@intentius/chant 0.13.1 → 0.15.0

package/dist/lint/rules/comp/comp002-dangling-wiring-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comp002-dangling-wiring-ref.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/comp002-dangling-wiring-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmD,MAAM,wBAAwB,CAAC;AAG9G,eAAO,MAAM,4BAA4B,EAAE,cAgE1C,CAAC"}

package/dist/lint/rules/comp/comp003-mutating-no-rollback.d.ts

@@ -0,0 +1,39 @@
+/**
+ * COMP003: mutating-no-rollback
+ *
+ * Flags a mutating capability step whose family has no known native/starter
+ * rollback and no explicit opt-out — the "mutating capability with no
+ * rollback and no explicit opt-out reason" guardrail from epic #551 §7 and
+ * §"Failure modes".
+ *
+ * Each capability declares its rollback disposition via `rollbackPolicy`
+ * (../../../components/capability.ts): `"native"` (a paired `rollback`, e.g.
+ * `cfn-deploy`/`ecs-update-service`/`lambda-deploy`/`code-deploy`),
+ * `"none-by-design"` (nothing to compensate — the build/publish and wait/verify
+ * families, whose outputs are immutable/content-addressed or read-only), or
+ * `"needs-opt-out"` (a mutating verb with no native rollback and no safe undo,
+ * e.g. `s3-sync`/`run-migration`). This rule flags only `"needs-opt-out"` steps
+ * lacking an explicit opt-out. It reads the disposition from the project's
+ * capability registry (`ctx.rollbackPolicies`, built by `chant lint` from the
+ * active lexicons + core starter — the same seam COMP005 uses for
+ * `ctx.knownKinds`), never a hard-coded verb list, so the aws leaves'
+ * dispositions come from the aws lexicon that owns them.
+ *
+ * The opt-out: since the capability interface and schema are out of scope for
+ * this issue (`Step` already has `additionalProperties: true` — see
+ * component.schema.json), a component may attach a `noRollback: "<reason>"`
+ * string property directly on the step to declare the compensation gap is
+ * intentional and understood, or supply its own explicit compensation via a
+ * component-level `rollback` field (as the ALB/ECS pilot does with
+ * `rollback-previous`) or a sibling `rollback-previous`/`snapshot-before` step
+ * in the same phase.
+ *
+ * Triggers on: a bare `{ kind: "run-migration", ... }` step with no
+ * `noRollback` reason, no component-level `rollback`, and no sibling
+ * `rollback-previous`/`snapshot-before` step.
+ * OK: `{ kind: "run-migration", ..., noRollback: "forward-only migration, ..." }`,
+ * or a component `rollback` field, or a sibling compensation step.
+ */
+import type { ComponentCheck } from "../../component-checks.js";
+export declare const comp003MutatingNoRollbackRule: ComponentCheck;
+//# sourceMappingURL=comp003-mutating-no-rollback.d.ts.map

package/dist/lint/rules/comp/comp003-mutating-no-rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comp003-mutating-no-rollback.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/comp003-mutating-no-rollback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmD,MAAM,wBAAwB,CAAC;AAsB9G,eAAO,MAAM,6BAA6B,EAAE,cAuD3C,CAAC"}

package/dist/lint/rules/comp/comp004-gate-needs-temporal.d.ts

@@ -0,0 +1,37 @@
+/**
+ * COMP004: gate-needs-temporal
+ *
+ * Flags a `gate` step anywhere in a component's composition — a durable,
+ * human-approval wait that cannot run on the local in-process executor (see
+ * ../../../components/driver.ts's `DriverGateUnsupportedError` and
+ * docs/components/orchestration.mdx's "Temporal is optional" aside: "gates ...
+ * require the durable (Temporal) execution backend").
+ *
+ * The component contract has no per-component backend/executor field (the
+ * backend is chosen per *run*, via `chant run --temporal`, per epic #551 §8 —
+ * intentionally not part of the declaration, so the same component graduates
+ * to Temporal without changing its definition). That means lint cannot tell,
+ * from the declaration alone, whether a given `gate` will actually run under
+ * Temporal when this component is deployed — every `gate` is a standing
+ * "this component needs the durable backend" fact worth surfacing, not a
+ * mistake to silently allow. Acknowledge it explicitly with a **file-level**
+ * disable directive once the durable backend is genuinely intended (see
+ * lint-rules/disable-directives.mdx) — a COMP* diagnostic carries no real
+ * line/column (it is reported for the whole component; see
+ * ../../component-checks.ts), so only the file-level `chant-disable` form is
+ * honored for these rules — `-line`/`-next-line` do not suppress a COMP*
+ * diagnostic (see ../../../cli/commands/lint.ts's
+ * `runComponentCheckDiagnostics`):
+ *
+ * ```ts
+ * // chant-disable COMP004 -- graduates to --temporal for the human approval wait
+ * ```
+ *
+ * Triggers on: any `gate` step in `deploy`/`rollback` with no matching
+ * file-level disable directive.
+ * OK: a component with no `gate` steps at all, or a `gate` whose file-level
+ * disable directive documents the Temporal graduation.
+ */
+import type { ComponentCheck } from "../../component-checks.js";
+export declare const comp004GateNeedsTemporalRule: ComponentCheck;
+//# sourceMappingURL=comp004-gate-needs-temporal.d.ts.map

