace: "myns.a2dd6",
+ *         taskQueue: "my-deploy",
+ *         tls: true,
+ *         apiKey: { env: "TEMPORAL_API_KEY" },
+ *       },
+ *     },
+ *     defaultProfile: "local",
+ *   } satisfies TemporalChantConfig,
+ * };
+ * ```
+ *
+ * ChantConfig uses `.passthrough()` in its Zod schema so the `temporal` key
+ * is accepted at runtime without core changes. Issue #8 (`chant run`) will
+ * read these profiles when starting workers.
+ */
+/**
+ * Activity timeout and retry configuration for infrastructure activity groups.
+ *
+ * Pre-built profiles match the four activity groups typically seen in infra workflows:
+ * fast/idempotent operations, long-running infra (GKE, kubectl apply --wait),
+ * K8s wait loops, and human-gate activities.
+ *
+ * @example
+ * ```ts
+ * import { TEMPORAL_ACTIVITY_PROFILES } from "@intentius/chant-lexicon-temporal";
+ * import { proxyActivities } from "@temporalio/workflow";
+ *
+ * const { applyInfra } = proxyActivities<typeof infraActivities>(
+ *   TEMPORAL_ACTIVITY_PROFILES.longInfra
+ * );
+ * ```
+ */
+export interface TemporalActivityProfile {
+    /** Maximum time allowed for a single activity execution attempt. */
+    startToCloseTimeout: string;
+    /**
+     * Time after the last heartbeat before Temporal marks the activity as timed out.
+     * Required for activities that call `activity.heartbeat()` to signal liveness.
+     */
+    heartbeatTimeout?: string;
+    /** Retry policy for failed activity attempts. */
+    retry?: {
+        /** Initial wait before the first retry (e.g. "5s"). */
+        initialInterval?: string;
+        /** Multiplier applied to the interval on each retry (e.g. 2). */
+        backoffCoefficient?: number;
+        /** Maximum number of attempts including the first (0 = unlimited). */
+        maximumAttempts?: number;
+        /** Cap on retry intervals (e.g. "5m"). */
+        maximumInterval?: string;
+        /**
+         * Error names (`Error.name`) that fail immediately without retry. Honored
+         * in both modes: the generated worker spreads this profile into
+         * `proxyActivities`, so Temporal's RetryPolicy uses it; the local executor
+         * reads it directly to short-circuit its retry loop.
+         */
+        nonRetryableErrorTypes?: string[];
+    };
+}
+/**
+ * Named activity profiles for common infrastructure workflow patterns.
+ *
+ * Import and spread into `proxyActivities()` so retry/timeout configuration
+ * lives in the lexicon rather than inline in workflow code.
+ */
+export declare const TEMPORAL_ACTIVITY_PROFILES: {
+    /**
+     * Fast, idempotent operations: `chant build`, `kubectl apply` without `--wait`,
+     * fetching nameservers, reading cluster status.
+     */
+    readonly fastIdempotent: {
+        readonly startToCloseTimeout: "5m";
+        readonly retry: {
+            readonly maximumAttempts: 3;
+            readonly initialInterval: "5s";
+            readonly backoffCoefficient: 2;
+        };
+    };
+    /**
+     * Long-running infra: GKE cluster creation via Config Connector (~10-20 min),
+     * `kubectl apply --wait` for large resource sets, Helm installs.
+     * Must heartbeat; 60 s silence → Temporal marks the activity dead.
+     */
+    readonly longInfra: {
+        readonly startToCloseTimeout: "20m";
+        readonly heartbeatTimeout: "60s";
+        readonly retry: {
+            readonly maximumAttempts: 3;
+            readonly initialInterval: "30s";
+            readonly backoffCoefficient: 2;
+        };
+    };
+    /**
+     * K8s wait loops: polling for StatefulSet rollout, ExternalDNS A-records,
+     * DNS propagation. Medium timeout with heartbeating.
+     */
+    readonly k8sWait: {
+        readonly startToCloseTimeout: "15m";
+        readonly heartbeatTimeout: "60s";
+        readonly retry: {
+            readonly maximumAttempts: 3;
+            readonly initialInterval: "10s";
+            readonly backoffCoefficient: 2;
+        };
+    };
+    /**
+     * Human-gate activities: waiting for an operator action (DNS delegation, approval).
