@intentius/chant 0.57.0 → 0.58.0

package/dist/op/composites/converge-op.d.ts

@@ -0,0 +1,120 @@
+/**
+ * ConvergeOp composite (#1484, epic #1487 feature 1) — the executable
+ * runbook. Observe, classify against a typed rule table, dispatch to
+ * declared ops within a per-tick budget, record, rest. Peer to `WatchOp` /
+ * `ReconcileOp` / `ApplyOp` — same `{ op }` shape, with the cadence on the
+ * Op itself (#2120).
+ *
+ * Phases: `Observe` (snapshot + a quick live diff, exactly `WatchOp`'s own
+ * shape, for the `Drift` outcome and per-phase visibility) ->
+ * `Converge` (one `convergeTick` activity call —
+ * ../activities/converge.ts — that does classify + dispatch + record;
+ * see that module's doc for why this can't be split into further static
+ * phases). `Observe`'s drift signal threads into `Converge`'s args via a
+ * step-output reference (#1290), not a search-attribute round-trip.
+ *
+ * @example
+ * ```typescript
+ * import { ConvergeOp, eq, gt, run, report, when } from "@intentius/chant/op";
+ * import type { ConvergeSymptom } from "@intentius/chant/lifecycle/symptoms";
+ *
+ * export const { op } = ConvergeOp({
+ *   name: "fountain-converge",
+ *   env: "staging",
+ *   dial: "apply",
+ *   schedule: "*\/10 * * * *",
+ *   rules: [
+ *     when<ConvergeSymptom>(eq("status", "drifted"), run("fountain-apply"), {
+ *       id: "drift-apply",
+ *       why: "Live config drifted from declared source; re-apply converges it back.",
+ *     }),
+ *     when<ConvergeSymptom>(gt("adoptCount", 0), report("unowned resources present"), {
+ *       id: "adopt-report",
+ *       why: "An unowned resource is reported for a human to review — never auto-claimed.",
+ *     }),
+ *     when<ConvergeSymptom>(eq("status", "unknown"), report("environment could not be fully observed"), {
+ *       id: "unknown-report",
+ *       why: "unknown never remediates — a partial read is a hole to report, not a guess to act on.",
+ *     }),
+ *   ],
+ * });
+ * ```
+ *
+ * @see #1484, #1487
+ */
+import type { OpResource } from "../resource.js";
+import { type ConvergeRule } from "../converge-rule.js";
+import type { ConvergeSymptom } from "../../lifecycle/symptoms.js";
+/**
+ * Authority level for this ConvergeOp's environment — issue #1484's own
+ * Autonomy table (dial × verb class):
+ *
+ * | verb class  | observe     | reconcile        | apply                 |
+ * |-------------|-------------|------------------|------------------------|
+ * | read-only   | free-run    | free-run         | free-run               |
+ * | mutating    | report only | open PR          | run, gated per op      |
+ * | destructive | refused     | refused          | always gated           |
+ *
+ * `ConvergeOp` adds no authority an environment did not already grant.
+ * Default `"observe"` — not autonomous by default (issue: "a ConvergeOp in
+ * an observe environment is a report generator").
+ *
+ * **v1 implements a conservative subset of this table**, not the whole
+ * thing (pre-merge review of #1954 caught the gap between what the code did
+ * and what this table says — this doc now matches the issue, and the code
+ * matches this doc):
+ *
+ * | verb class  | observe     | reconcile                          | apply                              |
+ * |-------------|-------------|-------------------------------------|--------------------------------------|
+ * | read-only   | free-run    | free-run                            | free-run                             |
+ * | mutating    | report only | **refused at build (OPS014)**       | run                                   |
+ * | destructive | refused     | refused                              | **refused at build (OPS014), v1**   |
+ *
+ * - **`reconcile` × mutating is "open PR" in the issue's table — not yet
+ *   implemented.** Building that channel (reusing `ReconcileOp`'s
+ *   `onDrift: "pull-request" | "issue" | "report"`) is out of v1 scope — see
+ *   `../converge-rule.ts`'s `ReportAction` doc and epic #1487's
+ *   onDrift-channel open question. Until it exists, a rule that would
+ *   dispatch a mutating op under `reconcile` is refused at build
+ *   (`OPS014`), not silently escalated to "run directly" the way `apply`
+ *   would. A runtime backstop in `convergeTick`
+ *   (`../activities/converge.ts`) re-checks the same thing at dispatch
+ *   time, for a rule table that reached the tick without going through that
+ *   build.
+ * - **`apply` × destructive is refused outright in v1, gate or not.** The
+ *   issue's table says "always gated", but the dispatch executor can't
+ *   honor a gate: `dispatchOp` shells `chant run <op>`, and a gated run ends
+ *   pending approval (#2119) rather than continuing — so
+ *   "destructive + apply + gated" reads as a path to dispatch but was a
+ *   dead cell: it could never actually succeed. `OPS014` refuses the rule
+ *   instead of shipping a path guaranteed to fail every time it's exercised.
+ *   Gated dispatch that waits for the approval is #1485's design to own.
+ */
+export type ConvergeDial = "observe" | "reconcile" | "apply";
+export interface ConvergeOpConfig {
+    /** Op name (kebab-case). Names the Op's output directory and is what `chant run` takes. */
+    name: string;
+    /** Environment to converge (e.g. "staging"). */
+    env: string;
+    /** @default "observe" */
+    dial?: ConvergeDial;
+    /** Max number of `run` dispatches per tick — the issue's "the worst tick is bounded" (Accessible Ops factor VI). Rules matched beyond the budget are recorded, not run. @default 3 */
+    budget?: number;
+    /** The rule table — build with `when()`/`eq()`/`run()`/`report()` from `@intentius/chant/op`. Non-empty; every rule id must be unique. */
+    rules: ConvergeRule<ConvergeSymptom>[];
+    /**
+     * Cron expression. When set, it lands on the Op as `schedule` — the cadence
+     * `chant operator` ticks this Op on and the CI generators render; omit for
+     * one-shot `chant run` on the local executor, also the test story (issue:
+     * "one-shot runnable locally for a single tick").
+     */
+    schedule?: string;
+    /** Run `chant lifecycle diff --live` in the Observe phase (queries live state). @default true */
+    live?: boolean;
+}
+export interface ConvergeOpResources {
+    /** Op resource — the observe-then-converge Op. */
+    op: InstanceType<typeof OpResource>;
+}
+export declare function ConvergeOp(config: ConvergeOpConfig): ConvergeOpResources;
+//# sourceMappingURL=converge-op.d.ts.map

