@intentius/chant-lexicon-fly 0.124.46 → 0.124.48

package/README.md

@@ -111,7 +111,7 @@ The agent-facing entry point is the `chant-fly` skill: a short operational playb
 | ------------------------------------------------------------------------------------------ | ------------------------------------- |
 | [@intentius/chant](https://www.npmjs.com/package/@intentius/chant)                         | Core type system, CLI, build pipeline |
 | [@intentius/chant-lexicon-aws](https://www.npmjs.com/package/@intentius/chant-lexicon-aws) | AWS CloudFormation lexicon            |
-| [@intentius/chant-lexicon-gcp](https://www.npmjs.com/package/@intentius/chant-lexicon-gcp) | GCP Deployment Manager lexicon        |
+| [@intentius/chant-lexicon-gcp](https://www.npmjs.com/package/@intentius/chant-lexicon-gcp) | GCP Config Connector lexicon          |
 
 ## License
 

package/dist/export-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAIL,KAAK,OAAO,EAEb,MAAM,2BAA2B,CAAC;AA8CnC,wBAAsB,eAAe,CACnC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,EACD,IAAI,GAAE,OAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,gBAAgB,CAAC,CA2C3B"}
+{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAIL,KAAK,OAAO,EAEb,MAAM,2BAA2B,CAAC;AA8CnC,wBAAsB,eAAe,CACnC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,EACD,IAAI,GAAE,OAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAoD3B"}

package/dist/export-resources.js

@@ -61,7 +61,7 @@ export async function exportResources(options, http = defaultFlyHttp(), signal)
         loggedBoundary = true;
         console.warn("[fly] apps carry no per-resource ownership marker — ownership is inferred at the app boundary (#741/#743); only apps with a chant-managed machine are exported under --owned");
     };
-    const resources = [];
+    const parts = [];
     for (const app of apps) {
         const appRes = await http("GET", `${ctx.base}/v1/apps/${encodeURIComponent(app)}`, undefined, undefined, signal);
         const appBody = appRes.status === 200 ? parseJson(appRes.text) : undefined;
@@ -75,7 +75,16 @@ export async function exportResources(options, http = defaultFlyHttp(), signal)
             owned: options.owned,
             onBoundaryInference,
         });
-        resources.push(...ir.resources);
+        parts.push(ir);
     }
-    return { resources, parameters: [] };
+    // Each app's export re-parses its own bundle; together they re-parse the
+    // whole export, so embedded collector configs reach the otel importer (#3373).
+    return {
+        resources: parts.flatMap((p) => p.resources),
+        parameters: [],
+        reparse: (context) => ({
+            resources: parts.flatMap((p) => (p.reparse ? p.reparse(context) : p).resources),
+            parameters: [],
+        }),
+    };
 }

package/dist/import/embedded.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Where a Fly Machine embeds another lexicon's content, for `chant import`
+ * (#3373).
+ *
+ * A machine's `config.files[]` entry with a `raw_value` is a file written into
+ * the machine, base64 in flaps. The parser decodes each one and offers the text
+ * to core's embedded-content resolver, as k8s offers a ConfigMap value
+ * (#2962). `FlyOtelCollector` writes its collector config this way, at the otel
+ * lexicon's `COLLECTOR_CONFIG_PATH`, so a live or file import of that machine
+ * gives the same otel source `chant import config.yaml` gives.
+ *
+ * Which lexicon imports the content is decided by core at run time; the hint
+ * below only names the owner a warning suggests when none is installed.
+ */
+import type { EmbeddedContentResolver, EmbeddedReference } from "@intentius/chant/import/embedded";
+/** The UTF-8 text a base64 `raw_value` holds, or undefined when it is not base64 of text. */
+export declare function decodeRawValue(raw: string): string | undefined;
+/**
+ * The marker the parser leaves on a file whose `raw_value` an owner imports:
+ * the generator renders it as the base64 of the reference's text.
+ */
+export interface EmbeddedRawValue {
+    readonly $base64: EmbeddedReference;
+}
+export declare function isEmbeddedRawValue(v: unknown): v is EmbeddedRawValue;
+/**
+ * Offer each `config.files[].raw_value` of one machine to `embedded`, replacing
+ * the value an owner imports with an {@link EmbeddedRawValue}. `properties` is
+ * the machine's IR properties, changed in place with fresh copies on the way
+ * down.
+ */
+export declare function delegateEmbedded(machineName: string, properties: Record<string, unknown>, embedded: EmbeddedContentResolver): void;
+//# sourceMappingURL=embedded.d.ts.map

package/dist/import/embedded.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embedded.d.ts","sourceRoot":"","sources":["../../src/import/embedded.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAmB,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAQpH,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM9D;AAUD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACrC;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,QAAQ,EAAE,uBAAuB,GAChC,IAAI,CA2BN"}

