@intentius/chant 0.57.0 → 0.58.0

package/dist/op/activities/converge.d.ts

@@ -0,0 +1,110 @@
+import { type ConvergeRule } from "../converge-rule.js";
+import { type OpVerbClass } from "../op-verb-class.js";
+import { type ConvergeSymptom } from "../../lifecycle/symptoms.js";
+import { sanitizeLedgerText, type ConvergeRuleOutcome, type ConvergeTickRecord } from "../../lifecycle/converge-ledger.js";
+/** A `ConvergeRule<ConvergeSymptom>`, restated with `S = ConvergeSymptom` fixed — the JSON shape `ConvergeOp` bakes into the Op's `convergeTick` step args. */
+export type SerializedConvergeRule = ConvergeRule<ConvergeSymptom>;
+export interface ConvergeTickArgs {
+    /** Op name (`ConvergeOp`'s own `config.name`) — carried into the ledger record. */
+    opName: string;
+    env: string;
+    /**
+     * Authority level for this environment (the issue's dial × verb-class
+     * matrix): `"observe"` never dispatches a mutating/destructive op
+     * (report-only); `"reconcile"` free-runs a read-only op but never a
+     * mutating one — the issue's table answer for `reconcile` × mutating is
+     * "open PR", which v1 doesn't implement (epic #1487's onDrift-channel open
+     * question), so `reconcile` refuses that dispatch (`OPS014`, build time)
+     * rather than silently escalating it to "run directly"; `"apply"` is the
+     * only dial that free-runs a mutating op. A destructive op is refused
+     * under every dial, `"apply"` included, in v1 — see `OPS014`'s doc on why
+     * "destructive + apply + gated" can never actually dispatch.
+     */
+    dial: "observe" | "reconcile" | "apply";
+    /** Max number of `run` dispatches this tick may perform; remaining matched rules are recorded `skipped-budget`. */
+    budget: number;
+    /** The rule table, in authored order. */
+    rules: SerializedConvergeRule[];
+    /**
+     * `Observe` phase's quick drift signal, threaded in via a step-output
+     * reference rather than a search-attribute round-trip (#1290) — a
+     * diagnostic cross-check folded into the tick record, not a control input
+     * (this activity re-derives its own symptom independently).
+     */
+    preflightDrift?: boolean;
+}
+export interface ConvergeTickResult {
+    /** The ledger record's tick id (#2027) — what a caller correlates this tick's outcomes, gate facts and remediations against. */
+    id: string;
+    drifted: boolean;
+    remediated: number;
+    reported: number;
+    skippedBudget: number;
+    skippedFlap: number;
+    unobserved: number;
+    adopted: number;
+    /** Rules whose dispatch hit a gate this tick (#1485) — see `ConvergeRuleOutcome.action`'s doc. */
+    gated: number;
+    /** The one human-readable summary line this tick produced. */
+    log: string;
+}
+/**
+ * Cap a subprocess failure's raw output to one sanitized line — a ledger
+ * record (`converge-ledger.ts`'s `appendConvergeRecord`) is one line of JSON,
+ * and a multi-line/oversized `stderr` folded straight into `outcome.reason`
+ * would break that. Not a fix for the ledger-durability bug (#1936,
+ * `writeBlobToPath`'s corruption under concurrent writes — fixed at the root
