@intentius/chant 0.57.0 → 0.59.0

package/dist/lint/post-synth.d.ts

@@ -1,4 +1,5 @@
 import type { Declarable } from "../declarable.js";
+import type { ActivityContract } from "../op/activity-contract.js";
 import type { SerializerResult } from "../serializer.js";
 import type { Severity } from "./rule.js";
 import { type OutputDoc } from "./output-docs.js";
@@ -36,6 +37,22 @@ export interface PostSynthContext {
      * with `ctx.docs ?? []` only when a context's provenance is unknown.
      */
     readonly docs?: OutputDoc[];
+    /**
+     * Activity contracts resolved across every lexicon this build configured
+     * (chant #2101), keyed by activity name — core's own plus whatever each
+     * lexicon contributes at `@intentius/chant-lexicon-<name>/op/activity-contracts`
+     * or through its plugin. Filled in by `chant build`, `chant lint` and
+     * `check-lexicon`'s example harness via `loadActivityContracts`.
+     *
+     * The checks that validate Op steps against contracts (OPS012 and OPS013,
+     * `./rules/op/`) merge this over their own statically imported table with
+     * `mergeActivityContracts`, so an Op calling `terraformPlan` or
+     * `k3sInstall` validates against the contract the owning lexicon declared
+     * instead of failing for the absence of one. Optional, and absent from a
+     * hand-built context: a check must behave as it did before this existed
+     * when it is `undefined`.
+     */
+    readonly activityContracts?: ReadonlyMap<string, ActivityContract>;
     /** Raw build result object */
     buildResult: {
         outputs: Map<string, string | SerializerResult>;
@@ -87,6 +104,14 @@ export declare function getAdditionalFiles(output: string | SerializerResult): R
  * comment (`chant-disable`) suppression is out of scope for post-synth
  * findings — see `./config.ts`'s `applyConfiguredSeverity` doc for the full
  * reasoning and what suppression surface post-synth findings get instead.
+ *
+ * chant #2111 finds a narrower anchor that does generalize: `./suppressions.ts`'s
+ * `applyInlineSuppressions` matches `entity` against `ctx.entities` (a map key
+ * every context already carries, source-level, before serialization), not
+ * against a name in the synthesized OUTPUT. A lexicon whose entities carry a
+ * `suppressions` field (see that file's module doc) gets inline `# chant-
+ * ignore`-style comments this way; one that doesn't is unaffected, and this
+ * interface's own contract (no `file`/`line`) is unchanged either way.
  */
 export interface PostSynthDiagnostic {
     /** ID of the check that produced this diagnostic */
@@ -103,6 +128,30 @@ export interface PostSynthDiagnostic {
     entity?: string;
     /** Optional lexicon related to this diagnostic */
     lexicon?: string;
+    /**
+     * Set when the finding is that something does not exist, rather than that
+     * something present is wrong (chant #2113). TF001 (no remote backend) is
+     * the motivating case: there is no resource to set `entity` to, only the
+     * scope that is missing one. Snyk's policy-engine spec names this the
+     * "missing-resource" archetype (a `deny` whose `info` carries a
+     * `resource_type` instead of a `resource`, because there is nothing to
+     * attach to) and is the only tool in chant's TF-family survey with a
+     * first-class shape for it; trivy's own inline-ignore comments admit they
+     * cannot suppress an absence finding for exactly this reason. `kind` names
+     * what is missing (a `backend`/`cloud` block, a required resource type);
+     * `scope` names where it is missing (a root module name, a file). Renders
+     * distinctly in all three reporters (stylish/JSON/SARIF, `../cli/commands/
+     * audit.ts` and `../audit/report-model.ts`) instead of falling back to
+     * `entity`, and gives #2111's HCL suppression a block-anchored key to
+     * suppress an absence finding by (the block that *should* declare `kind`
+     * inside `scope`), independent of whatever `entity` this diagnostic sets.
+     */
+    missing?: {
+        /** What kind of thing is absent (e.g. `"backend"`, `"cloud"`). */
+        kind: string;
+        /** Where it is missing from (e.g. a root module name). */
+        scope: string;
+    };
 }
 /**
  * A post-synthesis check that validates build output. Lexicons ship these as
@@ -121,7 +170,11 @@ export interface PostSynthCheck {
 export declare function isPostSynthCheck(value: unknown): value is PostSynthCheck;
 /**
  * Run a set of post-synthesis checks against a build result. `env` is threaded
- * into the context so a check can branch on the current environment/stack.
+ * into the context so a check can branch on the current environment/stack, and
+ * `opts.activityContracts` (chant #2101) carries the build's cross-lexicon
+ * activity-contract map to the checks that validate Op steps against it.
  */
-export declare function runPostSynthChecks(checks: PostSynthCheck[], buildResult: PostSynthContext["buildResult"], env?: string): PostSynthDiagnostic[];
+export declare function runPostSynthChecks(checks: PostSynthCheck[], buildResult: PostSynthContext["buildResult"], env?: string, opts?: {
+    activityContracts?: ReadonlyMap<string, ActivityContract>;
+}): PostSynthDiagnostic[];
 //# sourceMappingURL=post-synth.d.ts.map

