@intentius/chant-k8s-client 0.44.3 → 0.44.5

package/dist/client.d.ts

@@ -34,7 +34,7 @@
  * path that writes the `Authorization` header — runs for real, which is what
  * makes a test that injects one worth writing.
  */
-import type { ApiResourceInfo, ClientProvenance, K8sClientOptions, K8sObject, ObjectRef, ResourceSelector } from "./types.js";
+import type { ApiResourceInfo, ClientProvenance, K8sClientOptions, K8sObject, ObjectRef, ResourceSelector, KubeconfigView } from "./types.js";
 type ClientNode = typeof import("@kubernetes/client-node");
 /**
  * Load `@kubernetes/client-node`, once per process.
@@ -58,6 +58,31 @@ export declare function isK8sClientAvailable(): Promise<boolean>;
  * kubeconfig can be read at all.
  */
 export declare function readAmbientContext(options?: Pick<K8sClientOptions, "kubeconfig" | "kubeconfigPath">): Promise<string | undefined>;
+/**
+ * The merged kubeconfig's contexts and their apiservers, without building a
+ * client (chant #1630).
+ *
+ * A lens showing an operator which cluster the k8s half is being read from
+ * needs an address out of a file, not a client about to talk to one. Going
+ * through `createK8sClient` for that answer refuses in two places it should
+ * not: an auth plugin outside the exec allowlist throws, so a cluster whose
+ * address is sitting right there in the kubeconfig — and which kubectl reads
+ * without complaint — reports as no target at all; and a context resolving to
+ * no cluster throws where the caller wants "nothing to report". Both refusals
+ * are right for a client that is about to send a request and wrong for a
+ * config read. Enumerating also takes one client per context, and enumerating
+ * is exactly what a lens does.
+ *
+ * So: no credential touched, no exec plugin run, no request issued. Every
+ * failure — no kubeconfig, an unreadable one, `@kubernetes/client-node` not
+ * installed — is an empty result rather than a throw, because a lens on an
+ * aws-only project running on a machine that has never seen Kubernetes has
+ * nothing to report and nothing to fail about.
+ *
+ * `server` per context rather than a separate cluster map: joining the two is
+ * what every caller does anyway.
+ */
+export declare function readKubeconfigView(options?: Pick<K8sClientOptions, "kubeconfig" | "kubeconfigPath">): Promise<KubeconfigView>;
 /** Options for a single object read. */
 export interface ReadOptions {
     signal?: AbortSignal;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAcH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,SAAS,EAET,gBAAgB,EAEjB,MAAM,SAAS,CAAC;AAEjB,KAAK,UAAU,GAAG,cAAc,yBAAyB,CAAC,CAAC;AAI3D;;;;;;;GAOG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,CAQ1D;AAED,yEAAyE;AACzE,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO7D;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,gBAAgB,CAAM,GACpE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW7B;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC3D,wDAAwD;IACxD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,kDAAkD;IAClD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAChG,8EAA8E;IAC9E,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;;;;;;OAUG;IACH,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3E,wEAAwE;IACxE,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACrF,wFAAwF;IACxF,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9E;;;;;;;;OAQG;IACH,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,4DAA4D;IAC5D,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,oEAAoE;IACpE,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG;;;;;;OAMG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAChF;;;;;;;OAOG;IACH,sBAAsB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,6FAA6F;IAC7F,kBAAkB,IAAI,MAAM,EAAE,CAAC;CAChC;AAsBD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC,CAkdxF;AAED,qDAAqD;AACrD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAGpF;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAM/D;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAE9C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAeH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,SAAS,EAET,gBAAgB,EAGhB,cAAc,EACf,MAAM,SAAS,CAAC;AAEjB,KAAK,UAAU,GAAG,cAAc,yBAAyB,CAAC,CAAC;AAI3D;;;;;;;GAOG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,CAQ1D;AAED,yEAAyE;AACzE,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO7D;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,gBAAgB,CAAM,GACpE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,gBAAgB,CAAM,GACpE,OAAO,CAAC,cAAc,CAAC,CAwBzB;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC3D,wDAAwD;IACxD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,kDAAkD;IAClD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAChG,8EAA8E;IAC9E,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;;;;;;OAUG;IACH,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3E,wEAAwE;IACxE,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACrF,wFAAwF;IACxF,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9E;;;;;;;;OAQG;IACH,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,4DAA4D;IAC5D,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,oEAAoE;IACpE,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG;;;;;;OAMG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAChF;;;;;;;OAOG;IACH,sBAAsB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,6FAA6F;IAC7F,kBAAkB,IAAI,MAAM,EAAE,CAAC;CAChC;AAsBD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC,CA0cxF;AAED,qDAAqD;AACrD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAGpF;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAM/D;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAE9C"}