+     * Very long timeout, single attempt — no retry on human-gate timeouts.
+     */
+    readonly humanGate: {
+        readonly startToCloseTimeout: "48h";
+        readonly heartbeatTimeout: "90s";
+        readonly retry: {
+            readonly maximumAttempts: 1;
+        };
+    };
+    /**
+     * Argo CD sync waits: poll an Application until `health=Healthy && sync=Synced`
+     * (`waitForArgoSync`). Long timeout for slow first syncs, 60s heartbeat, cheap
+     * idempotent retries — re-polling is free. A terminal-unhealthy Application
+     * fails fast via `ArgoSyncFailedError` (non-retryable).
+     */
+    readonly argoSync: {
+        readonly startToCloseTimeout: "30m";
+        readonly heartbeatTimeout: "60s";
+        readonly retry: {
+            readonly maximumAttempts: 5;
+            readonly initialInterval: "10s";
+            readonly backoffCoefficient: 2;
+            readonly maximumInterval: "1m";
+            readonly nonRetryableErrorTypes: ["ArgoSyncFailedError"];
+        };
+    };
+    /**
+     * Organizational policy gate (`policyGate`): build the project and evaluate
+     * `lint.policies`. Deterministic — a violation is the same on every attempt —
+     * so a single attempt, short timeout, no retry. Fails fast in both executors.
+     */
+    readonly policyCheck: {
+        readonly startToCloseTimeout: "5m";
+        readonly retry: {
+            readonly maximumAttempts: 1;
+        };
+    };
+};
+export interface TemporalWorkerProfile {
+    /** Temporal server gRPC address. e.g. "localhost:7233" or "myns.a2dd6.tmprl.cloud:7233" */
+    address: string;
+    /** Temporal namespace to connect to */
+    namespace: string;
+    /** Task queue the worker polls */
+    taskQueue: string;
+    /** TLS configuration. Pass `true` or `{}` for Temporal Cloud default TLS */
+    tls?: boolean | {
+        serverNameOverride?: string;
+    };
+    /**
+     * API key for Temporal Cloud authentication.
+     * String value: used as-is (Bearer token).
+     * Object form: reads from process.env at runtime.
+     */
+    apiKey?: string | {
+        env: string;
+    };
+    /**
+     * Automatically start `temporal server start-dev` before the worker.
+     * Only applicable for local development profiles.
+     */
+    autoStart?: boolean;
+}
+export interface TemporalChantConfig {
+    /** Named connection profiles */
+    profiles: Record<string, TemporalWorkerProfile>;
+    /** Profile used when --profile flag is omitted from `chant run` */
+    defaultProfile?: string;
+}
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iDAAiD;IACjD,KAAK,CAAC,EAAE;QACN,uDAAuD;QACvD,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,iEAAiE;QACjE,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,sEAAsE;QACtE,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,0CAA0C;QAC1C,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB;;;;;WAKG;QACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;KACnC,CAAC;CACH;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;IACrC;;;OAGG;;;;;;;;;IAMH;;;;OAIG;;;;;;;;;;IAOH;;;OAGG;;;;;;;;;;IAOH;;;OAGG;;;;;;;;IAOH;;;;;OAKG;;;;;;;;;;;;IAaH;;;;OAIG;;;;;;;CAKuD,CAAC;AAE7D,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,OAAO,GAAG;QAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAChD,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/dist/coverage.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Coverage analysis for the Temporal lexicon.
+ *
+ * All 4 resources are hand-written (no remote spec), so coverage is always
+ * 100% by definition. This module satisfies the lexicon completeness checklist
+ * and provides a consistent interface for the plugin's coverage() lifecycle method.
+ */
+export interface CoverageResult {
+    total: number;
+    covered: number;
+    missing: string[];
+}
+export declare function analyze(): CoverageResult;
+export declare function printCoverageResult(result: CoverageResult, verbose?: boolean): void;
+//# sourceMappingURL=coverage.d.ts.map