package/dist/lint/rules/comp/comp004-gate-needs-temporal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comp004-gate-needs-temporal.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/comp004-gate-needs-temporal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmD,MAAM,wBAAwB,CAAC;AAG9G,eAAO,MAAM,4BAA4B,EAAE,cA2B1C,CAAC"}

package/dist/lint/rules/comp/comp005-capability-kind-is-noun.d.ts

@@ -0,0 +1,43 @@
+/**
+ * COMP005: capability-kind-is-noun
+ *
+ * Flags a step `kind` that names a component rather than an operation — the
+ * "capability-per-component (renamed sprawl)" failure mode from epic #551
+ * §"Failure modes ... + guardrails": "Tell: capabilities named after nouns."
+ * Every starter-set verb is a verb-phrase describing an operation
+ * (`cfn-deploy`, `publish-image`, `wait-steady-state`, ...); a capability
+ * named after *this* component (or any other discovered component) is
+ * exactly the sprawl the capability model exists to remove — see
+ * docs/components/capabilities.mdx#the-discipline ("A capability describes
+ * an operation, never a component").
+ *
+ * Detection is structural, not NLP: a step `kind` is flagged when it equals,
+ * or is built from, a discovered component's own kebab-case `name` (e.g. a
+ * `search-service` component composing a `{ kind: "deploy-search-service" }`
+ * or `{ kind: "search-service" }` step) — the concrete, checkable form of
+ * "named after a component" the issue asks for, mirroring how
+ * ../../../components/capability.ts's own docstring defines the discipline
+ * ("never named after the component that happens to use it").
+ *
+ * Every registered `kind` is excluded from this check unconditionally,
+ * regardless of whether its dash-separated segments happen to overlap a
+ * component's name. The allowlist comes from `ctx.knownKinds` — the kinds the
+ * project's capability registry actually resolves, which `chant lint` builds
+ * from the project's config (core's starter set plus the active lexicons'
+ * leaves, e.g. `cfn-deploy`/`wait-for-stack` when `lexicons: ["aws"]`). Without
+ * this exclusion, a component literally named "stack", "job", "image", or
+ * "host" would falsely flag `wait-for-stack`/`emr-start-job-run`/`publish-image`/
+ * `load-image-on-host` — a real capability's verb-ness is an established fact of
+ * the registry, not something to re-adjudicate by substring match. When no
+ * registry was resolved (a direct unit test), it falls back to core's starter
+ * set (`CORE_STARTER_KINDS`).
+ *
+ * Triggers on: `{ kind: "search-service" }` or `{ kind: "deploy-search-service" }`
+ * in any component, when "search-service" is a discovered component's name and
+ * neither form is a registered verb.
+ * OK: `{ kind: "cfn-deploy" }`, `{ kind: "ecs-update-service" }`,
+ * `{ kind: "wait-for-stack" }` — verb-named, and/or a registered verb.
+ */
+import type { ComponentCheck } from "../../component-checks.js";
+export declare const comp005CapabilityKindIsNounRule: ComponentCheck;
+//# sourceMappingURL=comp005-capability-kind-is-noun.d.ts.map

package/dist/lint/rules/comp/comp005-capability-kind-is-noun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comp005-capability-kind-is-noun.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/comp005-capability-kind-is-noun.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAmD,MAAM,wBAAwB,CAAC;AAwB9G,eAAO,MAAM,+BAA+B,EAAE,cA8C7C,CAAC"}

package/dist/lint/rules/comp/comp006-shell-needs-reason.d.ts

@@ -0,0 +1,22 @@
+/**
+ * COMP006: shell-needs-reason
+ *
+ * Flags a `shell` step with no (or empty/blank) `reason` — the escape-hatch
+ * discipline from epic #551 §7 and §"What chant adds": "raw `shell` without a
+ * declared reason" gets flagged. `shell` is the deliberate escape hatch
+ * (../../../components/verbs/shell.ts) for reaching past the capability set;
+ * `ShellInput.reason` is already a required field on the typed
+ * `createShellCapability` input, but a hand-authored/JSON-only component (the
+ * contract's whole point — see component-contract.mdx's "portable, not
+ * chant-only" framing) is not type-checked against that interface, so the raw
+ * JSON contract's `Step` (open `additionalProperties`) does not itself
+ * enforce it. This rule enforces the same discipline at the composition
+ * level, for every authoring form.
+ *
+ * Triggers on: `{ kind: "shell", cmd: "..." }` with no `reason`, or
+ * `reason: ""` / `reason: "   "`.
+ * OK: `{ kind: "shell", cmd: "...", reason: "no capability covers <x> yet" }`.
+ */
+import type { ComponentCheck } from "../../component-checks.js";
+export declare const comp006ShellNeedsReasonRule: ComponentCheck;
+//# sourceMappingURL=comp006-shell-needs-reason.d.ts.map