package/dist/lint/post-synth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IAC5B,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,GAC9C,MAAM,SAAS,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5F;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,EAAE,CAiBvB"}
+{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACnE,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,GAC9C,MAAM,SAAS,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,EAAE;QACR,kEAAkE;QAClE,IAAI,EAAE,MAAM,CAAC;QACb,0DAA0D;QAC1D,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;CAAE,GACnE,mBAAmB,EAAE,CAkBvB"}

package/dist/lint/rules/__fixtures__/comp/comp004/pass/neo4j-cluster.component.d.ts

@@ -1,4 +1,4 @@
 import type { Component } from "../../../../../../components/component.js";
-/** COMP004 pass case: a genuine gate, opted out via a file-level disable directive with a documented reason — the intended path for a component that graduates to the Temporal backend. */
+/** COMP004 pass case: a genuine gate, opted out via a file-level disable directive with a documented reason — the intended path for a component whose rollout genuinely waits on a person. */
 export declare const neo4jCluster: Component;
 //# sourceMappingURL=neo4j-cluster.component.d.ts.map

package/dist/lint/rules/__fixtures__/comp/comp004/pass/neo4j-cluster.component.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"neo4j-cluster.component.d.ts","sourceRoot":"","sources":["../../../../../../../src/lint/rules/__fixtures__/comp/comp004/pass/neo4j-cluster.component.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE,2LAA2L;AAC3L,eAAO,MAAM,YAAY,EAAE,SAiB1B,CAAC"}
+{"version":3,"file":"neo4j-cluster.component.d.ts","sourceRoot":"","sources":["../../../../../../../src/lint/rules/__fixtures__/comp/comp004/pass/neo4j-cluster.component.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE,8LAA8L;AAC9L,eAAO,MAAM,YAAY,EAAE,SAiB1B,CAAC"}

package/dist/lint/rules/__fixtures__/comp/comp004/pass/orders-table.component.d.ts

@@ -1,4 +1,4 @@
 import type { Component } from "../../../../../../components/component.js";
-/** COMP004 pass case: no gate step anywhere — nothing requires the durable backend. */
+/** COMP004 pass case: no gate step anywhere — nothing here stops the run for a person. */
 export declare const ordersTable: Component;
 //# sourceMappingURL=orders-table.component.d.ts.map

package/dist/lint/rules/__fixtures__/comp/comp004/pass/orders-table.component.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orders-table.component.d.ts","sourceRoot":"","sources":["../../../../../../../src/lint/rules/__fixtures__/comp/comp004/pass/orders-table.component.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE,uFAAuF;AACvF,eAAO,MAAM,WAAW,EAAE,SAKzB,CAAC"}
+{"version":3,"file":"orders-table.component.d.ts","sourceRoot":"","sources":["../../../../../../../src/lint/rules/__fixtures__/comp/comp004/pass/orders-table.component.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE,0FAA0F;AAC1F,eAAO,MAAM,WAAW,EAAE,SAKzB,CAAC"}