package/dist/coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../src/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AASD,wBAAgB,OAAO,IAAI,cAAc,CAMxC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAOnF"}

package/dist/describe-resources.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Live introspection of a Temporal cluster — implements the
+ * LexiconPlugin.describeResources() contract for the temporal lexicon.
+ *
+ * Connects to the cluster identified by the chant config profile that
+ * matches the current environment (falls back to defaultProfile), then lists:
+ *   - Namespaces        via workflowService.listNamespaces
+ *   - SearchAttributes  via operatorService.listSearchAttributes (per namespace)
+ *   - Schedules         via scheduleClient.list (per namespace)
+ *
+ * Results are keyed by server-side identifier (e.g. "namespace/prod",
+ * "searchAttribute/prod/Project", "schedule/prod/daily-report"). Mapping back
+ * to chant entity names is a separate concern (would need entity props passed
+ * through the plugin contract).
+ */
+import type { ResourceMetadata } from "@intentius/chant/lexicon";
+export declare function describeResources(options: {
+    environment: string;
+    buildOutput: string;
+    entityNames: string[];
+    entities: Map<string, {
+        entityType: string;
+        props: Record<string, unknown>;
+    }>;
+}): Promise<Record<string, ResourceMetadata>>;
+//# sourceMappingURL=describe-resources.d.ts.map

package/dist/describe-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAyKjE,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CA8F5C"}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+export { temporalPlugin } from "./plugin.js";
+export { temporalSerializer } from "./serializer.js";
+export { TemporalServer, TemporalNamespace, SearchAttribute, TemporalSchedule, } from "./resources.js";
+export type { TemporalServerProps, TemporalNamespaceProps, SearchAttributeProps, TemporalScheduleProps, } from "./resources.js";
+export type { TemporalWorkerProfile, TemporalChantConfig, TemporalActivityProfile } from "./config.js";
+export { TEMPORAL_ACTIVITY_PROFILES } from "./config.js";
+export { TemporalDevStack } from "./composites/dev-stack.js";
+export type { TemporalDevStackConfig, TemporalDevStackResources } from "./composites/dev-stack.js";
+export { TemporalCloudStack } from "./composites/cloud-stack.js";
+export type { TemporalCloudStackConfig, TemporalCloudStackResources } from "./composites/cloud-stack.js";
+export { WatchOp } from "./composites/watch-op.js";
+export type { WatchOpConfig, WatchOpResources } from "./composites/watch-op.js";
+export { ReconcileOp } from "./composites/reconcile-op.js";
+export type { ReconcileOpConfig, ReconcileOpResources } from "./composites/reconcile-op.js";
+export { WorkflowAuditOp } from "./composites/workflow-audit-op.js";
+export type { WorkflowAuditOpConfig, WorkflowAuditOpResources } from "./composites/workflow-audit-op.js";
+export { PipelineAuditOp } from "./composites/pipeline-audit-op.js";
+export type { PipelineAuditOpConfig, PipelineAuditOpResources } from "./composites/pipeline-audit-op.js";
+export { ApplyOp } from "./composites/apply-op.js";
+export type { ApplyOpConfig, ApplyOpResources } from "./composites/apply-op.js";
+export { Op, phase, activity, gate, build, kubectlApply, helmInstall, waitForStack, gitlabPipeline, lifecycleSnapshot, shell, teardown, policyGate, } from "@intentius/chant/op";
+export type { OpConfig, PhaseDefinition, StepDefinition, ActivityStep, GateStep } from "@intentius/chant/op";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAGrB,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAGtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACtG,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG7E,OAAO,EACL,EAAE,EACF,KAAK,EACL,QAAQ,EACR,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,KAAK,EACL,QAAQ,EACR,UAAU,GACX,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/integrity.json

