@intentius/chant 0.57.0 → 0.58.0

package/dist/op/activities/pipeline-audit.d.ts

@@ -0,0 +1,84 @@
+/**
+ * pipelineSupplyChainAudit — the live counterpart to the gitlab post-synth
+ * include/component/image checks (#297).
+ *
+ * Some include/component checks can only be answered against a moving external
+ * truth: whether a pinned component/include ref still resolves upstream, whether
+ * the upstream project was archived or moved, or whether a new advisory now
+ * covers a component/image already in use. These change independent of the
+ * source, so they cannot live in the deterministic build — this activity owns
+ * *only* the checks that require live resolution.
+ *
+ * Dependency-free and primitives-only: it reads the emitted `.gitlab-ci.yml`
+ * (passed as a string) and resolves references through an injectable
+ * `GitlabRefResolver`, so `chant run` can schedule it and tests can run
+ * it against recorded responses with no live network.
+ */
+/** What the audit produces on findings. For GitLab the PR mode is a merge request. */
+export type PipelineAuditMode = "report" | "issue" | "merge-request";
+/** The kind of reference being resolved. */
+export type PipelineRefKind = "include" | "component" | "image";
+/** Live resolution of a single pipeline reference against its upstream. */
+export interface PipelineRefResolution {
+    /** Does the project/component/image (at this ref/version) still resolve? */
+    exists: boolean;
+    /** Has the upstream project been archived? */
+    archived: boolean;
+    /** Has the upstream project moved (new path), if known. */
+    movedTo?: string;
+    /** Disclosed advisory identifiers affecting this reference. */
+    advisories: string[];
+}
+/** Pluggable upstream resolver — overridden in tests with recorded responses. */
+export type GitlabRefResolver = (kind: PipelineRefKind, identifier: string, ref: string) => Promise<PipelineRefResolution>;
+export type PipelineAuditFindingKind = "unresolved" | "archived" | "moved" | "advisory";
+export interface PipelineAuditFinding {
+    kind: PipelineAuditFindingKind;
+    refKind: PipelineRefKind;
+    /** project path / component address / image. */
+    identifier: string;
+    /** ref / version / tag. */
+    ref: string;
+    detail: string;
+}
+export interface PipelineAuditArgs {
+    /** One emitted `.gitlab-ci.yml` document. */
+    yaml?: string;
+    /** Several emitted documents. */
+    yamls?: string[];
+    /** Path to an emitted `.gitlab-ci.yml` to read at run time (default `.gitlab-ci.yml`). */
+    pipelineFile?: string;
+    /** What to produce. Default: report. */
+    mode?: PipelineAuditMode;
+    /** Injectable upstream resolver. Defaults to the live GitLab REST resolver. */
+    resolver?: GitlabRefResolver;
+}
+export interface PipelineAuditResult {
+    mode: PipelineAuditMode;
+    findings: PipelineAuditFinding[];
+    summary: string;
+}
+interface CollectedRef {
+    refKind: PipelineRefKind;
+    identifier: string;
+    ref: string;
+}
+/**
+ * Collect `include:project` (+ ref), `component:` (with @version), and `image:`
+ * references from a `.gitlab-ci.yml`.
+ */
+export declare function collectPipelineRefs(yaml: string): CollectedRef[];
+/**
+ * Default resolver: query the GitLab REST API for project existence / archive /
+ * move status. Best-effort and resilient — errors yield an "unknown" resolution
+ * (exists=true, no findings) rather than a false positive. Component/image
+ * advisory lookups are left to a configured resolver.
+ */
+export declare const defaultGitlabRefResolver: GitlabRefResolver;
+/**
+ * Resolve each include/component/image reference in the emitted pipeline against
+ * live upstreams and report drift.
+ */
+export declare function pipelineSupplyChainAudit(args: PipelineAuditArgs): Promise<PipelineAuditResult>;
+export {};
+//# sourceMappingURL=pipeline-audit.d.ts.map

package/dist/op/activities/pipeline-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-audit.d.ts","sourceRoot":"","sources":["../../../src/op/activities/pipeline-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,sFAAsF;AACtF,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,GAAG,eAAe,CAAC;AAErE,4CAA4C;AAC5C,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAE3H,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;AAExF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,YAAY;IACpB,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAwChE;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAgBtC,CAAC;AAmBF;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkCpG"}

