@intentius/chant 0.57.0 → 0.59.0

package/dist/op/activities/apply.d.ts

@@ -0,0 +1,262 @@
+/**
+ * `nativeApply` — push declared source to the cloud through the target's own
+ * mechanism. Authority stays with the platform; chant hosts no state file.
+ *
+ * ## Where the shell went (chant #1075, #1448, #1449)
+ *
+ * This used to build a shell command for every target — `kubectl apply -f`,
+ * `az deployment group create`, `aws cloudformation deploy`. Two things were
+ * wrong with that. The shell commands carried product knowledge that belongs to
+ * each product's lexicon, against the one-lexicon-per-product rule that already
+ * moved `kubectlApply`, `k3dUp`/`k3dDown` and `waitForArgoSync` out (chant
+ * #809). And each CLI's semantics diverged from what the docblocks promised —
+ * `kubectl apply`'s client-side merge gave the diff engine nothing to key on
+ * (#1075), and ARM Complete mode deleted resources chant never applied (#1448).
+ *
+ * So each branch moved to its product's lexicon: `kubectl`/`kustomize` are a
+ * server-side apply over the k8s lexicon's typed client (#1075, #1548), `arm`
+ * is the azure lexicon's per-resource `azApply` (#1448), `cloudformation`
+ * is the aws lexicon's `awsApply` — the CloudFormation Query API directly, no
+ * CLI in the path (#1449) — and `gcp`/`fly` are the gcp lexicon's
+ * per-resource `gcpApply` and the fly lexicon's `flyApply`, which never had a
+ * CLI in the path to begin with: gcp maps each CNRM kind to its REST API
+ * itself, and fly speaks the Machines API (flaps) directly, no flyctl.
+ * **The dispatcher stayed here**, because "which
+ * mechanism applies this target" is not any one product's knowledge — and
+ * because the activity keeps its name, its arguments and its place in
+ * `ApplyOp`, so no existing Op changes shape.
+ *
+ * The lexicons are reached by dynamic import at call time, never by a static
+ * one: this package must not depend on them. A project applying a target
+ * already lists that lexicon in its config, so the module is there; when it is
+ * not, the failure names the package to install.
+ */
+import { type ApplyResult } from "../../apply.js";
+/** The native apply mechanism for a target. */
+export type ApplyTarget = "cloudformation" | "kubectl" | "arm" | "kustomize" | "gcp" | "fly";
+/**
+ * How apply treats resources no longer declared.
+ * - `never` — additive only; never deletes.
+ * - `owned-only` — enables the target's own delete path. What bounds that path
+ *   differs per target, and all of them are genuinely owned-only: `kubectl`
+ *   sweeps by the ownership marker, `arm` prunes by the ownership tag
+ *   (`isChantOwned`, via the azure lexicon's `azApply`), `gcp` prunes by the
+ *   ownership label (via the gcp lexicon's `gcpApply` — only kinds it can
+ *   list; the rest are reported not-prunable), `fly` prunes machines by the
+ *   metadata marker and the metadata-less types (volumes/ips/certs/secrets)
+ *   app-scoped under a managed app (via the fly lexicon's `flyApply`), and
+ *   `cloudformation` is bounded by the stack — which holds, because a
+ *   resource CFN did not create is not in the stack.
+ * - `gated` — same delete scope as `owned-only`, but an approval gate precedes
+ *   the destructive apply, so an unapproved run ends `gated` before deleting
+ *   anything (the gate lives in the composite).
+ */
+export type DeleteMode = "never" | "owned-only" | "gated";
+export interface NativeApplyArgs {
+    /** Native mechanism to delegate to. */
+    target: ApplyTarget;
+    /** Environment. What it means is per target: the CFN stack name on
+     * `cloudformation`, the ARM resource group on `arm`, the chant environment
+     * on `kubectl`/`kustomize`. On `gcp` and `fly` it is a log label only — the
+     * gcp applier resolves the project (`GOOGLE_CLOUD_PROJECT` env / CNRM
+     * annotation) and endpoint (`GCP_ENDPOINT_URL` env) itself, and the fly
+     * applier resolves its endpoint (`FLY_FLAPS_BASE_URL` env) and token
+     * (`FLY_API_TOKEN` env) itself, with the app names coming from the plan. */
+    env: string;
+    /** Built manifest/template path. Default per target ({@link defaultOutput}):
+     * `dist` (a dir) for kubectl, `template.json` (a file) for
+     * CloudFormation/ARM, `dist/gcp.yaml` for gcp, `dist/fly.json` for fly. */
+    output?: string;
+    /** Delete handling. Default: never. */
+    deleteMode?: DeleteMode;
+    /**
+     * kubectl target only (chant #1075). Take ownership of fields another field