+ * in a separate PR); this only keeps one dispatch failure's own message from
+ * corrupting the line it's written into.
+ *
+ * The rule now lives next to the record it protects (`sanitizeLedgerText`,
+ * #2027), since a component verdict's `detail` needs the same cap; this stays
+ * as the dispatch path's name for it.
+ */
+export declare const sanitizeOneLine: typeof sanitizeLedgerText;
+/**
+ * The gate a gated `chant run` stopped at, read off its JSON result (#2119) —
+ * pure, unit-tested directly rather than only through `dispatchOp`'s
+ * subprocess plumbing. `undefined` when the output says nothing about a gate.
+ */
+export declare function classifyDispatchFailure(raw: string): {
+    gateName: string;
+} | undefined;
+/**
+ * Runtime backstop for issue #1484's Autonomy table (pre-merge review of
+ * #1954): `OPS014` already refuses, at build time, a rule table shaped to
+ * reach this point with a mutating dispatch outside `"apply"` or any
+ * destructive dispatch at all. This is the defense-in-depth check for a rule
+ * table that reached `convergeTick` without going through that build — the
+ * same "not authored through the checked path" concern
+ * `isWellFormedPredicate` already guards for a hand-assembled predicate (see
+ * `../../../../packages/core/src/op/converge-rule.ts`'s doc). Fail-closed:
+ * an unclassifiable target (`verbClass === undefined`, e.g. the target op
+ * couldn't be discovered/read) is never treated as safe to free-run — same
+ * fail-closed stance `classifyOpVerbClass` itself takes for an unrecognized
+ * activity `fn`.
+ */
+export declare function verbClassAllowedToDispatch(dial: ConvergeTickArgs["dial"], verbClass: OpVerbClass | undefined): boolean;
+/**
+ * Apply {@link verbClassAllowedToDispatch} to one planned "ran" outcome,
+ * downgrading it to "reported" (never silently dropped, never silently run)
+ * when the dial/verb-class pairing isn't one the tick may actually free-run.
+ * Pure — the impure part (discovering and classifying the target op) is
+ * {@link classifyDispatchTarget}, called by `convergeTick` before this.
+ */
+export declare function enforceVerbClassAtDispatch(outcome: ConvergeRuleOutcome, dial: ConvergeTickArgs["dial"], verbClass: OpVerbClass | undefined): ConvergeRuleOutcome;
+/**
+ * The pure planning core: given a symptom, a rule table, prior-tick fire
+ * history, the dial, and the remaining budget, decide what each rule does
+ * this tick. Exported and unit-tested directly — the activity function
+ * around it is the thin I/O shell (gather inputs, execute the plan, append
+ * the ledger record), matching `reconcilePr`'s split between its pure
+ * `reconcileSummary`/`entriesFromPlan` and its I/O body.
+ */
+export interface ConvergeTickPlan {
+    firedRuleIds: string[];
+    outcomes: ConvergeRuleOutcome[];
+}
+export declare function planConvergeTick(symptom: ConvergeSymptom, rules: SerializedConvergeRule[], priorRecords: ConvergeTickRecord[], dial: ConvergeTickArgs["dial"], budget: number): ConvergeTickPlan;
+export declare function convergeTick(args: ConvergeTickArgs, signal?: AbortSignal): Promise<ConvergeTickResult>;
+//# sourceMappingURL=converge.d.ts.map

