@intentius/chant 0.57.0 → 0.59.0

package/dist/op/activities/workflow-audit.d.ts

@@ -0,0 +1,92 @@
+/**
+ * workflowSupplyChainAudit — the live counterpart to the github post-synth
+ * supply-chain checks (#286-#291).
+ *
+ * Some workflow-reference checks can only be answered against a moving external
+ * truth: whether a pinned SHA still corresponds to a real tag/release upstream,
+ * whether a referenced commit exists in the repo it claims, whether a ref is
+ * confusable as both a tag and a branch, whether a pin matches its version
+ * comment, or whether a new advisory now covers an action already in use. These
+ * change over time independent of the source, so they cannot live in the
+ * deterministic build — this activity owns *only* the checks that require live
+ * resolution.
+ *
+ * It is dependency-free and primitives-only: it reads the emitted workflow YAML
+ * (passed as a string) and resolves references through an injectable
+ * `ActionRefResolver`, so `chant run` can schedule it and tests can run
+ * it against recorded responses with no live network.
+ */
+/** What the audit produces on findings, mirroring ReconcileOp's modes. */
+export type WorkflowAuditMode = "report" | "issue" | "pull-request";
+/** Live resolution of a single action reference against its upstream. */
+export interface ActionRefResolution {
+    /** Does the ref/SHA exist in the claimed repo? */
+    exists: boolean;
+    /** Tag/release names that point at this commit (empty for a SHA ⇒ stale pin). */
+    tags: string[];
+    /** Is the upstream repository archived? */
+    archived: boolean;
+    /** Disclosed advisory identifiers affecting this action. */
+    advisories: string[];
+    /** Is the ref resolvable as BOTH a tag and a branch upstream? */
+    ambiguousRef?: boolean;
+}
+/** Pluggable upstream resolver — overridden in tests with recorded responses. */
+export type ActionRefResolver = (slug: string, ref: string) => Promise<ActionRefResolution>;
+export type WorkflowAuditFindingKind = "stale-pin" | "impostor" | "ambiguous-ref" | "pin-comment-mismatch" | "advisory" | "archived";
+export interface WorkflowAuditFinding {
+    /** owner/repo slug. */
+    slug: string;
+    /** The pinned ref/SHA. */
+    ref: string;
+    kind: WorkflowAuditFindingKind;
+    detail: string;
+}
+export interface WorkflowAuditArgs {
+    /** One emitted workflow YAML document. */
+    yaml?: string;
+    /** Several emitted workflow YAML documents. */
+    yamls?: string[];
+    /**
+     * Directory of emitted workflow files (`*.yml`/`*.yaml`) to read at run time
+     * when no `yaml`/`yamls` is given — the form used inside a scheduled Op.
+     * Default `.github/workflows`.
+     */
+    workflowsDir?: string;
+    /** What to produce. Default: report. */
+    mode?: WorkflowAuditMode;
+    /** Injectable upstream resolver. Defaults to the live GitHub REST resolver. */
+    resolver?: ActionRefResolver;
+}
+export interface WorkflowAuditResult {
+    mode: WorkflowAuditMode;
+    findings: WorkflowAuditFinding[];
+    /** Markdown summary used as the PR/issue body or printed in report mode. */
+    summary: string;
+}
+interface CollectedRef {
+    slug: string;
+    ref: string;
+    /** Adjacent `# vX.Y.Z` comment, when present. */
+    comment?: string;
+}
+/**
+ * Collect external action references (`uses: owner/repo@ref`, with an optional
+ * trailing version comment) from a workflow YAML. Local (`./`) and `docker://`
+ * references are excluded.
+ */
+export declare function collectAuditRefs(yaml: string): CollectedRef[];
+/**
+ * Default resolver: query the GitHub REST API for whether the ref exists, what
+ * tags point at it, archive status, and advisories. Best-effort and resilient —
+ * a network/HTTP error yields an "unknown" resolution (exists=true, no findings)
+ * rather than a false positive.
+ */
+export declare const defaultActionRefResolver: ActionRefResolver;
+/**
+ * Resolve each pinned external reference in the emitted workflows against live
+ * upstreams and report drift.
+ */
+export declare function workflowSupplyChainAudit(args: WorkflowAuditArgs): Promise<WorkflowAuditResult>;
+export {};
+//# sourceMappingURL=workflow-audit.d.ts.map

