@intentius/chant 0.57.0 → 0.58.0

package/dist/lint/rules/op/ops013-step-output-ref.d.ts

@@ -0,0 +1,61 @@
+/**
+ * OPS013: a step-output reference (`stepOutput()`/`activity().out`, chant
+ * #1290) must name a step that precedes it, in scope (main `phases`, not
+ * `onFailure` or nested inside an `EffectStep`), with a registered
+ * `ActivityContract` whose `returns` schema the referenced path resolves
+ * against. Moved from a hosting lexicon's own TMP013 to core in #2122 (epic
+ * #2114 sub-issue 6), so it fires on every project that declares an Op — a
+ * project on the local runtime with no lexicons configured included.
+ *
+ * Same shape as OPS012 (`./ops012-activity-contract.ts`): the generic walk
+ * lives in `@intentius/chant/op`'s `validateStepOutputRefs`, over the same
+ * contract map this file builds from core's own base-activity contracts
+ * (`../../../op/activities/activity-contracts.ts`, #2117). A producer
+ * step whose `fn` has no registered contract is flagged (unlike OPS012's
+ * args/outcomeAttribute checks, which skip an unregistered `fn` — a
+ * reference has nothing to validate against without one, so it can't be
+ * silently allowed the way an unchecked arg can). The purely structural half
+ * of this check (an unknown step id, or a reference into a later phase) is
+ * independent of the contract map's contents entirely — no lexicon needs to
+ * be configured, and no activity needs a registered contract at all, for it
+ * to fire.
+ *
+ * Cross-lexicon (chant #2101): an Op step may call an activity any
+ * configured lexicon contributes (`terraformPlan`, `k3sInstall`,
+ * `flyApply`), and since this check became core-owned it fires on every
+ * project that declares an Op. `ctx.activityContracts` carries the contracts
+ * every configured lexicon declared, resolved by `loadActivityContracts`
+ * (`../../../op/activity-contract-registry.ts`) the same way
+ * `loadActivities` resolves the implementations, and is merged over the
+ * static table below. A context that carries none — a hand-built one in a
+ * test, a caller that has not loaded any — falls back to that table alone,
+ * exactly as before.
+ *
+ * That merge is what makes this rule usable at all on an Op whose steps are
+ * a lexicon's: before it, `terraformPlan` feeding `terraformApply` failed
+ * `chant build` for the absence of a contract the terraform lexicon does in
+ * fact declare, which is why both terraform examples carrying an Op kept it
+ * outside `src/` where the example-build harness could not see it.
+ *
+ * This check is what makes it safe for a lexicon's own serializer to compile
+ * every reference it finds unconditionally: `chant build` blocks file output
+ * while an error-severity post-synth finding stands, so generated code
+ * referencing an unresolved step never reaches disk (a lexicon's own Op
+ * serializer also runs the scope-only subset of this check directly —
+ * `validateStepOutputRefScope` — as defense-in-depth, chant #1950 pre-merge
+ * review finding 2).
+ *
+ * Cross-contract type compatibility (chant #1950 pre-merge review, finding
+ * 3): this rule also compares a producer's declared return type at `path`
+ * against the consumer's declared arg type at the same position
+ * (`string`/`number`/`boolean`/`object`/`array` only) and flags a mismatch —
+ * a string-returning path feeding a number-typed arg, for example.
+ * Deliberately shallow: a union, enum, literal, `z.any()`/`z.unknown()`, a
+ * transform, or a reference sitting inside an array in `args` all bail
+ * silently rather than being reasoned about. See `@intentius/chant/op`'s
+ * `step-output-ref.ts` module doc for the full writeup of what this catches
+ * and what it defers (to #1288 Stage 2).
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export declare const ops013: PostSynthCheck;
+//# sourceMappingURL=ops013-step-output-ref.d.ts.map

package/dist/lint/rules/op/ops013-step-output-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops013-step-output-ref.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/ops013-step-output-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AAU9F,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/rules/op/ops014-converge-rule-refusals.d.ts