package/dist/lint/rules/comp/comp006-shell-needs-reason.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comp006-shell-needs-reason.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/comp006-shell-needs-reason.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmD,MAAM,wBAAwB,CAAC;AAG9G,eAAO,MAAM,2BAA2B,EAAE,cA+BzC,CAAC"}

package/dist/lint/rules/comp/comp007-composition-sprawl.d.ts

@@ -0,0 +1,33 @@
+/**
+ * COMP007: composition-sprawl
+ *
+ * Flags two or more components whose `deploy` composition is structurally
+ * identical (same phases, same `parallel`/nesting shape, same step kinds in
+ * the same order) — the "composition copy-paste (declaration sprawl)"
+ * failure mode from epic #551 §"Failure modes ... + guardrails": "Guard:
+ * presets (Level 2) + a lint hint when an identical composition repeats
+ * across components." This is a *hint*, not a hard error (severity:
+ * "warning") — the epic frames it as "reach for a preset"
+ * (docs/components/capabilities.mdx#presets--reuse-without-a-closed-set),
+ * not a correctness defect.
+ *
+ * The fingerprint (../comp/support.ts's `compositionFingerprint`) compares
+ * phase names, `parallel` flags, nesting, and step *kinds* only — never
+ * `name`/`dependsOn`/literal wiring values/params, so two components that
+ * both do "build -> publish -> apply -> verify" with the same capability
+ * kinds but different templates/clusters/images still match (that is exactly
+ * the "own destiny is in the params, not the shape" case a preset should
+ * absorb).
+ *
+ * Triggers on: three components (arbitrary example) that all compose
+ * `docker-build` -> `publish-image` -> `cfn-deploy` + `ecs-update-service` ->
+ * `wait-steady-state` + `health-gate` with no meaningful structural
+ * difference.
+ * OK: components whose phase/step-kind shape differs (a different archetype,
+ * a different apply family, fan-out vs. no fan-out, etc.) — like the four
+ * real pilots, which were deliberately chosen to be structurally distinct
+ * (see ../../../components/SPRAWL-VALIDATION.md).
+ */
+import type { ComponentCheck } from "../../component-checks.js";
+export declare const comp007CompositionSprawlRule: ComponentCheck;
+//# sourceMappingURL=comp007-composition-sprawl.d.ts.map

package/dist/lint/rules/comp/comp007-composition-sprawl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comp007-composition-sprawl.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/comp007-composition-sprawl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmD,MAAM,wBAAwB,CAAC;AAG9G,eAAO,MAAM,4BAA4B,EAAE,cAoC1C,CAAC"}

package/dist/lint/rules/comp/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * COMP* composition lint rules (#562, epic #551) — the long-term entropy
+ * guards over the discovered `Component` graph. See ../../component-checks.ts
+ * for why these are `ComponentCheck`s (whole-project, post-discovery) rather
+ * than `LintRule`s (single-file AST), and docs/lint-rules/composition.mdx for
+ * the user-facing reference.
+ */
+import type { ComponentCheck } from "../../component-checks.js";
+export { comp001PublishesNeverAppliesRule } from "./comp001-publishes-never-applies.js";
+export { comp002DanglingWiringRefRule } from "./comp002-dangling-wiring-ref.js";
+export { comp003MutatingNoRollbackRule } from "./comp003-mutating-no-rollback.js";
+export { comp004GateNeedsTemporalRule } from "./comp004-gate-needs-temporal.js";
+export { comp005CapabilityKindIsNounRule } from "./comp005-capability-kind-is-noun.js";
+export { comp006ShellNeedsReasonRule } from "./comp006-shell-needs-reason.js";
+export { comp007CompositionSprawlRule } from "./comp007-composition-sprawl.js";
+/** All seven COMP* checks, sorted by id. */
+export declare function loadComponentChecks(): ComponentCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/comp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAS7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAE5E,4CAA4C;AAC5C,wBAAgB,mBAAmB,IAAI,cAAc,EAAE,CAUtD"}