package/dist/op/composites/converge-op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge-op.d.ts","sourceRoot":"","sources":["../../../src/op/composites/converge-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAGhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,sLAAsL;IACtL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0IAA0I;IAC1I,KAAK,EAAE,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iGAAiG;IACjG,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,mBAAmB,CAwFxE"}

package/dist/op/composites/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The Op composites (#2120) — the named verbs an operator authors instead of
+ * hand-writing phases: watch, reconcile, apply, converge, and the three audit
+ * runners.
+ *
+ * They lived in a hosting lexicon while a cadence meant a scheduler resource;
+ * now that the cadence is `OpConfig.schedule` they are runtime-neutral, each
+ * returns `{ op }`, and nothing here imports a hosting lexicon. A project that
+ * wants a real scheduler resource pairs one with the Op by hand (the pattern
+ * `lexicons/cedar/src/dogwood/replay-op.ts` documents).
+ */
+export { WatchOp } from "./watch-op.js";
+export type { WatchOpConfig, WatchOpResources } from "./watch-op.js";
+export { ReconcileOp } from "./reconcile-op.js";
+export type { ReconcileOpConfig, ReconcileOpResources } from "./reconcile-op.js";
+export { ApplyOp } from "./apply-op.js";
+export type { ApplyOpConfig, ApplyOpResources } from "./apply-op.js";
+export { ConvergeOp } from "./converge-op.js";
+export type { ConvergeOpConfig, ConvergeOpResources, ConvergeDial } from "./converge-op.js";
+export { WorkflowAuditOp } from "./workflow-audit-op.js";
+export type { WorkflowAuditOpConfig, WorkflowAuditOpResources } from "./workflow-audit-op.js";
+export { PipelineAuditOp } from "./pipeline-audit-op.js";
+export type { PipelineAuditOpConfig, PipelineAuditOpResources } from "./pipeline-audit-op.js";
+export { LexiconUpgradeOp, IN_SCOPE_LEXICONS } from "./lexicon-upgrade-op.js";
+export type { LexiconUpgradeOpConfig, LexiconUpgradeOpResources } from "./lexicon-upgrade-op.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/op/composites/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/composites/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/op/composites/lexicon-upgrade-op.d.ts