package/dist/op/activities/workflow-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-audit.d.ts","sourceRoot":"","sources":["../../../src/op/activities/workflow-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAC;AAEpE,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,MAAM,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,2CAA2C;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iEAAiE;IACjE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE5F,MAAM,MAAM,wBAAwB,GAChC,WAAW,GACX,UAAU,GACV,eAAe,GACf,sBAAsB,GACtB,UAAU,GACV,UAAU,CAAC;AAEf,MAAM,WAAW,oBAAoB;IACnC,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,wBAAwB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAcD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAQ7D;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBA0BtC,CAAC;AAUF;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwCpG"}

package/dist/op/activity-contract-registry.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Activity contract registry — the schema-shaped sibling of
+ * `./activity-registry.ts` (chant #2101).
+ *
+ * `activity-contract.ts` left contract ownership per-caller on purpose: an
+ * activity declares its contract alongside its implementation, and whoever
+ * builds a contract map decides which activities it covers. What was missing
+ * was the other half of that arrangement, a way for the checks that validate
+ * Op steps to SEE a contract a lexicon declared. OPS012 and OPS013
+ * (`../lint/rules/op/`) walk every Op entity in the build, including steps
+ * calling `terraformPlan`, `k3sInstall`, `flyApply` or `gcpApply`, over
+ * core's own static table alone. Since #2122 moved those checks into core
+ * they fire on every project that declares an Op, so an Op built out of one
+ * lexicon's steps failed `chant build` outright even though `loadActivities`
+ * resolves the very same names at run time. Both terraform examples that
+ * carry an Op kept it outside `src/` because of the older, lexicon-hosted
+ * form of the same gap, which meant no example ever proved its Op builds.
+ *
+ * The resolution mirrors activities exactly, by convention:
+ * `@intentius/chant-lexicon-<name>/op/activity-contracts` is imported for
+ * every configured lexicon and every {@link ActivityContract} it exports is
+ * collected, keyed by the contract's declared `name`. A lexicon that ships
+ * no such module is skipped, the same way `loadActivities` skips one that
+ * contributes no activities. A plugin may also hand its contracts over
+ * directly through {@link LexiconActivityContractContributor}, for a lexicon
+ * whose contracts are not reachable at a subpath (a bundled single-file
+ * plugin, a project-local one).
+ *
+ * The merged map reaches a post-synth check as
+ * `PostSynthContext.activityContracts` (`../lint/post-synth.ts`), filled in
+ * by whoever runs the checks: `chant build`, `chant lint` and
+ * `check-lexicon`'s example harness all do. A check merges it over its own
+ * base table rather than replacing it, so a context that carries none (a
+ * hand-built one in a test) behaves exactly as before this existed.
+ */
+import { type ActivityContract } from "./activity-contract.js";
+/**
+ * The shape {@link loadActivityContracts} reads off a plugin: an optional
+ * member returning this lexicon's contracts directly, for one that cannot be
+ * reached by the subpath convention. Structural on purpose, so core's op
+ * layer does not depend on `../lexicon.ts`.
+ */
+export interface LexiconActivityContractContributor {
+    /** The lexicon's name, as in `@intentius/chant-lexicon-<name>`. */
+    name: string;
+    /** This lexicon's activity contracts, if it declares them in code rather than at the conventional subpath. */
+    activityContracts?(): ActivityContract[];
+}
+/**
+ * Build the activity-contract map for build-time validation: core's own
+ * contracts (`./activities/activity-contracts`, a static import so a project
+ * that has installed nothing but chant still gets them) plus every contract
+ * the named lexicons contribute.
+ *
+ * `lexicons` may be plain names or plugin-shaped objects; a plugin's
+ * `activityContracts()` is read after its conventional module, so a plugin
+ * that declares both wins on a name collision with itself. Across lexicons,
+ * last one in wins, which is the same rule `loadActivities` applies to
+ * implementations.
+ *
+ * Never throws: an absent lexicon, a missing subpath, or a plugin member that
+ * throws all leave the map as it was.
+ */
+export declare function loadActivityContracts(lexicons?: ReadonlyArray<string | LexiconActivityContractContributor>): Promise<Map<string, ActivityContract>>;
+/**
+ * Merge a check's own base contracts with the ones the build loaded, into the
+ * map `validateActivitySteps`/`validateStepOutputRefs` take. The loaded set
+ * wins on a name collision: it is the one resolved against the lexicons this
+ * build actually configured, whereas the base table is whatever the check
+ * imported statically.
+ *
+ * `loaded` being `undefined` is the ordinary case for a hand-built
+ * `PostSynthContext` and yields the base table unchanged.
+ */
+export declare function mergeActivityContracts(base: ReadonlyMap<string, ActivityContract>, loaded: ReadonlyMap<string, ActivityContract> | undefined): ReadonlyMap<string, ActivityContract>;
+//# sourceMappingURL=activity-contract-registry.d.ts.map

