@intentius/chant 0.57.0 → 0.59.0

package/dist/op/activities/lexicon-upgrade.d.ts

@@ -0,0 +1,182 @@
+/**
+ * lexiconUpgrade — the upgrade-detection and PR-automation activity for
+ * in-scope lexicons (k8s, gcp, docker, gitlab, aws, azure, github).
+ *
+ * Classifies the lexicon as pinned or rolling, calls the right check function,
+ * then surfaces the result in the requested mode: report (default), issue, or
+ * pull-request. In pull-request mode it maintains a long-lived branch per
+ * lexicon (`lexicon-upgrade/<lexicon>`), updates the PR in place when the delta
+ * changes, and applies a semver label derived from the surface severity.
+ *
+ * For pinned lexicons in pull-request mode, the PR also bumps the lexicon's
+ * own package.json version according to the semver label (minor → minor bump,
+ * breaking → major bump). Merging the PR carries the version change so
+ * publish-on-merge can ship just that lexicon without a full monorepo release.
+ *
+ * Rolling lexicons (aws, azure, github) drift on their own cadence and are not
+ * version-bumped here — they move to drift-issues per #546.
+ *
+ * Supply-chain note: this activity never executes spec-provided content.
+ * It only reads the artifacts produced by the lexicon's own generate step,
+ * which is called through the lexicon's npm prepack chain.
+ */
+import type { UpgradeCheckResult, LexiconId } from "../../codegen/pinned-upgrade.js";
+import type { RollingUpgradeResult, RollingLexicon } from "../../codegen/rolling-upgrade.js";
+import { bumpPackageJsonVersion } from "../../codegen/version-bump.js";
+export { bumpPackageJsonVersion };
+/** Finding mode, mirrors ReconcileOp's mode. */
+export type LexiconUpgradeMode = "report" | "issue" | "pull-request";
+/** All lexicons supported by this activity. */
+export type SupportedLexicon = LexiconId | RollingLexicon;
+/** Semver label applied to upgrade PRs. */
+export type SemverLabel = "minor" | "breaking";
+export interface LexiconUpgradeArgs {
+    /**
+     * Which lexicon to check. Determines pinned vs rolling dispatch:
+     *   PINNED: k8s, gcp, docker, gitlab, cedar
+     *   ROLLING: aws, azure, github, fly
+     */
+    lexicon: SupportedLexicon;
+    /**
+     * Absolute path to the lexicon root directory.
+     * Defaults to `<cwd>/lexicons/<lexicon>`.
+     */
+    lexiconDir?: string;
+    /** What to produce. Default: "report". */
+    mode?: LexiconUpgradeMode;
+    /**
+     * Override the pinned check function — inject a mock in tests.
+     * The real implementation calls checkPinnedUpgrade from core.
+     */
+    _checkPinned?: CheckPinnedFn;
+    /**
+     * Override the rolling check function — inject a mock in tests.
+     * The real implementation calls checkRollingUpgrade from core.
+     */
+    _checkRolling?: CheckRollingFn;
+    /**
+     * Override the gh/git runner — inject a mock in tests.
+     */
+    _gh?: GhRunner;
+    /**
+     * Override the applyPinnedVersionBump function — inject a mock in tests.
+     */
+    _applyBump?: ApplyBumpFn;
+    /**
+     * Override the package.json version writer — inject a mock in tests.
+     * Defaults to bumpPackageJsonVersion.
+     */
+    _bumpPackageVersion?: BumpPackageVersionFn;
+}
+export interface LexiconUpgradeResult {
+    lexicon: SupportedLexicon;
+    mode: LexiconUpgradeMode;
+    /** True when an upgrade is available and validation passed. */
+    hasUpgrade: boolean;
+    /** Human-readable surface delta summary. Empty when no upgrade. */
+    deltaText: string;
+    /** Semver label applied to the PR. null when no upgrade or no change. */
+    semverLabel: SemverLabel | null;
+    /** URL of the opened/updated PR (pull-request mode). */
+    prUrl?: string;
+    /** URL of the opened issue (issue mode). */
+    issueUrl?: string;
+    /** Full markdown summary, used as PR/issue body or printed in report mode. */
+    summary: string;
+    /** Whether validation passed. False means a breakage report was produced. */
+    validationOk: boolean;
+}
+/** Matches checkPinnedUpgrade from core. */