package/dist/import/embedded.js

@@ -0,0 +1,79 @@
+/**
+ * Where a Fly Machine embeds another lexicon's content, for `chant import`
+ * (#3373).
+ *
+ * A machine's `config.files[]` entry with a `raw_value` is a file written into
+ * the machine, base64 in flaps. The parser decodes each one and offers the text
+ * to core's embedded-content resolver, as k8s offers a ConfigMap value
+ * (#2962). `FlyOtelCollector` writes its collector config this way, at the otel
+ * lexicon's `COLLECTOR_CONFIG_PATH`, so a live or file import of that machine
+ * gives the same otel source `chant import config.yaml` gives.
+ *
+ * Which lexicon imports the content is decided by core at run time; the hint
+ * below only names the owner a warning suggests when none is installed.
+ */
+import { embeddedDocument } from "@intentius/chant/import/embedded";
+import { COLLECTOR_CONFIG_PATH } from "@intentius/chant-lexicon-otel";
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** The UTF-8 text a base64 `raw_value` holds, or undefined when it is not base64 of text. */
+export function decodeRawValue(raw) {
+    if (!/^[A-Za-z0-9+/\s]*={0,2}\s*$/.test(raw))
+        return undefined;
+    const bytes = Buffer.from(raw, "base64");
+    const text = bytes.toString("utf8");
+    // A round trip that changes the bytes means the file is not UTF-8 text.
+    return Buffer.from(text, "utf8").equals(bytes) ? text : undefined;
+}
+function hintFor(guestPath, doc) {
+    if (guestPath === COLLECTOR_CONFIG_PATH)
+        return { lexicon: "otel", what: "an OpenTelemetry Collector config" };
+    if (isRecord(doc) && isRecord(doc.service) && isRecord(doc.service.pipelines)) {
+        return { lexicon: "otel", what: "an OpenTelemetry Collector config" };
+    }
+    return undefined;
+}
+export function isEmbeddedRawValue(v) {
+    return isRecord(v) && isRecord(v.$base64);
+}
+/**
+ * Offer each `config.files[].raw_value` of one machine to `embedded`, replacing
+ * the value an owner imports with an {@link EmbeddedRawValue}. `properties` is
+ * the machine's IR properties, changed in place with fresh copies on the way
+ * down.
+ */
+export function delegateEmbedded(machineName, properties, embedded) {
+    const config = properties.config;
+    if (!isRecord(config) || !Array.isArray(config.files))
+        return;
+    const files = config.files;
+    let changed = false;
+    const next = files.map((file, i) => {
+        if (!isRecord(file) || typeof file.raw_value !== "string")
+            return file;
+        const text = decodeRawValue(file.raw_value);
+        if (text === undefined)
+            return file;
+        const doc = embeddedDocument(text);
+        if (!isRecord(doc))
+            return file;
+        const guestPath = typeof file.guest_path === "string" ? file.guest_path : `files[${i}]`;
+        const base = guestPath.split("/").pop().replace(/\.[^.]*$/, "");
+        const ref = embedded.resolve({
+            host: "fly",
+            hostType: "Fly::Machines::Machine",
+            location: `Machine ${machineName} file ${guestPath}`,
+            directory: files.length === 1 ? machineName : `${machineName}-${base}`,
+            text,
+            document: doc,
+            expectedOwner: hintFor(guestPath, doc),
+        });
+        if (!ref)
+            return file;
+        changed = true;
+        return { ...file, raw_value: { $base64: ref } };
+    });
+    if (changed)
+        properties.config = { ...config, files: next };
+}

package/dist/import/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/import/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAuFjE,qBAAa,YAAa,YAAW,mBAAmB;IACtD,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,aAAa,EAAE,CAwBxC;CACF"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/import/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AA+FjE,qBAAa,YAAa,YAAW,mBAAmB;IACtD,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,aAAa,EAAE,CAqCxC;CACF"}

package/dist/import/generator.js

@@ -13,6 +13,8 @@
  * the same authoring surface `chant init` scaffolds and the serializer walks back
  * to the identical flaps body.
  */
+import { EmbeddedImportScope, isEmbeddedReference, renderEmbeddedReference } from "@intentius/chant/import/embedded";
+import { isEmbeddedRawValue } from "./embedded.js";
 /**
  * `<OwnerClass> → { <field>: { kind, cls } }` for every field whose declared
  * type is a fly property declarable (a class, an array of one, or a
@@ -95,20 +97,36 @@ export class FlyGenerator {
     generate(ir) {
         const imports = new Set();
         const bodyLines = [];
+        // Names an embedded reference's imports must not take: the module's own
+        // declarations and every fly class it could import.
+        const classNames = new Set(["App", "Machine", ...Object.keys(NESTED_DECLARABLES)]);
+        for (const fields of Object.values(NESTED_DECLARABLES))
+            for (const n of Object.values(fields))
+                classNames.add(n.cls);
+        for (const r of ir.resources) {
+            const parts = r.type.split("::");
+            classNames.add(parts.length >= 3 ? parts[2] : r.type);
+        }
+        const ctx = {
+            imports,
+            scope: new EmbeddedImportScope("", [...classNames, "Buffer", ...ir.resources.map((r) => camelCase(r.logicalId))]),
+        };
         for (const resource of ir.resources) {
             const parts = resource.type.split("::");
             const className = parts.length >= 3 ? parts[2] : resource.type;
             imports.add(className);
             const varName = camelCase(resource.logicalId);
-            const props = formatProps(resource.properties, 0, className, imports);
+            const props = formatProps(resource.properties, 0, className, ctx);
             bodyLines.push(`export const ${varName} = new ${className}(${props});`);
             bodyLines.push("");
         }
         const lines = [];
         if (imports.size > 0) {
             lines.push(`import { ${[...imports].sort().join(", ")} } from "@intentius/chant-lexicon-fly";`);
-            lines.push("");
         }
+        lines.push(...ctx.scope.lines());
+        if (lines.length > 0)
+            lines.push("");
         lines.push(...bodyLines);
         return [{ path: "main.ts", content: lines.join("\n") + "\n" }];
     }
@@ -123,7 +141,7 @@ function camelCase(str) {
  * type is a nested declarable are wrapped in their constructor; everything else
  * is emitted as a plain literal.
  */
-function formatProps(props, indent, ownerClass, imports) {
+function formatProps(props, indent, ownerClass, ctx) {
     const entries = Object.entries(props);
     if (entries.length === 0)
         return "{}";
@@ -133,20 +151,20 @@ function formatProps(props, indent, ownerClass, imports) {
     const lines = entries.map(([key, value]) => {
         const spec = nested?.[key];
         const rendered = spec !== undefined
-            ? formatNested(value, indent + 1, spec, imports)
-            : formatValue(value, indent + 1);
+            ? formatNested(value, indent + 1, spec, ctx)
+            : formatValue(value, indent + 1, ctx);
         return `${pad}${key}: ${rendered},`;
     });
     return `{\n${lines.join("\n")}\n${closePad}}`;
 }
 /** Wrap a nested-declarable value in its constructor per the field's kind. */
-function formatNested(value, indent, spec, imports) {
+function formatNested(value, indent, spec, ctx) {
     const construct = (obj, at) => {
         if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
-            return formatValue(obj, at);
+            return formatValue(obj, at, ctx);
         }
-        imports.add(spec.cls);
-        return `new ${spec.cls}(${formatProps(obj, at, spec.cls, imports)})`;
+        ctx.imports.add(spec.cls);
+        return `new ${spec.cls}(${formatProps(obj, at, spec.cls, ctx)})`;
     };
     if (spec.kind === "single") {
         return construct(value, indent);
@@ -161,7 +179,7 @@ function formatNested(value, indent, spec, imports) {
     }
     // record: a plain object whose values are wrapped in the constructor.
     if (!value || typeof value !== "object" || Array.isArray(value)) {
-        return formatValue(value, indent);
+        return formatValue(value, indent, ctx);
     }
     const record = value;
     const recKeys = Object.entries(record);
@@ -172,9 +190,16 @@ function formatNested(value, indent, spec, imports) {
     const items = recKeys.map(([k, v]) => `${pad}${JSON.stringify(k)}: ${construct(v, indent + 1)},`);
     return `{\n${items.join("\n")}\n${closePad}}`;
 }
-function formatValue(value, indent) {
+function formatValue(value, indent, ctx) {
     if (value === null || value === undefined)
         return "undefined";
+    // A machine file another lexicon imported (#3373): flaps wants the file's
+    // text base64-encoded, so the reference's text is encoded at build time.
+    if (isEmbeddedRawValue(value)) {
+        return `Buffer.from(${renderEmbeddedReference(value.$base64, ctx.scope, indent * 2)}, "utf8").toString("base64")`;
+    }
+    if (isEmbeddedReference(value))
+        return renderEmbeddedReference(value, ctx.scope, indent * 2);
     if (typeof value === "string")
         return JSON.stringify(value);
     if (typeof value === "number" || typeof value === "boolean")
@@ -184,22 +209,22 @@ function formatValue(value, indent) {
             return "[]";
         const pad = "  ".repeat(indent + 1);
         const closePad = "  ".repeat(indent);
-        const items = value.map((v) => `${pad}${formatValue(v, indent + 1)},`);
+        const items = value.map((v) => `${pad}${formatValue(v, indent + 1, ctx)},`);
         return `[\n${items.join("\n")}\n${closePad}]`;
     }
     if (typeof value === "object") {
-        return formatPlainObject(value, indent);
+        return formatPlainObject(value, indent, ctx);
     }
     return String(value);
 }
 /** A plain object literal (no constructor wrapping) — for scalar-valued maps like env/metadata. */
-function formatPlainObject(obj, indent) {
+function formatPlainObject(obj, indent, ctx) {
     const entries = Object.entries(obj);
     if (entries.length === 0)
         return "{}";
     const pad = "  ".repeat(indent + 1);
     const closePad = "  ".repeat(indent);
-    const lines = entries.map(([key, value]) => `${pad}${objectKey(key)}: ${formatValue(value, indent + 1)},`);
+    const lines = entries.map(([key, value]) => `${pad}${objectKey(key)}: ${formatValue(value, indent + 1, ctx)},`);
     return `{\n${lines.join("\n")}\n${closePad}}`;
 }
 /** Emit a bare identifier key when it is a valid one, else a quoted key. */