package/dist/op/activities/converge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge.d.ts","sourceRoot":"","sources":["../../../src/op/activities/converge.ts"],"names":[],"mappings":"AAkCA,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAKL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,iCAAiC,CAAC;AAQzC,+JAA+J;AAC/J,MAAM,MAAM,sBAAsB,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAEnE,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;IACxC,mHAAmH;IACnH,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,gIAAgI;IAChI,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,2BAAqB,CAAC;AA0BlD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAerF;AA0CD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAKtH;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAC9B,SAAS,EAAE,WAAW,GAAG,SAAS,GACjC,mBAAmB,CAWrB;AAaD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,sBAAsB,EAAE,EAC/B,YAAY,EAAE,kBAAkB,EAAE,EAClC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GACb,gBAAgB,CAmDlB;AAoBD,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyF5G"}

package/dist/op/activities/env-teardown.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `envTeardown` — the durable form of `chant lifecycle teardown <env> --yes`
+ * (#1222).
+ *
+ * Wraps core's {@link executeTeardown}: enumerate the live resources whose
+ * ownership marker carries this project's `ownership.stack` + the requested
+ * environment, delete them through each lexicon's `executeTeardown`
+ * capability, run core's one bounded retry pass, and fail the activity loudly
+ * when any candidate is still `failed` afterwards. Selection is marker-scoped
+ * by construction — the same engine the CLI verb drives, reached in-process
+ * rather than through a shell.
+ *
+ * The guards are the CLI's guards, unchanged:
+ * - an environment the project does not declare is refused;
+ * - a project with no `ownership.stack` is refused — teardown has nothing to
+ *   select on;
+ * - a production-like environment name (`prod`, `production`, `prod-eu`, ...)
+ *   is refused unless the step's args carry an explicit `confirmProd: true`.
+ *   An Op is non-interactive, so there is no re-type-the-name prompt to fall
+ *   back to — the confirmation must be authored into the Op.
+ *
+ * All three refusals throw before any live read, so a refused teardown
+ * touches nothing at all. They are configuration errors, not transient ones —
+ * no retry can make `prod` stop looking like production.
+ *
+ * Distinct from {@link chantTeardown} (`npm run teardown`), which runs
+ * whatever script a project wired under that name. This activity is
+ * product-agnostic: it imports core only, and core reaches each product
+ * through the lexicons the project configures.
+ */
+import { type ChantConfig } from "../../config.js";
+import { type TeardownReport } from "../../lifecycle/teardown.js";
+import type { ObservationLexicon } from "../../lexicon.js";
+export interface EnvTeardownArgs {
+    /** The environment to tear down — the marker env core selects on. */
+    env: string;
+    /**
+     * Required (as an explicit `true`) when `env` looks production-like.
+     * The Op's counterpart of the CLI's `--confirm-prod`: activities never
+     * prompt, so the confirmation is authored, reviewed, and versioned with
+     * the Op instead.
+     */
+    confirmProd?: boolean;
+    /** Path to the chant project (where chant.config.ts lives). Default: the chant process's cwd. */
+    path?: string;
+}
+/** What a completed (fully successful) teardown reports back to the run. */
+export interface EnvTeardownResult {
+    environment: string;
+    /** The ownership stack everything was selected on. */
+    stack: string;
+    deleted: number;
+    /** Deliberately refused by a lexicon, with the reason in the report. */
+    notPrunable: number;
+    /** Planned candidates whose lexicon implements no execution yet. */
+    skipped: number;
+    /** Kinds that could not be read (#1089) — the plan was incomplete, not clean. */
+    holes: number;
+    /** The full per-candidate report core produced. */
+    report: TeardownReport;
+}
+/** Injectable seams for testing — production loads both from the project. */
+export interface EnvTeardownDeps {
+    /** Pre-loaded project config (skips reading chant.config.ts). */
+    config?: ChantConfig;
+    /** Pre-loaded lexicon plugins (skips resolving + importing lexicon packages). */
+    plugins?: ObservationLexicon[];
+}
+/**
+ * Tear down one environment's marker-owned resources through the core
+ * teardown engine. Uses the `longInfra` profile — deletion waits on the
+ * target's own pace. Safe to retry: the engine re-plans from live markers on
+ * every run, and a resource already gone is simply no longer a candidate.
+ */
+export declare function envTeardown(args: EnvTeardownArgs, _signal?: AbortSignal, deps?: EnvTeardownDeps): Promise<EnvTeardownResult>;
+//# sourceMappingURL=env-teardown.d.ts.map

package/dist/op/activities/env-teardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-teardown.d.ts","sourceRoot":"","sources":["../../../src/op/activities/env-teardown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EAA0C,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAGxF,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iGAAiG;IACjG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAaD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,WAAW,EACrB,IAAI,CAAC,EAAE,eAAe,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAyE5B"}