@@ -0,0 +1,78 @@
+/**
+ * LexiconUpgradeOp composite — the runner that dogfoods chant to keep each
+ * in-scope lexicon current with its upstream spec (#527, epic #523).
+ *
+ * The shared tooling (#524) does the regen + surface-diff; the pinned (#525)
+ * and rolling (#526) pipelines do the detection. This Op wires them into an
+ * audit-style operational layer, modeled on `WorkflowAuditOp` / `PipelineAuditOp`:
+ * phases detect → run the right check for the lexicon → surface-diff → finding.
+ *
+ * It runs one-shot on the **local Op executor** via `chant run` — nothing
+ * durable is required for an upgrade check (the scheduled CI runner is the
+ * trigger). A `schedule` may still be supplied for continuous re-check; it
+ * lands on the Op itself (#2120).
+ *
+ * Lexicon classification (which check the activity dispatches to):
+ *   PINNED  {k8s, gcp, docker, gitlab} → checkPinnedUpgrade
+ *   ROLLING {aws, azure, github}       → checkRollingUpgrade
+ * helm / forgejo are excluded — no upstream spec.
+ *
+ * Finding-modes mirror ReconcileOp: `report` (default, no external services)
+ * | `issue` | `pull-request`. For the epic goal, `pull-request` opens/updates a
+ * long-lived branch per lexicon.
+ *
+ * @example
+ * ```typescript
+ * // one-shot, local executor, report only
+ * export const { op } = LexiconUpgradeOp({ lexicon: "aws" });
+ *
+ * // weekly, opening a PR when an upgrade is ready
+ * export const { op } = LexiconUpgradeOp({
+ *   lexicon: "k8s",
+ *   schedule: "0 6 * * 1",
+ *   onFinding: "pull-request",
+ * });
+ * ```
+ *
+ * @see #524 — shared regen-validate + surface-diff tooling.
+ * @see #525 — pinned-version bump pipeline.
+ * @see #526 — rolling-spec drift pipeline.
+ */
+import type { OpResource } from "../resource.js";
+import type { LexiconUpgradeMode, SupportedLexicon } from "../activities/lexicon-upgrade.js";
+/** The in-scope lexicons. helm / forgejo are excluded (no upstream spec). */
+export declare const IN_SCOPE_LEXICONS: readonly SupportedLexicon[];
+export interface LexiconUpgradeOpConfig {
+    /** Which in-scope lexicon to check. */
+    lexicon: SupportedLexicon;
+    /**
+     * Op name (kebab-case). Names the Op's output directory and is what `chant
+     * run` takes. Defaults to `<lexicon>-upgrade`.
+     */
+    name?: string;
+    /**
+     * Cron expression. When set, it lands on the Op as `schedule` for
+     * continuous re-check; omit for one-shot `chant run` on the local executor.
+     */
+    schedule?: string;
+    /**
+     * Absolute path to the lexicon root, forwarded to the activity. Defaults to
+     * `<cwd>/lexicons/<lexicon>` at run time.
+     */
+    lexiconDir?: string;
+    /**
+     * What to produce on findings. Default: "report".
+     * @default "report"
+     */
+    onFinding?: LexiconUpgradeMode;
+}
+export interface LexiconUpgradeOpResources {
+    /** Op resource — the upgrade Op, emitted on `chant build`. */
+    op: InstanceType<typeof OpResource>;
+}
+/**
+ * Build a LexiconUpgradeOp for one lexicon. Rejects out-of-scope lexicons at
+ * construction time so a typo never silently produces a no-op Op.
+ */
+export declare function LexiconUpgradeOp(config: LexiconUpgradeOpConfig): LexiconUpgradeOpResources;
+//# sourceMappingURL=lexicon-upgrade-op.d.ts.map

package/dist/op/composites/lexicon-upgrade-op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexicon-upgrade-op.d.ts","sourceRoot":"","sources":["../../../src/op/composites/lexicon-upgrade-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE1F,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,EAAE,SAAS,gBAAgB,EAU/C,CAAC;AAEX,MAAM,WAAW,sBAAsB;IACrC,uCAAuC;IACvC,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAyC1F"}