package/dist/op/activities/policy.d.ts

@@ -0,0 +1,17 @@
+export interface PolicyGateArgs {
+    /** Project/source directory to build and evaluate. Default ".". */
+    path?: string;
+    /** Environment for policy evaluation (falls back to `ownership.env`). */
+    env?: string;
+}
+/**
+ * Gate an apply on organizational policy: build the project, run its
+ * `lint.policies` over the resolved resources, and **block** on any violation.
+ * Place it as a step before the apply phase — a violation fails the run
+ * (non-retryable; the `policyCheck` profile is single-attempt) so nothing is
+ * applied. A clean evaluation passes through.
+ *
+ * A plain activity on every runtime, not a `gate` step.
+ */
+export declare function policyGate(args: PolicyGateArgs, _signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/op/activities/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/op/activities/policy.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB3F"}

package/dist/op/activities/reconcile.d.ts

@@ -0,0 +1,89 @@
+/** What the reconcile activity does with the regenerated source. */
+export type ReconcileMode = "pull-request" | "issue" | "report";
+/** A change-set entry that triggered reconciliation. */
+export interface ReconcileEntry {
+    /** chant entity name. */
+    name: string;
+    /** create | update | delete | adopt | noop (from `chant lifecycle plan`). */
+    action: string;
+    /** Resource type, when known. */
+    type?: string;
+}
+export interface ReconcilePrArgs {
+    /** Environment to reconcile from (passed to `chant import --from`). */
+    env: string;
+    /**
+     * The change-set entries that triggered this reconcile. Omit to derive them
+     * from `chant lifecycle plan <env> --json` at run time — the form used inside
+     * an Op, where the entries aren't known until the activity runs.
+     */
+    entries?: ReconcileEntry[];
+    /** What to produce. Default: pull-request. */
+    mode?: ReconcileMode;
+    /** Output directory for regenerated source. Default: ./infra. */
+    output?: string;
+    /** Branch to open the PR from. Default: chant/reconcile-<env>. */
+    branch?: string;
+    /** Restrict live import to chant-owned resources. */
+    owned?: boolean;
+    /** PR / issue title. Default derived from env. */
+    title?: string;
+    /**
+     * A finding body built by the caller, used verbatim as the issue/PR body in
+     * place of {@link reconcileSummary} (chant #2087).
+     *
+     * The summary this activity writes itself is a change-set table, which is
+     * the right artifact when the finding IS a change set. Some observe-dial
+     * Ops already hold a better one: `TerraformWatchOp` carries the
+     * `terraform plan -no-color` render its own Plan step produced, and
+     * re-deriving that from `chant lifecycle plan` here would both lose the
+     * plan and run a second, differently-timed read.
+     *
+     * Supplying it also suppresses the `chant lifecycle plan --json` derivation
+     * that fills `entries`: a caller that already knows what it wants to say
+     * is not asking this activity to go and find out.
+     */
+    body?: string;
+}
+export interface ReconcileResult {
+    mode: ReconcileMode;
+    /** Branch created (pull-request mode). */
+    branch?: string;
+    /** Opened PR URL (pull-request mode). */
+    prUrl?: string;
+    /** Opened issue URL (issue mode). */
+    issueUrl?: string;
+    /** The markdown summary used as the PR/issue body. */
+    summary: string;
+    /** The entries that triggered the reconcile. */
+    entries: ReconcileEntry[];
+}
+/** Default branch name for a reconcile PR. Deterministic — no timestamp. */
+export declare function reconcileBranchName(env: string): string;
+/**
+ * Build the markdown body summarizing which change-set entries triggered the
+ * reconcile. Pure — used as the PR/issue body and returned in `report` mode.
+ */
+export declare function reconcileSummary(env: string, entries: ReconcileEntry[]): string;
+/**
+ * Map a `chant lifecycle plan --json` ChangeSet to reconcile entries, dropping
+ * `noop` entries (nothing to reconcile). Pure — exported for testing.
+ */
+export declare function entriesFromPlan(planJson: string): ReconcileEntry[];
+/**
+ * Reconcile activity: turn regenerated TypeScript into a reviewable artifact.
+ *
+ * - `report` — return the summary only; no git, no network.
+ * - `issue` — open a GitHub issue describing the drift (no code change).
+ * - `pull-request` — create a branch, regenerate source via
+ *   `chant import --from <env>`, commit, push, and open a PR whose diff is the
+ *   regenerated TypeScript. Never commits to the main branch.
+ *
+ * The body is {@link reconcileSummary}'s change-set table unless `args.body`
+ * supplies one, in which case that text is used verbatim and no plan is
+ * derived (chant #2087).
+ *
+ * Requires `chant` and (for non-report modes) `gh`/`git` in the environment.
+ */
+export declare function reconcilePr(args: ReconcilePrArgs, signal?: AbortSignal): Promise<ReconcileResult>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/op/activities/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/op/activities/reconcile.ts"],"names":[],"mappings":"AAKA,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhE,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAkB/E;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAOlE;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAyCvG"}