package/dist/index.d.ts

@@ -11,7 +11,7 @@
  * `examples/k8s-client-boundary.test.ts` walks the static import graph to prove
  * it stays that way.
  */
-export { createK8sClient, readAmbientContext, loadClientNode, isK8sClientAvailable, apiVersionPath, splitApiVersion, selectorText, refText, } from "./client.js";
+export { createK8sClient, readAmbientContext, readKubeconfigView, loadClientNode, isK8sClientAvailable, apiVersionPath, splitApiVersion, selectorText, refText, } from "./client.js";
 export type { K8sClient, ReadOptions, ApplyOptions, DeleteOptions, ListOptions, ReadLogOptions } from "./client.js";
 export { K8sApiError, K8sTransportError, K8sClientUnavailableError, ExecCredentialNotAllowedError, FieldManagerError, KubeConfigError, UnknownResourceError, } from "./errors.js";
 export type { K8sStatus } from "./errors.js";
@@ -24,5 +24,5 @@ export type { ManagedFieldsEntry, ManagerFieldSet } from "./managed-fields.js";
 export { DEFAULT_EXEC_ALLOWLIST, assertExecCredentialAllowed, credentialPathOf, execConfigOf, execCommandName, } from "./credentials.js";
 export type { ExecConfig, KubeConfigUser } from "./credentials.js";
 export { mapConcurrent, DEFAULT_CONCURRENCY } from "./concurrency.js";
-export type { ApiResourceInfo, ClientProvenance, CredentialPath, K8sClientOptions, K8sObject, ObjectRef, RequestContextLike, RequestLayer, ResourceSelector, ResponseContextLike, } from "./types.js";
+export type { ApiResourceInfo, ClientProvenance, CredentialPath, K8sClientOptions, KubeconfigContextInfo, KubeconfigView, K8sObject, ObjectRef, RequestContextLike, RequestLayer, ResourceSelector, ResponseContextLike, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,OAAO,GACR,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEjH,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGhE,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEnE,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,OAAO,GACR,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEjH,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGhE,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEnE,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,SAAS,CAAC"}

package/dist/kubeconfig.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Loading the kubeconfig the way kubectl loads it — chant #1630.
+ *
+ * `@kubernetes/client-node` parses a kubeconfig faithfully and merges a
+ * `KUBECONFIG` path list on two rules that are not kubectl's. Both are
+ * reproducible with two files and no cluster (checked against client-node
+ * 1.4.0), and both make chant bind a different cluster than the `kubectl get`
+ * the operator ran to check:
+ *
+ * - **Duplicate names throw.** `mergeConfig` funnels every entry through
+ *   `addCluster`/`addUser`/`addContext`, each of which throws `Duplicate
+ *   cluster: <name>` on a name it already holds. kubectl's documented rule is
+ *   the opposite — keep the first, ignore later ones, never fail. Overlapping
+ *   names across a list are ordinary: a team-wide file plus a personal one
+ *   both naming `dev` is the usual way people get there. Today that throw is
+ *   swallowed by `readAmbientContext`'s try/catch, so chant reads those users
+ *   as having no kubeconfig at all.
+ * - **current-context is last-wins.** `loadFromDefault(opts,
+ *   contextFromStartingConfig)` defaults the second argument to `false`, and
+ *   `mergeConfig` then overwrites `currentContext` from each later file.
+ *   kubectl takes the FIRST file that sets one.
+ *
+ * So the multi-file case is merged here instead: one `KubeConfig` per file
+ * (which is also what keeps each file's relative certificate paths resolved
+ * against its own directory), then a first-wins union by name and the first
+ * `current-context` that appears. Everything else — the single-file path, the
+ * `~/.kube/config` fallback, in-cluster credentials — stays client-node's
+ * `loadFromDefault`, with the one-word fix that gives it kubectl's
+ * current-context.
+ *
+ * A file in the list that cannot be read is skipped rather than fatal, which
+ * is also kubectl's rule: a stale entry in a shared `KUBECONFIG` export must
+ * not take the whole config down with it.
+ */
+import type * as k8s from "@kubernetes/client-node";
+type ClientNode = typeof import("@kubernetes/client-node");
+/** Where the loaded kubeconfig came from, for {@link ClientProvenance}. */
+export type KubeconfigSource = "explicit-string" | "explicit-path" | "default" | "in-cluster";
+export interface LoadedKubeConfig {
+    kc: k8s.KubeConfig;
+    source: KubeconfigSource;
+}
+/**
+ * The kubeconfig this invocation should read, by the same precedence every
+ * entry point in this package uses: an explicit literal, then an explicit
+ * path, then the ambient default (`KUBECONFIG`, `~/.kube/config`, in-cluster).
+ *
+ * Throws whatever client-node throws for an explicit string or path — those
+ * are the caller naming a file, and a caller who names an unreadable one wants
+ * to hear about it. The ambient path never throws for a duplicate name.
+ */
+export declare function loadKubeConfig(mod: ClientNode, options?: {
+    kubeconfig?: string;
+    kubeconfigPath?: string;
+}): LoadedKubeConfig;
+export {};
+//# sourceMappingURL=kubeconfig.d.ts.map