@@ -0,0 +1,55 @@
+/**
+ * OPS014: converge-rule-refusals (#1484). Moved from a hosting lexicon's own
+ * TMP014 to core in #2122 (epic #2114 sub-issue 6), so it fires on every
+ * project that declares a `ConvergeOp`-shaped Op, not only one with that
+ * lexicon configured.
+ *
+ * Cross-Op build-time refusals for a `ConvergeOp`'s rule table — the checks
+ * `../../../op/composites/converge-op.ts`'s factory can't make on its own,
+ * since they need the *whole* discovered graph of `Chant::Op` entities
+ * (`PostSynthContext.entities`), not just the ConvergeOp instance under
+ * construction: a sibling `*.op.ts` file's Op may not exist yet at the
+ * moment a composite factory runs, the same reason OPS012/OPS013 exist as
+ * post-synth checks rather than builder-time throws.
+ *
+ * A `ConvergeOp`-produced Op is identified by its own
+ * `labels.Converge === "true"` marker (mirroring `ApplyOp`'s
+ * `{ Apply: "true" }` / `WatchOp`'s `{ Watch: "true" }`); its rule table is
+ * read back off the `convergeTick` activity step's `args.rules` (there is no
+ * dedicated `OpConfig` field for it — see `../../../op/composites/
+ * converge-op.ts`'s doc on why the rule table travels as a step's args
+ * instead of a bespoke config field).
+ *
+ * Flags (pre-merge review of #1954 tightened the last three to match issue
+ * #1484's own Autonomy table — see `converge-op.ts`'s module doc):
+ *  - a rule with no (or a blank) `why` — every rule must carry its
+ *    rationale (Accessible Ops factor III),
+ *  - a rule whose predicate isn't in the evaluable subset
+ *    (`isWellFormedPredicate`, re-validated here as the runtime backstop
+ *    over a rule table not authored through `when()`),
+ *  - a `run()` action naming an Op no declared Op entity has as its `name`,
+ *  - a `run()` action dispatching a `mutating` Op under any dial other than
+ *    `"apply"` — the issue's Autonomy table gives `reconcile` "open PR", not
+ *    "run directly"; opening a PR is out of v1 scope (epic #1487's
+ *    `onDrift`-channel open question), so `reconcile` refuses the mutating
+ *    dispatch rather than silently escalating it to "run directly",
+ *  - a `run()` action dispatching a `destructive` Op under any dial,
+ *    unconditionally — a converge tick runs unattended, on a schedule, with
+ *    no one watching it fire. A destructive dispatch needs a human's
+ *    approval *before* it is attempted, not a gate the tick consults after
+ *    it has already committed to running the op — and `run()` has no way to
+ *    ask first. (This used to be argued from the local executor's inability
+ *    to honor a gate at all; as of #2119 a gated op ends the run `gated`
+ *    rather than being refused, so that argument no longer holds — the
+ *    refusal stands on the unattended-approval ground instead.) Durable,
+ *    pre-approved destructive dispatch from a tick is a future design's to
+ *    own; v1 refuses the target rather than shipping a path that dispatches
+ *    a destructive op with no human in the loop,
+ *  - a rule whose predicate reads `adoptCount` while its action is `run()`
+ *    against a `mutating` Op — adopt safety (never auto-claiming an unowned
+ *    resource) is enforced here, not merely documented: a rule that reads
+ *    the adopt signal has no business dispatching a mutation.
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export declare const ops014: PostSynthCheck;
+//# sourceMappingURL=ops014-converge-rule-refusals.d.ts.map

package/dist/lint/rules/op/ops014-converge-rule-refusals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops014-converge-rule-refusals.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/ops014-converge-rule-refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AAuB9F,eAAO,MAAM,MAAM,EAAE,cAuGpB,CAAC"}

package/dist/lint/rules/op/support.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared support for the OPS* Op-model post-synth checks (#2122, epic #2114
+ * sub-issue 6) — OPS012 (`./ops012-activity-contract.ts`), OPS013
+ * (`./ops013-step-output-ref.ts`) and OPS014
+ * (`./ops014-converge-rule-refusals.ts`), ported here from a hosting
+ * lexicon's own TMP012/TMP013/TMP014.
+ *
+ * Op-entity recognition is core's own `isOpEntity` (`../../../op/resource.ts`,
+ * #2118) — re-exported here so every OPS* check imports it from one place.
+ */
+export { isOpEntity } from "../../../op/resource.js";
+//# sourceMappingURL=support.d.ts.map