package/dist/op/activities/shell.d.ts

@@ -0,0 +1,13 @@
+export interface ShellCmdArgs {
+    cmd: string;
+    /** Additional environment variables. */
+    env?: Record<string, string>;
+    /** Working directory. Default: process.cwd(). */
+    cwd?: string;
+}
+/**
+ * Run an arbitrary shell command.
+ * Uses fastIdempotent profile — 5m timeout, 3 retries.
+ */
+export declare function shellCmd(args: ShellCmdArgs, signal?: AbortSignal): Promise<string>;
+//# sourceMappingURL=shell.d.ts.map

package/dist/op/activities/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../src/op/activities/shell.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxF"}

package/dist/op/activities/teardown.d.ts

@@ -0,0 +1,10 @@
+export interface ChantTeardownArgs {
+    /** Path to the chant project to tear down. */
+    path: string;
+}
+/**
+ * Run `chant teardown` in the given project path.
+ * Uses longInfra profile — 20m timeout.
+ */
+export declare function chantTeardown(args: ChantTeardownArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=teardown.d.ts.map

package/dist/op/activities/teardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../../../src/op/activities/teardown.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhG"}

package/dist/op/activities/util.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Re-export shim — `sleep` is the shared activity-runtime helper one directory
+ * up (`../activity-runtime`). Kept here so existing `./util` imports resolve
+ * unchanged.
+ */
+export { sleep } from "../activity-runtime.js";
+//# sourceMappingURL=util.d.ts.map

package/dist/op/activities/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../../src/op/activities/util.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/op/activities/wait.d.ts

@@ -0,0 +1,28 @@
+export interface WaitForStackArgs {
+    /** Stack name — used to locate the kubectl deployment/statefulset to poll. */
+    name: string;
+    /** Kubernetes namespace. */
+    namespace?: string;
+    /** kubectl context. */
+    context?: string;
+    /** Poll interval in ms. Default: 10000. */
+    intervalMs?: number;
+}
+/**
+ * Poll until a Kubernetes Deployment or StatefulSet named `name` is fully rolled out.
+ * Uses the `k8sWait` profile — 15m timeout.
+ *
+ * Progress goes to stdout, one line per poll, which is the executor's step-record
+ * channel: the local executor streams an activity's output alongside the step it
+ * belongs to, so a long rollout is visible without a liveness protocol. Nothing
+ * mid-run is durable here by design (chant #2114) — the op re-runs and converges.
+ *
+ * Deliberately NOT migrated onto the generic `waitForReady` (#957): `kubectl
+ * rollout status` encodes rollout-specific semantics — progress-deadline
+ * timeouts, partial/paused rollouts, generation tracking — that a status-field
+ * predicate spec does not replicate, and it targets built-in workloads rather
+ * than arbitrary operator CRDs. `waitForReady` is the right tool for CRD
+ * readiness; `waitForStack` stays the right tool for workload rollouts.
+ */
+export declare function waitForStack(args: WaitForStackArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=wait.d.ts.map

package/dist/op/activities/wait.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC9F"}