package/dist/kubeconfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubeconfig.d.ts","sourceRoot":"","sources":["../src/kubeconfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAEpD,KAAK,UAAU,GAAG,cAAc,yBAAyB,CAAC,CAAC;AAE3D,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,eAAe,GAAG,SAAS,GAAG,YAAY,CAAC;AAE9F,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAwDD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,UAAU,EACf,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7D,gBAAgB,CAqBlB"}

package/dist/types.d.ts

@@ -85,6 +85,25 @@ export interface ClientProvenance {
     /** Where the kubeconfig itself came from. */
     kubeconfigSource: "explicit-string" | "explicit-path" | "default" | "in-cluster";
 }
+/**
+ * One context of the merged kubeconfig, joined to the apiserver its cluster
+ * resolves to (chant #1630). Plain data read out of a file: no credential is
+ * touched, no exec plugin runs, no request is issued.
+ */
+export interface KubeconfigContextInfo {
+    name: string;
+    /** Cluster name the context names. Empty when the context declares none. */
+    cluster: string;
+    user?: string;
+    namespace?: string;
+    /** The apiserver URL the named cluster resolves to, when the config has one. */
+    server?: string;
+}
+/** What {@link import("./client.js").readKubeconfigView} returns. */
+export interface KubeconfigView {
+    contexts: KubeconfigContextInfo[];
+    currentContext?: string;
+}
 /** Options for {@link import("./client.js").createK8sClient}. */
 export interface K8sClientOptions {
     /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,eAAe,GACf,OAAO,GACP,oBAAoB,GACpB,YAAY,GACZ,YAAY,GACZ,MAAM,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE,cAAc,CAAC;IAC3B,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,EAAE,iBAAiB,GAAG,eAAe,GAAG,SAAS,GAAG,YAAY,CAAC;CAClF;AAED,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;CACvF;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,MAAM,IAAI,MAAM,CAAC;IACjB,aAAa,IAAI,MAAM,CAAC;IACxB,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,OAAO,CAAC;CACpB;AAED,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE;QAAE,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC;CACnC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,eAAe,GACf,OAAO,GACP,oBAAoB,GACpB,YAAY,GACZ,YAAY,GACZ,MAAM,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE,cAAc,CAAC;IAC3B,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,EAAE,iBAAiB,GAAG,eAAe,GAAG,SAAS,GAAG,YAAY,CAAC;CAClF;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;CACvF;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,MAAM,IAAI,MAAM,CAAC;IACjB,aAAa,IAAI,MAAM,CAAC;IACxB,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,OAAO,CAAC;CACpB;AAED,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE;QAAE,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC;CACnC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-k8s-client",
-  "version": "0.44.3",
+  "version": "0.44.5",
   "description": "Typed Kubernetes API client for chant — the read/write path of the k8s lexicon, kept out of the build path",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant/lexicons/k8s/api-client/",

package/src/client.ts

@@ -47,6 +47,7 @@ import { assertExecCredentialAllowed, credentialPathOf, DEFAULT_EXEC_ALLOWLIST }
 import { asFieldManagerConflict } from "./conflict";
 import { assertValidFieldManager, CHANT_FIELD_MANAGER } from "./field-manager";
 import { DEFAULT_CONCURRENCY, mapConcurrent } from "./concurrency";
+import { loadKubeConfig } from "./kubeconfig";
 import type {
   ApiResourceInfo,
   ClientProvenance,
@@ -56,6 +57,8 @@ import type {
   RequestContextLike,
   ResourceSelector,
   ResponseContextLike,
+  KubeconfigContextInfo,
+  KubeconfigView,
 } from "./types";
 