package/dist/op/activities/guard-validate.d.ts

@@ -0,0 +1,64 @@
+export interface GuardValidateArgs {
+    /**
+     * Path to a `.guard` rules file or directory, passed to `cfn-guard validate
+     * -r`. No chant-specific rule format — these are ordinary cfn-guard rules,
+     * the same ones CDK's `CfnGuardValidator` would run.
+     */
+    rules: string;
+    /**
+     * Path to the built CloudFormation template to validate. Default:
+     * `<path>/template.json` — the convention `chant build -o template.json`
+     * writes to (see the aws lexicon's own examples and the native-output
+     * policy docs).
+     */
+    template?: string;
+    /** Project directory `template` is resolved relative to, when `template` is not given. Default ".". */
+    path?: string;
+    /**
+     * What to produce on a finding. Only `"report"` runs today — it prints a
+     * summary and throws on any finding, no external service involved.
+     * `issue`/`pull-request` modes (reusing the audit-Op finding-mode
+     * plumbing) are left to a follow-up. Default: `"report"`.
+     */
+    onFinding?: "report";
+    /** Path to (or name of) the `cfn-guard` binary. Default: `"cfn-guard"`, resolved via `PATH`. */
+    binary?: string;
+}
+/** One cfn-guard rule violation, mapped to a chant-shaped diagnostic. */
+export interface GuardFinding {
+    /** The cfn-guard rule name that failed. */
+    rule: string;
+    /** Always `"error"` today — a cfn-guard non-compliant result is a policy violation, the same weight `policyGate` gives a violation. */
+    severity: "error";
+    /** Human-readable violation message. */
+    message: string;
+    /** Best-effort CloudFormation logical id the violation is about, when cfn-guard's output names one. */
+    entity?: string;
+}
+export interface GuardValidateResult {
+    findings: GuardFinding[];
+    summary: string;
+}
+/**
+ * Map cfn-guard's `--output-format json` report to chant-shaped findings.
+ * Exported and tested directly (independent of `spawn`) — same split
+ * `collectPipelineRefs`/`pipelineSupplyChainAudit` (`./pipeline-audit.ts`)
+ * use between pure mapping and the orchestrating activity.
+ *
+ * Throws if `stdout` is not parseable JSON — a cfn-guard invocation that
+ * didn't run with `--output-format json` (a bad rules path, a version too
+ * old to support it) is a setup problem, not "zero violations"; reporting
+ * a clean run here would be a false negative.
+ */
+export declare function parseGuardFindings(stdout: string): GuardFinding[];
+/**
+ * Run an external CloudFormation Guard rules pack against the project's
+ * built CloudFormation template. `report` mode: prints a summary, and
+ * throws (non-retryable) when any rule is violated, so the local executor
+ * (`chant run`) exits non-zero and CI fails the pipeline — the same shape
+ * `policyGate` uses to block an apply. A clean run passes through.
+ *
+ * A plain activity on every runtime, not a `gate` step.
+ */
+export declare function guardValidate(args: GuardValidateArgs, _signal?: AbortSignal): Promise<GuardValidateResult>;
+//# sourceMappingURL=guard-validate.d.ts.map

package/dist/op/activities/guard-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-validate.d.ts","sourceRoot":"","sources":["../../../src/op/activities/guard-validate.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,uIAAuI;IACvI,QAAQ,EAAE,OAAO,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AA2DD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,EAAE,CA2BjE;AAUD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuChH"}

package/dist/op/activities/http-check.d.ts

@@ -0,0 +1,34 @@
+export interface HttpCheckArgs {
+    /** URL to GET (or `method`). */
+    url: string;
+    /** HTTP method. Default: `GET`. */
+    method?: string;
+    /** Exact expected status. Default: any 2xx. */
+    status?: number;
+    /** Substring the response body must contain. */
+    contains?: string;
+    /** Retries before failing, for a resource that may lag. Default: `0`. */
+    retries?: number;
+    /** Delay between retries in ms. Default: `1000`. */
+    intervalMs?: number;
+}
+/** Injectable fetch — the response shape `httpCheck` needs. Defaults to global `fetch`. */
+export type HttpFetch = (url: string, init?: {
+    method?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    status: number;
+    text(): Promise<string>;
+}>;
+/** Whether a status satisfies the expectation (exact if given, else any 2xx). Pure. */
+export declare function statusOk(status: number, expected?: number): boolean;
+/**
+ * Assert an HTTP endpoint responds as expected — a typed verify step, the modeled
+ * replacement for `shell("curl -fs ...")`. Fails (throwing) if the status or body
+ * doesn't match after the allowed retries. `fetchFn` is injectable for tests.
+ * Uses fastIdempotent profile — 5m timeout.
+ */
+export declare function httpCheck(args: HttpCheckArgs, signal?: AbortSignal, fetchFn?: HttpFetch): Promise<{
+    status: number;
+}>;
+//# sourceMappingURL=http-check.d.ts.map