@@ -1,15 +1,15 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "5f510701c9342dbdb923f794b7ff52507ee58b8fcad4a82e8af40414473a990c",
+    "manifest.json": "e9c0c8af9e76e4da58ae09f016216e46b24533fa5d5b8ff099d6a269a2415992",
     "meta.json": "c77a3c415993bed3865e07fa6db4fb7b9e87de0afa8d8675f64eadf50f914077",
     "types/index.d.ts": "5216f5256321f084a7c8211ef66ab599f621c74751cc3485cfc2a62502b81e2f",
-    "rules/tmp001.ts": "689222211a93716a7e4432f6dd6a2a2ab54020b232049fb602893872585f9978",
-    "rules/tmp002.ts": "a227dc8c9aae16bbb468664a35a199c0880827b15075227c8e26a8c5fe2eff30",
+    "rules/tmp001-retention-too-short.ts": "577d5c4b2b0c26d08c33490d0a1e38606ad6ed7910f78a3e909f50738044e0d9",
+    "rules/tmp002-allowall-without-note.ts": "f08458aa201aff8e56af59451c777baccc38e0e28f6a85bc8089650e9e6c36ce",
     "rules/tmp010-cron-syntax.ts": "47db78e7595bcd24a9a735dfd738e11b2d3d9465e317ae836fb3da8ff74cee63",
-    "rules/tmp011-namespace-reference.ts": "221c7832ab3012c1cf1e3a9f4a7f6fa8958b85b5fc0c75ab9673c920cbc97833",
+    "rules/tmp011-namespace-reference.ts": "95530a6c12c2efb37611c017569da6411f5c58574119a7691871775a472f37f7",
     "skills/chant-temporal.md": "ff929983b33bb420c49ab61851f3799c5610256cb972d6c584792bb98b0cfb22",
     "skills/chant-temporal-ops.md": "7e83bc3e6e63af4ab14b8dc07aa00132d51991cf35b1bca29560d48934bff6dc"
   },
-  "composite": "3afcc5c54d5f49b89fbb35fa657dc7714695660421c84a239ffb6031f2c1e9a5"
+  "composite": "35f023d7ed87211bfc615359e7515ee65d476f18df3e9318d7cc7c1170f5312f"
 }

package/dist/lint/post-synth/index.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const postSynthChecks: PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/post-synth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAMvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAK3C,CAAC"}

package/dist/lint/post-synth/tmp001-retention-too-short.d.ts

@@ -0,0 +1,10 @@
+/**
+ * TMP001: TemporalNamespace retention too short
+ *
+ * Workflow history older than the retention period is permanently deleted.
+ * Retentions shorter than 3 days leave very little time for debugging
+ * failures or running ad-hoc queries against closed workflow executions.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tmp001: PostSynthCheck;
+//# sourceMappingURL=tmp001-retention-too-short.d.ts.map

package/dist/lint/post-synth/tmp001-retention-too-short.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmp001-retention-too-short.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tmp001-retention-too-short.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAW9G,eAAO,MAAM,MAAM,EAAE,cA+BpB,CAAC"}

package/dist/lint/post-synth/tmp002-allowall-without-note.d.ts

@@ -0,0 +1,11 @@
+/**
+ * TMP002: TemporalSchedule AllowAll overlap without explanatory note
+ *
+ * AllowAll allows any number of concurrent schedule runs. This is safe for
+ * idempotent, read-only workflows, but can cause resource exhaustion or
+ * duplicate side-effects if not explicitly intended. Requiring a note forces
+ * the author to document the intent.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tmp002: PostSynthCheck;
+//# sourceMappingURL=tmp002-allowall-without-note.d.ts.map

package/dist/lint/post-synth/tmp002-allowall-without-note.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmp002-allowall-without-note.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tmp002-allowall-without-note.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAE9G,eAAO,MAAM,MAAM,EAAE,cA+BpB,CAAC"}