package/dist/import/live-export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-export.d.ts","sourceRoot":"","sources":["../../src/import/live-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAW7E,sGAAsG;AACtG,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIlG;AAED,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACxC,QAAQ,EAAE,YAAY,EAAE,EACxB,IAAI,GAAE;IACJ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B,GACL,gBAAgB,CAqClB"}
+{"version":3,"file":"live-export.d.ts","sourceRoot":"","sources":["../../src/import/live-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEnF,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAW7E,sGAAsG;AACtG,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIlG;AAED,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACxC,QAAQ,EAAE,YAAY,EAAE,EACxB,IAAI,GAAE;IACJ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B,GACL,gBAAgB,CA6BlB"}

package/dist/import/live-export.js

@@ -68,8 +68,14 @@ export function buildExportFromApp(app, machines, opts = {}) {
     const cleanMachines = keptMachines.map((m) => stripMachineServerFields(m));
     const cleanApp = keptApp ? stripAppServerFields(keptApp) : keptApp;
     const bundle = { ...(cleanApp ?? {}), machines: cleanMachines };
-    const ir = new FlyParser().parse(JSON.stringify(bundle));
-    const selector = opts.selector;
+    const content = JSON.stringify(bundle);
+    // `reparse(context)` parses the same bundle again with a `ParseContext`, so
+    // `chant import --from` hands a collector config in a machine file to the
+    // otel importer, as file import does (#3373).
+    const parse = (context) => select(new FlyParser().parse(content, context), opts.selector);
+    return { ...parse(), reparse: (context) => parse(context) };
+}
+function select(ir, selector) {
     if (!selector || (selector.type === undefined && selector.name === undefined)) {
         return ir;
     }

package/dist/import/parser.d.ts

@@ -18,7 +18,7 @@
  * shape. `logicalId` is the app/machine name (the generator camelCases it into a
  * variable).
  */
-import type { TemplateParser, TemplateIR } from "@intentius/chant/import/parser";
+import type { TemplateParser, TemplateIR, ParseContext } from "@intentius/chant/import/parser";
 import { BaseValueParser } from "@intentius/chant/import/base-parser";
 export declare const APP_TYPE = "Fly::Machines::App";
 export declare const MACHINE_TYPE = "Fly::Machines::Machine";
@@ -28,7 +28,15 @@ export declare const MACHINE_SERVER_FIELDS: string[];
 export declare const APP_SERVER_FIELDS: string[];
 export declare class FlyParser extends BaseValueParser implements TemplateParser {
     protected dispatchIntrinsic(_key: string, _value: unknown, _obj: Record<string, unknown>): unknown | null;
-    parse(input: string): TemplateIR;
+    /** Set for the length of one `parse` with a context (`chant import`). */
+    private embedded?;
+    /**
+     * With `context.embedded` (`chant import`), a machine file another lexicon
+     * owns (a collector config) is handed to it (see ./embedded.ts). Without
+     * it, every file is kept as written.
+     */
+    parse(input: string, context?: ParseContext): TemplateIR;
+    private parseInput;
     /** Map one serializer-plan request to a resource by its endpoint. */
     private resourceFromRequest;
     private looksLikeApp;