package/dist/op/activities/http-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-check.d.ts","sourceRoot":"","sources":["../../../src/op/activities/http-check.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,2FAA2F;AAC3F,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEhJ,uFAAuF;AACvF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,GAAE,SAAiB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAuBlI"}

package/dist/op/activities/index.d.ts

@@ -0,0 +1,31 @@
+export { chantBuild } from "./build.js";
+export type { ChantBuildArgs } from "./build.js";
+export { waitForStack } from "./wait.js";
+export type { WaitForStackArgs } from "./wait.js";
+export { shellCmd } from "./shell.js";
+export type { ShellCmdArgs } from "./shell.js";
+export { httpCheck, statusOk } from "./http-check.js";
+export type { HttpCheckArgs, HttpFetch } from "./http-check.js";
+export { lifecycleSnapshot, lifecycleDiff } from "./lifecycle.js";
+export type { LifecycleSnapshotArgs, LifecycleDiffArgs, LifecycleDiffResult } from "./lifecycle.js";
+export { chantTeardown } from "./teardown.js";
+export type { ChantTeardownArgs } from "./teardown.js";
+export { envTeardown } from "./env-teardown.js";
+export type { EnvTeardownArgs, EnvTeardownResult, EnvTeardownDeps } from "./env-teardown.js";
+export { reconcilePr } from "./reconcile.js";
+export type { ReconcilePrArgs, ReconcileResult, ReconcileMode, ReconcileEntry } from "./reconcile.js";
+export { nativeApply, compensateApply, hasNativeRollback } from "./apply.js";
+export type { NativeApplyArgs, NativeApplyResult, CompensateApplyArgs, CompensateApplyResult, ApplyTarget, DeleteMode, K8sApplier, AzureApplier, GcpApplier, FlyApplier, AwsApplier, AwsRollback, } from "./apply.js";
+export { policyGate } from "./policy.js";
+export type { PolicyGateArgs } from "./policy.js";
+export { guardValidate, parseGuardFindings } from "./guard-validate.js";
+export type { GuardValidateArgs, GuardValidateResult, GuardFinding } from "./guard-validate.js";
+export { workflowSupplyChainAudit, collectAuditRefs, defaultActionRefResolver } from "./workflow-audit.js";
+export type { WorkflowAuditArgs, WorkflowAuditResult, WorkflowAuditMode, WorkflowAuditFinding, WorkflowAuditFindingKind, ActionRefResolver, ActionRefResolution, } from "./workflow-audit.js";
+export { pipelineSupplyChainAudit, collectPipelineRefs, defaultGitlabRefResolver } from "./pipeline-audit.js";
+export type { PipelineAuditArgs, PipelineAuditResult, PipelineAuditMode, PipelineAuditFinding, PipelineAuditFindingKind, PipelineRefKind, GitlabRefResolver, PipelineRefResolution, } from "./pipeline-audit.js";
+export { convergeTick, planConvergeTick } from "./converge.js";
+export type { ConvergeTickArgs, ConvergeTickResult, ConvergeTickPlan, SerializedConvergeRule } from "./converge.js";
+export { lexiconUpgrade, isPinned, isRolling, severityToLabel, upgradeBranchName, upgradePrTitle, buildUpgradeSummary, } from "./lexicon-upgrade.js";
+export type { LexiconUpgradeArgs, LexiconUpgradeResult, LexiconUpgradeMode, SupportedLexicon, SemverLabel, CheckPinnedFn, CheckRollingFn, GhRunner, ApplyBumpFn, } from "./lexicon-upgrade.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAQ9C,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAK/C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACnD,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAiB1F,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEnG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC1E,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,GACZ,MAAM,SAAS,CAAC;AAKjB,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE7F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACxG,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC3G,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEjH,OAAO,EACL,cAAc,EACd,QAAQ,EACR,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,cAAc,EACd,QAAQ,EACR,WAAW,GACZ,MAAM,mBAAmB,CAAC"}