package/dist/lint/post-synth/tmp010-cron-syntax.d.ts

@@ -0,0 +1,12 @@
+/**
+ * TMP010: TemporalSchedule cron expression syntax
+ *
+ * Validates that cron expressions in TemporalSchedule.spec.cronExpressions
+ * are valid 5- or 6-field cron syntax. Malformed crons are silently ignored
+ * by Temporal's scheduler, leading to schedules that never fire.
+ *
+ * This is a pre-submission guard — final validation is Temporal's own parser.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tmp010: PostSynthCheck;
+//# sourceMappingURL=tmp010-cron-syntax.d.ts.map

package/dist/lint/post-synth/tmp010-cron-syntax.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmp010-cron-syntax.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tmp010-cron-syntax.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAW9G,eAAO,MAAM,MAAM,EAAE,cA0CpB,CAAC"}

package/dist/lint/post-synth/tmp011-namespace-reference.d.ts

@@ -0,0 +1,10 @@
+/**
+ * TMP011: SearchAttribute references an undeclared namespace
+ *
+ * If SearchAttribute.namespace is set to a value X, there must be a
+ * TemporalNamespace entity with name === X in the project. A missing
+ * namespace means the search attribute create command will fail at runtime.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tmp011: PostSynthCheck;
+//# sourceMappingURL=tmp011-namespace-reference.d.ts.map

package/dist/lint/post-synth/tmp011-namespace-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmp011-namespace-reference.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tmp011-namespace-reference.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAE9G,eAAO,MAAM,MAAM,EAAE,cAsCpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "temporal",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Temporal",
   "intrinsics": [],

package/dist/op/activities/apply.d.ts

@@ -0,0 +1,70 @@
+/** The native apply mechanism for a target. */
+export type ApplyTarget = "cloudformation" | "kubectl" | "arm";
+/**
+ * How apply treats resources no longer declared.
+ * - `never` — additive only; never deletes.
+ * - `owned-only` — deletes only chant-owned orphans, via the target's native
+ *   prune/complete mechanism scoped to the ownership marker.
+ * - `gated` — same delete scope as `owned-only`, but the workflow pauses for
+ *   approval before the destructive apply (the gate lives in the composite).
+ */
+export type DeleteMode = "never" | "owned-only" | "gated";
+export interface NativeApplyArgs {
+    /** Native mechanism to delegate to. */
+    target: ApplyTarget;
+    /** Environment — CFN stack name / ARM resource group. */
+    env: string;
+    /** Built manifest/template path (or directory for kubectl). Default: dist. */
+    output?: string;
+    /** Delete handling. Default: never. */
+    deleteMode?: DeleteMode;
+}
+/**
+ * Build the native apply command. Pure — exported for testing.
+ *
+ * Authority stays with the platform: the CloudFormation stack, the Kubernetes
+ * API server, the ARM resource group. chant hosts no state file. Owned-only
+ * deletes ride the native delete path, scoped to the ownership marker so a
+ * foreign resource is never touched:
+ * - kubectl: `--prune --selector <managed-by>=chant` prunes only chant-owned
+ *   objects absent from the apply set.
+ * - CloudFormation: the stack is the boundary; `deploy` deletes resources
+ *   removed from the template within it.
+ * - ARM: `--mode Complete` removes resources not in the template from the RG.
+ */
+export declare function applyCommand(target: ApplyTarget, env: string, output: string, deleteMode: DeleteMode): string;
+/**
+ * Apply declared source to the cloud via the target's native mechanism.
+ * Deletes (when enabled) are limited to chant-owned orphans by construction —
+ * the native prune/complete path is scoped to the ownership marker.
+ */
+export declare function nativeApply(args: NativeApplyArgs, signal?: AbortSignal): Promise<{
+    command: string;
+}>;
+/**
+ * The native rollback command for a target, or undefined when the target has
+ * no single-command rollback. Pure — exported for testing.
+ *
+ * Only CloudFormation has a native "return to last known good state" command.
+ * For kubectl/ARM the caller must supply a rollback command; otherwise the
+ * compensation degrades to a logged warning rather than silently doing nothing.
+ */
+export declare function rollbackCommand(target: ApplyTarget, env: string): string | undefined;
+export interface CompensateApplyArgs {
+    /** Native mechanism that was applied. */
+    target: ApplyTarget;
+    /** Environment — CFN stack name / ARM resource group. */
+    env: string;
+    /** Explicit rollback command, used in preference to the native default. */
+    command?: string;
+}
+/**
+ * Compensation step (saga rollback) for a partial apply failure. Runs the
+ * explicit `command` if given, else the target's native rollback. Where no
+ * automatic rollback exists, it warns rather than silently no-op'ing — partial
+ * state should never look reverted when it isn't.
+ */
+export declare function compensateApply(args: CompensateApplyArgs, signal?: AbortSignal): Promise<{
+    command?: string;
+}>;
+//# sourceMappingURL=apply.d.ts.map