+     * manager owns instead of failing with a conflict that names them.
+     * **Opt-in, and never defaulted on**: transferring ownership of a live field
+     * is a decision, not a retry.
+     */
+    forceConflicts?: boolean;
+}
+/**
+ * What an apply did — one shape for every target: the count projection of
+ * core's `NormalizedApply` (#1446, collapsed here in #1449). The per-target
+ * shapes this used to carry (`fieldManager`, `stackName`/`status`/`action`,
+ * a separate `notPrunable`) belong to the appliers and stay in their lexicons;
+ * this activity's result is the shape every Op reads back regardless of
+ * target, and the target-specific detail still reaches the operator on the
+ * activity log.
+ */
+export interface NativeApplyResult {
+    /** Resources the provider was called for and which converged — created,
+     * updated or unchanged. On `cloudformation` the unit is the stack, so a
+     * settled deploy is `1`. */
+    applied: number;
+    /** Owned, no-longer-declared resources deleted. */
+    pruned: number;
+    /** Declared resources no provider call was made for (#1447), including
+     * kinds an owned-only prune could not consider (`not-prunable`). Zero on a
+     * complete apply. */
+    notAttempted: number;
+}
+/**
+ * The k8s lexicon's server-side apply, as this module needs to call it.
+ * Structural, so nothing here imports the k8s lexicon's types.
+ */
+export type K8sApplier = (args: {
+    manifest: string;
+    /** Already-rendered documents (#1548) — the kustomize target hands the
+     * render straight in; `manifest` is then only the log label. */
+    documents?: Array<Record<string, unknown>>;
+    environment?: string;
+    deleteMode?: DeleteMode;
+    force?: boolean;
+}, signal?: AbortSignal) => Promise<{
+    applied: unknown[];
+    pruned: unknown[];
+    fieldManager: string;
+}>;
+/**
+ * The azure lexicon's per-resource ARM applier, as this module needs to call
+ * it: `azApply` composed with the lexicon's own `toApplyResult` projection, so
+ * what crosses this seam is core's versioned apply envelope (#1446) and
+ * nothing ARM-shaped.
+ */
+export type AzureApplier = (args: {
+    templatePath: string;
+    resourceGroup: string;
+    endpoint?: string;
+    prune?: boolean;
+}, signal?: AbortSignal) => Promise<ApplyResult>;
+/**
+ * The gcp lexicon's per-resource applier, as this module needs to call it
+ * (#1449): `gcpApply` composed with the lexicon's own `toApplyResult`
+ * projection, so what crosses this seam is core's versioned apply envelope
+ * (#1446) — the skips of #1447 ride it as NOT-ATTEMPTED entries, and a kind
+ * the prune could not consider rides it as `not-prunable`.
+ *
+ * Deliberately narrow: no `endpoint`, because `gcpApply` resolves
+ * `GCP_ENDPOINT_URL` itself — the same variable gcp's read path honours, so an
+ * apply lands wherever `--live` is already looking (floci-gcp, or real GCP
+ * when unset); and no `project`, because `gcpApply` resolves
+ * `GOOGLE_CLOUD_PROJECT` / the CNRM project-id annotation itself.
+ */
+export type GcpApplier = (args: {
+    manifestPath: string;
+    prune?: boolean;
+}, signal?: AbortSignal) => Promise<ApplyResult>;
+/**
+ * The fly lexicon's flaps applier, as this module needs to call it (#1449):
+ * `flyApply` composed with the lexicon's own `toApplyResult` projection. The
+ * eleven arrays flyApply returns — six entity classes applied, five pruned —
+ * are its own contract and stay in the fly lexicon; what crosses this seam is
+ * core's versioned apply envelope (#1446).
+ *
+ * Deliberately narrow: no `endpoint`, because `flyApply` resolves
+ * `FLY_FLAPS_BASE_URL` itself — mudflaps locally, real Fly when unset; and no
+ * `token`, because it resolves `FLY_API_TOKEN` itself.
+ */
+export type FlyApplier = (args: {
+    planPath: string;
+    prune?: boolean;
+}, signal?: AbortSignal) => Promise<ApplyResult>;
+/**
+ * The aws lexicon's CloudFormation applier, as this module needs to call it
+ * (#1449). Structural, like {@link K8sApplier} and {@link AzureApplier}.
+ *
+ * Deliberately narrow: no `endpoint`, because `awsApply` resolves
+ * `AWS_ENDPOINT_URL_CLOUDFORMATION` then `AWS_ENDPOINT_URL` itself (#1694) —
+ * the rule that used to live here as `applyEndpoint` (#926); and no
+ * `capabilities`, because `awsApply` derives them from the template body
+ * (`CAPABILITY_NAMED_IAM`, plus `CAPABILITY_AUTO_EXPAND` for a top-level
+ * `Transform` — #980), the rule that used to live here as `cfnCapabilities`.
+ */