package/dist/op/activities/lexicon-upgrade.d.ts

@@ -0,0 +1,182 @@
+/**
+ * lexiconUpgrade — the upgrade-detection and PR-automation activity for
+ * in-scope lexicons (k8s, gcp, docker, gitlab, aws, azure, github).
+ *
+ * Classifies the lexicon as pinned or rolling, calls the right check function,
+ * then surfaces the result in the requested mode: report (default), issue, or
+ * pull-request. In pull-request mode it maintains a long-lived branch per
+ * lexicon (`lexicon-upgrade/<lexicon>`), updates the PR in place when the delta
+ * changes, and applies a semver label derived from the surface severity.
+ *
+ * For pinned lexicons in pull-request mode, the PR also bumps the lexicon's
+ * own package.json version according to the semver label (minor → minor bump,
+ * breaking → major bump). Merging the PR carries the version change so
+ * publish-on-merge can ship just that lexicon without a full monorepo release.
+ *
+ * Rolling lexicons (aws, azure, github) drift on their own cadence and are not
+ * version-bumped here — they move to drift-issues per #546.
+ *
+ * Supply-chain note: this activity never executes spec-provided content.
+ * It only reads the artifacts produced by the lexicon's own generate step,
+ * which is called through the lexicon's npm prepack chain.
+ */
+import type { UpgradeCheckResult, LexiconId } from "../../codegen/pinned-upgrade.js";
+import type { RollingUpgradeResult, RollingLexicon } from "../../codegen/rolling-upgrade.js";
+import { bumpPackageJsonVersion } from "../../codegen/version-bump.js";
+export { bumpPackageJsonVersion };
+/** Finding mode, mirrors ReconcileOp's mode. */
+export type LexiconUpgradeMode = "report" | "issue" | "pull-request";
+/** All lexicons supported by this activity. */
+export type SupportedLexicon = LexiconId | RollingLexicon;
+/** Semver label applied to upgrade PRs. */
+export type SemverLabel = "minor" | "breaking";
+export interface LexiconUpgradeArgs {
+    /**
+     * Which lexicon to check. Determines pinned vs rolling dispatch:
+     *   PINNED: k8s, gcp, docker, gitlab, cedar
+     *   ROLLING: aws, azure, github, fly
+     */
+    lexicon: SupportedLexicon;
+    /**
+     * Absolute path to the lexicon root directory.
+     * Defaults to `<cwd>/lexicons/<lexicon>`.
+     */
+    lexiconDir?: string;
+    /** What to produce. Default: "report". */
+    mode?: LexiconUpgradeMode;
+    /**
+     * Override the pinned check function — inject a mock in tests.
+     * The real implementation calls checkPinnedUpgrade from core.
+     */
+    _checkPinned?: CheckPinnedFn;
+    /**
+     * Override the rolling check function — inject a mock in tests.
+     * The real implementation calls checkRollingUpgrade from core.
+     */
+    _checkRolling?: CheckRollingFn;
+    /**
+     * Override the gh/git runner — inject a mock in tests.
+     */
+    _gh?: GhRunner;
+    /**
+     * Override the applyPinnedVersionBump function — inject a mock in tests.
+     */
+    _applyBump?: ApplyBumpFn;
+    /**
+     * Override the package.json version writer — inject a mock in tests.
+     * Defaults to bumpPackageJsonVersion.
+     */
+    _bumpPackageVersion?: BumpPackageVersionFn;
+}
+export interface LexiconUpgradeResult {
+    lexicon: SupportedLexicon;
+    mode: LexiconUpgradeMode;
+    /** True when an upgrade is available and validation passed. */
+    hasUpgrade: boolean;
+    /** Human-readable surface delta summary. Empty when no upgrade. */
+    deltaText: string;
+    /** Semver label applied to the PR. null when no upgrade or no change. */
+    semverLabel: SemverLabel | null;
+    /** URL of the opened/updated PR (pull-request mode). */
+    prUrl?: string;
+    /** URL of the opened issue (issue mode). */
+    issueUrl?: string;
+    /** Full markdown summary, used as PR/issue body or printed in report mode. */
+    summary: string;
+    /** Whether validation passed. False means a breakage report was produced. */
+    validationOk: boolean;
+}
+/** Matches checkPinnedUpgrade from core. */
+export type CheckPinnedFn = (opts: {