package/dist/lint/rules/comp/comp004-gate-needs-durable-runtime.d.ts

@@ -0,0 +1,44 @@
+/**
+ * COMP004: gate-needs-durable-runtime (the file is renamed in #2116; the
+ * behaviour changed in #2119)
+ *
+ * The file name and the exported symbol keep the old wording on purpose
+ * (#2195): the id is what an author writes in a `chant-disable` comment and
+ * what every import names, and churning both buys nothing. `description`
+ * below is the accurate sentence, and it is what the docs page uses as its
+ * heading — since #2119 the rule has nothing to do with which runtime hosts
+ * the run.
+ *
+ * Flags a `gate` step anywhere in a component's composition — the point where
+ * a run stops and waits for a person. Since #2119 that is not a refusal: the
+ * driver decides the gate against the gate ledger (`../../../op/gate.ts`), and
+ * one nobody has approved ends the run pending `chant approve <component>
+ * <gate>`, to be re-decided next run.
+ *
+ * The rule survives the change because what it flags survives it. The
+ * component contract has no per-component runtime field (the runtime is chosen
+ * per *run*, via `chant run --on`, intentionally not part of the declaration),
+ * so lint cannot tell from the declaration alone that a `gate` is deliberate;
+ * every one is a standing "this component stops for a human" fact worth
+ * surfacing, not a mistake to silently allow. Acknowledge it explicitly with a
+ * **file-level**
+ * disable directive once the human wait is genuinely intended (see
+ * lint-rules/disable-directives.mdx) — a COMP* diagnostic carries no real
+ * line/column (it is reported for the whole component; see
+ * ../../component-checks.ts), so only the file-level `chant-disable` form is
+ * honored for these rules — `-line`/`-next-line` do not suppress a COMP*
+ * diagnostic (see ../../../cli/commands/lint.ts's
+ * `runComponentCheckDiagnostics`):
+ *
+ * ```ts
+ * // chant-disable COMP004 -- the rollout waits on a release manager's approval
+ * ```
+ *
+ * Triggers on: any `gate` step in `deploy`/`rollback` with no matching
+ * file-level disable directive.
+ * OK: a component with no `gate` steps at all, or a `gate` whose file-level
+ * disable directive says who is expected to approve it and why.
+ */
+import type { ComponentCheck } from "../../component-checks.js";
+export declare const comp004GateNeedsDurableRuntimeRule: ComponentCheck;
+//# sourceMappingURL=comp004-gate-needs-durable-runtime.d.ts.map

package/dist/lint/rules/comp/comp004-gate-needs-durable-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comp004-gate-needs-durable-runtime.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/comp004-gate-needs-durable-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmD,MAAM,wBAAwB,CAAC;AAI9G,eAAO,MAAM,kCAAkC,EAAE,cA6BhD,CAAC"}

package/dist/lint/rules/comp/index.d.ts

@@ -9,7 +9,7 @@ import type { ComponentCheck } from "../../component-checks.js";
 export { comp001PublishesNeverAppliesRule } from "./comp001-publishes-never-applies.js";
 export { comp002DanglingWiringRefRule } from "./comp002-dangling-wiring-ref.js";
 export { comp003MutatingNoRollbackRule } from "./comp003-mutating-no-rollback.js";
-export { comp004GateNeedsTemporalRule } from "./comp004-gate-needs-temporal.js";
+export { comp004GateNeedsDurableRuntimeRule } from "./comp004-gate-needs-durable-runtime.js";
 export { comp005CapabilityKindIsNounRule } from "./comp005-capability-kind-is-noun.js";
 export { comp006ShellNeedsReasonRule } from "./comp006-shell-needs-reason.js";
 export { comp007CompositionSprawlRule } from "./comp007-composition-sprawl.js";

package/dist/lint/rules/comp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAS7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAE5E,4CAA4C;AAC5C,wBAAgB,mBAAmB,IAAI,cAAc,EAAE,CAUtD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAS7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAE5E,4CAA4C;AAC5C,wBAAgB,mBAAmB,IAAI,cAAc,EAAE,CAUtD"}