+export type CheckPinnedFn = (opts: {
+    lexiconDir: string;
+    lexicon: LexiconId;
+    force?: boolean;
+    verbose?: boolean;
+}) => Promise<UpgradeCheckResult>;
+/** Matches checkRollingUpgrade from core. */
+export type CheckRollingFn = (opts: {
+    lexiconDir: string;
+    force?: boolean;
+    verbose?: boolean;
+}) => Promise<RollingUpgradeResult>;
+/** Minimal shell-exec interface for gh/git invocations. */
+export type GhRunner = (cmd: string) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+/** Applies a pinned version bump permanently (no revert). Async (core loads the lexicon's pin descriptor); a sync mock is also accepted. */
+export type ApplyBumpFn = (lexicon: LexiconId, lexiconDir: string, newVersion: string) => {
+    filePath: string;
+} | Promise<{
+    filePath: string;
+}>;
+/**
+ * Write a new version into a package.json, returning the file path.
+ * Injectable for tests via LexiconUpgradeArgs._bumpPackageVersion.
+ */
+export type BumpPackageVersionFn = (packageJsonPath: string, newVersion: string) => void;
+/**
+ * Compute a bumped semver string from a current version and a semver label.
+ *
+ * The mapping is 0.x-aware, because promoting to 1.0.0 should signal the
+ * lexicon's own API stability, not track an upstream spec's breaking change:
+ *
+ * - Pre-1.0 (major === 0): "breaking" bumps the minor (0.13.1 → 0.14.0),
+ *   "minor" (additive) bumps the patch (0.13.1 → 0.13.2). Never auto-1.0.0.
+ * - >= 1.0.0: "minor" bumps the minor (1.2.3 → 1.3.0), "breaking" bumps the
+ *   major (1.2.3 → 2.0.0).
+ *
+ * Handles the common "MAJOR.MINOR.PATCH" form. Returns null when the
+ * current version string cannot be parsed as M.m.p.
+ */
+export declare function computeBumpedVersion(current: string, label: SemverLabel): string | null;
+/** Return true when the lexicon uses a pinned version constant. */
+export declare function isPinned(lexicon: SupportedLexicon): lexicon is LexiconId;
+/** Return true when the lexicon follows a rolling spec (no pinned constant). */
+export declare function isRolling(lexicon: SupportedLexicon): lexicon is RollingLexicon;
+/**
+ * Map a surface severity to a semver label for the PR.
+ *
+ * "additive" → "minor"   (new resources/properties added)
+ * "breaking" → "breaking" (removed or changed resources/properties)
+ * "none"     → null       (surface unchanged)
+ */
+export declare function severityToLabel(severity: string): SemverLabel | null;
+/** Long-lived branch name for a lexicon upgrade PR. */
+export declare function upgradeBranchName(lexicon: SupportedLexicon): string;
+/** PR title for an upgrade. */
+export declare function upgradePrTitle(lexicon: SupportedLexicon, from?: string, to?: string | null): string;
+/** Build the PR/issue/report body from the upgrade result data. */
+export declare function buildUpgradeSummary(opts: {
+    lexicon: SupportedLexicon;
+    from?: string;
+    to?: string | null;
+    deltaText: string;
+    semverLabel: SemverLabel | null;
+    validationOk: boolean;
+    failures?: Array<{
+        step: string;
+        output: string;
+    }>;
+}): string;
+/**
+ * Run the lexicon upgrade check for one lexicon and surface the result.
+ *
+ * Pinned lexicons (k8s, gcp, docker, gitlab):
+ *   Calls checkPinnedUpgrade. A PR is opened only when hasUpgrade=true AND
+ *   validation passed. Validation failures produce a report or issue.
+ *
+ * Rolling lexicons (aws, azure, github):
+ *   Calls checkRollingUpgrade. A PR is opened only when the surface changed
+ *   AND validation passed. Surface unchanged = no action.
+ *
+ * In pull-request mode:
+ *   - Branch: lexicon-upgrade/<lexicon> (long-lived, one per lexicon).
+ *   - Idempotent: if the open PR body matches the new summary, skip re-push.
+ *   - Semver label: "minor" (additive) or "breaking" (changed/removed).
+ *   - Validation failure falls back to issue mode.
+ *
+ * Never auto-merges or auto-publishes.
+ */
+export declare function lexiconUpgrade(args: LexiconUpgradeArgs): Promise<LexiconUpgradeResult>;
+//# sourceMappingURL=lexicon-upgrade.d.ts.map