 type ClientNode = typeof import("@kubernetes/client-node");
@@ -103,16 +106,64 @@ export async function isK8sClientAvailable(): Promise<boolean> {
 export async function readAmbientContext(
   options: Pick<K8sClientOptions, "kubeconfig" | "kubeconfigPath"> = {},
 ): Promise<string | undefined> {
-  const mod = await loadClientNode();
-  const kc = new mod.KubeConfig();
   try {
-    if (options.kubeconfig !== undefined) kc.loadFromString(options.kubeconfig);
-    else if (options.kubeconfigPath !== undefined) kc.loadFromFile(options.kubeconfigPath);
-    else kc.loadFromDefault();
+    const { kc } = loadKubeConfig(await loadClientNode(), options);
+    return kc.getCurrentContext() || undefined;
   } catch {
     return undefined;
   }
-  return kc.getCurrentContext() || undefined;
+}
+
+/**
+ * The merged kubeconfig's contexts and their apiservers, without building a
+ * client (chant #1630).
+ *
+ * A lens showing an operator which cluster the k8s half is being read from
+ * needs an address out of a file, not a client about to talk to one. Going
+ * through `createK8sClient` for that answer refuses in two places it should
+ * not: an auth plugin outside the exec allowlist throws, so a cluster whose
+ * address is sitting right there in the kubeconfig — and which kubectl reads
+ * without complaint — reports as no target at all; and a context resolving to
+ * no cluster throws where the caller wants "nothing to report". Both refusals
+ * are right for a client that is about to send a request and wrong for a
+ * config read. Enumerating also takes one client per context, and enumerating
+ * is exactly what a lens does.
+ *
+ * So: no credential touched, no exec plugin run, no request issued. Every
+ * failure — no kubeconfig, an unreadable one, `@kubernetes/client-node` not
+ * installed — is an empty result rather than a throw, because a lens on an
+ * aws-only project running on a machine that has never seen Kubernetes has
+ * nothing to report and nothing to fail about.
+ *
+ * `server` per context rather than a separate cluster map: joining the two is
+ * what every caller does anyway.
+ */
+export async function readKubeconfigView(
+  options: Pick<K8sClientOptions, "kubeconfig" | "kubeconfigPath"> = {},
+): Promise<KubeconfigView> {
+  let kc;
+  try {
+    ({ kc } = loadKubeConfig(await loadClientNode(), options));
+  } catch {
+    return { contexts: [] };
+  }
+  try {
+    const servers = new Map<string, string | undefined>();
+    for (const cluster of kc.getClusters()) servers.set(cluster.name, cluster.server || undefined);
+    const contexts: KubeconfigContextInfo[] = kc.getContexts().map((context) => {
+      const server = servers.get(context.cluster);
+      return {
+        name: context.name,
+        cluster: context.cluster ?? "",
+        ...(context.user ? { user: context.user } : {}),
+        ...(context.namespace ? { namespace: context.namespace } : {}),
+        ...(server ? { server } : {}),
+      };
+    });
+    return { contexts, ...(kc.getCurrentContext() ? { currentContext: kc.getCurrentContext() } : {}) };
+  } catch {
+    return { contexts: [] };
+  }
 }
 
 /** Options for a single object read. */
@@ -268,18 +319,10 @@ interface RootDiscovery {
 export async function createK8sClient(options: K8sClientOptions = {}): Promise<K8sClient> {
   const mod = await loadClientNode();
 
-  const kc = new mod.KubeConfig();
-  let kubeconfigSource: ClientProvenance["kubeconfigSource"];
-  if (options.kubeconfig !== undefined) {
-    kc.loadFromString(options.kubeconfig);
-    kubeconfigSource = "explicit-string";
-  } else if (options.kubeconfigPath !== undefined) {
-    kc.loadFromFile(options.kubeconfigPath);
-    kubeconfigSource = "explicit-path";
-  } else {
-    kc.loadFromDefault();
-    kubeconfigSource = kc.getCurrentContext() === "inCluster" ? "in-cluster" : "default";
-  }
+  // kubectl's merge semantics, not client-node's (#1630): a KUBECONFIG list
+  // with overlapping names resolves first-wins instead of throwing, and
+  // current-context comes from the first file that sets one.
+  const { kc, source: kubeconfigSource } = loadKubeConfig(mod, options);
 
   if (options.context !== undefined) {
     if (!kc.getContextObject(options.context)) {

package/src/index.ts

@@ -15,6 +15,7 @@
 export {
   createK8sClient,
   readAmbientContext,
+  readKubeconfigView,
   loadClientNode,
   isK8sClientAvailable,
   apiVersionPath,
@@ -85,6 +86,8 @@ export type {
   ClientProvenance,
   CredentialPath,
   K8sClientOptions,
+  KubeconfigContextInfo,
+  KubeconfigView,
   K8sObject,
   ObjectRef,
   RequestContextLike,