package/dist/lint/rules/op/support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"support.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/support.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/lint/suppressions.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Inline HCL-comment suppression (chant #2111). This file is core's small,
+ * generic half of the mechanism. It filters already-produced
+ * `PostSynthDiagnostic`s against suppression directives an entity carries,
+ * with no knowledge of which lexicon produced that entity. The other half,
+ * reading `# chant-ignore` / `# chant-ignore-file` / `# chant-ignore-block`
+ * comments out of raw `.tf` text and attaching the result to each parsed
+ * entity, is terraform-specific and lives in
+ * `lexicons/terraform/src/hcl/suppressions.ts`.
+ *
+ * Placement. The issue that asked for this weighed two options: a wrapper
+ * over `runPostSynthChecks` private to the terraform lexicon, or a
+ * `PostSynthContext` field every lexicon could share. Neither is quite what
+ * this file does. `ctx.entities` is already the one thing every
+ * `PostSynthContext` carries regardless of lexicon, and a suppression
+ * directive is inherently a fact ABOUT one entity, namely which block it
+ * anchors to, not a fact about the run as a whole. That is the same reasoning
+ * that already lets each lexicon's `Declarable` carry its own `props` shape
+ * (`TerraformEntity.props`, `K8sEntity.props`, and so on), so the hook here
+ * is a plain, duck-typed optional field, `suppressions`, that any entity MAY
+ * carry beside its `props`, read generically through `entitySuppressions()`
+ * below. Choosing this over a `PostSynthContext.suppressions` field needed no
+ * change to `PostSynthContext`, `Declarable`, or any of the places that
+ * construct a context (`./post-synth.ts`'s `runPostSynthChecks`, `chant
+ * audit`'s `../audit/core.ts`, and the two test-utils builders). Every one
+ * of them already hands `applyInlineSuppressions` below `ctx.entities`, so a
+ * lexicon that wants this (k8s manifests are the epic's other named
+ * candidate) adopts the convention on its own entities, with zero further
+ * core changes.
+ *
+ * `rules` (a project's `lint.rules`) is optional here on purpose. `chant
+ * build` has one to pass, so `ignorable: false` works there; `chant audit`'s
+ * audit-core path does not thread a project config through at all today, see
+ * `../audit/core.ts`, so it calls this with `rules` omitted. Every rule
+ * reads as ignorable in that path, the same default this module
+ * gives an unconfigured rule id everywhere else.
+ */
+import type { RuleConfig } from "./rule.js";
+import type { PostSynthDiagnostic } from "./post-synth.js";
+import type { Declarable } from "../declarable.js";
+/** What a directive's id list names. `"all"` is the wildcard every form accepts. */
+export type SuppressionIds = "all" | ReadonlySet<string>;
+/** One `# chant-ignore*` comment, already parsed from raw source text. */
+export interface SuppressionDirective {
+    /** Which of the three comment forms produced this directive. */
+    form: "chant-ignore" | "chant-ignore-file" | "chant-ignore-block";
+    /** Rule ids this directive names, or `"all"`. */
+    ids: SuppressionIds;
+    /** The `exp:YYYY-MM-DD` term, if present. */
+    expires?: string;
+    /** Source file the comment lives in. */
+    file: string;
+    /** 1-based line the comment ITSELF sits on (not the block it anchors to). */
+    line: number;
+    /**
+     * `chant-ignore-file` is only valid as the file's first non-blank line
+     * (tflint's own constraint on `tflint-ignore-file`, kept here so the form
+     * stays findable). A directive found elsewhere sets this instead of being
+     * applied; see `SUPPRESSION_MISPLACED_FILE_ID` below.
+     */
+    misplaced?: boolean;
+    /**
+     * Stable identity, for dedup across the several entities one directive can
+     * attach to. A file-level directive attaches to every entity parsed from
+     * its file, but an expired-or-misplaced report about it should appear once.
+     */
+    key: string;
+}
+/** An expired suppression is reported once as its own finding, not dropped. */
+export declare const SUPPRESSION_EXPIRED_ID = "SUPP001";
+/** A `chant-ignore-file` found anywhere but the first non-blank line. */
+export declare const SUPPRESSION_MISPLACED_FILE_ID = "SUPP002";
+/** A directive explicitly names a rule id configured `ignorable: false`. */
+export declare const SUPPRESSION_UNIGNORABLE_ID = "SUPP003";
+export type SuppressionMetaCheckId = typeof SUPPRESSION_EXPIRED_ID | typeof SUPPRESSION_MISPLACED_FILE_ID | typeof SUPPRESSION_UNIGNORABLE_ID;
+/**
+ * A finding about the suppression mechanism itself, not about a rule id a
+ * check would normally report, so it deliberately does not go through the
+ * audit catalog: nothing here is registered as a `PostSynthCheck`, so it
+ * never needs a `RuleMeta` entry, a lineage entry, or a full page.
+ */
+export interface SuppressionMetaFinding {
+    checkId: SuppressionMetaCheckId;
+    severity: "warning";
+    message: string;
+    file: string;
+    line: number;
+}
+export interface InlineSuppressionResult {
+    /** Diagnostics after inline suppression, matched ones removed. */
+    diagnostics: PostSynthDiagnostic[];
+    /** Diagnostics an inline directive suppressed, unaltered (counted, never dropped silently). */
+    suppressed: PostSynthDiagnostic[];
+    /** Findings about the suppression mechanism itself: expired, misplaced, or denied by `ignorable: false`. */
+    meta: SuppressionMetaFinding[];
+}
+/** Read an entity's directives, if it carries any (duck-typed; see module doc). */
+export declare function entitySuppressions(entity: Declarable | undefined): readonly SuppressionDirective[];
+/**
+ * Apply inline (`# chant-ignore*`) suppression to a set of post-synth
+ * diagnostics. `entities` is `ctx.entities`, the same map every
+ * `PostSynthContext` already carries. `rules` is the project's `lint.rules`,
+ * for `ignorable: false`; see this module's doc comment for why it is
+ * optional. `today` is injectable so an expiry test doesn't depend on the
+ * clock.
+ */
+export declare function applyInlineSuppressions(diagnostics: readonly PostSynthDiagnostic[], entities: Map<string, Declarable>, rules?: Record<string, RuleConfig>, today?: Date): InlineSuppressionResult;
+//# sourceMappingURL=suppressions.d.ts.map