package/dist/lint/rules/op/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * OPS* Op-model post-synth checks (#2122, epic #2114 sub-issue 6) — ported
+ * from a hosting lexicon's own TMP012/TMP013/TMP014. Registered as core-owned
+ * post-synth checks (`coreOpChecks`, mirroring `../../receipt-checks.ts`'s
+ * `coreReceiptChecks`) so they run over the FULL build result regardless of
+ * which lexicons are configured — an Op is recognized by entity type
+ * (`../../../op/resource.ts`'s `OpResource`), not by which lexicon declared
+ * it.
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export { ops012 } from "./ops012-activity-contract.js";
+export { ops013 } from "./ops013-step-output-ref.js";
+export { ops014 } from "./ops014-converge-rule-refusals.js";
+/** Core's own post-synth checks over the Op model — OPS012, OPS013, OPS014. */
+export declare function coreOpChecks(): PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/op/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKvD,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAEzD,+EAA+E;AAC/E,wBAAgB,YAAY,IAAI,cAAc,EAAE,CAE/C"}

package/dist/lint/rules/op/ops012-activity-contract.d.ts

@@ -0,0 +1,27 @@
+/**
+ * OPS012: activity step args/outcomeAttribute must match the activity's
+ * declared contract (chant #1288 Stage 1; moved from a hosting lexicon's own
+ * TMP012 to core in #2122, epic #2114 sub-issue 6, so it fires on every
+ * project that declares an Op, not only one with that lexicon configured).
+ *
+ * Validates every Op entity's steps against core's own base-activity
+ * contracts (`../../../op/activities/activity-contracts.ts`, #2117), using
+ * the generic walk in `@intentius/chant/op`'s `validateActivitySteps`. A step
+ * whose `fn` has no registered contract here is skipped — most activities
+ * don't have one yet; see that module's doc for why that's the intended,
+ * non-breaking default.
+ *
+ * Cross-lexicon (chant #2101): an Op step may call an activity any
+ * configured lexicon contributes (`terraformPlan`, `k3sInstall`,
+ * `flyApply`), and since this check became core-owned it fires on every
+ * project that declares an Op. `ctx.activityContracts` carries the contracts
+ * every configured lexicon declared, resolved by `loadActivityContracts`
+ * (`../../../op/activity-contract-registry.ts`) the same way
+ * `loadActivities` resolves the implementations, and is merged over the
+ * static table below. A context that carries none — a hand-built one in a
+ * test, a caller that has not loaded any — falls back to that table alone,
+ * exactly as before.
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export declare const ops012: PostSynthCheck;
+//# sourceMappingURL=ops012-activity-contract.d.ts.map

package/dist/lint/rules/op/ops012-activity-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops012-activity-contract.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/ops012-activity-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AAU9F,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/rules/op/ops013-step-output-ref.d.ts

@@ -0,0 +1,61 @@
+/**
+ * OPS013: a step-output reference (`stepOutput()`/`activity().out`, chant
+ * #1290) must name a step that precedes it, in scope (main `phases`, not
+ * `onFailure` or nested inside an `EffectStep`), with a registered
+ * `ActivityContract` whose `returns` schema the referenced path resolves
+ * against. Moved from a hosting lexicon's own TMP013 to core in #2122 (epic
+ * #2114 sub-issue 6), so it fires on every project that declares an Op — a
+ * project on the local runtime with no lexicons configured included.
+ *
+ * Same shape as OPS012 (`./ops012-activity-contract.ts`): the generic walk
+ * lives in `@intentius/chant/op`'s `validateStepOutputRefs`, over the same
+ * contract map this file builds from core's own base-activity contracts
+ * (`../../../op/activities/activity-contracts.ts`, #2117). A producer
+ * step whose `fn` has no registered contract is flagged (unlike OPS012's
+ * args/outcomeAttribute checks, which skip an unregistered `fn` — a
+ * reference has nothing to validate against without one, so it can't be
+ * silently allowed the way an unchecked arg can). The purely structural half
+ * of this check (an unknown step id, or a reference into a later phase) is
+ * independent of the contract map's contents entirely — no lexicon needs to
+ * be configured, and no activity needs a registered contract at all, for it
+ * to fire.
+ *
+ * Cross-lexicon (chant #2101): an Op step may call an activity any
+ * configured lexicon contributes (`terraformPlan`, `k3sInstall`,
+ * `flyApply`), and since this check became core-owned it fires on every
+ * project that declares an Op. `ctx.activityContracts` carries the contracts
+ * every configured lexicon declared, resolved by `loadActivityContracts`
+ * (`../../../op/activity-contract-registry.ts`) the same way
+ * `loadActivities` resolves the implementations, and is merged over the
+ * static table below. A context that carries none — a hand-built one in a
+ * test, a caller that has not loaded any — falls back to that table alone,
+ * exactly as before.
+ *
+ * That merge is what makes this rule usable at all on an Op whose steps are
+ * a lexicon's: before it, `terraformPlan` feeding `terraformApply` failed
+ * `chant build` for the absence of a contract the terraform lexicon does in
+ * fact declare, which is why both terraform examples carrying an Op kept it
+ * outside `src/` where the example-build harness could not see it.
+ *
+ * This check is what makes it safe for a lexicon's own serializer to compile
+ * every reference it finds unconditionally: `chant build` blocks file output
+ * while an error-severity post-synth finding stands, so generated code
+ * referencing an unresolved step never reaches disk (a lexicon's own Op
+ * serializer also runs the scope-only subset of this check directly —
+ * `validateStepOutputRefScope` — as defense-in-depth, chant #1950 pre-merge
+ * review finding 2).
+ *
+ * Cross-contract type compatibility (chant #1950 pre-merge review, finding
+ * 3): this rule also compares a producer's declared return type at `path`
+ * against the consumer's declared arg type at the same position
+ * (`string`/`number`/`boolean`/`object`/`array` only) and flags a mismatch —
+ * a string-returning path feeding a number-typed arg, for example.
+ * Deliberately shallow: a union, enum, literal, `z.any()`/`z.unknown()`, a
+ * transform, or a reference sitting inside an array in `args` all bail
+ * silently rather than being reasoned about. See `@intentius/chant/op`'s
+ * `step-output-ref.ts` module doc for the full writeup of what this catches
+ * and what it defers (to #1288 Stage 2).
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export declare const ops013: PostSynthCheck;
+//# sourceMappingURL=ops013-step-output-ref.d.ts.map