package/dist/op/activities/workflow-audit.d.ts

@@ -0,0 +1,92 @@
+/**
+ * workflowSupplyChainAudit — the live counterpart to the github post-synth
+ * supply-chain checks (#286-#291).
+ *
+ * Some workflow-reference checks can only be answered against a moving external
+ * truth: whether a pinned SHA still corresponds to a real tag/release upstream,
+ * whether a referenced commit exists in the repo it claims, whether a ref is
+ * confusable as both a tag and a branch, whether a pin matches its version
+ * comment, or whether a new advisory now covers an action already in use. These
+ * change over time independent of the source, so they cannot live in the
+ * deterministic build — this activity owns *only* the checks that require live
+ * resolution.
+ *
+ * It is dependency-free and primitives-only: it reads the emitted workflow YAML
+ * (passed as a string) and resolves references through an injectable
+ * `ActionRefResolver`, so `chant run` can schedule it and tests can run
+ * it against recorded responses with no live network.
+ */
+/** What the audit produces on findings, mirroring ReconcileOp's modes. */
+export type WorkflowAuditMode = "report" | "issue" | "pull-request";
+/** Live resolution of a single action reference against its upstream. */
+export interface ActionRefResolution {
+    /** Does the ref/SHA exist in the claimed repo? */
+    exists: boolean;
+    /** Tag/release names that point at this commit (empty for a SHA ⇒ stale pin). */
+    tags: string[];
+    /** Is the upstream repository archived? */
+    archived: boolean;
+    /** Disclosed advisory identifiers affecting this action. */
+    advisories: string[];
+    /** Is the ref resolvable as BOTH a tag and a branch upstream? */
+    ambiguousRef?: boolean;
+}
+/** Pluggable upstream resolver — overridden in tests with recorded responses. */
+export type ActionRefResolver = (slug: string, ref: string) => Promise<ActionRefResolution>;
+export type WorkflowAuditFindingKind = "stale-pin" | "impostor" | "ambiguous-ref" | "pin-comment-mismatch" | "advisory" | "archived";
+export interface WorkflowAuditFinding {
+    /** owner/repo slug. */
+    slug: string;
+    /** The pinned ref/SHA. */
+    ref: string;
+    kind: WorkflowAuditFindingKind;
+    detail: string;
+}
+export interface WorkflowAuditArgs {
+    /** One emitted workflow YAML document. */
+    yaml?: string;
+    /** Several emitted workflow YAML documents. */
+    yamls?: string[];
+    /**
+     * Directory of emitted workflow files (`*.yml`/`*.yaml`) to read at run time
+     * when no `yaml`/`yamls` is given — the form used inside a scheduled Op.
+     * Default `.github/workflows`.
+     */
+    workflowsDir?: string;
+    /** What to produce. Default: report. */
+    mode?: WorkflowAuditMode;
+    /** Injectable upstream resolver. Defaults to the live GitHub REST resolver. */
+    resolver?: ActionRefResolver;
+}
+export interface WorkflowAuditResult {
+    mode: WorkflowAuditMode;
+    findings: WorkflowAuditFinding[];
+    /** Markdown summary used as the PR/issue body or printed in report mode. */
+    summary: string;
+}
+interface CollectedRef {
+    slug: string;
+    ref: string;
+    /** Adjacent `# vX.Y.Z` comment, when present. */
+    comment?: string;
+}
+/**
+ * Collect external action references (`uses: owner/repo@ref`, with an optional
+ * trailing version comment) from a workflow YAML. Local (`./`) and `docker://`
+ * references are excluded.
+ */
+export declare function collectAuditRefs(yaml: string): CollectedRef[];
+/**
+ * Default resolver: query the GitHub REST API for whether the ref exists, what
+ * tags point at it, archive status, and advisories. Best-effort and resilient —
+ * a network/HTTP error yields an "unknown" resolution (exists=true, no findings)
+ * rather than a false positive.
+ */
+export declare const defaultActionRefResolver: ActionRefResolver;
+/**
+ * Resolve each pinned external reference in the emitted workflows against live
+ * upstreams and report drift.
+ */
+export declare function workflowSupplyChainAudit(args: WorkflowAuditArgs): Promise<WorkflowAuditResult>;
+export {};
+//# sourceMappingURL=workflow-audit.d.ts.map