package/dist/import/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EAEX,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAGtE,eAAO,MAAM,QAAQ,uBAAuB,CAAC;AAC7C,eAAO,MAAM,YAAY,2BAA2B,CAAC;AAErD,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,UAajC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,UAO7B,CAAC;AAMF,qBAAa,SAAU,SAAQ,eAAgB,YAAW,cAAc;IACtE,SAAS,CAAC,iBAAiB,CACzB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,GAAG,IAAI,CAGhB;IAED,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CA+C/B;IAED,qEAAqE;IACrE,OAAO,CAAC,mBAAmB;IAkB3B,OAAO,CAAC,YAAY;IAIpB,kFAAkF;IAClF,OAAO,CAAC,WAAW;IAuBnB,yEAAyE;IACzE,OAAO,CAAC,eAAe;CAexB"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EAEV,YAAY,EACb,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAItE,eAAO,MAAM,QAAQ,uBAAuB,CAAC;AAC7C,eAAO,MAAM,YAAY,2BAA2B,CAAC;AAErD,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,UAajC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,UAO7B,CAAC;AAMF,qBAAa,SAAU,SAAQ,eAAgB,YAAW,cAAc;IACtE,SAAS,CAAC,iBAAiB,CACzB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,GAAG,IAAI,CAGhB;IAED,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,CAA0B;IAE3C;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,UAAU,CAOvD;IAED,OAAO,CAAC,UAAU;IAiDlB,qEAAqE;IACrE,OAAO,CAAC,mBAAmB;IAkB3B,OAAO,CAAC,YAAY;IAIpB,kFAAkF;IAClF,OAAO,CAAC,WAAW;IAuBnB,yEAAyE;IACzE,OAAO,CAAC,eAAe;CAgBxB"}

package/dist/import/parser.js

@@ -20,6 +20,7 @@
  */
 import { BaseValueParser } from "@intentius/chant/import/base-parser";
 import { isSerializerPlan } from "../detect.js";
+import { delegateEmbedded } from "./embedded.js";
 export const APP_TYPE = "Fly::Machines::App";
 export const MACHINE_TYPE = "Fly::Machines::Machine";
 /** Server-written read-only machine fields — never part of the authored shape. */
@@ -54,7 +55,21 @@ export class FlyParser extends BaseValueParser {
         // flaps JSON has no intrinsic functions.
         return null;
     }
-    parse(input) {
+    /**
+     * With `context.embedded` (`chant import`), a machine file another lexicon
+     * owns (a collector config) is handed to it (see ./embedded.ts). Without
+     * it, every file is kept as written.
+     */
+    parse(input, context) {
+        this.embedded = context?.embedded;
+        try {
+            return this.parseInput(input);
+        }
+        finally {
+            this.embedded = undefined;
+        }
+    }
+    parseInput(input) {
         const trimmed = input.trim();
         if (!trimmed)
             return { resources: [], parameters: [] };
@@ -152,6 +167,8 @@ export class FlyParser extends BaseValueParser {
         }
         // Always carry a name so the round-trip keeps the machine's identity.
         properties.name = name;
+        if (this.embedded)
+            delegateEmbedded(name, properties, this.embedded);
         return { logicalId: name, type: MACHINE_TYPE, properties };
     }
 }

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4b0145f698aa9822dd923ee79ba4d1172b38da78c27d14bb1d10e9b8cc836355",
+    "manifest.json": "862833387a9f34a223d92ef6c0c9a68b8b5750ba798c10a8dbe4b5b20455e63a",
     "meta.json": "273f2a523b66f08ca91642dba2592c44765ab59ddf7329998884a0b08c6c3f24",
-    "types/index.d.ts": "ca9b4c777e58e7ce2132f5f024e7a1b3d3f2ba4305d935aab85f6523469aed1e",
+    "types/index.d.ts": "75c29d3ba9faa7c2792a0a25c51dc13df011906ffbd4c9e3ccc80023f5f32667",
     "rules/guest-sizing.ts": "8dd2db79a47ceab3d488f84f560aed1b1e4a66b4e36bf11f3baf6a8544d6e126",
     "rules/no-secret-literals.ts": "3854307bd0e8d7a1bf6c23051b460b90f3212baa8bb2f7d4324d0e4418a69982",
     "rules/valid-region.ts": "238afb252ffb59ef131d070a705a49a1ac87b98f6a86c029a69dc82200e1aabf",
@@ -15,5 +15,5 @@
     "skills/chant-fly-ops.md": "44102f1fdf611b9262c04457258990e44026e83f9e5b19ae86b69322f3a37620",
     "skills/chant-fly-sprites.md": "3d100680422151b58d082c3a7b30a286edfc52faa4887995c9ad5553873bab95"
   },
-  "composite": "83977ae2cdcbb3d3a7a08049ce804386ab3f31bb2c1f4944c3f0bc62ad93637a"
+  "composite": "b72790ed3a71100ac3a137dab0d262b5391b94a649170d4a577642dddb9f1f22"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "fly",
-  "version": "0.124.46",
+  "version": "0.124.48",
   "chantVersion": ">=0.1.0",
   "namespace": "Fly"
 }

package/dist/okf/types/App.md

@@ -10,8 +10,8 @@ resource_type: Fly::Machines::App
 
 ## Properties
 
-- `enable_subdomains` (`boolean`, optional)
+- `enable_subdomains` (`boolean`, optional): Request a wildcard TLS certificate for *.svc.<app-name>.fly.dev. Defaults to false. Certificate provisioning is asynchronous; this does not create services or configure their routing.
 - `idempotency_key` (`string`, optional): When set, makes a retry of this exact request safe: a second create with the same key and the same name (or no name) returns the app the first request created, instead of erroring on a false name conflict or creating a duplicate. A second create with the same key but a *different* name is rejected outright; it won't silently hand back the first app.
-- `name` (`string`, optional)
-- `network` (`string`, optional)
-- `org_slug` (`string`, optional)
+- `name` (`string`, optional): Globally unique name for the app. Required.
+- `network` (`string`, optional): Name of the organization's private network to attach the app to. Creates the network if it does not exist. Omit, use an empty string, or use "default" to select the organization's default network.
+- `org_slug` (`string`, optional): Slug of the organization that will own the app, or "personal" for your personal organization. Required.