package/dist/lint/rules/comp/support.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Shared walking/wiring helpers for the COMP* composition rules (#562, epic
+ * #551). Every COMP rule operates over the real, discovered `Component`
+ * graph (see ../../component-checks.ts), not raw TypeScript source — these
+ * helpers flatten a component's `deploy`/`rollback` phases into steps and
+ * parse the wiring reference forms `../../../components/driver.ts` already
+ * resolves at runtime, so lint can check the same references before
+ * anything runs (per docs/components/orchestration.mdx).
+ */
+import type { Component, Gate, Phase, Step } from "../../../components/component.js";
+/** True if a step/gate/nested-phase entry is a `Gate` (`kind: "gate"`). */
+export declare function isGateEntry(entry: Step | Gate | Phase): entry is Gate;
+/** True if a step/gate/nested-phase entry is itself a nested `Phase` (a fan-out unit) — see `component.ts`'s `isNestedPhase`. */
+export declare function isPhaseEntry(entry: Step | Gate | Phase): entry is Phase;
+/** True if a step/gate/nested-phase entry is a plain capability `Step` (neither a gate nor a nested phase). */
+export declare function isStepEntry(entry: Step | Gate | Phase): entry is Step;
+/** One step found while walking a component, together with the (possibly nested) phase it lives directly under. */
+export interface WalkedStep {
+    step: Step;
+    phaseName: string;
+    /**
+     * The exact `Phase` object this step lives directly under — object
+     * identity, not just `phaseName`, since two different nested fan-out
+     * phases (or a nested phase and its parent) can share the same display
+     * name. Rules that need "another step in this same phase" (e.g. COMP003's
+     * compensation-sibling check) should group by this reference, not by name.
+     */
+    phase: Phase;
+}
+/** One gate found while walking a component, together with the phase it lives directly under. */
+export interface WalkedGate {
+    gate: Gate;
+    phaseName: string;
+    phase: Phase;
+}
+/**
+ * Flatten every step and gate across a list of phases (including nested
+ * fan-out phases and `onFailure` compensation phases), matching
+ * `component.ts`'s own `allSteps` walk but keeping the immediate phase
+ * alongside each entry (needed for `@Phase.field` reference checks and for
+ * "same phase" sibling checks) and separating gates out explicitly.
+ */
+export declare function walkPhases(phases: Phase[] | undefined): {
+    steps: WalkedStep[];
+    gates: WalkedGate[];
+};
+/** Every step and gate across a component's `deploy` plus its top-level `rollback` phases. */
+export declare function walkComponent(component: Component): {
+    steps: WalkedStep[];
+    gates: WalkedGate[];
+};
+/** Every distinct phase name declared directly in a component's `deploy` (top-level only, not nested fan-out phase names — those are addressed by the fan-out's own phase name, never the parent's). */
+export declare function topLevelPhaseNames(component: Component): Set<string>;
+export interface PriorStepRef {
+    kind: "prior-step";
+    phaseName: string;
+    field: string;
+}
+export interface ComponentArtifactRef {
+    kind: "component-artifact";
+    componentName: string;
+    field: "uri" | "digest" | "key";
+}
+export type WiringRef = PriorStepRef | ComponentArtifactRef;
+/** Parse a single string value as one of the two name-bearing wiring reference forms (`@Phase.field`, `@component.publish.*`). Returns `undefined` for a plain literal, an `$env.*` reference, or a malformed `@` reference (schema validation, not lint, is responsible for rejecting malformed references). */
+export declare function parseWiringRef(value: unknown): WiringRef | undefined;
+/** Recursively collect every wiring-reference-shaped string found anywhere in a step's fields (imageRef, jar, revision, inputs, and any other open capability-specific property), matching how ../../../components/driver.ts's `resolveStepInput` walks a step's input. */
+export declare function collectWiringRefs(step: Step): WiringRef[];
+/** A structural fingerprint of a component's composition shape, ignoring `name`/`dependsOn`/wiring literal values — two components with the same fingerprint compose the exact same phase/step-kind shape (see COMP007, "identical composition repeated across components"). */
+export declare function compositionFingerprint(component: Component): string;
+//# sourceMappingURL=support.d.ts.map

package/dist/lint/rules/comp/support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"support.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/support.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AAElF,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,IAAI,IAAI,CAErE;AAED,iIAAiI;AACjI,wBAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,IAAI,KAAK,CAEvE;AAED,+GAA+G;AAC/G,wBAAgB,WAAW,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,IAAI,IAAI,CAErE;AAED,mHAAmH;AACnH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,KAAK,EAAE,KAAK,CAAC;CACd;AAED,iGAAiG;AACjG,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,GAAG;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAA;CAAE,CAqBpG;AAED,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAA;CAAE,CAOhG;AAED,wMAAwM;AACxM,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAEpE;AASD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,KAAK,CAAC;CACjC;AAED,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAE5D,iTAAiT;AACjT,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAcpE;AAED,2QAA2Q;AAC3Q,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,EAAE,CAuBzD;AAED,gRAAgR;AAChR,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAGnE"}