package/dist/op/activities/workflow-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-audit.d.ts","sourceRoot":"","sources":["../../../src/op/activities/workflow-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAC;AAEpE,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,MAAM,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,2CAA2C;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iEAAiE;IACjE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE5F,MAAM,MAAM,wBAAwB,GAChC,WAAW,GACX,UAAU,GACV,eAAe,GACf,sBAAsB,GACtB,UAAU,GACV,UAAU,CAAC;AAEf,MAAM,WAAW,oBAAoB;IACnC,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,wBAAwB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAcD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAQ7D;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBA0BtC,CAAC;AAUF;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwCpG"}

package/dist/op/activity-contract-registry.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Activity contract registry — the schema-shaped sibling of
+ * `./activity-registry.ts` (chant #2101).
+ *
+ * `activity-contract.ts` left contract ownership per-caller on purpose: an
+ * activity declares its contract alongside its implementation, and whoever
+ * builds a contract map decides which activities it covers. What was missing
+ * was the other half of that arrangement, a way for the checks that validate
+ * Op steps to SEE a contract a lexicon declared. OPS012 and OPS013
+ * (`../lint/rules/op/`) walk every Op entity in the build, including steps
+ * calling `terraformPlan`, `k3sInstall`, `flyApply` or `gcpApply`, over
+ * core's own static table alone. Since #2122 moved those checks into core
+ * they fire on every project that declares an Op, so an Op built out of one
+ * lexicon's steps failed `chant build` outright even though `loadActivities`
+ * resolves the very same names at run time. Both terraform examples that
+ * carry an Op kept it outside `src/` because of the older, lexicon-hosted
+ * form of the same gap, which meant no example ever proved its Op builds.
+ *
+ * The resolution mirrors activities exactly, by convention:
+ * `@intentius/chant-lexicon-<name>/op/activity-contracts` is imported for
+ * every configured lexicon and every {@link ActivityContract} it exports is
+ * collected, keyed by the contract's declared `name`. A lexicon that ships
+ * no such module is skipped, the same way `loadActivities` skips one that
+ * contributes no activities. A plugin may also hand its contracts over
+ * directly through {@link LexiconActivityContractContributor}, for a lexicon
+ * whose contracts are not reachable at a subpath (a bundled single-file
+ * plugin, a project-local one).
+ *
+ * The merged map reaches a post-synth check as
+ * `PostSynthContext.activityContracts` (`../lint/post-synth.ts`), filled in
+ * by whoever runs the checks: `chant build`, `chant lint` and
+ * `check-lexicon`'s example harness all do. A check merges it over its own
+ * base table rather than replacing it, so a context that carries none (a
+ * hand-built one in a test) behaves exactly as before this existed.
+ */
+import { type ActivityContract } from "./activity-contract.js";
+/**
+ * The shape {@link loadActivityContracts} reads off a plugin: an optional
+ * member returning this lexicon's contracts directly, for one that cannot be
+ * reached by the subpath convention. Structural on purpose, so core's op
+ * layer does not depend on `../lexicon.ts`.
+ */
+export interface LexiconActivityContractContributor {
+    /** The lexicon's name, as in `@intentius/chant-lexicon-<name>`. */
+    name: string;
+    /** This lexicon's activity contracts, if it declares them in code rather than at the conventional subpath. */
+    activityContracts?(): ActivityContract[];
+}
+/**
+ * Build the activity-contract map for build-time validation: core's own
+ * contracts (`./activities/activity-contracts`, a static import so a project
+ * that has installed nothing but chant still gets them) plus every contract
+ * the named lexicons contribute.
+ *
+ * `lexicons` may be plain names or plugin-shaped objects; a plugin's
+ * `activityContracts()` is read after its conventional module, so a plugin
+ * that declares both wins on a name collision with itself. Across lexicons,
+ * last one in wins, which is the same rule `loadActivities` applies to
+ * implementations.
+ *
+ * Never throws: an absent lexicon, a missing subpath, or a plugin member that
+ * throws all leave the map as it was.
+ */
+export declare function loadActivityContracts(lexicons?: ReadonlyArray<string | LexiconActivityContractContributor>): Promise<Map<string, ActivityContract>>;
+/**
+ * Merge a check's own base contracts with the ones the build loaded, into the
+ * map `validateActivitySteps`/`validateStepOutputRefs` take. The loaded set
+ * wins on a name collision: it is the one resolved against the lexicons this
+ * build actually configured, whereas the base table is whatever the check
+ * imported statically.
+ *
+ * `loaded` being `undefined` is the ordinary case for a hand-built
+ * `PostSynthContext` and yields the base table unchanged.
+ */
+export declare function mergeActivityContracts(base: ReadonlyMap<string, ActivityContract>, loaded: ReadonlyMap<string, ActivityContract> | undefined): ReadonlyMap<string, ActivityContract>;
+//# sourceMappingURL=activity-contract-registry.d.ts.map