package/dist/op/activity-contract-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-contract-registry.d.ts","sourceRoot":"","sources":["../../src/op/activity-contract-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC;IACjD,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,8GAA8G;IAC9G,iBAAiB,CAAC,IAAI,gBAAgB,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,GAAE,aAAa,CAAC,MAAM,GAAG,kCAAkC,CAAM,GACxE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAwBxC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,GACxD,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAKvC"}

package/dist/op/activity-contract.d.ts

@@ -16,28 +16,35 @@
  * An activity declares a contract alongside its implementation — the same
  * "registration surface" the issue asked for (`activity-registry.ts`'s
  * `collectActivities` already does this for implementations; this is the
- * schema-shaped sibling). `chant build` — via a lexicon's own post-synth
- * check, e.g. the temporal lexicon's TMP012 — resolves each step's `fn`
- * against a contract map built the same way and validates `args` and
- * `outcomeAttribute.from`. A step whose `fn` has no registered contract is
- * skipped (not an error): this is deliberately incremental — a lexicon opts
- * an activity in by declaring a contract for it, and the k8s/aws/azure/gcp/
- * fly activity sets are expected to pick this up lexicon by lexicon rather
- * than all at once (see the issue's "worth checking this lands cleanly"
- * note).
+ * schema-shaped sibling). `chant build` resolves each step's `fn` against a
+ * contract map built from `Object.values()` of an activity-contracts module
+ * and validates `args` and `outcomeAttribute.from` — core's own OPS012
+ * (`../lint/rules/op/ops012-activity-contract.ts`, chant #2122) does this
+ * for every declared Op regardless of which lexicons are configured; a
+ * lexicon's own post-synth check can additionally validate against its own
+ * roster the same way (a lexicon-owned check did this before #2122 moved the
+ * op-model checks to core). A step whose `fn` has no registered
+ * contract is skipped (not an error): this is deliberately incremental — a
+ * contract map opts an activity in by declaring one for it, and the
+ * k8s/aws/azure/gcp/fly activity sets are expected to pick this up one at a
+ * time rather than all at once (see the issue's "worth checking this lands
+ * cleanly" note).
  *
- * Ownership is decentralized on purpose: each lexicon declares contracts for
- * the activities it implements and validates them with its own post-synth
- * check (the same `rulePrefix`-per-lexicon pattern every other check in
- * chant already uses), rather than a shared cross-lexicon registry. A
- * `Temporal::Op` step can call an activity contributed by any lexicon, and
- * `PostSynthContext.entities` already carries the whole resolved graph to
- * every lexicon's checks, so no new plumbing is needed for that to work.
+ * Ownership of a contract map is per-caller, not a shared cross-lexicon
+ * registry: whoever builds the map (core's OPS012/OPS013, or a lexicon's own
+ * check) decides which activities it covers. A `Chant::Op` step can call an
+ * activity contributed by any lexicon, and `PostSynthContext.entities`
+ * already carries the whole resolved graph to every check, so no new
+ * plumbing is needed for that to work.
  */
 import { z } from "zod";
 import type { OpConfig } from "./types.js";
-/** Every literal value {@link ActivityStep.profile} may hold. Kept in sync with `types.ts`'s `ActivityStep["profile"]`. */
-export declare const KNOWN_ACTIVITY_PROFILES: readonly ["fastIdempotent", "longInfra", "k8sWait", "humanGate", "argoSync", "policyCheck"];
+/**
+ * Every literal value {@link ActivityStep.profile} may hold, read off
+ * {@link ACTIVITY_PROFILES} itself so the runtime list cannot drift from the
+ * table the type is derived from.
+ */
+export declare const KNOWN_ACTIVITY_PROFILES: ("fastIdempotent" | "longInfra" | "k8sWait" | "humanGate" | "argoSync" | "policyCheck")[];
 declare const CONTRACT_BRAND: unique symbol;
 /**
  * A registered activity's args/return schemas — the declaration that lets