package/dist/op/composites/pipeline-audit-op.d.ts

@@ -0,0 +1,50 @@
+/**
+ * PipelineAuditOp composite — the live include/component audit of GitLab
+ * pipelines as a chant Op with an optional schedule (#303).
+ *
+ * The gitlab post-synth checks (#297) own everything answerable from the
+ * deterministic build. This Op owns *only* the checks that require live
+ * resolution against a moving upstream truth — a pinned component/include ref
+ * that no longer resolves, an archived or moved upstream project, or a new
+ * advisory covering a component/image in use. It sits at **observe** on the
+ * lifecycle dial, with a finding-mode (`report | issue | merge-request`) as the
+ * **reconcile** step — for GitLab the PR mode is a merge request.
+ *
+ * Runs one-shot on the local Op executor via `chant run`; a `schedule` puts
+ * the cadence on the Op itself (#2120).
+ *
+ * @example
+ * ```typescript
+ * export const { op } = PipelineAuditOp({
+ *   name: "pipeline-audit",
+ *   schedule: "0 6 * * *",
+ *   onFinding: "merge-request",
+ * });
+ * ```
+ *
+ * @see #297 — the deterministic counterpart this freshens.
+ */
+import type { OpResource } from "../resource.js";
+import type { PipelineAuditMode } from "../activities/pipeline-audit.js";
+export interface PipelineAuditOpConfig {
+    /** Op name (kebab-case). Names the Op's output directory and is what `chant run` takes. */
+    name: string;
+    /** Cron expression. When set, it lands on the Op as `schedule`; omit for one-shot. */
+    schedule?: string;
+    /**
+     * Path to the emitted `.gitlab-ci.yml` to audit at run time.
+     * @default ".gitlab-ci.yml"
+     */
+    pipelineFile?: string;
+    /**
+     * What to produce on findings. Default: "report".
+     * @default "report"
+     */
+    onFinding?: PipelineAuditMode;
+}
+export interface PipelineAuditOpResources {
+    /** Op resource — the audit Op, emitted on `chant build`. */
+    op: InstanceType<typeof OpResource>;
+}
+export declare function PipelineAuditOp(config: PipelineAuditOpConfig): PipelineAuditOpResources;
+//# sourceMappingURL=pipeline-audit-op.d.ts.map

package/dist/op/composites/pipeline-audit-op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-audit-op.d.ts","sourceRoot":"","sources":["../../../src/op/composites/pipeline-audit-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,GAAG,wBAAwB,CAwBvF"}

package/dist/op/composites/reconcile-op.d.ts

@@ -0,0 +1,57 @@
+/**
+ * ReconcileOp composite — the cloud → code workflow as an Op.
+ *
+ * Keeps source tracking reality: when live drifts from declarations, open a PR
+ * that regenerates the affected TypeScript. Mirrors the {@link WatchOp} shape.
+ *
+ * Phases: snapshot → plan → regenerate (live import) → open PR. The
+ * regenerate-and-PR step is the `reconcilePr` activity (#122), which derives
+ * the change set from `chant lifecycle plan` and opens a reviewable PR.
+ *
+ * Runs one-shot on the local Op executor for a `chant run`; with a `schedule`
+ * the cadence rides on the Op itself (#2120) for whichever runtime honours it.
+ *
+ * @example
+ * ```typescript
+ * // one-shot, local executor
+ * export const { op } = ReconcileOp({ name: "prod-reconcile", env: "prod" });
+ *
+ * // hourly
+ * export const { op } = ReconcileOp({
+ *   name: "prod-reconcile",
+ *   env: "prod",
+ *   schedule: "0 * * * *",
+ *   scope: { owned: true },
+ * });
+ * ```
+ *
+ * @see #112 — stateless-authoritative state model + live import
+ */
+import type { OpResource } from "../resource.js";
+import type { ReconcileMode } from "../activities/reconcile.js";
+export interface ReconcileOpConfig {
+    /** Op name (kebab-case). Names the Op's output directory and is what `chant run` takes. */
+    name: string;
+    /** Environment to reconcile (e.g. "prod"). */
+    env: string;
+    /**
+     * Cron expression. When set, it lands on the Op as `schedule`; omit for
+     * one-shot `chant run` on the local executor.
+     */
+    schedule?: string;
+    /**
+     * What to produce on drift. Default: "pull-request".
+     * @default "pull-request"
+     */
+    onDrift?: ReconcileMode;
+    /** Restrict reconciliation to chant-owned resources. */
+    scope?: {
+        owned?: boolean;
+    };
+}
+export interface ReconcileOpResources {
+    /** Op resource — the snapshot→plan→regenerate→PR Op. */
+    op: InstanceType<typeof OpResource>;
+}
+export declare function ReconcileOp(config: ReconcileOpConfig): ReconcileOpResources;
+//# sourceMappingURL=reconcile-op.d.ts.map