+    lexiconDir: string;
+    lexicon: LexiconId;
+    force?: boolean;
+    verbose?: boolean;
+}) => Promise<UpgradeCheckResult>;
+/** Matches checkRollingUpgrade from core. */
+export type CheckRollingFn = (opts: {
+    lexiconDir: string;
+    force?: boolean;
+    verbose?: boolean;
+}) => Promise<RollingUpgradeResult>;
+/** Minimal shell-exec interface for gh/git invocations. */
+export type GhRunner = (cmd: string) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+/** Applies a pinned version bump permanently (no revert). Async (core loads the lexicon's pin descriptor); a sync mock is also accepted. */
+export type ApplyBumpFn = (lexicon: LexiconId, lexiconDir: string, newVersion: string) => {
+    filePath: string;
+} | Promise<{
+    filePath: string;
+}>;
+/**
+ * Write a new version into a package.json, returning the file path.
+ * Injectable for tests via LexiconUpgradeArgs._bumpPackageVersion.
+ */
+export type BumpPackageVersionFn = (packageJsonPath: string, newVersion: string) => void;
+/**
+ * Compute a bumped semver string from a current version and a semver label.
+ *
+ * The mapping is 0.x-aware, because promoting to 1.0.0 should signal the
+ * lexicon's own API stability, not track an upstream spec's breaking change:
+ *
+ * - Pre-1.0 (major === 0): "breaking" bumps the minor (0.13.1 → 0.14.0),
+ *   "minor" (additive) bumps the patch (0.13.1 → 0.13.2). Never auto-1.0.0.
+ * - >= 1.0.0: "minor" bumps the minor (1.2.3 → 1.3.0), "breaking" bumps the
+ *   major (1.2.3 → 2.0.0).
+ *
+ * Handles the common "MAJOR.MINOR.PATCH" form. Returns null when the
+ * current version string cannot be parsed as M.m.p.
+ */
+export declare function computeBumpedVersion(current: string, label: SemverLabel): string | null;
+/** Return true when the lexicon uses a pinned version constant. */
+export declare function isPinned(lexicon: SupportedLexicon): lexicon is LexiconId;
+/** Return true when the lexicon follows a rolling spec (no pinned constant). */
+export declare function isRolling(lexicon: SupportedLexicon): lexicon is RollingLexicon;
+/**
+ * Map a surface severity to a semver label for the PR.
+ *
+ * "additive" → "minor"   (new resources/properties added)
+ * "breaking" → "breaking" (removed or changed resources/properties)
+ * "none"     → null       (surface unchanged)
+ */
+export declare function severityToLabel(severity: string): SemverLabel | null;
+/** Long-lived branch name for a lexicon upgrade PR. */
+export declare function upgradeBranchName(lexicon: SupportedLexicon): string;
+/** PR title for an upgrade. */
+export declare function upgradePrTitle(lexicon: SupportedLexicon, from?: string, to?: string | null): string;
+/** Build the PR/issue/report body from the upgrade result data. */
+export declare function buildUpgradeSummary(opts: {
+    lexicon: SupportedLexicon;
+    from?: string;
+    to?: string | null;
+    deltaText: string;
+    semverLabel: SemverLabel | null;
+    validationOk: boolean;
+    failures?: Array<{
+        step: string;
+        output: string;
+    }>;
+}): string;
+/**
+ * Run the lexicon upgrade check for one lexicon and surface the result.
+ *
+ * Pinned lexicons (k8s, gcp, docker, gitlab):
+ *   Calls checkPinnedUpgrade. A PR is opened only when hasUpgrade=true AND
+ *   validation passed. Validation failures produce a report or issue.
+ *
+ * Rolling lexicons (aws, azure, github):
+ *   Calls checkRollingUpgrade. A PR is opened only when the surface changed
+ *   AND validation passed. Surface unchanged = no action.
+ *
+ * In pull-request mode:
+ *   - Branch: lexicon-upgrade/<lexicon> (long-lived, one per lexicon).
+ *   - Idempotent: if the open PR body matches the new summary, skip re-push.
+ *   - Semver label: "minor" (additive) or "breaking" (changed/removed).
+ *   - Validation failure falls back to issue mode.
+ *
+ * Never auto-merges or auto-publishes.
+ */
+export declare function lexiconUpgrade(args: LexiconUpgradeArgs): Promise<LexiconUpgradeResult>;
+//# sourceMappingURL=lexicon-upgrade.d.ts.map