package/dist/lint/suppressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/lint/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAEzD,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,IAAI,EAAE,cAAc,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;IAClE,iDAAiD;IACjD,GAAG,EAAE,cAAc,CAAC;IACpB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAChD,yEAAyE;AACzE,eAAO,MAAM,6BAA6B,YAAY,CAAC;AACvD,4EAA4E;AAC5E,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAC9B,OAAO,sBAAsB,GAC7B,OAAO,6BAA6B,GACpC,OAAO,0BAA0B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,sBAAsB,CAAC;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,+FAA+F;IAC/F,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,4GAA4G;IAC5G,IAAI,EAAE,sBAAsB,EAAE,CAAC;CAChC;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,oBAAoB,EAAE,CAIlG;AAqBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAClC,KAAK,GAAE,IAAiB,GACvB,uBAAuB,CAyDzB"}

package/dist/live-endpoint.d.ts

@@ -40,7 +40,7 @@ import { type EmulatorDeclaration } from "./op/emulator-lifecycle.js";
  * The ambient endpoint vars a lexicon honors, from its emulator capability.
  *
  * A lexicon with no emulator contributes nothing, which is the same answer the
- * hand-maintained map gave for k8s, gcp and temporal — they resolve their live
+ * hand-maintained map gave for k8s and gcp — they resolve their live
  * target from `chant.config` itself, so there is nothing to inject.
  */
 export declare function endpointEnvVarsFor(lexicon: EndpointLexicon): string[];