package/dist/op/composites/reconcile-op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-op.d.ts","sourceRoot":"","sources":["../../../src/op/composites/reconcile-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,WAAW,iBAAiB;IAChC,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,wDAAwD;IACxD,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,oBAAoB,CAgD3E"}

package/dist/op/composites/watch-op.d.ts

@@ -0,0 +1,60 @@
+/**
+ * WatchOp composite — periodic state observation as an Op.
+ *
+ * Composes existing pieces:
+ *   - The local executor (`../local-executor.ts`) runs the phases in order and
+ *     files each step's record under the phase it belongs to
+ *   - The pre-built lifecycleSnapshot + lifecycleDiff activities
+ *   - `schedule` puts the cadence on the Op itself (#2120)
+ *
+ * The cron is Op data, not a resource: `chant operator` ticks on it, the
+ * github/gitlab/forgejo generators render it as a CI cron, and a hosting
+ * lexicon hands it to its own scheduler.
+ *
+ * @example
+ * ```typescript
+ * export const { op } = WatchOp({
+ *   name: "prod-watch",
+ *   env: "prod",
+ *   schedule: "0,15,30,45 * * * *", // every 15 minutes
+ * });
+ * ```
+ *
+ * @see #31 — Continuous observation (the issue this composite addresses)
+ */
+import type { OpResource } from "../resource.js";
+import type { EffectReceiptDeclaration } from "../../effect-receipt.js";
+export interface WatchOpConfig {
+    /** Op name (kebab-case). Names the Op's output directory and is what `chant run` takes. */
+    name: string;
+    /** Environment to snapshot + diff (e.g. "prod"). */
+    env: string;
+    /**
+     * Cron expression controlling how often the watch runs. Omit for a
+     * one-shot `chant run` on the local executor.
+     * @example "0,15,30,45 * * * *" — every 15 minutes
+     * @example "0 * * * *" — hourly
+     */
+    schedule?: string;
+    /**
+     * Run `chant lifecycle diff --live` (queries cloud APIs) instead of the
+     * default digest-only diff. Recommended for real drift detection.
+     * @default true
+     */
+    live?: boolean;
+    /**
+     * Effect receipts to check for staleness between change windows (#1834,
+     * epic #1703). Typed references only — import each EffectReceipt const.
+     * Read-only: the watch reads each receipt through the receipt store
+     * (provided by the receipt row's lexicon, #1835) and reports absent or
+     * differing values as findings. It never runs an effect and never writes
+     * a receipt — the `effect()` step is the sole writer.
+     */
+    receipts?: EffectReceiptDeclaration[];
+}
+export interface WatchOpResources {
+    /** Op resource — the snapshot+diff Op, emitted on `chant build`. */
+    op: InstanceType<typeof OpResource>;
+}
+export declare function WatchOp(config: WatchOpConfig): WatchOpResources;
+//# sourceMappingURL=watch-op.d.ts.map

package/dist/op/composites/watch-op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch-op.d.ts","sourceRoot":"","sources":["../../../src/op/composites/watch-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,WAAW,aAAa;IAC5B,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CA2C/D"}

