feat(temporal): add temporal lexicon, rewrite temporal-crdb-deploy, rename temporal-local

.github/workflows/chant.yml

@@ -40,6 +40,7 @@ jobs:
           npm run --prefix lexicons/helm prepack
           npm run --prefix lexicons/docker prepack
           npm run --prefix lexicons/slurm prepack
+          npm run --prefix lexicons/temporal prepack
 
       - name: Typecheck
         run: npx tsc --noEmit -p packages/core/tsconfig.json
@@ -89,6 +90,7 @@ jobs:
           npm run --prefix lexicons/helm prepack
           npm run --prefix lexicons/docker prepack
           npm run --prefix lexicons/slurm prepack
+          npm run --prefix lexicons/temporal prepack
 
       - name: Run tests
         run: npx vitest run
@@ -144,6 +146,9 @@ jobs:
       - name: Generate and validate Slurm lexicon
         run: npm run --prefix lexicons/slurm prepack
 
+      - name: Generate and validate Temporal lexicon
+        run: npm run --prefix lexicons/temporal prepack
+
   smoke-npm:
     if: false  # disabled — Docker smoke tests are for local/release validation, not every push
     runs-on: ubuntu-latest

.github/workflows/publish.yml

@@ -35,6 +35,7 @@ jobs:
       - run: npm run --prefix lexicons/helm prepack
       - run: npm run --prefix lexicons/docker prepack
       - run: npm run --prefix lexicons/slurm prepack
+      - run: npm run --prefix lexicons/temporal prepack
       - run: npx vitest run
 
   publish:
@@ -129,3 +130,10 @@ jobs:
           V=$(node -e "process.stdout.write(require('./package.json').version)")
           P=$(npm view @intentius/chant-lexicon-slurm version 2>/dev/null || echo "none")
           [ "$V" = "$P" ] && echo "Already at $V, skipping" || npm publish --access public
+
+      - name: Publish @intentius/chant-lexicon-temporal
+        working-directory: lexicons/temporal
+        run: |
+          V=$(node -e "process.stdout.write(require('./package.json').version)")
+          P=$(npm view @intentius/chant-lexicon-temporal version 2>/dev/null || echo "none")
+          [ "$V" = "$P" ] && echo "Already at $V, skipping" || npm publish --access public

examples/temporal-crdb-deploy/chant.config.ts

@@ -0,0 +1,35 @@
+/**
+ * chant configuration — Temporal worker profiles.
+ *
+ * The `temporal.profiles` object is the single source of truth for how this project's
+ * Temporal worker connects to Temporal Cloud. Importing this config in worker.ts means
+ * connection configuration is version-controlled and TypeScript-checked — a missing
+ * `taskQueue` or wrong namespace is a compile error, not a runtime failure after 5 minutes.
+ *
+ * Usage in worker.ts:
+ *   import config from "../chant.config.ts";
+ *   const profile = config.temporal.profiles[config.temporal.defaultProfile ?? "cloud"];
+ */
+
+import type { TemporalChantConfig } from "@intentius/chant-lexicon-temporal";
+
+export default {
+  temporal: {
+    profiles: {
+      cloud: {
+        address:    process.env.TEMPORAL_ADDRESS   ?? "crdb-deploy.a2dd6.tmprl.cloud:7233",
+        namespace:  process.env.TEMPORAL_NAMESPACE ?? "crdb-deploy.a2dd6",
+        taskQueue:  "crdb-deploy",
+        tls:        true,
+        apiKey:     { env: "TEMPORAL_API_KEY" },
+      },
+      local: {
+        address:    "localhost:7233",
+        namespace:  "default",
+        taskQueue:  "crdb-deploy",
+        autoStart:  true,
+      },
+    },
+    defaultProfile: "cloud",
+  } satisfies TemporalChantConfig,
+};

examples/temporal-crdb-deploy/package.json

@@ -4,15 +4,17 @@
   "type": "module",
   "private": true,
   "scripts": {
-    "build": "npm run build:shared && npm run build:east && npm run build:central && npm run build:west",
+    "build": "npm run build:temporal && npm run build:shared && npm run build:east && npm run build:central && npm run build:west",
     "build:shared": "chant build src/shared --lexicon gcp -o dist/shared-infra.yaml",
     "build:east": "chant build src/east --lexicon gcp -o dist/east-infra.yaml && chant build src/east --lexicon k8s -o dist/east-k8s.yaml",
     "build:central": "chant build src/central --lexicon gcp -o dist/central-infra.yaml && chant build src/central --lexicon k8s -o dist/central-k8s.yaml",
     "build:west": "chant build src/west --lexicon gcp -o dist/west-infra.yaml && chant build src/west --lexicon k8s -o dist/west-k8s.yaml",
+    "build:temporal": "chant build src --lexicon temporal -o dist/temporal-setup.sh",
     "lint": "chant lint src/shared && chant lint src/east && chant lint src/central && chant lint src/west",
     "bootstrap": "bash scripts/bootstrap.sh",
     "deploy": "bash scripts/deploy.sh",
     "teardown": "bash scripts/teardown.sh",
+    "temporal:setup": "bash dist/temporal-setup.sh",
     "temporal:worker": "tsx temporal/worker.ts",
     "temporal:deploy": "tsx temporal/client.ts start",
     "temporal:signal": "tsx temporal/client.ts signal",
@@ -23,6 +25,7 @@
     "@intentius/chant": "*",
     "@intentius/chant-lexicon-gcp": "*",
     "@intentius/chant-lexicon-k8s": "*",
+    "@intentius/chant-lexicon-temporal": "*",
     "@temporalio/activity": "^1.10.4",
     "@temporalio/client": "^1.10.4",
     "@temporalio/worker": "^1.10.4",