package/dist/types/index.d.ts

@@ -4,6 +4,7 @@
 
 export declare class App {
   constructor(props: {
+    /** Request a wildcard TLS certificate for *.svc.<app-name>.fly.dev. Defaults to false. Certificate provisioning is asynchronous; this does not create services or configure their routing. */
     enable_subdomains?: boolean;
     /** When set, makes a retry of this exact request safe: a
 second create with the same key and the same name (or no name) returns
@@ -12,8 +13,11 @@ conflict or creating a duplicate. A second create with the same key
 but a *different* name is rejected outright; it won't silently
 hand back the first app. */
     idempotency_key?: string;
+    /** Globally unique name for the app. Required. */
     name?: string;
+    /** Name of the organization's private network to attach the app to. Creates the network if it does not exist. Omit, use an empty string, or use "default" to select the organization's default network. */
     network?: string;
+    /** Slug of the organization that will own the app, or "personal" for your personal organization. Required. */
     org_slug?: string;
   });
   readonly id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-fly",
-  "version": "0.124.46",
+  "version": "0.124.48",
   "type": "module",
   "files": [
     "src/",
@@ -58,7 +58,7 @@
     "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   },
   "dependencies": {
-    "@intentius/chant-lexicon-otel": "^0.124.46",
+    "@intentius/chant-lexicon-otel": "^0.124.48",
     "ws": "^8.18.0"
   },
   "devDependencies": {
@@ -69,7 +69,7 @@
     "zod": "^4.3.6"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.46",
+    "@intentius/chant": "^0.124.48",
     "zod": "^4.3.6"
   },
   "description": "Fly.io Machines lexicon for chant — declarative IaC in TypeScript",

package/src/export-resources.ts

@@ -93,7 +93,7 @@ export async function exportResources(
     );
   };
 
-  const resources: ExportedTemplate["resources"] = [];
+  const parts: ExportedTemplate[] = [];
   for (const app of apps) {
     const appRes = await http(
       "GET",
@@ -116,8 +116,17 @@ export async function exportResources(
       owned: options.owned,
       onBoundaryInference,
     });
-    resources.push(...ir.resources);
+    parts.push(ir);
   }
 
-  return { resources, parameters: [] };
+  // Each app's export re-parses its own bundle; together they re-parse the
+  // whole export, so embedded collector configs reach the otel importer (#3373).
+  return {
+    resources: parts.flatMap((p) => p.resources),
+    parameters: [],
+    reparse: (context) => ({
+      resources: parts.flatMap((p) => (p.reparse ? p.reparse(context) : p).resources),
+      parameters: [],
+    }),
+  };
 }

package/src/generated/index.d.ts

@@ -4,6 +4,7 @@
 
 export declare class App {
   constructor(props: {
+    /** Request a wildcard TLS certificate for *.svc.<app-name>.fly.dev. Defaults to false. Certificate provisioning is asynchronous; this does not create services or configure their routing. */
     enable_subdomains?: boolean;
     /** When set, makes a retry of this exact request safe: a
 second create with the same key and the same name (or no name) returns
@@ -12,8 +13,11 @@ conflict or creating a duplicate. A second create with the same key
 but a *different* name is rejected outright; it won't silently
 hand back the first app. */
     idempotency_key?: string;
+    /** Globally unique name for the app. Required. */
     name?: string;
+    /** Name of the organization's private network to attach the app to. Creates the network if it does not exist. Omit, use an empty string, or use "default" to select the organization's default network. */
     network?: string;
+    /** Slug of the organization that will own the app, or "personal" for your personal organization. Required. */
     org_slug?: string;
   });
   readonly id: string;