package/dist/lint/rules/op/ops013-step-output-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops013-step-output-ref.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/ops013-step-output-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AAU9F,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/rules/op/ops014-converge-rule-refusals.d.ts

@@ -0,0 +1,55 @@
+/**
+ * OPS014: converge-rule-refusals (#1484). Moved from a hosting lexicon's own
+ * TMP014 to core in #2122 (epic #2114 sub-issue 6), so it fires on every
+ * project that declares a `ConvergeOp`-shaped Op, not only one with that
+ * lexicon configured.
+ *
+ * Cross-Op build-time refusals for a `ConvergeOp`'s rule table — the checks
+ * `../../../op/composites/converge-op.ts`'s factory can't make on its own,
+ * since they need the *whole* discovered graph of `Chant::Op` entities
+ * (`PostSynthContext.entities`), not just the ConvergeOp instance under
+ * construction: a sibling `*.op.ts` file's Op may not exist yet at the
+ * moment a composite factory runs, the same reason OPS012/OPS013 exist as
+ * post-synth checks rather than builder-time throws.
+ *
+ * A `ConvergeOp`-produced Op is identified by its own
+ * `labels.Converge === "true"` marker (mirroring `ApplyOp`'s
+ * `{ Apply: "true" }` / `WatchOp`'s `{ Watch: "true" }`); its rule table is
+ * read back off the `convergeTick` activity step's `args.rules` (there is no
+ * dedicated `OpConfig` field for it — see `../../../op/composites/
+ * converge-op.ts`'s doc on why the rule table travels as a step's args
+ * instead of a bespoke config field).
+ *
+ * Flags (pre-merge review of #1954 tightened the last three to match issue
+ * #1484's own Autonomy table — see `converge-op.ts`'s module doc):
+ *  - a rule with no (or a blank) `why` — every rule must carry its
+ *    rationale (Accessible Ops factor III),
+ *  - a rule whose predicate isn't in the evaluable subset
+ *    (`isWellFormedPredicate`, re-validated here as the runtime backstop
+ *    over a rule table not authored through `when()`),
+ *  - a `run()` action naming an Op no declared Op entity has as its `name`,
+ *  - a `run()` action dispatching a `mutating` Op under any dial other than
+ *    `"apply"` — the issue's Autonomy table gives `reconcile` "open PR", not
+ *    "run directly"; opening a PR is out of v1 scope (epic #1487's
+ *    `onDrift`-channel open question), so `reconcile` refuses the mutating
+ *    dispatch rather than silently escalating it to "run directly",
+ *  - a `run()` action dispatching a `destructive` Op under any dial,
+ *    unconditionally — a converge tick runs unattended, on a schedule, with
+ *    no one watching it fire. A destructive dispatch needs a human's
+ *    approval *before* it is attempted, not a gate the tick consults after
+ *    it has already committed to running the op — and `run()` has no way to
+ *    ask first. (This used to be argued from the local executor's inability
+ *    to honor a gate at all; as of #2119 a gated op ends the run `gated`
+ *    rather than being refused, so that argument no longer holds — the
+ *    refusal stands on the unattended-approval ground instead.) Durable,
+ *    pre-approved destructive dispatch from a tick is a future design's to
+ *    own; v1 refuses the target rather than shipping a path that dispatches
+ *    a destructive op with no human in the loop,
+ *  - a rule whose predicate reads `adoptCount` while its action is `run()`
+ *    against a `mutating` Op — adopt safety (never auto-claiming an unowned
+ *    resource) is enforced here, not merely documented: a rule that reads
+ *    the adopt signal has no business dispatching a mutation.
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export declare const ops014: PostSynthCheck;
+//# sourceMappingURL=ops014-converge-rule-refusals.d.ts.map