package/src/kubeconfig.test.ts

@@ -0,0 +1,231 @@
+/**
+ * The kubeconfig read surface and kubectl's merge semantics — chant #1630.
+ *
+ * Every case writes its own kubeconfig files into a temp directory and points
+ * `KUBECONFIG` at them, so nothing reads the developer's real config and
+ * nothing contacts a cluster: these are file reads, and the point of the
+ * surface under test is that they stay file reads.
+ *
+ * Where kubectl is on PATH, `kubectl config view` is asked the same questions
+ * and its answers are asserted to match — the merge rules are only worth
+ * having because they are kubectl's, and a hardcoded expectation cannot prove
+ * that. Skipped (with the expectations still asserted on their own) where it
+ * is not installed.
+ */
+
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { delimiter, join } from "node:path";
+import { readAmbientContext, readKubeconfigView, createK8sClient } from "./client";
+import { fakeKubeconfig, fakeRequestLayer } from "./testing";
+
+/** A kubeconfig naming one cluster, one user and one context, with a chosen
+ * current-context — the material both merge divergences are reproduced with. */
+function configYaml(opts: { cluster: string; server: string; context: string; user?: string }): string {
+  const user = opts.user ?? `user-${opts.context}`;
+  return [
+    "apiVersion: v1",
+    "kind: Config",
+    `current-context: ${opts.context}`,
+    "clusters:",
+    `  - name: ${opts.cluster}`,
+    "    cluster:",
+    `      server: ${opts.server}`,
+    "      insecure-skip-tls-verify: true",
+    "users:",
+    `  - name: ${user}`,
+    "    user:",
+    '      token: "test-token"',
+    "contexts:",
+    `  - name: ${opts.context}`,
+    "    context:",
+    `      cluster: ${opts.cluster}`,
+    `      user: ${user}`,
+    "",
+  ].join("\n");
+}
+
+const kubectlAvailable = spawnSync("kubectl", ["version", "--client=true"], { encoding: "utf8" }).status === 0;
+
+/** `kubectl config view` against a KUBECONFIG list, or undefined without kubectl. */
+function kubectlView(kubeconfig: string, args: string[]): string | undefined {
+  if (!kubectlAvailable) return undefined;
+  const r = spawnSync("kubectl", ["config", ...args], {
+    encoding: "utf8",
+    env: { ...process.env, KUBECONFIG: kubeconfig },
+  });
+  return r.status === 0 ? r.stdout.trim() : undefined;
+}
+
+let dir: string;
+let savedKubeconfig: string | undefined;
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "chant-kubeconfig-"));
+  savedKubeconfig = process.env.KUBECONFIG;
+});
+
+afterEach(() => {
+  if (savedKubeconfig === undefined) delete process.env.KUBECONFIG;
+  else process.env.KUBECONFIG = savedKubeconfig;
+  rmSync(dir, { recursive: true, force: true });
+});
+
+function write(name: string, content: string): string {
+  const path = join(dir, name);
+  writeFileSync(path, content);
+  return path;
+}
+
+describe("readKubeconfigView (#1630)", () => {
+  test("returns each context joined to its apiserver, plus the current context", async () => {
+    const view = await readKubeconfigView({
+      kubeconfig: fakeKubeconfig({
+        contexts: [
+          { name: "ctx-a", cluster: "cluster-a", user: "user-a", namespace: "team" },
+          { name: "ctx-b", cluster: "cluster-b", user: "user-b" },
+        ],
+        currentContext: "ctx-b",
+        server: "https://cluster.test:6443",
+      }),
+    });
+
+    expect(view.currentContext).toBe("ctx-b");
+    expect(view.contexts).toEqual([
+      { name: "ctx-a", cluster: "cluster-a", user: "user-a", namespace: "team", server: "https://cluster.test:6443" },
+      { name: "ctx-b", cluster: "cluster-b", user: "user-b", server: "https://cluster.test:6443" },
+    ]);
+  });
+
+  test("reads an address behind an auth plugin the client would refuse to run", async () => {
+    // `createK8sClient` throws ExecCredentialNotAllowedError here, correctly —
+    // it is about to run the plugin. Reading the address out of the file runs
+    // nothing, so refusing would report "no target" for a cluster kubectl
+    // reads without complaint.
+    const view = await readKubeconfigView({
+      kubeconfig: fakeKubeconfig({ exec: { command: "harvest-credentials" }, server: "https://plugin.test:6443" }),
+    });
+    expect(view.contexts).toHaveLength(1);
+    expect(view.contexts[0].server).toBe("https://plugin.test:6443");
+  });
+
+  test("a context resolving to no cluster is reported without a server, not as a failure", async () => {
+    const view = await readKubeconfigView({
+      kubeconfig: [
+        "apiVersion: v1",
+        "kind: Config",
+        "current-context: dangling",
+        "clusters: []",
+        "users: []",
+        "contexts:",
+        "  - name: dangling",
+        "    context:",
+        "      cluster: gone",
+        "      user: nobody",
+        "",
+      ].join("\n"),
+    });
+    expect(view.currentContext).toBe("dangling");
+    expect(view.contexts).toEqual([{ name: "dangling", cluster: "gone", user: "nobody" }]);
+  });
+
+  test("an unreadable or absent kubeconfig is an empty view, never a throw", async () => {
+    await expect(readKubeconfigView({ kubeconfigPath: join(dir, "nope.yaml") })).resolves.toEqual({ contexts: [] });
+    await expect(readKubeconfigView({ kubeconfig: "%%% not yaml : [" })).resolves.toEqual({ contexts: [] });
+    // A machine that has never seen Kubernetes: KUBECONFIG points at nothing