package/dist/op/activities/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/apply.ts"],"names":[],"mappings":"AAMA,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,SAAS,GAAG,KAAK,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACrB,MAAM,CAiBR;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ3G;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQpF;AAED,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAYpH"}

package/dist/op/activities/argo.d.ts

@@ -0,0 +1,56 @@
+/**
+ * waitForArgoSync — block until an Argo CD Application reports
+ * `health=Healthy && sync=Synced`.
+ *
+ * This activity is intentionally **dependency-free**: it must not import the k8s
+ * lexicon or its generated Argo CRD types. Its signature is primitives-only
+ * (app name / namespace / server). It reads the Application's status either via
+ * `kubectl get application` (default) or the Argo CD REST API (when `server` is
+ * given), so Temporal can gate procedural steps on a declarative apply that Argo
+ * owns.
+ */
+export interface WaitForArgoSyncArgs {
+    /** Argo Application name. */
+    appName: string;
+    /** Namespace the Application object lives in (default "argocd"). */
+    namespace?: string;
+    /**
+     * Argo CD API base URL (e.g. https://argocd.example.com). When set, status is
+     * read from the REST API instead of kubectl. Pass `authToken` with it.
+     */
+    server?: string;
+    /** Bearer token for the Argo CD REST API (used with `server`). */
+    authToken?: string;
+    /** Skip TLS verification for the REST API (default false). */
+    insecure?: boolean;
+    /** kubectl context (used when `server` is not set). */
+    context?: string;
+    /** Poll interval in ms (default 15000). Heartbeats every poll. */
+    intervalMs?: number;
+}
+/** The two status fields the activity gates on. */
+export interface ArgoAppStatus {
+    /** Application health: Healthy | Progressing | Degraded | Missing | Suspended | Unknown. */
+    health: string;
+    /** Sync status: Synced | OutOfSync | Unknown. */
+    sync: string;
+}
+/** Pluggable status reader — overridden in tests with a faked Argo API. */
+export type ArgoStatusFetcher = (args: WaitForArgoSyncArgs, signal?: AbortSignal) => Promise<ArgoAppStatus>;
+/** Error thrown when the Application reaches a terminal unhealthy state. */
+export declare class ArgoSyncFailedError extends Error {
+    constructor(message: string);
+}
+/** Default fetcher: REST API when `server` is set, else kubectl. */
+export declare const defaultArgoStatusFetcher: ArgoStatusFetcher;
+/**
+ * Poll until the Application is Healthy and Synced. Throws
+ * `ArgoSyncFailedError` if it reaches a terminal unhealthy state (Degraded /
+ * Missing). Heartbeats every poll so the `argoSync` profile's 60s heartbeat
+ * timeout never trips.
+ *
+ * @param fetcher injectable status reader (defaults to kubectl/REST). Tests pass
+ *   a fake to drive Healthy/Progressing/Degraded transitions.
+ */
+export declare function waitForArgoSync(args: WaitForArgoSyncArgs, signal?: AbortSignal, fetcher?: ArgoStatusFetcher): Promise<ArgoAppStatus>;
+//# sourceMappingURL=argo.d.ts.map