package/src/import/embedded-live.test.ts

@@ -0,0 +1,190 @@
+/**
+ * A `FlyOtelCollector`'s config through `chant import` (#3373): the machine
+ * file at `COLLECTOR_CONFIG_PATH` is handed to the otel importer, and a live
+ * import (`chant import --from`) gives the same otel source a file import of
+ * the build's `fly.json` gives, and both give what `chant import config.yaml`
+ * gives for the config itself.
+ */
+
+import { describe, expect, test } from "vitest";
+import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "fs";
+import { join, relative, resolve } from "path";
+import { load } from "js-yaml";
+import { importCommand, liveImportFromPlugins } from "@intentius/chant/cli/commands/import";
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+import { build } from "@intentius/chant/build";
+import { EmbeddedImports } from "@intentius/chant/import/embedded";
+import { COLLECTOR_CONFIG_PATH, otelPlugin, otelSerializer } from "@intentius/chant-lexicon-otel";
+import { OtelCollectorParser } from "@intentius/chant-lexicon-otel/import/parser";
+import { OtelCollectorGenerator } from "@intentius/chant-lexicon-otel/import/generator";
+import { flyPlugin } from "../plugin";
+import { flySerializer } from "../serializer";
+import { exportResources } from "../export-resources";
+import type { FlyHttp } from "../op/activities/fly-apply";
+import { FlyParser } from "./parser";
+import { decodeRawValue } from "./embedded";
+
+type Json = Record<string, unknown>;
+
+const pkgDir = resolve(import.meta.dirname, "../..");
+
+const SOURCE = `import { App, FlyOtelCollector } from "@intentius/chant-lexicon-fly";
+import { OtlpHttpExporter } from "@intentius/chant-lexicon-otel";
+
+export const app = new App({ name: "otel" });
+export const collector = FlyOtelCollector({
+  region: "iad",
+  exporters: [new OtlpHttpExporter({ endpoint: "https://otlp.example.com" })],
+});
+`;
+
+function walk(dir: string, root: string, out: Record<string, string>): void {
+  for (const entry of readdirSync(dir)) {
+    const path = join(dir, entry);
+    if (statSync(path).isDirectory()) walk(path, root, out);
+    else out[relative(root, path)] = readFileSync(path, "utf-8");
+  }
+}
+
+function project(): { dir: string; srcDir: string } {
+  const dir = mkdtempSync(join(pkgDir, ".roundtrip-tmp-"));
+  writeFileSync(join(dir, "package.json"), '{ "name": "fly-embedded", "private": true, "type": "module" }\n');
+  writeFileSync(join(dir, "chant.config.ts"), 'export default { lexicons: ["fly", "otel"] };\n');
+  const srcDir = join(dir, "src");
+  mkdirSync(srcDir);
+  return { dir, srcDir };
+}
+
+function files(srcDir: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  walk(srcDir, srcDir, out);
+  return out;
+}
+
+/** The build's flaps plan for a FlyOtelCollector. */
+async function plan(): Promise<Record<string, { endpoint: string; body: Json }>> {
+  const { dir, srcDir } = project();
+  try {
+    writeFileSync(join(srcDir, "main.ts"), SOURCE);
+    const result = await build(srcDir, [flySerializer, otelSerializer]);
+    expect(result.errors).toEqual([]);
+    const out = result.outputs.get("fly");
+    return JSON.parse(typeof out === "string" ? out : (out as { primary: string }).primary);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function machineBody(p: Awaited<ReturnType<typeof plan>>): Json {
+  const req = Object.values(p).find((r) => /\/machines\/?$/.test(r.endpoint));
+  if (!req) throw new Error("no machine in the plan");
+  return req.body;
+}
+
+function configText(machine: Json): string {
+  const files = (machine.config as Json).files as Json[];
+  const file = files.find((f) => f.guest_path === COLLECTOR_CONFIG_PATH)!;
+  return decodeRawValue(file.raw_value as string)!;
+}
+
+/** `chant import config.yaml`: the otel modules for the config alone. */
+function standalone(text: string): Record<string, string> {
+  return Object.fromEntries(new OtelCollectorGenerator().generate(new OtelCollectorParser().parse(text)).map((f) => [f.path, f.content]));
+}
+
+/** The modules under `dir/`, keyed by their path inside it. */
+function under(all: Record<string, string>, dir: string): Record<string, string> {
+  return Object.fromEntries(Object.entries(all).filter(([p]) => p.startsWith(`${dir}/`)).map(([p, c]) => [p.slice(dir.length + 1), c]));
+}
+
+/** A fake flaps API holding one app and the plan's machine, with the fields a server adds. */
+function flaps(machine: Json): FlyHttp {
+  const live = { ...machine, id: "m-1", state: "started", instance_id: "I1", private_ip: "fdaa::1" };
+  return async (_method, url) => {
+    if (/\/v1\/apps\/otel\/machines/.test(url)) return { status: 200, text: JSON.stringify([live]) };
+    if (/\/v1\/apps\/otel$/.test(url)) return { status: 200, text: JSON.stringify({ name: "otel", organization: { slug: "acme" } }) };
+    return { status: 404, text: "" };
+  };
+}
+
+describe("FlyOtelCollector through chant import (#3373)", () => {
+  test("a live import gives the otel source a file import gives, and builds back to the same config", async () => {
+    const p = await plan();
+    const machine = machineBody(p);
+    const text = configText(machine);
+    const name = machine.name as string;
+    const expected = standalone(text);
+    expect(Object.keys(expected).length).toBeGreaterThan(0);
+
+    // File import of the build's fly.json.
+    const fileProject = project();
+    // Live import from a fake flaps API.
+    const liveProject = project();
+    const prevApp = process.env.FLY_APP_NAME;
+    process.env.FLY_APP_NAME = "otel";
+    try {
+      const templatePath = join(fileProject.dir, "fly.json");
+      writeFileSync(templatePath, JSON.stringify(p));
+      const fileResult = await importCommand({ templatePath, output: fileProject.srcDir, lexicon: "fly" });
+      expect(fileResult.error).toBeUndefined();
+      expect(fileResult.warnings.filter((w) => w.includes("kept as written"))).toEqual([]);
+      const fromFile = files(fileProject.srcDir);
+
+      const plugin: LexiconPlugin = { ...flyPlugin, exportResources: (options) => exportResources(options, flaps(machine)) };
+      const liveResult = await liveImportFromPlugins([plugin, otelPlugin], {
+        environment: "test",
+        output: liveProject.srcDir,
+        lexicon: "fly",
+        force: true,
+      });
+      expect(liveResult.error).toBeUndefined();
+      expect(liveResult.success).toBe(true);
+      expect(liveResult.warnings.filter((w) => w.includes("kept as written"))).toEqual([]);
+      const fromLive = files(liveProject.srcDir);
+
+      expect(under(fromLive, name)).toEqual(expected);
+      expect(under(fromFile, name)).toEqual(expected);
+      expect(fromLive["main.ts"]).toContain('import { collectorYaml } from "@intentius/chant-lexicon-otel";');
+      expect(fromLive["main.ts"]).toContain("raw_value: Buffer.from(collectorYaml(");
+
+      // The imported source builds back to the config the machine holds.
+      const rebuilt = await build(liveProject.srcDir, [flySerializer, otelSerializer]);
+      expect(rebuilt.errors).toEqual([]);
+      const out = rebuilt.outputs.get("fly");
+      const after = machineBody(JSON.parse(typeof out === "string" ? out : (out as { primary: string }).primary));
+      expect(load(configText(after))).toEqual(load(text));
+    } finally {
+      if (prevApp === undefined) delete process.env.FLY_APP_NAME;
+      else process.env.FLY_APP_NAME = prevApp;
+      rmSync(fileProject.dir, { recursive: true, force: true });
+      rmSync(liveProject.dir, { recursive: true, force: true });
+    }
+  });
+
+  test("without a context the export keeps the file as read, and offers a reparse", async () => {
+    const machine = machineBody(await plan());
+    const prevApp = process.env.FLY_APP_NAME;
+    process.env.FLY_APP_NAME = "otel";
+    try {
+      const ir = await exportResources({ environment: "test" }, flaps(machine));
+      const m = ir.resources.find((r) => r.type === "Fly::Machines::Machine")!;
+      const file = ((m.properties.config as Json).files as Json[])[0];
+      expect(typeof file.raw_value).toBe("string");
+      expect(typeof ir.reparse).toBe("function");
+    } finally {
+      if (prevApp === undefined) delete process.env.FLY_APP_NAME;
+      else process.env.FLY_APP_NAME = prevApp;
+    }
+  });
+
+  test("a file that is not a document, or not text, is never offered", () => {
+    const probe = new EmbeddedImports([], { quiet: true });
+    const files = [
+      { guest_path: "/etc/motd", raw_value: Buffer.from("hello there\n").toString("base64") },
+      { guest_path: "/bin/blob", raw_value: Buffer.from([0xff, 0xfe, 0x00, 0x81]).toString("base64") },
+      { guest_path: "/etc/app.yaml", raw_value: Buffer.from("a: 1\n").toString("base64") },
+    ];
+    new FlyParser().parse(JSON.stringify({ name: "m", config: { image: "x", files } }), { embedded: probe });
+    expect(probe.offered.map((c) => c.location)).toEqual(["Machine m file /etc/app.yaml"]);
+  });
+});