+export type AwsApplier = (args: {
+    templatePath: string;
+    stackName: string;
+}, signal?: AbortSignal) => Promise<{
+    stackName: string;
+    status: string;
+    action: "created" | "updated" | "unchanged";
+}>;
+/**
+ * The aws lexicon's CloudFormation rollback (saga compensation), as
+ * {@link compensateApply} needs to call it. Structural, like the appliers.
+ */
+export type AwsRollback = (args: {
+    stackName: string;
+}, signal?: AbortSignal) => Promise<{
+    stackName: string;
+    rolledBack: boolean;
+    status?: string;
+}>;
+/**
+ * Sensible default build output per target. kubectl takes a directory (all
+ * manifests), so `dist`; kustomize's "output" is the kustomization DIRECTORY
+ * the render reads. The file targets take the file their lexicon's build
+ * conventionally emits: `template.json` for CloudFormation/ARM, `dist/gcp.yaml`
+ * (the CNRM manifest) for gcp, `dist/fly.json` (the serialized plan) for fly.
+ * Pure — exported for testing.
+ */
+export declare function defaultOutput(target: ApplyTarget): string;
+/**
+ * Apply declared source to the cloud via the target's native mechanism.
+ * Deletes (when enabled) ride that mechanism's own delete path — marker-scoped
+ * on `kubectl`, tag-scoped on `arm`, label-scoped on `gcp`, marker- and
+ * app-scoped on `fly`, and stack-scoped on `cloudformation`, where the deploy
+ * itself removes resources dropped from the template and `deleteMode` changes
+ * nothing: a resource CFN did not create is not in the stack. See
+ * {@link DeleteMode}.
+ *
+ * The appliers are injectable so this dispatcher can be tested without the
+ * product lexicons present; production resolves them through
+ * {@link loadK8sApplier} / {@link loadAzureApplier} / {@link loadAwsApplier} /
+ * {@link loadGcpApplier} / {@link loadFlyApplier}.
+ */
+export declare function nativeApply(args: NativeApplyArgs, signal?: AbortSignal, applier?: K8sApplier, azureApplier?: AzureApplier, renderer?: (dir: string) => Promise<Array<Record<string, unknown>>>, awsApplier?: AwsApplier, gcpApplier?: GcpApplier, flyApplier?: FlyApplier): Promise<NativeApplyResult>;
+/**
+ * Whether a target has a mapped native rollback for {@link compensateApply} to
+ * run without an explicit `compensate.command`. `cloudformation` is the only
+ * one today — the aws lexicon's `rollbackStack`. This is the totality
+ * predicate `ApplyOp` checks at build time (#1449): a target outside it with
+ * no command has nothing a compensation could run, so the op refuses to build
+ * with compensation on rather than warn at rollback time.
+ */
+export declare function hasNativeRollback(target: ApplyTarget): boolean;
+export interface CompensateApplyArgs {
+    /** Native mechanism that was applied. */
+    target: ApplyTarget;
+    /** Environment — CFN stack name / ARM resource group. */
+    env: string;
+    /** Explicit rollback command, used in preference to the native default. */
+    command?: string;
+}
+/** What a compensation did. */
+export interface CompensateApplyResult {
+    /** The explicit rollback command that ran, when one was supplied. */
+    command?: string;
+    /** The stack rolled back — cloudformation. */
+    stackName?: string;
+    /** Whether the native rollback actually ran — cloudformation. `false` when
+     * the stack was absent or the target does not implement RollbackStack (Floci). */
+    rolledBack?: boolean;
+    /** The settled post-rollback stack status — cloudformation. */
+    status?: string;
+}
+/**
+ * Compensation step (saga rollback) for a partial apply failure. Runs the
+ * explicit `command` if given; otherwise `cloudformation` rolls back natively
+ * through the aws lexicon's `rollbackStack` (#1449 — CloudFormation
+ * `RollbackStack` over the Query API, no CLI in the path).
+ *
+ * Compensation is total for built ops: `ApplyOp` refuses at build time to wire
+ * this activity for a target with neither a native rollback
+ * ({@link hasNativeRollback}) nor an explicit `command`, so the no-rollback
+ * branch below is unreachable from an op it built. It stays as a throw, not a
+ * warn — a hand-assembled op that reaches it must fail loudly, because partial
+ * state should never look reverted when it isn't.
+ *
+ * `rollback` is injectable for tests; production resolves it through
+ * {@link loadAwsRollback}.
+ */
+export declare function compensateApply(args: CompensateApplyArgs, signal?: AbortSignal, rollback?: AwsRollback): Promise<CompensateApplyResult>;
+//# sourceMappingURL=apply.d.ts.map