package/dist/op/activities/argo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argo.d.ts","sourceRoot":"","sources":["../../../src/op/activities/argo.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mDAAmD;AACnD,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,aAAa,CAAC,CAAC;AAK5B,4EAA4E;AAC5E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4CD,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,EAAE,iBACkC,CAAC;AAE1E;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,iBAA4C,GACpD,OAAO,CAAC,aAAa,CAAC,CAuBxB"}

package/dist/op/activities/build.d.ts

@@ -0,0 +1,11 @@
+export interface ChantBuildArgs {
+    path: string;
+    /** Optional extra env vars to pass to the build command. */
+    env?: Record<string, string>;
+}
+/**
+ * Run `npm run build` in the given project directory.
+ * Uses fastIdempotent profile — 5m timeout, 3 retries.
+ */
+export declare function chantBuild(args: ChantBuildArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=build.d.ts.map

package/dist/op/activities/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/op/activities/build.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ1F"}

package/dist/op/activities/gitlab.d.ts

@@ -0,0 +1,15 @@
+export interface GitlabPipelineArgs {
+    /** GitLab project name or path (e.g. "group/project"). */
+    name: string;
+    /** Git ref to run the pipeline on. Default: current branch. */
+    ref?: string;
+    /** Poll interval in ms. Default: 30000. */
+    intervalMs?: number;
+}
+/**
+ * Trigger a GitLab CI pipeline and wait for it to complete successfully.
+ * Requires `glab` CLI authenticated in the environment.
+ * Uses longInfra profile — 20m timeout, heartbeat every poll.
+ */
+export declare function gitlabPipeline(args: GitlabPipelineArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=gitlab.d.ts.map

package/dist/op/activities/gitlab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gitlab.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsClG"}

package/dist/op/activities/heartbeat.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Activity heartbeat shim.
+ *
+ * Activities heartbeat so a Temporal worker knows they are still alive. Two
+ * things make a naive `Context.current().heartbeat()` call unsafe outside a
+ * worker:
+ *
+ *   1. `@temporalio/activity` may not be installed at all — chant's local
+ *      executor runs these same activity implementations with no Temporal SDK
+ *      present. A static `import` would make the entire activity library fail
+ *      to load. So we resolve `Context` lazily via dynamic import and cache it.
+ *   2. Even when installed, `Context.current()` throws when called outside an
+ *      activity execution context. We swallow that too.
+ *
+ * Net effect: identical activity code heartbeats under a Temporal worker and
+ * no-ops locally, and the activity library imports cleanly without the SDK.
+ */
+/**
+ * Emit an activity heartbeat if running under a Temporal worker; otherwise no-op.
+ *
+ * The first call kicks off a one-time lazy load of `@temporalio/activity` and
+ * returns immediately; once resolved, subsequent calls heartbeat. Heartbeats
+ * are periodic (every ~15s, well inside the 60s heartbeat timeout), so the
+ * single missed first tick is harmless.
+ */
+export declare function safeHeartbeat(details?: unknown): void;
+//# sourceMappingURL=heartbeat.d.ts.map

package/dist/op/activities/heartbeat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"heartbeat.d.ts","sourceRoot":"","sources":["../../../src/op/activities/heartbeat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAuBH;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAWrD"}

package/dist/op/activities/helm.d.ts

@@ -0,0 +1,18 @@
+export interface HelmInstallArgs {
+    /** Helm release name. */
+    name: string;
+    /** Chart reference (local path or `repo/chart`). */
+    chart: string;
+    /** Path to a values file. */
+    values?: string;
+    /** Kubernetes namespace. */
+    namespace?: string;
+    /** Additional --set arguments. */
+    set?: Record<string, string>;
+}
+/**
+ * Run `helm upgrade --install <name> <chart>`.
+ * Uses longInfra profile — 20m timeout, heartbeat every 15s.
+ */
+export declare function helmInstall(args: HelmInstallArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=helm.d.ts.map

package/dist/op/activities/helm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm.d.ts","sourceRoot":"","sources":["../../../src/op/activities/helm.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB5F"}