package/dist/op/activities/activity-contracts.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Activity contracts for core's own `op/activities` (chant #1288
+ * Stage 1). Each contract's `args` schema mirrors the corresponding
+ * `*Args` interface in `./activities/*.ts` — kept alongside the
+ * implementation, the way the issue asked for, and validated by
+ * `chant build` via `tmp012` (the OPS012 activity-contract rule).
+ *
+ * Author `args` with `z.strictObject(...)`, never `z.object(...)`: the
+ * default form silently drops a key it doesn't recognize instead of
+ * rejecting it, which reproduces the exact bug this issue is about
+ * (`helmInstall("api", "./chart", { nameSpace: "prod" })` — the misspelled
+ * key vanishes rather than failing the build).
+ *
+ * Deliberately partial. Only activities with args simple enough for a zod
+ * mirror to earn its keep are covered here — `kubectlApply`/`helmInstall`/
+ * the cloud appliers carry a dozen-plus fields each with real cross-field
+ * logic (see `KubectlApplyArgs`, `HelmInstallArgs`), and forcing those
+ * through a duplicate schema is exactly the maintenance burden Stage 2
+ * (regenerating the step builders as fully typed wrappers) is meant to
+ * avoid by deriving types instead of restating them. A step calling an
+ * activity with no registered contract here is skipped by `tmp012`, not
+ * flagged — see `activityContract`'s doc in `../activity-contract` for why
+ * that's the intended, non-breaking default.
+ */
+export declare const lifecycleSnapshotContract: import("../index.js").ActivityContract<{
+    env: string;
+}, never>;
+export declare const lifecycleDiffContract: import("../index.js").ActivityContract<{
+    env: string;
+    live?: boolean | undefined;
+}, {
+    output: string;
+    exitCode: number;
+    drifted: boolean;
+}>;
+export declare const shellCmdContract: import("../index.js").ActivityContract<{
+    cmd: string;
+    env?: Record<string, string> | undefined;
+    cwd?: string | undefined;
+}, never>;
+export declare const httpCheckContract: import("../index.js").ActivityContract<{
+    url: string;
+    method?: string | undefined;
+    status?: number | undefined;
+    contains?: string | undefined;
+    retries?: number | undefined;
+    intervalMs?: number | undefined;
+}, {
+    status: number;
+}>;
+export declare const chantTeardownContract: import("../index.js").ActivityContract<{
+    path: string;
+}, never>;
+//# sourceMappingURL=activity-contracts.d.ts.map

package/dist/op/activities/activity-contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../../src/op/activities/activity-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,eAAO,MAAM,yBAAyB;;SAGrC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;EAIjC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;SAG5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;EAgB7B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;SAGjC,CAAC"}