package/dist/op/activities/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/D,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,SAAS,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,GAAG,KAAK,CAAC;AAE7F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;;gFAM4E;IAC5E,GAAG,EAAE,MAAM,CAAC;IACZ;;+EAE2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC;;gCAE4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf;;yBAEqB;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB;oEACgE;IAChE,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,EACD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE;IACJ,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,EACD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1B;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,IAAI,EAAE;IACJ,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,EACD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,EACD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACjD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC3B,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAgN1E;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAYzD;AAgCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,UAAU,EACpB,YAAY,CAAC,EAAE,YAAY,EAC3B,QAAQ,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAuB,EACxF,UAAU,CAAC,EAAE,UAAU,EACvB,UAAU,CAAC,EAAE,UAAU,EACvB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,iBAAiB,CAAC,CA0F5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAE9D;AAED,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+BAA+B;AAC/B,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;sFACkF;IAClF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,qBAAqB,CAAC,CA0BhC"}

package/dist/op/activities/build.d.ts

@@ -0,0 +1,13 @@
+export interface ChantBuildArgs {
+    path: string;
+    /** npm script to run. Default: `build`. Set e.g. `build:aws` to build one target. */
+    script?: string;
+    /** Optional extra env vars to pass to the build command. */
+    env?: Record<string, string>;
+}
+/**
+ * Run an npm build script (`build` by default) in the given project directory.
+ * Uses fastIdempotent profile — 5m timeout, 3 retries.
+ */
+export declare function chantBuild(args: ChantBuildArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=build.d.ts.map

package/dist/op/activities/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/op/activities/build.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ1F"}