package/dist/lint/rules/op/ops014-converge-rule-refusals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops014-converge-rule-refusals.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/ops014-converge-rule-refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AAuB9F,eAAO,MAAM,MAAM,EAAE,cAuGpB,CAAC"}

package/dist/lint/rules/op/support.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared support for the OPS* Op-model post-synth checks (#2122, epic #2114
+ * sub-issue 6) — OPS012 (`./ops012-activity-contract.ts`), OPS013
+ * (`./ops013-step-output-ref.ts`) and OPS014
+ * (`./ops014-converge-rule-refusals.ts`), ported here from a hosting
+ * lexicon's own TMP012/TMP013/TMP014.
+ *
+ * Op-entity recognition is core's own `isOpEntity` (`../../../op/resource.ts`,
+ * #2118) — re-exported here so every OPS* check imports it from one place.
+ */
+export { isOpEntity } from "../../../op/resource.js";
+//# sourceMappingURL=support.d.ts.map

package/dist/lint/rules/op/support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"support.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/support.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/lint/suppressions.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Inline HCL-comment suppression (chant #2111). This file is core's small,
+ * generic half of the mechanism. It filters already-produced
+ * `PostSynthDiagnostic`s against suppression directives an entity carries,
+ * with no knowledge of which lexicon produced that entity. The other half,
+ * reading `# chant-ignore` / `# chant-ignore-file` / `# chant-ignore-block`
+ * comments out of raw `.tf` text and attaching the result to each parsed
+ * entity, is terraform-specific and lives in
+ * `lexicons/terraform/src/hcl/suppressions.ts`.
+ *
+ * Placement. The issue that asked for this weighed two options: a wrapper
+ * over `runPostSynthChecks` private to the terraform lexicon, or a
+ * `PostSynthContext` field every lexicon could share. Neither is quite what
+ * this file does. `ctx.entities` is already the one thing every
+ * `PostSynthContext` carries regardless of lexicon, and a suppression
+ * directive is inherently a fact ABOUT one entity, namely which block it
+ * anchors to, not a fact about the run as a whole. That is the same reasoning
+ * that already lets each lexicon's `Declarable` carry its own `props` shape
+ * (`TerraformEntity.props`, `K8sEntity.props`, and so on), so the hook here
+ * is a plain, duck-typed optional field, `suppressions`, that any entity MAY
+ * carry beside its `props`, read generically through `entitySuppressions()`
+ * below. Choosing this over a `PostSynthContext.suppressions` field needed no
+ * change to `PostSynthContext`, `Declarable`, or any of the places that
+ * construct a context (`./post-synth.ts`'s `runPostSynthChecks`, `chant
+ * audit`'s `../audit/core.ts`, and the two test-utils builders). Every one
+ * of them already hands `applyInlineSuppressions` below `ctx.entities`, so a
+ * lexicon that wants this (k8s manifests are the epic's other named
+ * candidate) adopts the convention on its own entities, with zero further
+ * core changes.
+ *
+ * `rules` (a project's `lint.rules`) is optional here on purpose. `chant
+ * build` has one to pass, so `ignorable: false` works there; `chant audit`'s
+ * audit-core path does not thread a project config through at all today, see
+ * `../audit/core.ts`, so it calls this with `rules` omitted. Every rule
+ * reads as ignorable in that path, the same default this module
+ * gives an unconfigured rule id everywhere else.
+ */
+import type { RuleConfig } from "./rule.js";
+import type { PostSynthDiagnostic } from "./post-synth.js";