package/dist/op/activity-contract-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-contract-registry.d.ts","sourceRoot":"","sources":["../../src/op/activity-contract-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC;IACjD,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,8GAA8G;IAC9G,iBAAiB,CAAC,IAAI,gBAAgB,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,GAAE,aAAa,CAAC,MAAM,GAAG,kCAAkC,CAAM,GACxE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAwBxC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,GACxD,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAKvC"}

package/dist/op/activity-contract.d.ts

@@ -16,28 +16,35 @@
  * An activity declares a contract alongside its implementation — the same
  * "registration surface" the issue asked for (`activity-registry.ts`'s
  * `collectActivities` already does this for implementations; this is the
- * schema-shaped sibling). `chant build` — via a lexicon's own post-synth
- * check, e.g. the temporal lexicon's TMP012 — resolves each step's `fn`
- * against a contract map built the same way and validates `args` and
- * `outcomeAttribute.from`. A step whose `fn` has no registered contract is
- * skipped (not an error): this is deliberately incremental — a lexicon opts
- * an activity in by declaring a contract for it, and the k8s/aws/azure/gcp/
- * fly activity sets are expected to pick this up lexicon by lexicon rather
- * than all at once (see the issue's "worth checking this lands cleanly"
- * note).
+ * schema-shaped sibling). `chant build` resolves each step's `fn` against a
+ * contract map built from `Object.values()` of an activity-contracts module
+ * and validates `args` and `outcomeAttribute.from` — core's own OPS012
+ * (`../lint/rules/op/ops012-activity-contract.ts`, chant #2122) does this
+ * for every declared Op regardless of which lexicons are configured; a
+ * lexicon's own post-synth check can additionally validate against its own
+ * roster the same way (a lexicon-owned check did this before #2122 moved the
+ * op-model checks to core). A step whose `fn` has no registered
+ * contract is skipped (not an error): this is deliberately incremental — a
+ * contract map opts an activity in by declaring one for it, and the
+ * k8s/aws/azure/gcp/fly activity sets are expected to pick this up one at a
+ * time rather than all at once (see the issue's "worth checking this lands
+ * cleanly" note).
  *
- * Ownership is decentralized on purpose: each lexicon declares contracts for
- * the activities it implements and validates them with its own post-synth
- * check (the same `rulePrefix`-per-lexicon pattern every other check in
- * chant already uses), rather than a shared cross-lexicon registry. A
- * `Temporal::Op` step can call an activity contributed by any lexicon, and
- * `PostSynthContext.entities` already carries the whole resolved graph to
- * every lexicon's checks, so no new plumbing is needed for that to work.
+ * Ownership of a contract map is per-caller, not a shared cross-lexicon
+ * registry: whoever builds the map (core's OPS012/OPS013, or a lexicon's own
+ * check) decides which activities it covers. A `Chant::Op` step can call an
+ * activity contributed by any lexicon, and `PostSynthContext.entities`
+ * already carries the whole resolved graph to every check, so no new
+ * plumbing is needed for that to work.
  */
 import { z } from "zod";
 import type { OpConfig } from "./types.js";
-/** Every literal value {@link ActivityStep.profile} may hold. Kept in sync with `types.ts`'s `ActivityStep["profile"]`. */
-export declare const KNOWN_ACTIVITY_PROFILES: readonly ["fastIdempotent", "longInfra", "k8sWait", "humanGate", "argoSync", "policyCheck"];
+/**
+ * Every literal value {@link ActivityStep.profile} may hold, read off
+ * {@link ACTIVITY_PROFILES} itself so the runtime list cannot drift from the
+ * table the type is derived from.
+ */
+export declare const KNOWN_ACTIVITY_PROFILES: ("fastIdempotent" | "longInfra" | "k8sWait" | "humanGate" | "argoSync" | "policyCheck")[];
 declare const CONTRACT_BRAND: unique symbol;
 /**
  * A registered activity's args/return schemas — the declaration that lets