examples/temporal-crdb-deploy/src/central/infra.ts

@@ -0,0 +1,37 @@
+/**
+ * Central region (us-central1) GCP infrastructure.
+ *
+ * Replaces: infra/cluster.ts + infra/dns.ts
+ */
+
+import { GkeCrdbRegion } from "@intentius/chant-lexicon-gcp";
+import { GCP_PROJECT_ID, CRDB_DOMAIN, BACKUP_BUCKET } from "../shared/config";
+
+export const central = GkeCrdbRegion({
+  region: "us-central1",
+  clusterName: "gke-crdb-central",
+  network: "crdb-multi-region",
+  subnetwork: "crdb-multi-region-central-nodes",
+  domain: `central.${CRDB_DOMAIN}`,
+  project: GCP_PROJECT_ID,
+  crdbNamespace: "crdb-central",
+  masterCidr: "172.17.0.0/28",
+  nodeConfig: {
+    machineType: "n2-standard-2",
+    diskSizeGb: 100,
+    nodeCount: 1,
+    maxNodeCount: 3,
+  },
+  backupBucket: BACKUP_BUCKET,
+});
+
+export const cluster = central.cluster;
+export const nodePool = central.nodePool;
+export const defaultPool = central.defaultPool;
+export const dnsZone = central.dnsZone;
+export const dnsGsa = central.dnsGsa;
+export const dnsWiBinding = central.dnsWiBinding;
+export const dnsAdminBinding = central.dnsAdminBinding;
+export const crdbGsa = central.crdbGsa;
+export const crdbWiBinding = central.crdbWiBinding;
+export const crdbBackupBinding = (central as Record<string, unknown>).crdbBackupBinding;

examples/temporal-crdb-deploy/src/central/k8s.ts

@@ -0,0 +1,52 @@
+/**
+ * Central region (us-central1) Kubernetes resources.
+ *
+ * Replaces: k8s/namespace.ts + k8s/storage.ts + k8s/cockroachdb.ts +
+ *           k8s/external-secrets.ts + k8s/ingress.ts + k8s/tls.ts +
+ *           k8s/backend-config.ts + k8s/monitoring.ts  (8 files → 1 call)
+ */
+
+import { CockroachDbRegionStack } from "@intentius/chant-lexicon-k8s";
+import { GCP_PROJECT_ID, CRDB_DOMAIN, INTERNAL_DOMAIN, CRDB_CLUSTER, ALL_CIDRS } from "../shared/config";
+
+export const central = CockroachDbRegionStack({
+  region: "central",
+  namespace: "crdb-central",
+  domain: `central.${CRDB_DOMAIN}`,
+  internalDomain: `central.${INTERNAL_DOMAIN}`,
+  publicRootDomain: CRDB_DOMAIN,
+
+  projectId: GCP_PROJECT_ID,
+  clusterName: "gke-crdb-central",
+  clusterRegion: "us-central1",
+  crdbGsaEmail: `gke-crdb-central-crdb@${GCP_PROJECT_ID}.iam.gserviceaccount.com`,
+  externalDnsGsaEmail: `gke-crdb-central-dns@${GCP_PROJECT_ID}.iam.gserviceaccount.com`,
+
+  cockroachdb: {
+    ...CRDB_CLUSTER,
+    locality: "cloud=gcp,region=us-central1",
+    skipInit: true,
+    mountClientCerts: true,
+    advertiseHostDomain: `central.${INTERNAL_DOMAIN}`,
+    extraCertNodeAddresses: [
+      `cockroachdb-0.central.${INTERNAL_DOMAIN}`,
+      `cockroachdb-1.central.${INTERNAL_DOMAIN}`,
+      `cockroachdb-2.central.${INTERNAL_DOMAIN}`,
+    ],
+  },
+
+  tls: {
+    gcpSecretNames: {
+      ca:            "crdb-ca-crt",
+      nodeCrt:       "crdb-node-crt",
+      nodeKey:       "crdb-node-key",
+      clientRootCrt: "crdb-client-root-crt",
+      clientRootKey: "crdb-client-root-key",
+    },
+  },
+
+  quota: { cpu: "8", memory: "20Gi", maxPods: 25 },
+  allowCidrs: ALL_CIDRS,
+  cloudArmor: { policyName: "crdb-ui-waf" },
+  monitoring: true,
+});