package/dist/op/activities/apply.d.ts

@@ -0,0 +1,262 @@
+/**
+ * `nativeApply` — push declared source to the cloud through the target's own
+ * mechanism. Authority stays with the platform; chant hosts no state file.
+ *
+ * ## Where the shell went (chant #1075, #1448, #1449)
+ *
+ * This used to build a shell command for every target — `kubectl apply -f`,
+ * `az deployment group create`, `aws cloudformation deploy`. Two things were
+ * wrong with that. The shell commands carried product knowledge that belongs to
+ * each product's lexicon, against the one-lexicon-per-product rule that already
+ * moved `kubectlApply`, `k3dUp`/`k3dDown` and `waitForArgoSync` out (chant
+ * #809). And each CLI's semantics diverged from what the docblocks promised —
+ * `kubectl apply`'s client-side merge gave the diff engine nothing to key on
+ * (#1075), and ARM Complete mode deleted resources chant never applied (#1448).
+ *
+ * So each branch moved to its product's lexicon: `kubectl`/`kustomize` are a
+ * server-side apply over the k8s lexicon's typed client (#1075, #1548), `arm`
+ * is the azure lexicon's per-resource `azApply` (#1448), `cloudformation`
+ * is the aws lexicon's `awsApply` — the CloudFormation Query API directly, no
+ * CLI in the path (#1449) — and `gcp`/`fly` are the gcp lexicon's
+ * per-resource `gcpApply` and the fly lexicon's `flyApply`, which never had a
+ * CLI in the path to begin with: gcp maps each CNRM kind to its REST API
+ * itself, and fly speaks the Machines API (flaps) directly, no flyctl.
+ * **The dispatcher stayed here**, because "which
+ * mechanism applies this target" is not any one product's knowledge — and
+ * because the activity keeps its name, its arguments and its place in
+ * `ApplyOp`, so no existing Op changes shape.
+ *
+ * The lexicons are reached by dynamic import at call time, never by a static
+ * one: this package must not depend on them. A project applying a target
+ * already lists that lexicon in its config, so the module is there; when it is
+ * not, the failure names the package to install.
+ */
+import { type ApplyResult } from "../../apply.js";
+/** The native apply mechanism for a target. */
+export type ApplyTarget = "cloudformation" | "kubectl" | "arm" | "kustomize" | "gcp" | "fly";
+/**
+ * How apply treats resources no longer declared.
+ * - `never` — additive only; never deletes.
+ * - `owned-only` — enables the target's own delete path. What bounds that path
+ *   differs per target, and all of them are genuinely owned-only: `kubectl`
+ *   sweeps by the ownership marker, `arm` prunes by the ownership tag
+ *   (`isChantOwned`, via the azure lexicon's `azApply`), `gcp` prunes by the
+ *   ownership label (via the gcp lexicon's `gcpApply` — only kinds it can
+ *   list; the rest are reported not-prunable), `fly` prunes machines by the
+ *   metadata marker and the metadata-less types (volumes/ips/certs/secrets)
+ *   app-scoped under a managed app (via the fly lexicon's `flyApply`), and
+ *   `cloudformation` is bounded by the stack — which holds, because a
+ *   resource CFN did not create is not in the stack.
+ * - `gated` — same delete scope as `owned-only`, but an approval gate precedes
+ *   the destructive apply, so an unapproved run ends `gated` before deleting
+ *   anything (the gate lives in the composite).
+ */
+export type DeleteMode = "never" | "owned-only" | "gated";
+export interface NativeApplyArgs {
+    /** Native mechanism to delegate to. */
+    target: ApplyTarget;
+    /** Environment. What it means is per target: the CFN stack name on
+     * `cloudformation`, the ARM resource group on `arm`, the chant environment
+     * on `kubectl`/`kustomize`. On `gcp` and `fly` it is a log label only — the
+     * gcp applier resolves the project (`GOOGLE_CLOUD_PROJECT` env / CNRM
+     * annotation) and endpoint (`GCP_ENDPOINT_URL` env) itself, and the fly
+     * applier resolves its endpoint (`FLY_FLAPS_BASE_URL` env) and token
+     * (`FLY_API_TOKEN` env) itself, with the app names coming from the plan. */
+    env: string;
+    /** Built manifest/template path. Default per target ({@link defaultOutput}):
+     * `dist` (a dir) for kubectl, `template.json` (a file) for
+     * CloudFormation/ARM, `dist/gcp.yaml` for gcp, `dist/fly.json` for fly. */
+    output?: string;
+    /** Delete handling. Default: never. */
+    deleteMode?: DeleteMode;
+    /**
+     * kubectl target only (chant #1075). Take ownership of fields another field
+     * manager owns instead of failing with a conflict that names them.
+     * **Opt-in, and never defaulted on**: transferring ownership of a live field
+     * is a decision, not a retry.
+     */
+    forceConflicts?: boolean;
+}
+/**
+ * What an apply did — one shape for every target: the count projection of
+ * core's `NormalizedApply` (#1446, collapsed here in #1449). The per-target
+ * shapes this used to carry (`fieldManager`, `stackName`/`status`/`action`,
+ * a separate `notPrunable`) belong to the appliers and stay in their lexicons;
+ * this activity's result is the shape every Op reads back regardless of
+ * target, and the target-specific detail still reaches the operator on the
+ * activity log.
+ */
+export interface NativeApplyResult {
+    /** Resources the provider was called for and which converged — created,
+     * updated or unchanged. On `cloudformation` the unit is the stack, so a
+     * settled deploy is `1`. */
+    applied: number;
+    /** Owned, no-longer-declared resources deleted. */
+    pruned: number;
+    /** Declared resources no provider call was made for (#1447), including
+     * kinds an owned-only prune could not consider (`not-prunable`). Zero on a
+     * complete apply. */
+    notAttempted: number;
+}
+/**
+ * The k8s lexicon's server-side apply, as this module needs to call it.
+ * Structural, so nothing here imports the k8s lexicon's types.
+ */
+export type K8sApplier = (args: {
+    manifest: string;
+    /** Already-rendered documents (#1548) — the kustomize target hands the
+     * render straight in; `manifest` is then only the log label. */
+    documents?: Array<Record<string, unknown>>;
+    environment?: string;
+    deleteMode?: DeleteMode;
+    force?: boolean;
+}, signal?: AbortSignal) => Promise<{
+    applied: unknown[];
+    pruned: unknown[];
+    fieldManager: string;
+}>;
+/**
+ * The azure lexicon's per-resource ARM applier, as this module needs to call
+ * it: `azApply` composed with the lexicon's own `toApplyResult` projection, so
+ * what crosses this seam is core's versioned apply envelope (#1446) and
+ * nothing ARM-shaped.
+ */
+export type AzureApplier = (args: {
+    templatePath: string;
+    resourceGroup: string;
+    endpoint?: string;
+    prune?: boolean;