package/dist/op/activities/lexicon-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexicon-upgrade.d.ts","sourceRoot":"","sources":["../../../src/op/activities/lexicon-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,OAAO,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAmB,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAErF,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAMlC,gDAAgD;AAChD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAC;AAErE,+CAA+C;AAC/C,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,cAAc,CAAC;AAE1D,2CAA2C;AAC3C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;OAEG;IACH,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf;;OAEG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,kBAAkB,CAAC;IACzB,+DAA+D;IAC/D,UAAU,EAAE,OAAO,CAAC;IACpB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,YAAY,EAAE,OAAO,CAAC;CACvB;AAID,4CAA4C;AAC5C,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,SAAS,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC,6CAA6C;AAC7C,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEpC,2DAA2D;AAC3D,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEpF,4IAA4I;AAC5I,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,SAAS,EAClB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,KACf;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;AAIzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,GACjB,MAAM,GAAG,IAAI,CAKf;AASD,mEAAmE;AACnE,wBAAgB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,IAAI,SAAS,CAExE;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,IAAI,cAAc,CAE9E;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAIpE;AAID,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAEnE;AAED,+BAA+B;AAC/B,wBAAgB,cAAc,CAC5B,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,MAAM,EACb,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GACjB,MAAM,CAGR;AAID,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD,GAAG,MAAM,CAqDT;AA6FD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA4R5F"}

package/dist/op/activities/lifecycle.d.ts

@@ -0,0 +1,42 @@
+export interface LifecycleSnapshotArgs {
+    /** Environment name (e.g. "dev", "staging", "prod"). */
+    env: string;
+}
+/**
+ * Take a chant lifecycle snapshot for the given environment.
+ * Uses fastIdempotent profile — 5m timeout, 3 retries.
+ */
+export declare function lifecycleSnapshot(args: LifecycleSnapshotArgs, signal?: AbortSignal): Promise<void>;
+export interface LifecycleDiffArgs {
+    /** Environment name (e.g. "dev", "staging", "prod"). */
+    env: string;
+    /**
+     * When true, run `chant lifecycle diff <env> --live` (queries cloud APIs).
+     * When false (default), run digest-only diff against the last snapshot.
+     */
+    live?: boolean;
+}
+export interface LifecycleDiffResult {
+    /** Combined stdout + stderr from the chant command. */
+    output: string;
+    /** Process exit code (0 = success). */
+    exitCode: number;
+    /**
+     * True when the diff output contains any drift indicators
+     * (MISSING / ORPHAN / DRIFTED / DISAPPEARED section headers from
+     * `chant lifecycle diff --live`).
+     */
+    drifted: boolean;
+}
+/**
+ * Run `chant lifecycle diff <env>` and return the output + structured drift
+ * flag. Read-only; intended for use inside watch/observation Ops.
+ * Uses fastIdempotent profile.
+ *
+ * The `drifted` field is computed by scanning the output for any of the
+ * MISSING / ORPHAN / DRIFTED / DISAPPEARED section headers documented in
+ * cli/state.mdx. Pair with `outcomeAttribute: { name: "Drift", from: "drifted" }`
+ * on a WatchOp activity step to surface drift as the run's `Drift` outcome.
+ */
+export declare function lifecycleDiff(args: LifecycleDiffArgs, signal?: AbortSignal): Promise<LifecycleDiffResult>;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/op/activities/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/op/activities/lifecycle.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxG;AAED,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAoBD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAa/G"}