package/dist/op/activity-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-contract.d.ts","sourceRoot":"","sources":["../../src/op/activity-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAiD,MAAM,SAAS,CAAC;AAEvF,2HAA2H;AAC3H,eAAO,MAAM,uBAAuB,6FAO1B,CAAC;AAEX,QAAA,MAAM,cAAc,eAA0C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB,CAAC,IAAI,GAAG,OAAO,EAAE,MAAM,GAAG,OAAO;IAChE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;IAChC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,oCAAoC;AACpC,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,CAAC,CAAC,UAAU,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,KAAK,EACzG,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE,YAAY,EACtB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7B,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,CAQ5G;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,IAAI,CAIhH;AAID,MAAM,WAAW,qBAAqB;IACpC,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;CACjB;AAmCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,SAAS,CASxG;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAQrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC,EACvD,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC/C,qBAAqB,EAAE,CA+CzB"}
+{"version":3,"file":"activity-contract.d.ts","sourceRoot":"","sources":["../../src/op/activity-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAiD,MAAM,SAAS,CAAC;AAGvF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,2FAAyB,CAAC;AAE9D,QAAA,MAAM,cAAc,eAA0C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB,CAAC,IAAI,GAAG,OAAO,EAAE,MAAM,GAAG,OAAO;IAChE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;IAChC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,oCAAoC;AACpC,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,CAAC,CAAC,UAAU,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,KAAK,EACzG,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE,YAAY,EACtB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7B,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,CAQ5G;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,IAAI,CAIhH;AAID,MAAM,WAAW,qBAAqB;IACpC,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;CACjB;AAmCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,SAAS,CASxG;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAQrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC,EACvD,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC/C,qBAAqB,EAAE,CAiDzB"}

package/dist/op/activity-failure.d.ts

@@ -0,0 +1,28 @@
+/**
+ * A terminal activity failure.
+ *
+ * Some activities fail deterministically: an organizational policy violation
+ * (`policyGate`) or a cfn-guard finding (`guardValidate`) reads the same on the
+ * second attempt as on the first, so a retry only delays the report. Those
+ * activities used to raise an orchestrator SDK's non-retryable failure type,
+ * which put that SDK on the import path of every base activity. Core owns the
+ * base activities now (chant #2114), and depends on no runtime SDK — this is
+ * the same signal in a plain `Error`.
+ *
+ * `name` is the failure type, not the class name, so the local executor's
+ * `retry.nonRetryableErrorTypes` (which matches on `Error.name`) can name it in
+ * a profile. `type` and `nonRetryable` are kept alongside it because that is
+ * the shape callers and tests already read.
+ */
+export declare class NonRetryableActivityError extends Error {
+    /** Failure type, e.g. `"PolicyViolation"`. Also this error's `name`. */
+    readonly type: string;
+    /** Always true — present so a caller can branch without an `instanceof`. */
+    readonly nonRetryable = true;
+    constructor(message: string, 
+    /** Failure type, e.g. `"PolicyViolation"`. Also this error's `name`. */
+    type: string);
+}
+/** Build a {@link NonRetryableActivityError} — a non-retryable failure with no SDK behind it. */
+export declare function nonRetryableFailure(message: string, type: string): NonRetryableActivityError;
+//# sourceMappingURL=activity-failure.d.ts.map

package/dist/op/activity-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-failure.d.ts","sourceRoot":"","sources":["../../src/op/activity-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAMhD,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM;IANvB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,QAAQ;gBAG3B,OAAO,EAAE,MAAM;IACf,wEAAwE;IAC/D,IAAI,EAAE,MAAM;CAKxB;AAED,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,yBAAyB,CAE5F"}