+    // that exists, and a lens over an aws-only project still renders.
+    process.env.KUBECONFIG = [join(dir, "a.yaml"), join(dir, "b.yaml")].join(delimiter);
+    await expect(readKubeconfigView()).resolves.toEqual({ contexts: [] });
+  });
+});
+
+describe("KUBECONFIG merge semantics match kubectl (#1630)", () => {
+  test("overlapping names resolve first-wins instead of failing", async () => {
+    // client-node's `mergeConfig` throws `Duplicate cluster: shared` here. A
+    // team-wide file plus a personal one both naming `dev` is the ordinary way
+    // people get into this, and kubectl keeps the first.
+    const a = write("a.yaml", configYaml({ cluster: "shared", server: "https://from-a:6443", context: "ctx-a" }));
+    const b = write("b.yaml", configYaml({ cluster: "shared", server: "https://from-b:6443", context: "ctx-b" }));
+    const kubeconfig = [a, b].join(delimiter);
+    process.env.KUBECONFIG = kubeconfig;
+
+    const view = await readKubeconfigView();
+    expect(view.contexts.map((c) => c.name)).toEqual(["ctx-a", "ctx-b"]);
+    // Both contexts name the cluster `shared`, and the first file's server is
+    // the one `shared` means.
+    expect(view.contexts.map((c) => c.server)).toEqual(["https://from-a:6443", "https://from-a:6443"]);
+
+    const kubectlServer = kubectlView(kubeconfig, [
+      "view",
+      "-o",
+      'jsonpath={.clusters[?(@.name=="shared")].cluster.server}',
+    ]);
+    if (kubectlServer !== undefined) expect(kubectlServer).toBe("https://from-a:6443");
+    const kubectlContexts = kubectlView(kubeconfig, ["view", "-o", 'jsonpath={range .contexts[*]}{.name}{"\\n"}{end}']);
+    if (kubectlContexts !== undefined) expect(kubectlContexts.split("\n")).toEqual(["ctx-a", "ctx-b"]);
+  });
+
+  test("readAmbientContext answers for a duplicate-name list instead of reporting no kubeconfig", async () => {
+    // The load lives inside readAmbientContext's try/catch, so client-node's
+    // throw came out as `undefined` — chant read these users as having no
+    // kubeconfig at all when they have a perfectly good one.
+    const a = write("a.yaml", configYaml({ cluster: "shared", server: "https://from-a:6443", context: "ctx-a" }));
+    const b = write("b.yaml", configYaml({ cluster: "shared", server: "https://from-b:6443", context: "ctx-b" }));
+    process.env.KUBECONFIG = [a, b].join(delimiter);
+
+    await expect(readAmbientContext()).resolves.toBe("ctx-a");
+  });
+
+  test("current-context comes from the FIRST file that sets one, not the last", async () => {
+    const a = write("a.yaml", configYaml({ cluster: "cluster-a", server: "https://from-a:6443", context: "ctx-a" }));
+    const c = write("c.yaml", configYaml({ cluster: "cluster-c", server: "https://from-c:6443", context: "ctx-c" }));
+    const kubeconfig = [a, c].join(delimiter);
+    process.env.KUBECONFIG = kubeconfig;
+
+    // client-node's mergeConfig overwrites currentContext from each later
+    // file, so the bare loadFromDefault() answered `ctx-c` — the opposite of
+    // every `kubectl get` the operator ran to check.
+    await expect(readAmbientContext()).resolves.toBe("ctx-a");
+    expect((await readKubeconfigView()).currentContext).toBe("ctx-a");
+
+    const kubectlCurrent = kubectlView(kubeconfig, ["current-context"]);
+    if (kubectlCurrent !== undefined) expect(kubectlCurrent).toBe("ctx-a");
+  });
+
+  test("a file the list names but cannot be read is skipped, not fatal", async () => {
+    const a = write("a.yaml", configYaml({ cluster: "cluster-a", server: "https://from-a:6443", context: "ctx-a" }));
+    process.env.KUBECONFIG = [join(dir, "missing.yaml"), a].join(delimiter);
+
+    const view = await readKubeconfigView();
+    expect(view.currentContext).toBe("ctx-a");
+    expect(view.contexts.map((c) => c.server)).toEqual(["https://from-a:6443"]);
+  });
+
+  test("createK8sClient binds the cluster kubectl would bind", async () => {
+    const a = write("a.yaml", configYaml({ cluster: "shared", server: "https://from-a:6443", context: "ctx-a" }));
+    const b = write("b.yaml", configYaml({ cluster: "shared", server: "https://from-b:6443", context: "ctx-b" }));
+    process.env.KUBECONFIG = [a, b].join(delimiter);
+
+    // Constructing the client issues no request; the layer is here so nothing
+    // could reach a network if it tried.
+    const client = await createK8sClient({ requestLayer: fakeRequestLayer(() => ({ body: {} })) });
+    expect(client.provenance.server).toBe("https://from-a:6443");
+    expect(client.provenance.context).toBe("ctx-a");
+    expect(client.provenance.kubeconfigSource).toBe("default");
+  });
+
+  test("an explicit kubeconfig string or path is untouched by the list", async () => {
+    const a = write("a.yaml", configYaml({ cluster: "cluster-a", server: "https://from-a:6443", context: "ctx-a" }));
+    const explicit = write("explicit.yaml", configYaml({ cluster: "cluster-x", server: "https://from-x:6443", context: "ctx-x" }));
+    process.env.KUBECONFIG = a;
+
+    expect((await readKubeconfigView({ kubeconfigPath: explicit })).currentContext).toBe("ctx-x");
+    await expect(readAmbientContext({ kubeconfigPath: explicit })).resolves.toBe("ctx-x");
+    expect(
+      (await readKubeconfigView({ kubeconfig: configYaml({ cluster: "c", server: "https://s:6443", context: "ctx-lit" }) }))
+        .currentContext,
+    ).toBe("ctx-lit");
+  });
+});