package/dist/op/activities/pipeline-audit.d.ts

@@ -0,0 +1,84 @@
+/**
+ * pipelineSupplyChainAudit — the live counterpart to the gitlab post-synth
+ * include/component/image checks (#297).
+ *
+ * Some include/component checks can only be answered against a moving external
+ * truth: whether a pinned component/include ref still resolves upstream, whether
+ * the upstream project was archived or moved, or whether a new advisory now
+ * covers a component/image already in use. These change independent of the
+ * source, so they cannot live in the deterministic build — this activity owns
+ * *only* the checks that require live resolution.
+ *
+ * Dependency-free and primitives-only: it reads the emitted `.gitlab-ci.yml`
+ * (passed as a string) and resolves references through an injectable
+ * `GitlabRefResolver`, so `chant run` can schedule it and tests can run
+ * it against recorded responses with no live network.
+ */
+/** What the audit produces on findings. For GitLab the PR mode is a merge request. */
+export type PipelineAuditMode = "report" | "issue" | "merge-request";
+/** The kind of reference being resolved. */
+export type PipelineRefKind = "include" | "component" | "image";
+/** Live resolution of a single pipeline reference against its upstream. */
+export interface PipelineRefResolution {
+    /** Does the project/component/image (at this ref/version) still resolve? */
+    exists: boolean;
+    /** Has the upstream project been archived? */
+    archived: boolean;
+    /** Has the upstream project moved (new path), if known. */
+    movedTo?: string;
+    /** Disclosed advisory identifiers affecting this reference. */
+    advisories: string[];
+}
+/** Pluggable upstream resolver — overridden in tests with recorded responses. */
+export type GitlabRefResolver = (kind: PipelineRefKind, identifier: string, ref: string) => Promise<PipelineRefResolution>;
+export type PipelineAuditFindingKind = "unresolved" | "archived" | "moved" | "advisory";
+export interface PipelineAuditFinding {
+    kind: PipelineAuditFindingKind;
+    refKind: PipelineRefKind;
+    /** project path / component address / image. */
+    identifier: string;
+    /** ref / version / tag. */
+    ref: string;
+    detail: string;
+}
+export interface PipelineAuditArgs {
+    /** One emitted `.gitlab-ci.yml` document. */
+    yaml?: string;
+    /** Several emitted documents. */
+    yamls?: string[];
+    /** Path to an emitted `.gitlab-ci.yml` to read at run time (default `.gitlab-ci.yml`). */
+    pipelineFile?: string;
+    /** What to produce. Default: report. */
+    mode?: PipelineAuditMode;
+    /** Injectable upstream resolver. Defaults to the live GitLab REST resolver. */
+    resolver?: GitlabRefResolver;
+}
+export interface PipelineAuditResult {
+    mode: PipelineAuditMode;
+    findings: PipelineAuditFinding[];
+    summary: string;
+}
+interface CollectedRef {
+    refKind: PipelineRefKind;
+    identifier: string;
+    ref: string;
+}
+/**
+ * Collect `include:project` (+ ref), `component:` (with @version), and `image:`
+ * references from a `.gitlab-ci.yml`.
+ */
+export declare function collectPipelineRefs(yaml: string): CollectedRef[];
+/**
+ * Default resolver: query the GitLab REST API for project existence / archive /
+ * move status. Best-effort and resilient — errors yield an "unknown" resolution
+ * (exists=true, no findings) rather than a false positive. Component/image
+ * advisory lookups are left to a configured resolver.
+ */
+export declare const defaultGitlabRefResolver: GitlabRefResolver;
+/**
+ * Resolve each include/component/image reference in the emitted pipeline against
+ * live upstreams and report drift.
+ */
+export declare function pipelineSupplyChainAudit(args: PipelineAuditArgs): Promise<PipelineAuditResult>;
+export {};
+//# sourceMappingURL=pipeline-audit.d.ts.map