package/src/import/embedded.ts

@@ -0,0 +1,90 @@
+/**
+ * Where a Fly Machine embeds another lexicon's content, for `chant import`
+ * (#3373).
+ *
+ * A machine's `config.files[]` entry with a `raw_value` is a file written into
+ * the machine, base64 in flaps. The parser decodes each one and offers the text
+ * to core's embedded-content resolver, as k8s offers a ConfigMap value
+ * (#2962). `FlyOtelCollector` writes its collector config this way, at the otel
+ * lexicon's `COLLECTOR_CONFIG_PATH`, so a live or file import of that machine
+ * gives the same otel source `chant import config.yaml` gives.
+ *
+ * Which lexicon imports the content is decided by core at run time; the hint
+ * below only names the owner a warning suggests when none is installed.
+ */
+
+import type { EmbeddedContent, EmbeddedContentResolver, EmbeddedReference } from "@intentius/chant/import/embedded";
+import { embeddedDocument } from "@intentius/chant/import/embedded";
+import { COLLECTOR_CONFIG_PATH } from "@intentius/chant-lexicon-otel";
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+/** The UTF-8 text a base64 `raw_value` holds, or undefined when it is not base64 of text. */
+export function decodeRawValue(raw: string): string | undefined {
+  if (!/^[A-Za-z0-9+/\s]*={0,2}\s*$/.test(raw)) return undefined;
+  const bytes = Buffer.from(raw, "base64");
+  const text = bytes.toString("utf8");
+  // A round trip that changes the bytes means the file is not UTF-8 text.
+  return Buffer.from(text, "utf8").equals(bytes) ? text : undefined;
+}
+
+function hintFor(guestPath: string, doc: unknown): EmbeddedContent["expectedOwner"] {
+  if (guestPath === COLLECTOR_CONFIG_PATH) return { lexicon: "otel", what: "an OpenTelemetry Collector config" };
+  if (isRecord(doc) && isRecord(doc.service) && isRecord(doc.service.pipelines)) {
+    return { lexicon: "otel", what: "an OpenTelemetry Collector config" };
+  }
+  return undefined;
+}
+
+/**
+ * The marker the parser leaves on a file whose `raw_value` an owner imports:
+ * the generator renders it as the base64 of the reference's text.
+ */
+export interface EmbeddedRawValue {
+  readonly $base64: EmbeddedReference;
+}
+
+export function isEmbeddedRawValue(v: unknown): v is EmbeddedRawValue {
+  return isRecord(v) && isRecord(v.$base64);
+}
+
+/**
+ * Offer each `config.files[].raw_value` of one machine to `embedded`, replacing
+ * the value an owner imports with an {@link EmbeddedRawValue}. `properties` is
+ * the machine's IR properties, changed in place with fresh copies on the way
+ * down.
+ */
+export function delegateEmbedded(
+  machineName: string,
+  properties: Record<string, unknown>,
+  embedded: EmbeddedContentResolver,
+): void {
+  const config = properties.config;
+  if (!isRecord(config) || !Array.isArray(config.files)) return;
+  const files = config.files;
+  let changed = false;
+  const next = files.map((file, i) => {
+    if (!isRecord(file) || typeof file.raw_value !== "string") return file;
+    const text = decodeRawValue(file.raw_value);
+    if (text === undefined) return file;
+    const doc = embeddedDocument(text);
+    if (!isRecord(doc)) return file;
+    const guestPath = typeof file.guest_path === "string" ? file.guest_path : `files[${i}]`;
+    const base = guestPath.split("/").pop()!.replace(/\.[^.]*$/, "");
+    const ref = embedded.resolve({
+      host: "fly",
+      hostType: "Fly::Machines::Machine",
+      location: `Machine ${machineName} file ${guestPath}`,
+      directory: files.length === 1 ? machineName : `${machineName}-${base}`,
+      text,
+      document: doc,
+      expectedOwner: hintFor(guestPath, doc),
+    });
+    if (!ref) return file;
+    changed = true;
+    return { ...file, raw_value: { $base64: ref } satisfies EmbeddedRawValue };
+  });
+  if (changed) properties.config = { ...config, files: next };
+}

package/src/import/generator.ts

@@ -16,6 +16,14 @@
 
 import type { TypeScriptGenerator, GeneratedFile } from "@intentius/chant/import/generator";
 import type { TemplateIR } from "@intentius/chant/import/parser";
+import { EmbeddedImportScope, isEmbeddedReference, renderEmbeddedReference } from "@intentius/chant/import/embedded";
+import { isEmbeddedRawValue } from "./embedded";
+
+/** What one module's rendering collects: the fly classes it uses, and the imports embedded references need. */
+interface Ctx {
+  imports: Set<string>;
+  scope: EmbeddedImportScope;
+}
 
 /**
  * How a nested field is wrapped: `single` → `new Cls({...})`, `array` → each
@@ -106,13 +114,25 @@ export class FlyGenerator implements TypeScriptGenerator {
   generate(ir: TemplateIR): GeneratedFile[] {
     const imports = new Set<string>();
     const bodyLines: string[] = [];
+    // Names an embedded reference's imports must not take: the module's own
+    // declarations and every fly class it could import.
+    const classNames = new Set(["App", "Machine", ...Object.keys(NESTED_DECLARABLES)]);
+    for (const fields of Object.values(NESTED_DECLARABLES)) for (const n of Object.values(fields)) classNames.add(n.cls);
+    for (const r of ir.resources) {
+      const parts = r.type.split("::");
+      classNames.add(parts.length >= 3 ? parts[2] : r.type);
+    }
+    const ctx: Ctx = {
+      imports,
+      scope: new EmbeddedImportScope("", [...classNames, "Buffer", ...ir.resources.map((r) => camelCase(r.logicalId))]),
+    };
 
     for (const resource of ir.resources) {
       const parts = resource.type.split("::");
       const className = parts.length >= 3 ? parts[2] : resource.type;
       imports.add(className);
       const varName = camelCase(resource.logicalId);
-      const props = formatProps(resource.properties, 0, className, imports);
+      const props = formatProps(resource.properties, 0, className, ctx);
       bodyLines.push(`export const ${varName} = new ${className}(${props});`);
       bodyLines.push("");
     }
@@ -122,8 +142,9 @@ export class FlyGenerator implements TypeScriptGenerator {
       lines.push(
         `import { ${[...imports].sort().join(", ")} } from "@intentius/chant-lexicon-fly";`,
       );
-      lines.push("");
     }
+    lines.push(...ctx.scope.lines());
+    if (lines.length > 0) lines.push("");
     lines.push(...bodyLines);
 
     return [{ path: "main.ts", content: lines.join("\n") + "\n" }];
@@ -145,7 +166,7 @@ function formatProps(
   props: Record<string, unknown>,
   indent: number,
   ownerClass: string,
-  imports: Set<string>,
+  ctx: Ctx,
 ): string {
   const entries = Object.entries(props);
   if (entries.length === 0) return "{}";
@@ -158,8 +179,8 @@ function formatProps(
     const spec = nested?.[key];
     const rendered =
       spec !== undefined
-        ? formatNested(value, indent + 1, spec, imports)
-        : formatValue(value, indent + 1);
+        ? formatNested(value, indent + 1, spec, ctx)
+        : formatValue(value, indent + 1, ctx);
     return `${pad}${key}: ${rendered},`;
   });
 