package/dist/op/activity-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-contract.d.ts","sourceRoot":"","sources":["../../src/op/activity-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAiD,MAAM,SAAS,CAAC;AAEvF,2HAA2H;AAC3H,eAAO,MAAM,uBAAuB,6FAO1B,CAAC;AAEX,QAAA,MAAM,cAAc,eAA0C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB,CAAC,IAAI,GAAG,OAAO,EAAE,MAAM,GAAG,OAAO;IAChE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;IAChC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,oCAAoC;AACpC,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,CAAC,CAAC,UAAU,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,KAAK,EACzG,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE,YAAY,EACtB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7B,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,CAQ5G;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,IAAI,CAIhH;AAID,MAAM,WAAW,qBAAqB;IACpC,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;CACjB;AAmCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,SAAS,CASxG;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAQrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC,EACvD,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC/C,qBAAqB,EAAE,CA+CzB"}
+{"version":3,"file":"activity-contract.d.ts","sourceRoot":"","sources":["../../src/op/activity-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAiD,MAAM,SAAS,CAAC;AAGvF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,2FAAyB,CAAC;AAE9D,QAAA,MAAM,cAAc,eAA0C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB,CAAC,IAAI,GAAG,OAAO,EAAE,MAAM,GAAG,OAAO;IAChE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;IAChC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,oCAAoC;AACpC,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,CAAC,CAAC,UAAU,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,KAAK,EACzG,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE,YAAY,EACtB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7B,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,CAQ5G;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,IAAI,CAIhH;AAID,MAAM,WAAW,qBAAqB;IACpC,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;CACjB;AAmCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,SAAS,CASxG;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAQrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC,EACvD,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC/C,qBAAqB,EAAE,CAiDzB"}

package/dist/op/activity-failure.d.ts

@@ -0,0 +1,28 @@
+/**
+ * A terminal activity failure.
+ *
+ * Some activities fail deterministically: an organizational policy violation
+ * (`policyGate`) or a cfn-guard finding (`guardValidate`) reads the same on the
+ * second attempt as on the first, so a retry only delays the report. Those
+ * activities used to raise an orchestrator SDK's non-retryable failure type,
+ * which put that SDK on the import path of every base activity. Core owns the
+ * base activities now (chant #2114), and depends on no runtime SDK — this is
+ * the same signal in a plain `Error`.
+ *
+ * `name` is the failure type, not the class name, so the local executor's
+ * `retry.nonRetryableErrorTypes` (which matches on `Error.name`) can name it in
+ * a profile. `type` and `nonRetryable` are kept alongside it because that is
+ * the shape callers and tests already read.
+ */
+export declare class NonRetryableActivityError extends Error {
+    /** Failure type, e.g. `"PolicyViolation"`. Also this error's `name`. */
+    readonly type: string;
+    /** Always true — present so a caller can branch without an `instanceof`. */
+    readonly nonRetryable = true;
+    constructor(message: string, 
+    /** Failure type, e.g. `"PolicyViolation"`. Also this error's `name`. */
+    type: string);
+}
+/** Build a {@link NonRetryableActivityError} — a non-retryable failure with no SDK behind it. */
+export declare function nonRetryableFailure(message: string, type: string): NonRetryableActivityError;
+//# sourceMappingURL=activity-failure.d.ts.map

package/dist/op/activity-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-failure.d.ts","sourceRoot":"","sources":["../../src/op/activity-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAMhD,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM;IANvB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,QAAQ;gBAG3B,OAAO,EAAE,MAAM;IACf,wEAAwE;IAC/D,IAAI,EAAE,MAAM;CAKxB;AAED,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,yBAAyB,CAE5F"}