package/dist/op/activities/pipeline-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-audit.d.ts","sourceRoot":"","sources":["../../../src/op/activities/pipeline-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,sFAAsF;AACtF,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,GAAG,eAAe,CAAC;AAErE,4CAA4C;AAC5C,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAE3H,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;AAExF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,YAAY;IACpB,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAwChE;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAgBtC,CAAC;AAmBF;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkCpG"}

package/dist/op/activities/policy.d.ts

@@ -0,0 +1,17 @@
+export interface PolicyGateArgs {
+    /** Project/source directory to build and evaluate. Default ".". */
+    path?: string;
+    /** Environment for policy evaluation (falls back to `ownership.env`). */
+    env?: string;
+}
+/**
+ * Gate an apply on organizational policy: build the project, run its
+ * `lint.policies` over the resolved resources, and **block** on any violation.
+ * Place it as a step before the apply phase — a violation fails the run
+ * (non-retryable; the `policyCheck` profile is single-attempt) so nothing is
+ * applied. A clean evaluation passes through.
+ *
+ * A plain activity on every runtime, not a `gate` step.
+ */
+export declare function policyGate(args: PolicyGateArgs, _signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/op/activities/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/op/activities/policy.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB3F"}

package/dist/op/activities/reconcile.d.ts

@@ -0,0 +1,149 @@
+/**
+ * What the reconcile activity does with the regenerated source.
+ *
+ * `comment` is the one mode that posts nothing new: it writes the body onto
+ * the pull request that triggered the run, updating the same comment on every
+ * re-run (chant #2231). It therefore needs a pull-request trigger, and
+ * {@link resolvePullRequestContext} fails the step by name when the run has
+ * none.
+ */
+export type ReconcileMode = "pull-request" | "issue" | "report" | "comment";
+/** A change-set entry that triggered reconciliation. */
+export interface ReconcileEntry {
+    /** chant entity name. */
+    name: string;
+    /** create | update | delete | adopt | noop (from `chant lifecycle plan`). */
+    action: string;
+    /** Resource type, when known. */
+    type?: string;
+}
+export interface ReconcilePrArgs {
+    /** Environment to reconcile from (passed to `chant import --from`). */
+    env: string;
+    /**
+     * The change-set entries that triggered this reconcile. Omit to derive them
+     * from `chant lifecycle plan <env> --json` at run time — the form used inside
+     * an Op, where the entries aren't known until the activity runs.
+     */
+    entries?: ReconcileEntry[];
+    /** What to produce. Default: pull-request. */
+    mode?: ReconcileMode;
+    /** Output directory for regenerated source. Default: ./infra. */
+    output?: string;
+    /** Branch to open the PR from. Default: chant/reconcile-<env>. */
+    branch?: string;
+    /** Restrict live import to chant-owned resources. */
+    owned?: boolean;
+    /** PR / issue title. Default derived from env. */
+    title?: string;
+    /**
+     * Hidden marker identifying this Op's comment on the pull request (comment
+     * mode). The activity writes it as the comment's first line and finds the
+     * comment again by it on the next run, so a re-run edits one comment instead
+     * of stacking a new one. Default: {@link commentMarker} keyed on `env`, so
+     * two Ops over two roots get two comments and each updates in place.
+     */
+    marker?: string;
+    /**
+     * A finding body built by the caller, used verbatim as the issue/PR body in
+     * place of {@link reconcileSummary} (chant #2087).
+     *
+     * The summary this activity writes itself is a change-set table, which is
+     * the right artifact when the finding IS a change set. Some observe-dial
+     * Ops already hold a better one: `TerraformWatchOp` carries the
+     * `terraform plan -no-color` render its own Plan step produced, and
+     * re-deriving that from `chant lifecycle plan` here would both lose the
+     * plan and run a second, differently-timed read.
+     *
+     * Supplying it also suppresses the `chant lifecycle plan --json` derivation
+     * that fills `entries`: a caller that already knows what it wants to say
+     * is not asking this activity to go and find out.
+     */
+    body?: string;
+}
+export interface ReconcileResult {
+    mode: ReconcileMode;
+    /** Branch created (pull-request mode). */
+    branch?: string;
+    /** Opened PR URL (pull-request mode). */