package/dist/lsp/lexicon-providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lexicon-providers.d.ts","sourceRoot":"","sources":["../../src/lsp/lexicon-providers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAI1F,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9E;AAID;;GAEG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;IAEzD,8DAA8D;IAC9D,gBAAgB,IAAI,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAUtE,0DAA0D;IAC1D,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAqB7C,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;CAGjD;AAID;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,YAAY,EACnB,YAAY,EAAE,MAAM,GACnB,cAAc,EAAE,CA4ClB;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,YAAY,EACnB,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,SAAS,GAAG,SAAS,GAC9E,SAAS,GAAG,SAAS,CAiBvB"}
+{"version":3,"file":"lexicon-providers.d.ts","sourceRoot":"","sources":["../../src/lsp/lexicon-providers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAI1F,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9E;AAID;;GAEG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;IAEzD,8DAA8D;IAC9D,gBAAgB,IAAI,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAUtE,0DAA0D;IAC1D,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAqB7C,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;CAGjD;AAID;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,YAAY,EACnB,YAAY,EAAE,MAAM,GACnB,cAAc,EAAE,CAsDlB;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,YAAY,EACnB,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,SAAS,GAAG,SAAS,GAC9E,SAAS,GAAG,SAAS,CAiBvB"}

package/dist/op/activity-registry.d.ts

@@ -15,14 +15,19 @@
  */
 export type ActivityFn = (args: Record<string, unknown>, signal?: AbortSignal) => Promise<unknown>;
 /**
- * Dynamically import the Temporal lexicon's activity library and return a map
- * of every exported function keyed by its export name (`shellCmd`, `chantBuild`,
- * `kubectlApply`, …).
+ * Build the activity map for local execution by importing activity libraries and
+ * keying every exported function by name (`shellCmd`, `kubectlApply`, `gcpApply`, …).
  *
- * Throws a friendly error if the lexicon is not installed — local execution
- * needs the activity implementations even though it never starts a worker.
+ * The base activities always live in the temporal lexicon. Cloud-specific
+ * appliers live in their own lexicon (aws → `flociUp`/`flociDown`, gcp →
+ * `gcpApply`, azure → `azGroupEnsure`/`azGroupDelete`), so `lexicons` — the
+ * project's configured lexicon list — is consulted to pull those in. A lexicon
+ * that ships no `op/activities` module is skipped.
+ *
+ * Throws only if the temporal base library is missing — local execution needs
+ * the activity implementations even though it never starts a worker.
  */
-export declare function loadActivities(): Promise<Map<string, ActivityFn>>;
+export declare function loadActivities(lexicons?: string[]): Promise<Map<string, ActivityFn>>;
 /** Structural shape of a TEMPORAL_ACTIVITY_PROFILES entry (timeout + retry). */
 export interface ActivityProfile {
     startToCloseTimeout?: string;

package/dist/op/activity-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-registry.d.ts","sourceRoot":"","sources":["../../src/op/activity-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEnG;;;;;;;GAOG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAmBvE;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE;QACN,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,6EAA6E;QAC7E,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;KACnC,CAAC;CACH;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAQ7E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACnC,EAAE,EAAE,MAAM,GACT,UAAU,CAOZ"}
+{"version":3,"file":"activity-registry.d.ts","sourceRoot":"","sources":["../../src/op/activity-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAWnG;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,QAAQ,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAwB9F;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE;QACN,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,6EAA6E;QAC7E,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;KACnC,CAAC;CACH;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAQ7E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACnC,EAAE,EAAE,MAAM,GACT,UAAU,CAOZ"}

package/dist/op/activity-runtime.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Activity runtime helpers shared by every Op activity implementation, wherever
+ * it lives — the base activities in the temporal lexicon and the cloud-specific
+ * appliers relocated into the aws/gcp/azure lexicons. Hosting them in core keeps
+ * a cloud lexicon from having to depend on the temporal lexicon just to
+ * heartbeat or sleep.
+ */
+/**
+ * Emit an activity heartbeat if running under a Temporal worker; otherwise no-op.
+ *
+ * The first call kicks off a one-time lazy load of `@temporalio/activity` and
+ * returns immediately; once resolved, subsequent calls heartbeat. Heartbeats
+ * are periodic (every ~15s, well inside the 60s heartbeat timeout), so the
+ * single missed first tick is harmless. Under chant's local executor (no
+ * Temporal SDK present) it no-ops, and the module imports cleanly without the SDK.
+ */
+export declare function safeHeartbeat(details?: unknown): void;
+/**
+ * Sleep for `ms`, rejecting early if `signal` aborts. Polling activities use
+ * this between attempts so a local-executor timeout or Ctrl-C interrupts the
+ * wait instead of running it to completion.
+ */
+export declare function sleep(ms: number, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=activity-runtime.d.ts.map