package/dist/op/activity-profiles.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Activity timeout and retry profiles.
+ *
+ * A profile is a named retry/timeout shape an Op step opts into
+ * (`activity("chantBuild", …, "fastIdempotent")`), so tuning lives in one table
+ * instead of inline at every call site. The six names cover the shapes infra
+ * steps actually take: fast idempotent work, long infra, K8s wait loops, a
+ * human gate, an Argo sync wait, and a deterministic policy check.
+ *
+ * These lived in a hosting lexicon, under its own prefixed name, until chant
+ * #2114 moved the base activities into core. Nothing about a timeout or a
+ * backoff coefficient belonged to that runtime, so the table came with them and
+ * lost the prefix. `heartbeatTimeout` did not come along: it configured a
+ * liveness protocol between a worker and a server, and no in-process step
+ * heartbeats to anything.
+ */
+export interface ActivityProfile {
+    /** Maximum time allowed for a single activity execution attempt (e.g. `"20m"`). */
+    timeout: string;
+    /** Retry policy for failed activity attempts. */
+    retry?: {
+        /** Initial wait before the first retry (e.g. "5s"). */
+        initialInterval?: string;
+        /** Multiplier applied to the interval on each retry (e.g. 2). */
+        backoffCoefficient?: number;
+        /** Maximum number of attempts including the first (0 = unlimited). */
+        maximumAttempts?: number;
+        /** Cap on retry intervals (e.g. "5m"). */
+        maximumInterval?: string;
+        /**
+         * Error names (`Error.name`) that fail immediately without retry — the
+         * executor short-circuits its retry loop on a match.
+         */
+        nonRetryableErrorTypes?: string[];
+    };
+}
+/** Named activity profiles for common infrastructure step patterns. */
+export declare const ACTIVITY_PROFILES: {
+    /**
+     * Fast, idempotent operations: `chant build`, `kubectl apply` without `--wait`,
+     * fetching nameservers, reading cluster status.
+     */
+    readonly fastIdempotent: {
+        readonly timeout: "5m";
+        readonly retry: {
+            readonly maximumAttempts: 3;
+            readonly initialInterval: "5s";
+            readonly backoffCoefficient: 2;
+        };
+    };
+    /**
+     * Long-running infra: GKE cluster creation via Config Connector (~10-20 min),
+     * `kubectl apply --wait` for large resource sets, Helm installs.
+     */
+    readonly longInfra: {
+        readonly timeout: "20m";
+        readonly retry: {
+            readonly maximumAttempts: 3;
+            readonly initialInterval: "30s";
+            readonly backoffCoefficient: 2;
+        };
+    };
+    /**
+     * K8s wait loops: polling for StatefulSet rollout, ExternalDNS A-records,
+     * DNS propagation.
+     */
+    readonly k8sWait: {
+        readonly timeout: "15m";
+        readonly retry: {
+            readonly maximumAttempts: 3;
+            readonly initialInterval: "10s";
+            readonly backoffCoefficient: 2;
+            readonly nonRetryableErrorTypes: ["ReadinessFailedError"];
+        };
+    };
+    /**
+     * Human-gate steps: waiting for an operator action (DNS delegation, approval).
+     * Very long timeout, single attempt — no retry on human-gate timeouts.
+     */
+    readonly humanGate: {
+        readonly timeout: "48h";
+        readonly retry: {
+            readonly maximumAttempts: 1;
+        };
+    };
+    /**
+     * Argo CD sync waits: poll an Application until `health=Healthy && sync=Synced`
+     * (`waitForArgoSync`). Long timeout for slow first syncs, cheap idempotent
+     * retries — re-polling is free. A terminal-unhealthy Application fails fast
+     * via `ArgoSyncFailedError` (non-retryable).
+     */
+    readonly argoSync: {
+        readonly timeout: "30m";
+        readonly retry: {
+            readonly maximumAttempts: 5;
+            readonly initialInterval: "10s";
+            readonly backoffCoefficient: 2;
+            readonly maximumInterval: "1m";
+            readonly nonRetryableErrorTypes: ["ArgoSyncFailedError"];
+        };
+    };
+    /**
+     * Organizational policy gate (`policyGate`): build the project and evaluate
+     * `lint.policies`. Deterministic — a violation is the same on every attempt —
+     * so a single attempt, short timeout, no retry.
+     */
+    readonly policyCheck: {
+        readonly timeout: "5m";
+        readonly retry: {
+            readonly maximumAttempts: 1;
+        };
+    };
+};
+/** The name of a built-in activity profile — the union `ActivityStep.profile` admits. */
+export type ActivityProfileName = keyof typeof ACTIVITY_PROFILES;
+/** Every profile name, as a runtime list (`KNOWN_ACTIVITY_PROFILES`'s source). */
+export declare const ACTIVITY_PROFILE_NAMES: ActivityProfileName[];
+//# sourceMappingURL=activity-profiles.d.ts.map