+import type { Declarable } from "../declarable.js";
+/** What a directive's id list names. `"all"` is the wildcard every form accepts. */
+export type SuppressionIds = "all" | ReadonlySet<string>;
+/** One `# chant-ignore*` comment, already parsed from raw source text. */
+export interface SuppressionDirective {
+    /** Which of the three comment forms produced this directive. */
+    form: "chant-ignore" | "chant-ignore-file" | "chant-ignore-block";
+    /** Rule ids this directive names, or `"all"`. */
+    ids: SuppressionIds;
+    /** The `exp:YYYY-MM-DD` term, if present. */
+    expires?: string;
+    /** Source file the comment lives in. */
+    file: string;
+    /** 1-based line the comment ITSELF sits on (not the block it anchors to). */
+    line: number;
+    /**
+     * `chant-ignore-file` is only valid as the file's first non-blank line
+     * (tflint's own constraint on `tflint-ignore-file`, kept here so the form
+     * stays findable). A directive found elsewhere sets this instead of being
+     * applied; see `SUPPRESSION_MISPLACED_FILE_ID` below.
+     */
+    misplaced?: boolean;
+    /**
+     * Stable identity, for dedup across the several entities one directive can
+     * attach to. A file-level directive attaches to every entity parsed from
+     * its file, but an expired-or-misplaced report about it should appear once.
+     */
+    key: string;
+}
+/** An expired suppression is reported once as its own finding, not dropped. */
+export declare const SUPPRESSION_EXPIRED_ID = "SUPP001";
+/** A `chant-ignore-file` found anywhere but the first non-blank line. */
+export declare const SUPPRESSION_MISPLACED_FILE_ID = "SUPP002";
+/** A directive explicitly names a rule id configured `ignorable: false`. */
+export declare const SUPPRESSION_UNIGNORABLE_ID = "SUPP003";
+export type SuppressionMetaCheckId = typeof SUPPRESSION_EXPIRED_ID | typeof SUPPRESSION_MISPLACED_FILE_ID | typeof SUPPRESSION_UNIGNORABLE_ID;
+/**
+ * A finding about the suppression mechanism itself, not about a rule id a
+ * check would normally report, so it deliberately does not go through the
+ * audit catalog: nothing here is registered as a `PostSynthCheck`, so it
+ * never needs a `RuleMeta` entry, a lineage entry, or a full page.
+ */
+export interface SuppressionMetaFinding {
+    checkId: SuppressionMetaCheckId;
+    severity: "warning";
+    message: string;
+    file: string;
+    line: number;
+}
+export interface InlineSuppressionResult {
+    /** Diagnostics after inline suppression, matched ones removed. */
+    diagnostics: PostSynthDiagnostic[];
+    /** Diagnostics an inline directive suppressed, unaltered (counted, never dropped silently). */
+    suppressed: PostSynthDiagnostic[];
+    /** Findings about the suppression mechanism itself: expired, misplaced, or denied by `ignorable: false`. */
+    meta: SuppressionMetaFinding[];
+}
+/** Read an entity's directives, if it carries any (duck-typed; see module doc). */
+export declare function entitySuppressions(entity: Declarable | undefined): readonly SuppressionDirective[];
+/**
+ * Apply inline (`# chant-ignore*`) suppression to a set of post-synth
+ * diagnostics. `entities` is `ctx.entities`, the same map every
+ * `PostSynthContext` already carries. `rules` is the project's `lint.rules`,
+ * for `ignorable: false`; see this module's doc comment for why it is
+ * optional. `today` is injectable so an expiry test doesn't depend on the
+ * clock.
+ */
+export declare function applyInlineSuppressions(diagnostics: readonly PostSynthDiagnostic[], entities: Map<string, Declarable>, rules?: Record<string, RuleConfig>, today?: Date): InlineSuppressionResult;
+//# sourceMappingURL=suppressions.d.ts.map