package/dist/op/activities/converge.d.ts

@@ -0,0 +1,110 @@
+import { type ConvergeRule } from "../converge-rule.js";
+import { type OpVerbClass } from "../op-verb-class.js";
+import { type ConvergeSymptom } from "../../lifecycle/symptoms.js";
+import { sanitizeLedgerText, type ConvergeRuleOutcome, type ConvergeTickRecord } from "../../lifecycle/converge-ledger.js";
+/** A `ConvergeRule<ConvergeSymptom>`, restated with `S = ConvergeSymptom` fixed — the JSON shape `ConvergeOp` bakes into the Op's `convergeTick` step args. */
+export type SerializedConvergeRule = ConvergeRule<ConvergeSymptom>;
+export interface ConvergeTickArgs {
+    /** Op name (`ConvergeOp`'s own `config.name`) — carried into the ledger record. */
+    opName: string;
+    env: string;
+    /**
+     * Authority level for this environment (the issue's dial × verb-class
+     * matrix): `"observe"` never dispatches a mutating/destructive op
+     * (report-only); `"reconcile"` free-runs a read-only op but never a
+     * mutating one — the issue's table answer for `reconcile` × mutating is
+     * "open PR", which v1 doesn't implement (epic #1487's onDrift-channel open
+     * question), so `reconcile` refuses that dispatch (`OPS014`, build time)
+     * rather than silently escalating it to "run directly"; `"apply"` is the
+     * only dial that free-runs a mutating op. A destructive op is refused
+     * under every dial, `"apply"` included, in v1 — see `OPS014`'s doc on why
+     * "destructive + apply + gated" can never actually dispatch.
+     */
+    dial: "observe" | "reconcile" | "apply";
+    /** Max number of `run` dispatches this tick may perform; remaining matched rules are recorded `skipped-budget`. */
+    budget: number;
+    /** The rule table, in authored order. */
+    rules: SerializedConvergeRule[];
+    /**
+     * `Observe` phase's quick drift signal, threaded in via a step-output
+     * reference rather than a search-attribute round-trip (#1290) — a
+     * diagnostic cross-check folded into the tick record, not a control input
+     * (this activity re-derives its own symptom independently).
+     */
+    preflightDrift?: boolean;
+}
+export interface ConvergeTickResult {
+    /** The ledger record's tick id (#2027) — what a caller correlates this tick's outcomes, gate facts and remediations against. */
+    id: string;
+    drifted: boolean;
+    remediated: number;
+    reported: number;
+    skippedBudget: number;
+    skippedFlap: number;
+    unobserved: number;
+    adopted: number;
+    /** Rules whose dispatch hit a gate this tick (#1485) — see `ConvergeRuleOutcome.action`'s doc. */
+    gated: number;
+    /** The one human-readable summary line this tick produced. */
+    log: string;
+}
+/**
+ * Cap a subprocess failure's raw output to one sanitized line — a ledger
+ * record (`converge-ledger.ts`'s `appendConvergeRecord`) is one line of JSON,
+ * and a multi-line/oversized `stderr` folded straight into `outcome.reason`
+ * would break that. Not a fix for the ledger-durability bug (#1936,
+ * `writeBlobToPath`'s corruption under concurrent writes — fixed at the root
+ * in a separate PR); this only keeps one dispatch failure's own message from
+ * corrupting the line it's written into.
+ *
+ * The rule now lives next to the record it protects (`sanitizeLedgerText`,
+ * #2027), since a component verdict's `detail` needs the same cap; this stays
+ * as the dispatch path's name for it.
+ */
+export declare const sanitizeOneLine: typeof sanitizeLedgerText;
+/**
+ * The gate a gated `chant run` stopped at, read off its JSON result (#2119) —
+ * pure, unit-tested directly rather than only through `dispatchOp`'s
+ * subprocess plumbing. `undefined` when the output says nothing about a gate.
+ */
+export declare function classifyDispatchFailure(raw: string): {
+    gateName: string;
+} | undefined;
+/**
+ * Runtime backstop for issue #1484's Autonomy table (pre-merge review of
+ * #1954): `OPS014` already refuses, at build time, a rule table shaped to
+ * reach this point with a mutating dispatch outside `"apply"` or any
+ * destructive dispatch at all. This is the defense-in-depth check for a rule
+ * table that reached `convergeTick` without going through that build — the
+ * same "not authored through the checked path" concern
+ * `isWellFormedPredicate` already guards for a hand-assembled predicate (see
+ * `../../../../packages/core/src/op/converge-rule.ts`'s doc). Fail-closed:
+ * an unclassifiable target (`verbClass === undefined`, e.g. the target op
+ * couldn't be discovered/read) is never treated as safe to free-run — same
+ * fail-closed stance `classifyOpVerbClass` itself takes for an unrecognized
+ * activity `fn`.
+ */
+export declare function verbClassAllowedToDispatch(dial: ConvergeTickArgs["dial"], verbClass: OpVerbClass | undefined): boolean;
+/**
+ * Apply {@link verbClassAllowedToDispatch} to one planned "ran" outcome,
+ * downgrading it to "reported" (never silently dropped, never silently run)
+ * when the dial/verb-class pairing isn't one the tick may actually free-run.
+ * Pure — the impure part (discovering and classifying the target op) is
+ * {@link classifyDispatchTarget}, called by `convergeTick` before this.
+ */
+export declare function enforceVerbClassAtDispatch(outcome: ConvergeRuleOutcome, dial: ConvergeTickArgs["dial"], verbClass: OpVerbClass | undefined): ConvergeRuleOutcome;
+/**
+ * The pure planning core: given a symptom, a rule table, prior-tick fire
+ * history, the dial, and the remaining budget, decide what each rule does
+ * this tick. Exported and unit-tested directly — the activity function
+ * around it is the thin I/O shell (gather inputs, execute the plan, append
+ * the ledger record), matching `reconcilePr`'s split between its pure
+ * `reconcileSummary`/`entriesFromPlan` and its I/O body.
+ */
+export interface ConvergeTickPlan {
+    firedRuleIds: string[];
+    outcomes: ConvergeRuleOutcome[];
+}
+export declare function planConvergeTick(symptom: ConvergeSymptom, rules: SerializedConvergeRule[], priorRecords: ConvergeTickRecord[], dial: ConvergeTickArgs["dial"], budget: number): ConvergeTickPlan;
+export declare function convergeTick(args: ConvergeTickArgs, signal?: AbortSignal): Promise<ConvergeTickResult>;
+//# sourceMappingURL=converge.d.ts.map