package/dist/op/activities/lexicon-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexicon-upgrade.d.ts","sourceRoot":"","sources":["../../../src/op/activities/lexicon-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,OAAO,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAmB,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAErF,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAMlC,gDAAgD;AAChD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAC;AAErE,+CAA+C;AAC/C,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,cAAc,CAAC;AAE1D,2CAA2C;AAC3C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;OAEG;IACH,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf;;OAEG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,kBAAkB,CAAC;IACzB,+DAA+D;IAC/D,UAAU,EAAE,OAAO,CAAC;IACpB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,YAAY,EAAE,OAAO,CAAC;CACvB;AAID,4CAA4C;AAC5C,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,SAAS,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC,6CAA6C;AAC7C,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEpC,2DAA2D;AAC3D,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEpF,4IAA4I;AAC5I,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,SAAS,EAClB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,KACf;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;AAIzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,GACjB,MAAM,GAAG,IAAI,CAKf;AASD,mEAAmE;AACnE,wBAAgB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,IAAI,SAAS,CAExE;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,IAAI,cAAc,CAE9E;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAIpE;AAID,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAEnE;AAED,+BAA+B;AAC/B,wBAAgB,cAAc,CAC5B,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,MAAM,EACb,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GACjB,MAAM,CAGR;AAID,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD,GAAG,MAAM,CAqDT;AA6FD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA4R5F"}

package/dist/op/activities/lifecycle.d.ts

@@ -0,0 +1,42 @@
+export interface LifecycleSnapshotArgs {
+    /** Environment name (e.g. "dev", "staging", "prod"). */
+    env: string;
+}
+/**
+ * Take a chant lifecycle snapshot for the given environment.
+ * Uses fastIdempotent profile — 5m timeout, 3 retries.
+ */
+export declare function lifecycleSnapshot(args: LifecycleSnapshotArgs, signal?: AbortSignal): Promise<void>;
+export interface LifecycleDiffArgs {
+    /** Environment name (e.g. "dev", "staging", "prod"). */
+    env: string;
+    /**
+     * When true, run `chant lifecycle diff <env> --live` (queries cloud APIs).
+     * When false (default), run digest-only diff against the last snapshot.
+     */
+    live?: boolean;
+}
+export interface LifecycleDiffResult {
+    /** Combined stdout + stderr from the chant command. */
+    output: string;
+    /** Process exit code (0 = success). */
+    exitCode: number;
+    /**
+     * True when the diff output contains any drift indicators
+     * (MISSING / ORPHAN / DRIFTED / DISAPPEARED section headers from
+     * `chant lifecycle diff --live`).
+     */
+    drifted: boolean;
+}
+/**
+ * Run `chant lifecycle diff <env>` and return the output + structured drift
+ * flag. Read-only; intended for use inside watch/observation Ops.
+ * Uses fastIdempotent profile.
+ *
+ * The `drifted` field is computed by scanning the output for any of the
+ * MISSING / ORPHAN / DRIFTED / DISAPPEARED section headers documented in
+ * cli/state.mdx. Pair with `outcomeAttribute: { name: "Drift", from: "drifted" }`
+ * on a WatchOp activity step to surface drift as the run's `Drift` outcome.
+ */
+export declare function lifecycleDiff(args: LifecycleDiffArgs, signal?: AbortSignal): Promise<LifecycleDiffResult>;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/op/activities/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/op/activities/lifecycle.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxG;AAED,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAoBD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAa/G"}