package/dist/op/composites/workflow-audit-op.d.ts

@@ -0,0 +1,57 @@
+/**
+ * WorkflowAuditOp composite — the live supply-chain audit of GitHub workflows
+ * as a chant Op with an optional schedule (#292).
+ *
+ * The github post-synth checks (#286-#291) own everything answerable from the
+ * deterministic build. This Op owns *only* the checks that require live
+ * resolution against a moving upstream truth — stale SHA pins, impostor refs,
+ * symbolic-ref confusion, pin/comment mismatch, advisories, archived upstreams.
+ * It sits at **observe** on the lifecycle dial, with a finding-mode (mirroring
+ * `ReconcileOp`: `report | issue | pull-request`) as the **reconcile** step.
+ *
+ * Runs one-shot on the local Op executor via `chant run`; a `schedule` puts
+ * the cadence on the Op itself (#2120), for continuous re-audit between
+ * change windows.
+ *
+ * @example
+ * ```typescript
+ * // one-shot, local executor
+ * export const { op } = WorkflowAuditOp({ name: "actions-audit" });
+ *
+ * // daily, opening a PR that bumps a stale pin
+ * export const { op } = WorkflowAuditOp({
+ *   name: "actions-audit",
+ *   schedule: "0 6 * * *",
+ *   onFinding: "pull-request",
+ * });
+ * ```
+ *
+ * @see #286 — the deterministic counterpart this freshens.
+ */
+import type { OpResource } from "../resource.js";
+import type { WorkflowAuditMode } from "../activities/workflow-audit.js";
+export interface WorkflowAuditOpConfig {
+    /** Op name (kebab-case). Names the Op's output directory and is what `chant run` takes. */
+    name: string;
+    /**
+     * Cron expression. When set, it lands on the Op as `schedule` for
+     * continuous re-audit; omit for one-shot `chant run` on the local executor.
+     */
+    schedule?: string;
+    /**
+     * Directory of emitted workflow files to audit at run time.
+     * @default ".github/workflows"
+     */
+    workflowsDir?: string;
+    /**
+     * What to produce on findings. Default: "report".
+     * @default "report"
+     */
+    onFinding?: WorkflowAuditMode;
+}
+export interface WorkflowAuditOpResources {
+    /** Op resource — generates the audit workflow on `chant build`. */
+    op: InstanceType<typeof OpResource>;
+}
+export declare function WorkflowAuditOp(config: WorkflowAuditOpConfig): WorkflowAuditOpResources;
+//# sourceMappingURL=workflow-audit-op.d.ts.map

package/dist/op/composites/workflow-audit-op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-audit-op.d.ts","sourceRoot":"","sources":["../../../src/op/composites/workflow-audit-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,GAAG,wBAAwB,CA2BvF"}

package/dist/op/converge-rule.d.ts

@@ -5,10 +5,10 @@
  * The issue's illustrative sketch writes a rule's condition as a JS arrow
  * function (`s => s.status === "drifted"`). That reads well but can't
  * actually ship: a rule is evaluated per-tick against live, freshly-observed
- * data inside a Temporal activity, and an activity's arguments — including
- * whatever a `ConvergeOp` composite bakes into its generated workflow — must
- * be plain JSON (see `step-output-ref.ts`'s module doc on why a value
- * crossing the workflow/activity boundary can't carry a closure). A rule
+ * data inside an activity, and an activity's arguments — including whatever a
+ * `ConvergeOp` composite bakes into the Op it builds — must be plain JSON (see
+ * `step-output-ref.ts`'s module doc on why a value crossing an activity
+ * boundary can't carry a closure). A rule
  * "outside the evaluable subset" is one of the build-time refusals #1484
  * names explicitly, which only makes sense if there IS an evaluable subset
  * to be outside of — so rules here are data: a small comparison language
@@ -25,7 +25,8 @@
  * produces" refusal, satisfied for free. {@link isWellFormedPredicate} is the
  * runtime backstop for a rule assembled by hand (bypassing `when()`/the
  * comparison builders) rather than authored through them, and is what a
- * build-time check (TMP014) re-validates the serialized rule table against.
+ * build-time check (OPS014, ../lint/rules/op/ops014-converge-rule-refusals.ts)
+ * re-validates the serialized rule table against.
  */
 /** Comparison operators over a single symptom field. */
 export type FieldComparisonOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte";
@@ -59,8 +60,9 @@ export interface AnyOfPredicate<S> {
 export type SymptomPredicate<S> = FieldComparisonPredicate<S> | FieldTruthinessPredicate<S> | AllOfPredicate<S> | AnyOfPredicate<S>;
 /**
  * Structural validator for a value claiming to be a {@link SymptomPredicate}
- * — the runtime backstop `TMP014` (lexicons/temporal's post-synth check)
- * re-checks a serialized rule table against, since nothing forces a rule
+ * — the runtime backstop OPS014
+ * (../lint/rules/op/ops014-converge-rule-refusals.ts) re-checks a serialized
+ * rule table against, since nothing forces a rule
  * assembled by hand (rather than through the builders below) to match this
  * shape. Recurses through `allOf`/`anyOf`; `fieldWhitelist`, when given,
  * additionally refuses a field name the symptom record doesn't actually
@@ -75,9 +77,9 @@ export declare function evaluatePredicate<S>(predicate: SymptomPredicate<S>, sym
  * Does a predicate reference the given symptom field anywhere in it,
  * recursing through `allOf`/`anyOf`? The build-time backstop for a claim
  * about a *category* of rule (e.g. "a rule reading `adoptCount`") rather
- * than a single comparison — `TMP014`'s adopt-safety check
- * (../../../lexicons/temporal/src/lint/post-synth/tmp014-converge-rule-refusals.ts)
- * uses this to refuse a rule that both reads `adoptCount` and dispatches a
+ * than a single comparison — OPS014's adopt-safety check
+ * (../lint/rules/op/ops014-converge-rule-refusals.ts) uses this to refuse a
+ * rule that both reads `adoptCount` and dispatches a
  * mutating op, rather than merely documenting that authors shouldn't write
  * one.
  */