package/dist/op/activity-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-profiles.d.ts","sourceRoot":"","sources":["../../src/op/activity-profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE;QACN,uDAAuD;QACvD,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,iEAAiE;QACjE,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,sEAAsE;QACtE,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,0CAA0C;QAC1C,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB;;;WAGG;QACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;KACnC,CAAC;CACH;AAED,uEAAuE;AACvE,eAAO,MAAM,iBAAiB;IAC5B;;;OAGG;;;;;;;;;IAMH;;;OAGG;;;;;;;;;IAMH;;;OAGG;;;;;;;;;;IAaH;;;OAGG;;;;;;;IAMH;;;;;OAKG;;;;;;;;;;;IAYH;;;;OAIG;;;;;;;CAK+C,CAAC;AAErD,yFAAyF;AACzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAEjE,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,EAAqC,mBAAmB,EAAE,CAAC"}

package/dist/op/activity-registry.d.ts

@@ -2,56 +2,40 @@
  * Activity registry — resolves an Op step's `fn` name to a callable activity
  * implementation for local execution.
  *
- * Activities live in the Temporal lexicon (`@intentius/chant-lexicon-temporal`)
- * but are plain async functions taking a single args object — Temporal-free to
- * call. Local mode loads them by name instead of registering them with a worker.
+ * The base activities are core's own (`./activities`): plain async functions
+ * taking a single args object, with no workflow engine anywhere in the call
+ * path. They are imported statically, so `loadActivities([])` works in a
+ * project that has installed nothing but chant. Product-specific appliers stay
+ * in their owning lexicon (#809) and are pulled in dynamically per the
+ * project's configured lexicon list.
  */
+import { type ActivityProfile } from "./activity-profiles.js";
+export type { ActivityProfile } from "./activity-profiles.js";
 /**
  * An activity is an async function taking a single args object and an optional
  * `AbortSignal`. Local execution passes a signal that fires on timeout or
- * Ctrl-C so the activity can kill in-flight child processes; the Temporal
- * worker invokes activities with args only (cancellation comes from its own
- * `Context`), so the signal is always optional.
+ * Ctrl-C so the activity can kill in-flight child processes; a hosted runtime
+ * may invoke activities with args only, so the signal is always optional.
  */
 export type ActivityFn = (args: Record<string, unknown>, signal?: AbortSignal) => Promise<unknown>;
 /**
- * Build the activity map for local execution by importing activity libraries and
- * keying every exported function by name (`shellCmd`, `kubectlApply`, `gcpApply`, …).
+ * Build the activity map for local execution: core's base activities plus every
+ * activity module the project's configured lexicons contribute, keyed by export
+ * name (`shellCmd`, `kubectlApply`, `gcpApply`, …).
  *
- * The base activities always live in the temporal lexicon. Cloud-specific
- * appliers live in their own lexicon (aws → `flociUp`/`flociDown`, gcp →
- * `gcpApply`, azure → `azGroupEnsure`/`azGroupDelete`), so `lexicons` — the
- * project's configured lexicon list — is consulted to pull those in. A lexicon
- * that ships no `op/activities` module is skipped.
+ * Cloud-specific appliers live in their own lexicon (aws → `flociUp`/`flociDown`,
+ * gcp → `gcpApply`, azure → `azGroupEnsure`/`azGroupDelete`), so `lexicons` —
+ * the project's configured lexicon list — is consulted to pull those in. A
+ * lexicon that ships no `op/activities` module is skipped.
  *
- * Throws only if the temporal base library is missing — local execution needs
- * the activity implementations even though it never starts a worker.
+ * Never throws: the base library is a static import, so there is no "no
+ * activities registered" state to report.
  */
 export declare function loadActivities(lexicons?: string[]): Promise<Map<string, ActivityFn>>;
-/** Structural shape of a TEMPORAL_ACTIVITY_PROFILES entry (timeout + retry). */
-export interface ActivityProfile {
-    startToCloseTimeout?: string;
-    heartbeatTimeout?: string;
-    retry?: {
-        initialInterval?: string;
-        backoffCoefficient?: number;
-        maximumAttempts?: number;
-        maximumInterval?: string;
-        /** Error names (`Error.name`) that should fail immediately without retry. */
-        nonRetryableErrorTypes?: string[];
-    };
-}
 /**
- * Dynamically import the lexicon's `TEMPORAL_ACTIVITY_PROFILES` (pure data, no
- * Temporal SDK). Returns an empty record if the lexicon is absent — the
- * executor then falls back to built-in defaults per step.
- *
- * Imports the lexicon's `/config` entry, not its root index. `/config` is a
- * side-effect-free data module; the root index pulls in the plugin, serializer,
- * composites, and re-exported Op machinery, any of which could throw on load
- * and make this silently return `{}` — which would drop every profiled step to
- * the 5-minute default while the Temporal path (reading the same table) kept the
- * declared timeout. Importing the narrow module keeps the two executors agreed.
+ * The built-in profile table. Kept async because it is awaited on the CLI's
+ * run path alongside {@link loadActivities}, and because a hosted runtime may
+ * one day resolve profiles from somewhere less immediate.
  */
 export declare function loadProfiles(): Promise<Record<string, ActivityProfile>>;
 /**