package/src/kubeconfig.ts

@@ -0,0 +1,136 @@
+/**
+ * Loading the kubeconfig the way kubectl loads it — chant #1630.
+ *
+ * `@kubernetes/client-node` parses a kubeconfig faithfully and merges a
+ * `KUBECONFIG` path list on two rules that are not kubectl's. Both are
+ * reproducible with two files and no cluster (checked against client-node
+ * 1.4.0), and both make chant bind a different cluster than the `kubectl get`
+ * the operator ran to check:
+ *
+ * - **Duplicate names throw.** `mergeConfig` funnels every entry through
+ *   `addCluster`/`addUser`/`addContext`, each of which throws `Duplicate
+ *   cluster: <name>` on a name it already holds. kubectl's documented rule is
+ *   the opposite — keep the first, ignore later ones, never fail. Overlapping
+ *   names across a list are ordinary: a team-wide file plus a personal one
+ *   both naming `dev` is the usual way people get there. Today that throw is
+ *   swallowed by `readAmbientContext`'s try/catch, so chant reads those users
+ *   as having no kubeconfig at all.
+ * - **current-context is last-wins.** `loadFromDefault(opts,
+ *   contextFromStartingConfig)` defaults the second argument to `false`, and
+ *   `mergeConfig` then overwrites `currentContext` from each later file.
+ *   kubectl takes the FIRST file that sets one.
+ *
+ * So the multi-file case is merged here instead: one `KubeConfig` per file
+ * (which is also what keeps each file's relative certificate paths resolved
+ * against its own directory), then a first-wins union by name and the first
+ * `current-context` that appears. Everything else — the single-file path, the
+ * `~/.kube/config` fallback, in-cluster credentials — stays client-node's
+ * `loadFromDefault`, with the one-word fix that gives it kubectl's
+ * current-context.
+ *
+ * A file in the list that cannot be read is skipped rather than fatal, which
+ * is also kubectl's rule: a stale entry in a shared `KUBECONFIG` export must
+ * not take the whole config down with it.
+ */
+
+import { delimiter } from "node:path";
+import type * as k8s from "@kubernetes/client-node";
+
+type ClientNode = typeof import("@kubernetes/client-node");
+
+/** Where the loaded kubeconfig came from, for {@link ClientProvenance}. */
+export type KubeconfigSource = "explicit-string" | "explicit-path" | "default" | "in-cluster";
+
+export interface LoadedKubeConfig {
+  kc: k8s.KubeConfig;
+  source: KubeconfigSource;
+}
+
+/** The `KUBECONFIG` entries, in order. Empty when the variable is unset. */
+function kubeconfigPathList(): string[] {
+  const raw = process.env.KUBECONFIG;
+  if (!raw) return [];
+  return raw.split(delimiter).filter((f) => f.length > 0);
+}
+
+/**
+ * Merge a `KUBECONFIG` path list on kubectl's rules: first-wins for every
+ * cluster/user/context name, and the first `current-context` that any file
+ * sets. Unreadable files are skipped.
+ */
+function mergeKubeconfigFiles(mod: ClientNode, files: readonly string[]): k8s.KubeConfig {
+  const clusters: k8s.Cluster[] = [];
+  const users: k8s.User[] = [];
+  const contexts: k8s.Context[] = [];
+  const seenClusters = new Set<string>();
+  const seenUsers = new Set<string>();
+  const seenContexts = new Set<string>();
+  let currentContext: string | undefined;
+
+  for (const file of files) {
+    const part = new mod.KubeConfig();
+    try {