package/dist/op/converge-rule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-rule.d.ts","sourceRoot":"","sources":["../../src/op/converge-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;AAE3E,4EAA4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnD,MAAM,WAAW,wBAAwB,CAAC,CAAC;IACzC,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IACxB,EAAE,EAAE,iBAAiB,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB,CAAC,CAAC;IACzC,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IACxB,EAAE,EAAE,iBAAiB,CAAC;CACvB;AAED,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAC1B,wBAAwB,CAAC,CAAC,CAAC,GAC3B,wBAAwB,CAAC,CAAC,CAAC,GAC3B,cAAc,CAAC,CAAC,CAAC,GACjB,cAAc,CAAC,CAAC,CAAC,CAAC;AAKtB;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAyBnG;AAED,qGAAqG;AACrG,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAiCxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CASlG;AAID,wBAAgB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE5G;AACD,wBAAgB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE7G;AACD,wBAAgB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAEzF;AACD,wBAAgB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE1F;AACD,wBAAgB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAEzF;AACD,wBAAgB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE1F;AACD,wBAAgB,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE9E;AACD,wBAAgB,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE7E;AACD,wBAAgB,KAAK,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAEhF;AACD,wBAAgB,KAAK,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAEhF;AAID;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,KAAK,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;AAElD,wBAAgB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,CAEzC;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAEnD;AAID,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,+IAA+I;IAC/I,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,oIAAoI;IACpI,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,IAAI,CAAC,CAAC,EACpB,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC9B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD,YAAY,CAAC,CAAC,CAAC,CAiBjB;AAED,sHAAsH;AACtH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAQtE"}
+{"version":3,"file":"converge-rule.d.ts","sourceRoot":"","sources":["../../src/op/converge-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;AAE3E,4EAA4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnD,MAAM,WAAW,wBAAwB,CAAC,CAAC;IACzC,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IACxB,EAAE,EAAE,iBAAiB,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB,CAAC,CAAC;IACzC,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IACxB,EAAE,EAAE,iBAAiB,CAAC;CACvB;AAED,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAC1B,wBAAwB,CAAC,CAAC,CAAC,GAC3B,wBAAwB,CAAC,CAAC,CAAC,GAC3B,cAAc,CAAC,CAAC,CAAC,GACjB,cAAc,CAAC,CAAC,CAAC,CAAC;AAKtB;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAyBnG;AAED,qGAAqG;AACrG,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAiCxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CASlG;AAID,wBAAgB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE5G;AACD,wBAAgB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE7G;AACD,wBAAgB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAEzF;AACD,wBAAgB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE1F;AACD,wBAAgB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAEzF;AACD,wBAAgB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE1F;AACD,wBAAgB,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE9E;AACD,wBAAgB,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAE7E;AACD,wBAAgB,KAAK,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAEhF;AACD,wBAAgB,KAAK,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAEhF;AAID;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,KAAK,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;AAElD,wBAAgB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,CAEzC;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAEnD;AAID,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,+IAA+I;IAC/I,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,oIAAoI;IACpI,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,IAAI,CAAC,CAAC,EACpB,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC9B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD,YAAY,CAAC,CAAC,CAAC,CAiBjB;AAED,sHAAsH;AACtH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAQtE"}