package/dist/op/activity-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-registry.d.ts","sourceRoot":"","sources":["../../src/op/activity-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAWnG;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,QAAQ,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAwB9F;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE;QACN,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,6EAA6E;QAC7E,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;KACnC,CAAC;CACH;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAQ7E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACnC,EAAE,EAAE,MAAM,GACT,UAAU,CAOZ"}
+{"version":3,"file":"activity-registry.d.ts","sourceRoot":"","sources":["../../src/op/activity-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE9E,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAWnG;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,QAAQ,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAe9F;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAE7E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACnC,EAAE,EAAE,MAAM,GACT,UAAU,CAOZ"}

package/dist/op/activity-runtime.d.ts

@@ -1,20 +1,9 @@
 /**
  * Activity runtime helpers shared by every Op activity implementation, wherever
- * it lives — the base activities in the temporal lexicon and the cloud-specific
- * appliers relocated into the aws/gcp/azure lexicons. Hosting them in core keeps
- * a cloud lexicon from having to depend on the temporal lexicon just to
- * heartbeat or sleep.
+ * it lives — the base activities in `./activities` and the product-specific
+ * appliers in the aws/gcp/azure/k8s/fly lexicons. Hosting them in core keeps a
+ * lexicon from depending on another lexicon just to sleep between polls.
  */
-/**
- * Emit an activity heartbeat if running under a Temporal worker; otherwise no-op.
- *
- * The first call kicks off a one-time lazy load of `@temporalio/activity` and
- * returns immediately; once resolved, subsequent calls heartbeat. Heartbeats
- * are periodic (every ~15s, well inside the 60s heartbeat timeout), so the
- * single missed first tick is harmless. Under chant's local executor (no
- * Temporal SDK present) it no-ops, and the module imports cleanly without the SDK.
- */
-export declare function safeHeartbeat(details?: unknown): void;
 /**
  * Sleep for `ms`, rejecting early if `signal` aborts. Polling activities use
  * this between attempts so a local-executor timeout or Ctrl-C interrupts the

package/dist/op/activity-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-runtime.d.ts","sourceRoot":"","sources":["../../src/op/activity-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuBH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAWrD;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrE"}
+{"version":3,"file":"activity-runtime.d.ts","sourceRoot":"","sources":["../../src/op/activity-runtime.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrE"}