package/dist/op/activity-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-runtime.d.ts","sourceRoot":"","sources":["../../src/op/activity-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuBH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAWrD;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrE"}

package/dist/op/builders.d.ts

@@ -55,6 +55,62 @@ export declare const shell: (cmd: string, opts?: {
 }) => ActivityStep;
 /** Run `chant teardown` in the given project directory. Uses `longInfra` profile. */
 export declare const teardown: (path: string) => ActivityStep;
+/**
+ * Create a local k3d cluster (vanilla Kubernetes in Docker) and merge its
+ * kubeconfig / switch context — k3d's defaults. Idempotent: skips creation if a
+ * cluster of the same name already exists. Defaults to the `longInfra` profile
+ * (creating a cluster may pull the k3s image); override via `opts.profile`.
+ *
+ * `opts` accepts `servers`, `agents`, `image`, `ports` (e.g.
+ * `["8080:80@loadbalancer"]`), `registryCreate`, `configFile`, and `timeout`.
+ */
+export declare const k3dUp: (name: string, opts?: Record<string, unknown>) => ActivityStep;
+/** Delete a local k3d cluster. Defaults to the `fastIdempotent` profile (override via `opts.profile`). */
+export declare const k3dDown: (name: string, opts?: Record<string, unknown>) => ActivityStep;
+/**
+ * Boot a local Floci AWS emulator in Docker and point subsequent steps at it —
+ * sets `AWS_ENDPOINT_URL` + test creds in the process env so a following
+ * `cloudformation` apply targets the emulator (local executor). Idempotent:
+ * reuses a running container of the same name. Defaults to the `longInfra`
+ * profile (the image may pull); override via `opts.profile`.
+ *
+ * `opts` accepts `name`, `port`, `image`, `dockerSocket` (mount the docker
+ * socket for the ECR backing registry), `region`, `readyService`, `timeoutMs`.
+ */
+export declare const flociUp: (opts?: Record<string, unknown>) => ActivityStep;
+/** Stop and remove the local Floci emulator container. Defaults to the `fastIdempotent` profile (override via `opts.profile`). */
+export declare const flociDown: (opts?: Record<string, unknown>) => ActivityStep;
+/**
+ * Ensure an Azure resource group exists before an ARM apply. `az deployment
+ * group create` (the `arm` apply target) fails without its group, so place this
+ * before the deploy phase. Idempotent. Defaults to the `fastIdempotent` profile
+ * (override via `opts.profile`). `opts` accepts `location` (default `eastus`).
+ */
+export declare const azGroupEnsure: (resourceGroup: string, opts?: Record<string, unknown>) => ActivityStep;
+/** Delete an Azure resource group and its contents (non-blocking). Defaults to the `fastIdempotent` profile (override via `opts.profile`). */
+export declare const azGroupDelete: (resourceGroup: string, opts?: Record<string, unknown>) => ActivityStep;
+/**
+ * Apply chant's built ARM template directly to the ARM resource API — the Azure
+ * twin of {@link gcpApply}. Targets floci-az's resource CRUD (which `az deployment`
+ * can't, floci-az having no deployments provider) or real Azure by endpoint
+ * override; ensures the resource group first. Defaults to the `longInfra` profile.
+ *
+ * `opts` requires `resourceGroup`; accepts `location`, `endpoint` (floci-az
+ * `http://localhost:4577`), and `subscriptionId`.
+ */
+export declare const azApply: (templatePath: string, opts?: Record<string, unknown>) => ActivityStep;
+/**
+ * Apply chant's built GCP (CNRM) resources directly to the GCS REST API,
+ * targeting a local floci-gcp emulator or real GCP by endpoint override — the
+ * native GCP applier (#706 starter #711), currently handling `StorageBucket`.
+ * Defaults to the `longInfra` profile (override via `opts.profile`).
+ *
+ * `opts` accepts `endpoint` (default `STORAGE_EMULATOR_HOST` env / real GCS) and
+ * `project` (default `GOOGLE_CLOUD_PROJECT` env / the CNRM project-id annotation).
+ */
+export declare const gcpApply: (manifestPath: string, opts?: Record<string, unknown>) => ActivityStep;
+/** Delete the GCP (CNRM) resources in a built manifest — the inverse of {@link gcpApply}. Defaults to the `longInfra` profile (override via `opts.profile`). */
+export declare const gcpDelete: (manifestPath: string, opts?: Record<string, unknown>) => ActivityStep;
 /**
  * Gate an apply on organizational policy: build the project and run its
  * `lint.policies` over the resolved resources, blocking the workflow on any