package/dist/op/activities/converge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge.d.ts","sourceRoot":"","sources":["../../../src/op/activities/converge.ts"],"names":[],"mappings":"AAkCA,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAKL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,iCAAiC,CAAC;AAQzC,+JAA+J;AAC/J,MAAM,MAAM,sBAAsB,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAEnE,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;IACxC,mHAAmH;IACnH,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,gIAAgI;IAChI,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,2BAAqB,CAAC;AA0BlD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAerF;AA0CD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAKtH;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAC9B,SAAS,EAAE,WAAW,GAAG,SAAS,GACjC,mBAAmB,CAWrB;AAaD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,sBAAsB,EAAE,EAC/B,YAAY,EAAE,kBAAkB,EAAE,EAClC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GACb,gBAAgB,CAmDlB;AAoBD,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyF5G"}

package/dist/op/activities/env-teardown.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `envTeardown` — the durable form of `chant lifecycle teardown <env> --yes`
+ * (#1222).
+ *
+ * Wraps core's {@link executeTeardown}: enumerate the live resources whose
+ * ownership marker carries this project's `ownership.stack` + the requested
+ * environment, delete them through each lexicon's `executeTeardown`
+ * capability, run core's one bounded retry pass, and fail the activity loudly
+ * when any candidate is still `failed` afterwards. Selection is marker-scoped
+ * by construction — the same engine the CLI verb drives, reached in-process
+ * rather than through a shell.
+ *
+ * The guards are the CLI's guards, unchanged:
+ * - an environment the project does not declare is refused;
+ * - a project with no `ownership.stack` is refused — teardown has nothing to
+ *   select on;
+ * - a production-like environment name (`prod`, `production`, `prod-eu`, ...)
+ *   is refused unless the step's args carry an explicit `confirmProd: true`.
+ *   An Op is non-interactive, so there is no re-type-the-name prompt to fall
+ *   back to — the confirmation must be authored into the Op.
+ *
+ * All three refusals throw before any live read, so a refused teardown
+ * touches nothing at all. They are configuration errors, not transient ones —
+ * no retry can make `prod` stop looking like production.
+ *
+ * Distinct from {@link chantTeardown} (`npm run teardown`), which runs
+ * whatever script a project wired under that name. This activity is
+ * product-agnostic: it imports core only, and core reaches each product
+ * through the lexicons the project configures.
+ */
+import { type ChantConfig } from "../../config.js";
+import { type TeardownReport } from "../../lifecycle/teardown.js";
+import type { ObservationLexicon } from "../../lexicon.js";
+export interface EnvTeardownArgs {
+    /** The environment to tear down — the marker env core selects on. */
+    env: string;
+    /**
+     * Required (as an explicit `true`) when `env` looks production-like.
+     * The Op's counterpart of the CLI's `--confirm-prod`: activities never
+     * prompt, so the confirmation is authored, reviewed, and versioned with
+     * the Op instead.
+     */
+    confirmProd?: boolean;
+    /** Path to the chant project (where chant.config.ts lives). Default: the chant process's cwd. */
+    path?: string;
+}
+/** What a completed (fully successful) teardown reports back to the run. */
+export interface EnvTeardownResult {
+    environment: string;
+    /** The ownership stack everything was selected on. */
+    stack: string;
+    deleted: number;
+    /** Deliberately refused by a lexicon, with the reason in the report. */
+    notPrunable: number;
+    /** Planned candidates whose lexicon implements no execution yet. */
+    skipped: number;
+    /** Kinds that could not be read (#1089) — the plan was incomplete, not clean. */
+    holes: number;
+    /** The full per-candidate report core produced. */
+    report: TeardownReport;
+}
+/** Injectable seams for testing — production loads both from the project. */
+export interface EnvTeardownDeps {
+    /** Pre-loaded project config (skips reading chant.config.ts). */
+    config?: ChantConfig;
+    /** Pre-loaded lexicon plugins (skips resolving + importing lexicon packages). */
+    plugins?: ObservationLexicon[];
+}
+/**
+ * Tear down one environment's marker-owned resources through the core
+ * teardown engine. Uses the `longInfra` profile — deletion waits on the
+ * target's own pace. Safe to retry: the engine re-plans from live markers on
+ * every run, and a resource already gone is simply no longer a candidate.
+ */
+export declare function envTeardown(args: EnvTeardownArgs, _signal?: AbortSignal, deps?: EnvTeardownDeps): Promise<EnvTeardownResult>;
+//# sourceMappingURL=env-teardown.d.ts.map

package/dist/op/activities/env-teardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-teardown.d.ts","sourceRoot":"","sources":["../../../src/op/activities/env-teardown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EAA0C,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAGxF,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iGAAiG;IACjG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAaD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,WAAW,EACrB,IAAI,CAAC,EAAE,eAAe,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAyE5B"}