+      part.loadFromFile(file);
+    } catch {
+      continue;
+    }
+    for (const cluster of part.getClusters()) {
+      if (seenClusters.has(cluster.name)) continue;
+      seenClusters.add(cluster.name);
+      clusters.push(cluster);
+    }
+    for (const user of part.getUsers()) {
+      if (seenUsers.has(user.name)) continue;
+      seenUsers.add(user.name);
+      users.push(user);
+    }
+    for (const context of part.getContexts()) {
+      if (seenContexts.has(context.name)) continue;
+      seenContexts.add(context.name);
+      contexts.push(context);
+    }
+    if (currentContext === undefined) {
+      const current = part.getCurrentContext();
+      if (current) currentContext = current;
+    }
+  }
+
+  const kc = new mod.KubeConfig();
+  kc.loadFromOptions({ clusters, users, contexts, currentContext });
+  return kc;
+}
+
+/**
+ * The kubeconfig this invocation should read, by the same precedence every
+ * entry point in this package uses: an explicit literal, then an explicit
+ * path, then the ambient default (`KUBECONFIG`, `~/.kube/config`, in-cluster).
+ *
+ * Throws whatever client-node throws for an explicit string or path — those
+ * are the caller naming a file, and a caller who names an unreadable one wants
+ * to hear about it. The ambient path never throws for a duplicate name.
+ */
+export function loadKubeConfig(
+  mod: ClientNode,
+  options: { kubeconfig?: string; kubeconfigPath?: string } = {},
+): LoadedKubeConfig {
+  if (options.kubeconfig !== undefined) {
+    const kc = new mod.KubeConfig();
+    kc.loadFromString(options.kubeconfig);
+    return { kc, source: "explicit-string" };
+  }
+  if (options.kubeconfigPath !== undefined) {
+    const kc = new mod.KubeConfig();
+    kc.loadFromFile(options.kubeconfigPath);
+    return { kc, source: "explicit-path" };
+  }
+
+  const files = kubeconfigPathList();
+  if (files.length > 1) return { kc: mergeKubeconfigFiles(mod, files), source: "default" };
+
+  const kc = new mod.KubeConfig();
+  // `true` is the whole current-context fix for the single-file and
+  // `~/.kube/config` paths: it tells client-node to keep the starting config's
+  // context rather than letting a later merge overwrite it.
+  kc.loadFromDefault(undefined, true);
+  return { kc, source: kc.getCurrentContext() === "inCluster" ? "in-cluster" : "default" };
+}

package/src/types.ts

@@ -95,6 +95,27 @@ export interface ClientProvenance {
   kubeconfigSource: "explicit-string" | "explicit-path" | "default" | "in-cluster";
 }
 
+/**
+ * One context of the merged kubeconfig, joined to the apiserver its cluster
+ * resolves to (chant #1630). Plain data read out of a file: no credential is
+ * touched, no exec plugin runs, no request is issued.
+ */
+export interface KubeconfigContextInfo {
+  name: string;
+  /** Cluster name the context names. Empty when the context declares none. */
+  cluster: string;
+  user?: string;
+  namespace?: string;
+  /** The apiserver URL the named cluster resolves to, when the config has one. */
+  server?: string;
+}
+
+/** What {@link import("./client").readKubeconfigView} returns. */
+export interface KubeconfigView {
+  contexts: KubeconfigContextInfo[];
+  currentContext?: string;
+}
+
 /** Options for {@link import("./client").createK8sClient}. */
 export interface K8sClientOptions {
   /**