package/dist/lint/suppressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/lint/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAEzD,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,IAAI,EAAE,cAAc,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;IAClE,iDAAiD;IACjD,GAAG,EAAE,cAAc,CAAC;IACpB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAChD,yEAAyE;AACzE,eAAO,MAAM,6BAA6B,YAAY,CAAC;AACvD,4EAA4E;AAC5E,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAC9B,OAAO,sBAAsB,GAC7B,OAAO,6BAA6B,GACpC,OAAO,0BAA0B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,sBAAsB,CAAC;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,+FAA+F;IAC/F,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,4GAA4G;IAC5G,IAAI,EAAE,sBAAsB,EAAE,CAAC;CAChC;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,oBAAoB,EAAE,CAIlG;AAqBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAClC,KAAK,GAAE,IAAiB,GACvB,uBAAuB,CAyDzB"}

package/dist/live-endpoint.d.ts

@@ -40,7 +40,7 @@ import { type EmulatorDeclaration } from "./op/emulator-lifecycle.js";
  * The ambient endpoint vars a lexicon honors, from its emulator capability.
  *
  * A lexicon with no emulator contributes nothing, which is the same answer the
- * hand-maintained map gave for k8s, gcp and temporal — they resolve their live
+ * hand-maintained map gave for k8s and gcp — they resolve their live
  * target from `chant.config` itself, so there is nothing to inject.
  */
 export declare function endpointEnvVarsFor(lexicon: EndpointLexicon): string[];

package/dist/op/activities/activity-contracts.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Activity contracts for core's own `op/activities` (chant #1288
+ * Stage 1). Each contract's `args` schema mirrors the corresponding
+ * `*Args` interface in `./activities/*.ts` — kept alongside the
+ * implementation, the way the issue asked for, and validated by
+ * `chant build` via `tmp012` (the OPS012 activity-contract rule).
+ *
+ * Author `args` with `z.strictObject(...)`, never `z.object(...)`: the
+ * default form silently drops a key it doesn't recognize instead of
+ * rejecting it, which reproduces the exact bug this issue is about
+ * (`helmInstall("api", "./chart", { nameSpace: "prod" })` — the misspelled
+ * key vanishes rather than failing the build).
+ *
+ * Deliberately partial. Only activities with args simple enough for a zod
+ * mirror to earn its keep are covered here — `kubectlApply`/`helmInstall`/
+ * the cloud appliers carry a dozen-plus fields each with real cross-field
+ * logic (see `KubectlApplyArgs`, `HelmInstallArgs`), and forcing those
+ * through a duplicate schema is exactly the maintenance burden Stage 2
+ * (regenerating the step builders as fully typed wrappers) is meant to
+ * avoid by deriving types instead of restating them. A step calling an
+ * activity with no registered contract here is skipped by `tmp012`, not
+ * flagged — see `activityContract`'s doc in `../activity-contract` for why
+ * that's the intended, non-breaking default.
+ */
+export declare const lifecycleSnapshotContract: import("../index.js").ActivityContract<{
+    env: string;
+}, never>;
+export declare const lifecycleDiffContract: import("../index.js").ActivityContract<{
+    env: string;
+    live?: boolean | undefined;
+}, {
+    output: string;
+    exitCode: number;
+    drifted: boolean;
+}>;
+export declare const shellCmdContract: import("../index.js").ActivityContract<{
+    cmd: string;
+    env?: Record<string, string> | undefined;
+    cwd?: string | undefined;
+}, never>;
+export declare const httpCheckContract: import("../index.js").ActivityContract<{
+    url: string;
+    method?: string | undefined;
+    status?: number | undefined;
+    contains?: string | undefined;
+    retries?: number | undefined;
+    intervalMs?: number | undefined;
+}, {
+    status: number;
+}>;
+export declare const chantTeardownContract: import("../index.js").ActivityContract<{
+    path: string;
+}, never>;
+//# sourceMappingURL=activity-contracts.d.ts.map

package/dist/op/activities/activity-contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../../src/op/activities/activity-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,eAAO,MAAM,yBAAyB;;SAGrC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;EAIjC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;SAG5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;EAgB7B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;SAGjC,CAAC"}