package/dist/op/activities/guard-validate.d.ts

@@ -0,0 +1,64 @@
+export interface GuardValidateArgs {
+    /**
+     * Path to a `.guard` rules file or directory, passed to `cfn-guard validate
+     * -r`. No chant-specific rule format — these are ordinary cfn-guard rules,
+     * the same ones CDK's `CfnGuardValidator` would run.
+     */
+    rules: string;
+    /**
+     * Path to the built CloudFormation template to validate. Default:
+     * `<path>/template.json` — the convention `chant build -o template.json`
+     * writes to (see the aws lexicon's own examples and the native-output
+     * policy docs).
+     */
+    template?: string;
+    /** Project directory `template` is resolved relative to, when `template` is not given. Default ".". */
+    path?: string;
+    /**
+     * What to produce on a finding. Only `"report"` runs today — it prints a
+     * summary and throws on any finding, no external service involved.
+     * `issue`/`pull-request` modes (reusing the audit-Op finding-mode
+     * plumbing) are left to a follow-up. Default: `"report"`.
+     */
+    onFinding?: "report";
+    /** Path to (or name of) the `cfn-guard` binary. Default: `"cfn-guard"`, resolved via `PATH`. */
+    binary?: string;
+}
+/** One cfn-guard rule violation, mapped to a chant-shaped diagnostic. */
+export interface GuardFinding {
+    /** The cfn-guard rule name that failed. */
+    rule: string;
+    /** Always `"error"` today — a cfn-guard non-compliant result is a policy violation, the same weight `policyGate` gives a violation. */
+    severity: "error";
+    /** Human-readable violation message. */
+    message: string;
+    /** Best-effort CloudFormation logical id the violation is about, when cfn-guard's output names one. */
+    entity?: string;
+}
+export interface GuardValidateResult {
+    findings: GuardFinding[];
+    summary: string;
+}
+/**
+ * Map cfn-guard's `--output-format json` report to chant-shaped findings.
+ * Exported and tested directly (independent of `spawn`) — same split
+ * `collectPipelineRefs`/`pipelineSupplyChainAudit` (`./pipeline-audit.ts`)
+ * use between pure mapping and the orchestrating activity.
+ *
+ * Throws if `stdout` is not parseable JSON — a cfn-guard invocation that
+ * didn't run with `--output-format json` (a bad rules path, a version too
+ * old to support it) is a setup problem, not "zero violations"; reporting
+ * a clean run here would be a false negative.
+ */
+export declare function parseGuardFindings(stdout: string): GuardFinding[];
+/**
+ * Run an external CloudFormation Guard rules pack against the project's
+ * built CloudFormation template. `report` mode: prints a summary, and
+ * throws (non-retryable) when any rule is violated, so the local executor
+ * (`chant run`) exits non-zero and CI fails the pipeline — the same shape
+ * `policyGate` uses to block an apply. A clean run passes through.
+ *
+ * A plain activity on every runtime, not a `gate` step.
+ */
+export declare function guardValidate(args: GuardValidateArgs, _signal?: AbortSignal): Promise<GuardValidateResult>;
+//# sourceMappingURL=guard-validate.d.ts.map

package/dist/op/activities/guard-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-validate.d.ts","sourceRoot":"","sources":["../../../src/op/activities/guard-validate.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,uIAAuI;IACvI,QAAQ,EAAE,OAAO,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AA2DD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,EAAE,CA2BjE;AAUD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuChH"}

package/dist/op/activities/http-check.d.ts

@@ -0,0 +1,34 @@
+export interface HttpCheckArgs {
+    /** URL to GET (or `method`). */
+    url: string;
+    /** HTTP method. Default: `GET`. */
+    method?: string;
+    /** Exact expected status. Default: any 2xx. */
+    status?: number;
+    /** Substring the response body must contain. */
+    contains?: string;
+    /** Retries before failing, for a resource that may lag. Default: `0`. */
+    retries?: number;
+    /** Delay between retries in ms. Default: `1000`. */
+    intervalMs?: number;
+}
+/** Injectable fetch — the response shape `httpCheck` needs. Defaults to global `fetch`. */
+export type HttpFetch = (url: string, init?: {
+    method?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    status: number;
+    text(): Promise<string>;
+}>;
+/** Whether a status satisfies the expectation (exact if given, else any 2xx). Pure. */
+export declare function statusOk(status: number, expected?: number): boolean;
+/**
+ * Assert an HTTP endpoint responds as expected — a typed verify step, the modeled
+ * replacement for `shell("curl -fs ...")`. Fails (throwing) if the status or body
+ * doesn't match after the allowed retries. `fetchFn` is injectable for tests.
+ * Uses fastIdempotent profile — 5m timeout.
+ */
+export declare function httpCheck(args: HttpCheckArgs, signal?: AbortSignal, fetchFn?: HttpFetch): Promise<{
+    status: number;
+}>;
+//# sourceMappingURL=http-check.d.ts.map