package/dist/op/cron.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Cron for an Op's own schedule (#2120) — validation at `Op()` construction
+ * and minute-granularity matching for `chant operator`'s per-op cadence.
+ *
+ * `OpConfig.schedule.cron` is runtime-neutral data: the github lexicon turns
+ * it into `on.schedule`, a hosting lexicon hands it to its own scheduler,
+ * `chant operator` reads it as that Op's tick cadence, and the local one-shot
+ * executor ignores it entirely. Nothing here talks to a scheduler.
+ *
+ * The validator a lexicon's own post-synth cron check imports rather than
+ * keeping its own copy:
+ * deliberately permissive, a pre-submission guard rather than a full parser,
+ * since the final word belongs to whichever scheduler runs the cron.
+ *
+ * {@link cronMatches} is stricter about what it can *evaluate* than
+ * {@link isValidCronExpression} is about what it accepts, so a field carrying
+ * a Quartz extension the evaluator does not implement (`L`, `W`, `#`, `?`)
+ * matches everything rather than nothing — an operator that ticks too often
+ * is a wasted converge, one that never ticks is a silent outage.
+ */
+/**
+ * True when `expr` looks like 5- or 6-field cron. Field-shape only: it does
+ * not check that a number is in range for its position, and it accepts the
+ * Quartz extensions (`L`, `W`, `#`, `?`) some schedulers take.
+ */
+export declare function isValidCronExpression(expr: string): boolean;
+/**
+ * The message `Op()` throws with and a lexicon's post-synth cron check
+ * reports, so one wording covers both the build-time refusal and the
+ * post-synth diagnostic.
+ */
+export declare function cronSyntaxMessage(expr: string): string;
+/**
+ * True when `date` falls on a minute `expr` fires at, in the host's local
+ * time zone (the only clock the operator daemon has).
+ *
+ * A 6-field expression is read as Quartz's `second minute hour dom month dow`
+ * and the seconds field is dropped — nothing in chant ticks sub-minute.
+ * Day-of-month and day-of-week follow the usual cron rule: when both are
+ * restricted, either one matching is enough.
+ */
+export declare function cronMatches(expr: string, date: Date): boolean;
+/**
+ * True when `expr` fires at some minute in `(after, upTo]` — what a round
+ * asks for an Op it last ticked at `after`. Level-triggered on purpose: a
+ * round that arrives late still ticks the Op it owes rather than waiting for
+ * the next exact match, and several missed fires collapse into the one tick a
+ * convergent verb needs.
+ */
+export declare function cronDueBetween(expr: string, after: Date, upTo: Date): boolean;
+//# sourceMappingURL=cron.d.ts.map

package/dist/op/cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.d.ts","sourceRoot":"","sources":["../../src/op/cron.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI3D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AA+CD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAoB7D;AAUD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAa7E"}

package/dist/op/discover.d.ts

@@ -2,6 +2,12 @@ import type { OpConfig } from "./types.js";
 export interface DiscoveredOp {
     config: OpConfig;
     filePath: string;
+    /**
+     * The export this Op arrived on: `"default"`, or the named export's own
+     * name (#2171). Diagnostic only, and the reason a file may carry more than
+     * one Op without either becoming ambiguous.
+     */
+    exportName: string;
 }
 export interface OpDiscoveryResult {
     ops: Map<string, DiscoveredOp>;
@@ -12,6 +18,9 @@ export interface OpDiscoveryResult {
  * project root (the directory holding `chant.config.ts`/`.json`, walking up
  * from `cwd`), or under the git root when no config exists — see
  * {@link findDiscoveryRoot} (#2058).
+ *
+ * An Op may be the file's default export or a named one, and a file may hold
+ * several. See {@link opsExportedBy} (#2171).
  */
 export declare function discoverOps(opts?: {
     cwd?: string;

package/dist/op/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/op/discover.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AA0DD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuCrF"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/op/discover.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAmHD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyCrF"}