+    prUrl?: string;
+    /** Opened issue URL (issue mode). */
+    issueUrl?: string;
+    /** The posted or updated PR comment's URL (comment mode). */
+    commentUrl?: string;
+    /** The pull request the comment landed on, `owner/repo#number` (comment mode). */
+    pullRequest?: string;
+    /** The markdown summary used as the PR/issue body. */
+    summary: string;
+    /** The entries that triggered the reconcile. */
+    entries: ReconcileEntry[];
+}
+/** Default branch name for a reconcile PR. Deterministic — no timestamp. */
+export declare function reconcileBranchName(env: string): string;
+/**
+ * Build the markdown body summarizing which change-set entries triggered the
+ * reconcile. Pure — used as the PR/issue body and returned in `report` mode.
+ */
+export declare function reconcileSummary(env: string, entries: ReconcileEntry[]): string;
+/** The pull request a `comment`-mode run posts onto. */
+export interface PullRequestContext {
+    /** `owner/repo`, from `GITHUB_REPOSITORY`. */
+    repo: string;
+    /** The pull request number. */
+    number: number;
+}
+/**
+ * The hidden marker that makes a `comment`-mode finding findable across
+ * re-runs: written as the comment's first line, matched with `startswith` on
+ * the next run. Keyed on `env` (slugified the same way {@link
+ * reconcileBranchName} slugifies it, which also keeps the value free of the
+ * quotes and backslashes it is interpolated next to), so two Ops over two
+ * environments own two comments and each updates in place.
+ */
+export declare function commentMarker(env: string): string;
+/** What a `comment`-mode step says when the run it is in has no pull request. */
+export declare function noPullRequestContextMessage(): string;
+/**
+ * Derive the triggering pull request from CI environment variables plus the
+ * already-parsed event payload. Pure — exported for testing; the IO (reading
+ * `GITHUB_EVENT_PATH`) is {@link resolvePullRequestContext}'s.
+ *
+ * Returns undefined rather than throwing, so the caller owns the message.
+ */
+export declare function pullRequestContextFrom(env: Record<string, string | undefined>, eventPayload?: unknown): PullRequestContext | undefined;
+/**
+ * Resolve the triggering pull request, reading and parsing the event payload
+ * `GITHUB_EVENT_PATH` names. Throws {@link noPullRequestContextMessage} when
+ * the run has no pull request, which is the whole point: a `comment` mode that
+ * quietly fell back to an issue would post the finding somewhere nobody asked
+ * for it.
+ */
+export declare function resolvePullRequestContext(env?: Record<string, string | undefined>): Promise<PullRequestContext>;
+/**
+ * Map a `chant lifecycle plan --json` ChangeSet to reconcile entries, dropping
+ * `noop` entries (nothing to reconcile). Pure — exported for testing.
+ */
+export declare function entriesFromPlan(planJson: string): ReconcileEntry[];
+/**
+ * Reconcile activity: turn regenerated TypeScript into a reviewable artifact.
+ *
+ * - `report` — return the summary only; no git, no network.
+ * - `issue` — open a GitHub issue describing the drift (no code change).
+ * - `comment` — post the body as one comment on the pull request that
+ *   triggered the run, editing that same comment on every re-run rather than
+ *   stacking a new one (#2231). Needs a pull-request-triggered run; fails by
+ *   name when there is none. No code change, and the `pull-requests: write`
+ *   the generated workflow already grants on that trigger is the whole scope
+ *   it spends.
+ * - `pull-request` — create a branch, regenerate source via
+ *   `chant import --from <env>`, commit, push, and open a PR whose diff is the
+ *   regenerated TypeScript. Never commits to the main branch.
+ *
+ * The body is {@link reconcileSummary}'s change-set table unless `args.body`
+ * supplies one, in which case that text is used verbatim and no plan is
+ * derived (chant #2087).
+ *
+ * Requires `chant` and (for non-report modes) `gh`/`git` in the environment.
+ */
+export declare function reconcilePr(args: ReconcilePrArgs, signal?: AbortSignal): Promise<ReconcileResult>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/op/activities/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/op/activities/reconcile.ts"],"names":[],"mappings":"AAMA;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE5E,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAkB/E;AAMD,wDAAwD;AACxD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,IAAI,MAAM,CAQpD;AAeD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,YAAY,CAAC,EAAE,OAAO,GACrB,kBAAkB,GAAG,SAAS,CAOhC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AA2CD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAOlE;AAgBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAmDvG"}