+}, signal?: AbortSignal) => Promise<ApplyResult>;
+/**
+ * The gcp lexicon's per-resource applier, as this module needs to call it
+ * (#1449): `gcpApply` composed with the lexicon's own `toApplyResult`
+ * projection, so what crosses this seam is core's versioned apply envelope
+ * (#1446) — the skips of #1447 ride it as NOT-ATTEMPTED entries, and a kind
+ * the prune could not consider rides it as `not-prunable`.
+ *
+ * Deliberately narrow: no `endpoint`, because `gcpApply` resolves
+ * `GCP_ENDPOINT_URL` itself — the same variable gcp's read path honours, so an
+ * apply lands wherever `--live` is already looking (floci-gcp, or real GCP
+ * when unset); and no `project`, because `gcpApply` resolves
+ * `GOOGLE_CLOUD_PROJECT` / the CNRM project-id annotation itself.
+ */
+export type GcpApplier = (args: {
+    manifestPath: string;
+    prune?: boolean;
+}, signal?: AbortSignal) => Promise<ApplyResult>;
+/**
+ * The fly lexicon's flaps applier, as this module needs to call it (#1449):
+ * `flyApply` composed with the lexicon's own `toApplyResult` projection. The
+ * eleven arrays flyApply returns — six entity classes applied, five pruned —
+ * are its own contract and stay in the fly lexicon; what crosses this seam is
+ * core's versioned apply envelope (#1446).
+ *
+ * Deliberately narrow: no `endpoint`, because `flyApply` resolves
+ * `FLY_FLAPS_BASE_URL` itself — mudflaps locally, real Fly when unset; and no
+ * `token`, because it resolves `FLY_API_TOKEN` itself.
+ */
+export type FlyApplier = (args: {
+    planPath: string;
+    prune?: boolean;
+}, signal?: AbortSignal) => Promise<ApplyResult>;
+/**
+ * The aws lexicon's CloudFormation applier, as this module needs to call it
+ * (#1449). Structural, like {@link K8sApplier} and {@link AzureApplier}.
+ *
+ * Deliberately narrow: no `endpoint`, because `awsApply` resolves
+ * `AWS_ENDPOINT_URL_CLOUDFORMATION` then `AWS_ENDPOINT_URL` itself (#1694) —
+ * the rule that used to live here as `applyEndpoint` (#926); and no
+ * `capabilities`, because `awsApply` derives them from the template body
+ * (`CAPABILITY_NAMED_IAM`, plus `CAPABILITY_AUTO_EXPAND` for a top-level
+ * `Transform` — #980), the rule that used to live here as `cfnCapabilities`.
+ */
+export type AwsApplier = (args: {
+    templatePath: string;
+    stackName: string;
+}, signal?: AbortSignal) => Promise<{
+    stackName: string;
+    status: string;
+    action: "created" | "updated" | "unchanged";
+}>;
+/**
+ * The aws lexicon's CloudFormation rollback (saga compensation), as
+ * {@link compensateApply} needs to call it. Structural, like the appliers.
+ */
+export type AwsRollback = (args: {
+    stackName: string;
+}, signal?: AbortSignal) => Promise<{
+    stackName: string;
+    rolledBack: boolean;
+    status?: string;
+}>;
+/**
+ * Sensible default build output per target. kubectl takes a directory (all
+ * manifests), so `dist`; kustomize's "output" is the kustomization DIRECTORY
+ * the render reads. The file targets take the file their lexicon's build
+ * conventionally emits: `template.json` for CloudFormation/ARM, `dist/gcp.yaml`
+ * (the CNRM manifest) for gcp, `dist/fly.json` (the serialized plan) for fly.
+ * Pure — exported for testing.
+ */
+export declare function defaultOutput(target: ApplyTarget): string;
+/**
+ * Apply declared source to the cloud via the target's native mechanism.
+ * Deletes (when enabled) ride that mechanism's own delete path — marker-scoped
+ * on `kubectl`, tag-scoped on `arm`, label-scoped on `gcp`, marker- and
+ * app-scoped on `fly`, and stack-scoped on `cloudformation`, where the deploy
+ * itself removes resources dropped from the template and `deleteMode` changes
+ * nothing: a resource CFN did not create is not in the stack. See
+ * {@link DeleteMode}.
+ *
+ * The appliers are injectable so this dispatcher can be tested without the
+ * product lexicons present; production resolves them through
+ * {@link loadK8sApplier} / {@link loadAzureApplier} / {@link loadAwsApplier} /
+ * {@link loadGcpApplier} / {@link loadFlyApplier}.
+ */
+export declare function nativeApply(args: NativeApplyArgs, signal?: AbortSignal, applier?: K8sApplier, azureApplier?: AzureApplier, renderer?: (dir: string) => Promise<Array<Record<string, unknown>>>, awsApplier?: AwsApplier, gcpApplier?: GcpApplier, flyApplier?: FlyApplier): Promise<NativeApplyResult>;
+/**
+ * Whether a target has a mapped native rollback for {@link compensateApply} to
+ * run without an explicit `compensate.command`. `cloudformation` is the only
+ * one today — the aws lexicon's `rollbackStack`. This is the totality
+ * predicate `ApplyOp` checks at build time (#1449): a target outside it with
+ * no command has nothing a compensation could run, so the op refuses to build
+ * with compensation on rather than warn at rollback time.
+ */
+export declare function hasNativeRollback(target: ApplyTarget): boolean;
+export interface CompensateApplyArgs {
+    /** Native mechanism that was applied. */
+    target: ApplyTarget;
+    /** Environment — CFN stack name / ARM resource group. */
+    env: string;
+    /** Explicit rollback command, used in preference to the native default. */
+    command?: string;
+}
+/** What a compensation did. */
+export interface CompensateApplyResult {
+    /** The explicit rollback command that ran, when one was supplied. */
+    command?: string;
+    /** The stack rolled back — cloudformation. */
+    stackName?: string;
+    /** Whether the native rollback actually ran — cloudformation. `false` when
+     * the stack was absent or the target does not implement RollbackStack (Floci). */
+    rolledBack?: boolean;
+    /** The settled post-rollback stack status — cloudformation. */
+    status?: string;
+}
+/**
+ * Compensation step (saga rollback) for a partial apply failure. Runs the
+ * explicit `command` if given; otherwise `cloudformation` rolls back natively
+ * through the aws lexicon's `rollbackStack` (#1449 — CloudFormation
+ * `RollbackStack` over the Query API, no CLI in the path).
+ *
+ * Compensation is total for built ops: `ApplyOp` refuses at build time to wire
+ * this activity for a target with neither a native rollback
+ * ({@link hasNativeRollback}) nor an explicit `command`, so the no-rollback
+ * branch below is unreachable from an op it built. It stays as a throw, not a
+ * warn — a hand-assembled op that reaches it must fail loudly, because partial
+ * state should never look reverted when it isn't.
+ *
+ * `rollback` is injectable for tests; production resolves it through
+ * {@link loadAwsRollback}.
+ */
+export declare function compensateApply(args: CompensateApplyArgs, signal?: AbortSignal, rollback?: AwsRollback): Promise<CompensateApplyResult>;
+//# sourceMappingURL=apply.d.ts.map