package/dist/op/activities/http-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-check.d.ts","sourceRoot":"","sources":["../../../src/op/activities/http-check.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,2FAA2F;AAC3F,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEhJ,uFAAuF;AACvF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,GAAE,SAAiB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAuBlI"}

package/dist/op/activities/index.d.ts

@@ -0,0 +1,31 @@
+export { chantBuild } from "./build.js";
+export type { ChantBuildArgs } from "./build.js";
+export { waitForStack } from "./wait.js";
+export type { WaitForStackArgs } from "./wait.js";
+export { shellCmd } from "./shell.js";
+export type { ShellCmdArgs } from "./shell.js";
+export { httpCheck, statusOk } from "./http-check.js";
+export type { HttpCheckArgs, HttpFetch } from "./http-check.js";
+export { lifecycleSnapshot, lifecycleDiff } from "./lifecycle.js";
+export type { LifecycleSnapshotArgs, LifecycleDiffArgs, LifecycleDiffResult } from "./lifecycle.js";
+export { chantTeardown } from "./teardown.js";
+export type { ChantTeardownArgs } from "./teardown.js";
+export { envTeardown } from "./env-teardown.js";
+export type { EnvTeardownArgs, EnvTeardownResult, EnvTeardownDeps } from "./env-teardown.js";
+export { reconcilePr, commentMarker, pullRequestContextFrom, resolvePullRequestContext } from "./reconcile.js";
+export type { ReconcilePrArgs, ReconcileResult, ReconcileMode, ReconcileEntry, PullRequestContext } from "./reconcile.js";
+export { nativeApply, compensateApply, hasNativeRollback } from "./apply.js";
+export type { NativeApplyArgs, NativeApplyResult, CompensateApplyArgs, CompensateApplyResult, ApplyTarget, DeleteMode, K8sApplier, AzureApplier, GcpApplier, FlyApplier, AwsApplier, AwsRollback, } from "./apply.js";
+export { policyGate } from "./policy.js";
+export type { PolicyGateArgs } from "./policy.js";
+export { guardValidate, parseGuardFindings } from "./guard-validate.js";
+export type { GuardValidateArgs, GuardValidateResult, GuardFinding } from "./guard-validate.js";
+export { workflowSupplyChainAudit, collectAuditRefs, defaultActionRefResolver } from "./workflow-audit.js";
+export type { WorkflowAuditArgs, WorkflowAuditResult, WorkflowAuditMode, WorkflowAuditFinding, WorkflowAuditFindingKind, ActionRefResolver, ActionRefResolution, } from "./workflow-audit.js";
+export { pipelineSupplyChainAudit, collectPipelineRefs, defaultGitlabRefResolver } from "./pipeline-audit.js";
+export type { PipelineAuditArgs, PipelineAuditResult, PipelineAuditMode, PipelineAuditFinding, PipelineAuditFindingKind, PipelineRefKind, GitlabRefResolver, PipelineRefResolution, } from "./pipeline-audit.js";
+export { convergeTick, planConvergeTick } from "./converge.js";
+export type { ConvergeTickArgs, ConvergeTickResult, ConvergeTickPlan, SerializedConvergeRule } from "./converge.js";
+export { lexiconUpgrade, isPinned, isRolling, severityToLabel, upgradeBranchName, upgradePrTitle, buildUpgradeSummary, } from "./lexicon-upgrade.js";
+export type { LexiconUpgradeArgs, LexiconUpgradeResult, LexiconUpgradeMode, SupportedLexicon, SemverLabel, CheckPinnedFn, CheckRollingFn, GhRunner, ApplyBumpFn, } from "./lexicon-upgrade.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAQ9C,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAK/C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACnD,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAiB1F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC5G,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC1E,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,GACZ,MAAM,SAAS,CAAC;AAKjB,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE7F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACxG,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC3G,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEjH,OAAO,EACL,cAAc,EACd,QAAQ,EACR,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,cAAc,EACd,QAAQ,EACR,WAAW,GACZ,MAAM,mBAAmB,CAAC"}