package/dist/op/activities/shell.d.ts

@@ -0,0 +1,13 @@
+export interface ShellCmdArgs {
+    cmd: string;
+    /** Additional environment variables. */
+    env?: Record<string, string>;
+    /** Working directory. Default: process.cwd(). */
+    cwd?: string;
+}
+/**
+ * Run an arbitrary shell command.
+ * Uses fastIdempotent profile — 5m timeout, 3 retries.
+ */
+export declare function shellCmd(args: ShellCmdArgs, signal?: AbortSignal): Promise<string>;
+//# sourceMappingURL=shell.d.ts.map

package/dist/op/activities/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../src/op/activities/shell.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxF"}

package/dist/op/activities/teardown.d.ts

@@ -0,0 +1,10 @@
+export interface ChantTeardownArgs {
+    /** Path to the chant project to tear down. */
+    path: string;
+}
+/**
+ * Run `chant teardown` in the given project path.
+ * Uses longInfra profile — 20m timeout.
+ */
+export declare function chantTeardown(args: ChantTeardownArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=teardown.d.ts.map

package/dist/op/activities/teardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../../../src/op/activities/teardown.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhG"}

package/dist/op/activities/util.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Re-export shim — `sleep` is the shared activity-runtime helper one directory
+ * up (`../activity-runtime`). Kept here so existing `./util` imports resolve
+ * unchanged.
+ */
+export { sleep } from "../activity-runtime.js";
+//# sourceMappingURL=util.d.ts.map

package/dist/op/activities/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../../src/op/activities/util.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/op/activities/wait.d.ts

@@ -0,0 +1,28 @@
+export interface WaitForStackArgs {
+    /** Stack name — used to locate the kubectl deployment/statefulset to poll. */
+    name: string;
+    /** Kubernetes namespace. */
+    namespace?: string;
+    /** kubectl context. */
+    context?: string;
+    /** Poll interval in ms. Default: 10000. */
+    intervalMs?: number;
+}
+/**
+ * Poll until a Kubernetes Deployment or StatefulSet named `name` is fully rolled out.
+ * Uses the `k8sWait` profile — 15m timeout.
+ *
+ * Progress goes to stdout, one line per poll, which is the executor's step-record
+ * channel: the local executor streams an activity's output alongside the step it
+ * belongs to, so a long rollout is visible without a liveness protocol. Nothing
+ * mid-run is durable here by design (chant #2114) — the op re-runs and converges.
+ *
+ * Deliberately NOT migrated onto the generic `waitForReady` (#957): `kubectl
+ * rollout status` encodes rollout-specific semantics — progress-deadline
+ * timeouts, partial/paused rollouts, generation tracking — that a status-field
+ * predicate spec does not replicate, and it targets built-in workloads rather
+ * than arbitrary operator CRDs. `waitForReady` is the right tool for CRD
+ * readiness; `waitForStack` stays the right tool for workload rollouts.
+ */
+export declare function waitForStack(args: WaitForStackArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=wait.d.ts.map

package/dist/op/activities/wait.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC9F"}