package/dist/op/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIjG;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,CAAC,OAAO,UAAU,CAAC,CAEpE;AAED,mEAAmE;AACnE,wBAAgB,KAAK,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,cAAc,EAAE,EACvB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5B,eAAe,CAEjB;AAED,iEAAiE;AACjE,wBAAgB,QAAQ,CACtB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,GAChC,YAAY,CAOd;AAED,oFAAoF;AACpF,wBAAgB,IAAI,CAClB,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,QAAQ,CAOV;AAsBD,6EAA6E;AAC7E,eAAO,MAAM,KAAK,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAGpE,CAAC;AAEF,4GAA4G;AAC5G,eAAO,MAAM,YAAY,GAAI,UAAU,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAG/E,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,WAAW,GACtB,MAAM,MAAM,EACZ,OAAO,MAAM,EACb,OAAO;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,KACtG,YAGF,CAAC;AAEF,iJAAiJ;AACjJ,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAG3E,CAAC;AAEF,gIAAgI;AAChI,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAG7E,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,YACR,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,KAAK,GAChB,KAAK,MAAM,EACX,OAAO;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAA;CAAE,KACzE,YACoF,CAAC;AAExF,qFAAqF;AACrF,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,KAAG,YACU,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,YAKjE,CAAC"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIjG;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,CAAC,OAAO,UAAU,CAAC,CAEpE;AAED,mEAAmE;AACnE,wBAAgB,KAAK,CACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,cAAc,EAAE,EACvB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5B,eAAe,CAEjB;AAED,iEAAiE;AACjE,wBAAgB,QAAQ,CACtB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,GAChC,YAAY,CAOd;AAED,oFAAoF;AACpF,wBAAgB,IAAI,CAClB,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,QAAQ,CAOV;AAsBD,6EAA6E;AAC7E,eAAO,MAAM,KAAK,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAGpE,CAAC;AAEF,4GAA4G;AAC5G,eAAO,MAAM,YAAY,GAAI,UAAU,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAG/E,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,WAAW,GACtB,MAAM,MAAM,EACZ,OAAO,MAAM,EACb,OAAO;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,KACtG,YAGF,CAAC;AAEF,iJAAiJ;AACjJ,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAG3E,CAAC;AAEF,gIAAgI;AAChI,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAG7E,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,YACR,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,KAAK,GAChB,KAAK,MAAM,EACX,OAAO;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAA;CAAE,KACzE,YACoF,CAAC;AAExF,qFAAqF;AACrF,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,KAAG,YACU,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,KAAK,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAGpE,CAAC;AAEF,0GAA0G;AAC1G,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAGtE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAGxD,CAAC;AAEF,kIAAkI;AAClI,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAG1D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,eAAe,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAGrF,CAAC;AAEF,8IAA8I;AAC9I,eAAO,MAAM,aAAa,GAAI,eAAe,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAGrF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,cAAc,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAG9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,GAAI,cAAc,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAG/E,CAAC;AAEF,gKAAgK;AAChK,eAAO,MAAM,SAAS,GAAI,cAAc,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAGhF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,YAKjE,CAAC"}

package/dist/op/index.d.ts

@@ -1,5 +1,6 @@
-export { Op, phase, activity, gate, build, kubectlApply, helmInstall, waitForStack, gitlabPipeline, lifecycleSnapshot, shell, teardown, policyGate } from "./builders.js";
+export { Op, phase, activity, gate, build, kubectlApply, helmInstall, waitForStack, gitlabPipeline, lifecycleSnapshot, shell, teardown, k3dUp, k3dDown, flociUp, flociDown, azGroupEnsure, azGroupDelete, azApply, gcpApply, gcpDelete, policyGate } from "./builders.js";
 export { OpResource } from "./resource.js";
+export { safeHeartbeat, sleep } from "./activity-runtime.js";
 export type { OpConfig, PhaseDefinition, StepDefinition, ActivityStep, GateStep } from "./types.js";
 export { discoverOps } from "./discover.js";
 export type { DiscoveredOp, OpDiscoveryResult } from "./discover.js";

package/dist/op/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/op/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EACzE,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpF,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClH,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/op/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EACzE,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EACtF,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC1D,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpF,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClH,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/ownership.d.ts