package/dist/op/activities/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/D,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,SAAS,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,GAAG,KAAK,CAAC;AAE7F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;;gFAM4E;IAC5E,GAAG,EAAE,MAAM,CAAC;IACZ;;+EAE2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC;;gCAE4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf;;yBAEqB;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB;oEACgE;IAChE,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,EACD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE;IACJ,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,EACD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1B;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,IAAI,EAAE;IACJ,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,EACD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,EACD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACjD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC3B,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAgN1E;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAYzD;AAgCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,UAAU,EACpB,YAAY,CAAC,EAAE,YAAY,EAC3B,QAAQ,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAuB,EACxF,UAAU,CAAC,EAAE,UAAU,EACvB,UAAU,CAAC,EAAE,UAAU,EACvB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,iBAAiB,CAAC,CA0F5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAE9D;AAED,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+BAA+B;AAC/B,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;sFACkF;IAClF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,qBAAqB,CAAC,CA0BhC"}

package/dist/op/activities/build.d.ts

@@ -0,0 +1,13 @@
+export interface ChantBuildArgs {
+    path: string;
+    /** npm script to run. Default: `build`. Set e.g. `build:aws` to build one target. */
+    script?: string;
+    /** Optional extra env vars to pass to the build command. */
+    env?: Record<string, string>;
+}
+/**
+ * Run an npm build script (`build` by default) in the given project directory.
+ * Uses fastIdempotent profile — 5m timeout, 3 retries.
+ */
+export declare function chantBuild(args: ChantBuildArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=build.d.ts.map

package/dist/op/activities/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/op/activities/build.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ1F"}