@@ -25,28 +25,35 @@ export interface OwnershipMarker {
     env?: string;
 }
 /**
- * The native metadata channel a target stamps into. Tag-key syntax differs:
- * Kubernetes/GCP labels allow a `prefix/name` form; AWS tag keys allow `:`;
- * Azure tag keys forbid `/`, so they use a hyphenated form.
+ * The marker key names a target stamps into — the managed-by/stack/env tag or
+ * label keys. Tag-key syntax differs per provider (Kubernetes/GCP labels allow
+ * a `prefix/name` form; AWS tag keys allow `:`; Azure tag keys forbid `/`), so
+ * each cloud lexicon provides its own `ChannelKeys` and passes it to these
+ * helpers. Core owns the generic stamp/detect logic and the shared label
+ * convention (`LABEL_OWNERSHIP_KEYS`), not a per-provider key registry.
  */
-export type OwnershipChannel = "label" | "aws-tag" | "azure-tag";
-interface ChannelKeys {
+export interface ChannelKeys {
     readonly managedBy: string;
     readonly stack: string;
     readonly env: string;
 }
-/** The marker key names used in a given channel. */
-export declare function ownershipKeys(channel: OwnershipChannel): ChannelKeys;
 /**
- * The key/value entries to stamp for a channel: the managed-by marker, the
- * stack identity, and the env identity when present.
+ * The label-based ownership convention (`app.kubernetes.io/managed-by` +
+ * `chant.intentius.io/{stack,env}`) — the default, shared by every label-based
+ * lexicon (k8s, gcp, helm, and the Temporal apply activity's `kubectl --prune`
+ * selector). AWS and Azure tag keys are defined in their own lexicons.
  */
-export declare function ownershipEntries(channel: OwnershipChannel, marker: OwnershipMarker): Record<string, string>;
+export declare const LABEL_OWNERSHIP_KEYS: ChannelKeys;
+/**
+ * The key/value entries to stamp: the managed-by marker, the stack identity,
+ * and the env identity when present.
+ */
+export declare function ownershipEntries(keys: ChannelKeys, marker: OwnershipMarker): Record<string, string>;
 /**
  * Ownership test: does this resource carry chant's managed-by marker? Other
  * tools may co-stamp; only the managed-by marker is required to count as owned.
  */
-export declare function hasOwnershipMarker(tagsOrLabels: Record<string, unknown> | undefined, channel: OwnershipChannel): boolean;
+export declare function hasOwnershipMarker(tagsOrLabels: Record<string, unknown> | undefined, keys: ChannelKeys): boolean;
 /**
  * The two live-side ownership verdicts a marker query can produce.
  *
@@ -57,7 +64,7 @@ export declare function hasOwnershipMarker(tagsOrLabels: Record<string, unknown>
  * The third verdict, `unknown`, is reserved for when no marker channel was
  * queried at all (see the `Ownership` type in the change set).
  */
-export declare function classifyOwnership(tagsOrLabels: Record<string, unknown> | undefined, channel: OwnershipChannel): "owned" | "foreign";
+export declare function classifyOwnership(tagsOrLabels: Record<string, unknown> | undefined, keys: ChannelKeys): "owned" | "foreign";
 /**
  * Convert a tag array of `{Key, Value}` (AWS/CloudFormation form) into the
  * key→value map the ownership helpers expect.
@@ -70,6 +77,5 @@ export declare function tagArrayToMap(tags: ReadonlyArray<{
  * Read the stack/env identity from a marked resource's tags/labels. Returns
  * undefined when the managed-by marker is absent.
  */
-export declare function readOwnership(tagsOrLabels: Record<string, unknown> | undefined, channel: OwnershipChannel): OwnershipMarker | undefined;
-export {};
+export declare function readOwnership(tagsOrLabels: Record<string, unknown> | undefined, keys: ChannelKeys): OwnershipMarker | undefined;
 //# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,UAAU,CAAC;AAElD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjE,UAAU,WAAW;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAoBD,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,WAAW,CAEpE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,eAAe,GACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAGT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,OAAO,EAAE,gBAAgB,GACxB,OAAO,GAAG,SAAS,CAErB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,aAAa,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,SAAS,GACjE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMzB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,OAAO,EAAE,gBAAgB,GACxB,eAAe,GAAG,SAAS,CAS7B"}
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,UAAU,CAAC;AAElD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,eAAe,GACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,WAAW,GAChB,OAAO,CAGT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,WAAW,GAChB,OAAO,GAAG,SAAS,CAErB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,aAAa,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,SAAS,GACjE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMzB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,WAAW,GAChB,eAAe,GAAG,SAAS,CAQ7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -39,6 +39,11 @@
       "types": "./dist/index.d.ts",
       "default": "./src/index.ts"
     },
+    "./yaml": {
+      "development": "./src/yaml.ts",
+      "types": "./dist/yaml.d.ts",
+      "default": "./src/yaml.ts"
+    },
     "./cli": {
       "development": "./src/cli/index.ts",
       "types": "./dist/cli/index.d.ts",
@@ -54,6 +59,11 @@
       "types": "./dist/op/index.d.ts",
       "default": "./src/op/index.ts"
     },
+    "./components": {
+      "development": "./src/components/index.ts",
+      "types": "./dist/components/index.d.ts",
+      "default": "./src/components/index.ts"
+    },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
@@ -71,5 +81,8 @@
     "tsx": "^4.0.0",
     "typescript": "^5.5.0",
     "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "ajv": "^8.20.0"
   }
 }