@@ -171,14 +192,14 @@ function formatNested(
   value: unknown,
   indent: number,
   spec: Nested,
-  imports: Set<string>,
+  ctx: Ctx,
 ): string {
   const construct = (obj: unknown, at: number): string => {
     if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
-      return formatValue(obj, at);
+      return formatValue(obj, at, ctx);
     }
-    imports.add(spec.cls);
-    return `new ${spec.cls}(${formatProps(obj as Record<string, unknown>, at, spec.cls, imports)})`;
+    ctx.imports.add(spec.cls);
+    return `new ${spec.cls}(${formatProps(obj as Record<string, unknown>, at, spec.cls, ctx)})`;
   };
 
   if (spec.kind === "single") {
@@ -195,7 +216,7 @@ function formatNested(
 
   // record: a plain object whose values are wrapped in the constructor.
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return formatValue(value, indent);
+    return formatValue(value, indent, ctx);
   }
   const record = value as Record<string, unknown>;
   const recKeys = Object.entries(record);
@@ -206,8 +227,14 @@ function formatNested(
   return `{\n${items.join("\n")}\n${closePad}}`;
 }
 
-function formatValue(value: unknown, indent: number): string {
+function formatValue(value: unknown, indent: number, ctx: Ctx): string {
   if (value === null || value === undefined) return "undefined";
+  // A machine file another lexicon imported (#3373): flaps wants the file's
+  // text base64-encoded, so the reference's text is encoded at build time.
+  if (isEmbeddedRawValue(value)) {
+    return `Buffer.from(${renderEmbeddedReference(value.$base64, ctx.scope, indent * 2)}, "utf8").toString("base64")`;
+  }
+  if (isEmbeddedReference(value)) return renderEmbeddedReference(value, ctx.scope, indent * 2);
   if (typeof value === "string") return JSON.stringify(value);
   if (typeof value === "number" || typeof value === "boolean") return String(value);
 
@@ -215,24 +242,24 @@ function formatValue(value: unknown, indent: number): string {
     if (value.length === 0) return "[]";
     const pad = "  ".repeat(indent + 1);
     const closePad = "  ".repeat(indent);
-    const items = value.map((v) => `${pad}${formatValue(v, indent + 1)},`);
+    const items = value.map((v) => `${pad}${formatValue(v, indent + 1, ctx)},`);
     return `[\n${items.join("\n")}\n${closePad}]`;
   }
 
   if (typeof value === "object") {
-    return formatPlainObject(value as Record<string, unknown>, indent);
+    return formatPlainObject(value as Record<string, unknown>, indent, ctx);
   }
 
   return String(value);
 }
 
 /** A plain object literal (no constructor wrapping) — for scalar-valued maps like env/metadata. */
-function formatPlainObject(obj: Record<string, unknown>, indent: number): string {
+function formatPlainObject(obj: Record<string, unknown>, indent: number, ctx: Ctx): string {
   const entries = Object.entries(obj);
   if (entries.length === 0) return "{}";
   const pad = "  ".repeat(indent + 1);
   const closePad = "  ".repeat(indent);
-  const lines = entries.map(([key, value]) => `${pad}${objectKey(key)}: ${formatValue(value, indent + 1)},`);
+  const lines = entries.map(([key, value]) => `${pad}${objectKey(key)}: ${formatValue(value, indent + 1, ctx)},`);
   return `{\n${lines.join("\n")}\n${closePad}}`;
 }
 

package/src/import/live-export.ts

@@ -19,6 +19,7 @@
  */
 
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+import type { ParseContext, TemplateIR } from "@intentius/chant/import/parser";
 import { isChantOwned, type FlapsMachine } from "../op/activities/fly-apply";
 import {
   FlyParser,
@@ -90,9 +91,15 @@ export function buildExportFromApp(
   const cleanApp = keptApp ? stripAppServerFields(keptApp) : keptApp;
 
   const bundle: Record<string, unknown> = { ...(cleanApp ?? {}), machines: cleanMachines };
-  const ir = new FlyParser().parse(JSON.stringify(bundle));
+  const content = JSON.stringify(bundle);
+  // `reparse(context)` parses the same bundle again with a `ParseContext`, so
+  // `chant import --from` hands a collector config in a machine file to the
+  // otel importer, as file import does (#3373).
+  const parse = (context?: ParseContext): TemplateIR => select(new FlyParser().parse(content, context), opts.selector);
+  return { ...parse(), reparse: (context) => parse(context) };
+}
 
-  const selector = opts.selector;
+function select(ir: TemplateIR, selector: ResourceSelector | undefined): TemplateIR {
   if (!selector || (selector.type === undefined && selector.name === undefined)) {
     return ir;
   }

package/src/import/parser.ts

@@ -23,9 +23,12 @@ import type {
   TemplateParser,
   TemplateIR,
   ResourceIR,
+  ParseContext,
 } from "@intentius/chant/import/parser";
+import type { EmbeddedContentResolver } from "@intentius/chant/import/embedded";
 import { BaseValueParser } from "@intentius/chant/import/base-parser";
 import { isSerializerPlan } from "../detect";
+import { delegateEmbedded } from "./embedded";
 
 export const APP_TYPE = "Fly::Machines::App";
 export const MACHINE_TYPE = "Fly::Machines::Machine";
@@ -70,7 +73,24 @@ export class FlyParser extends BaseValueParser implements TemplateParser {
     return null;
   }
 
-  parse(input: string): TemplateIR {
+  /** Set for the length of one `parse` with a context (`chant import`). */
+  private embedded?: EmbeddedContentResolver;
+
+  /**
+   * With `context.embedded` (`chant import`), a machine file another lexicon
+   * owns (a collector config) is handed to it (see ./embedded.ts). Without
+   * it, every file is kept as written.
+   */
+  parse(input: string, context?: ParseContext): TemplateIR {
+    this.embedded = context?.embedded;
+    try {
+      return this.parseInput(input);
+    } finally {
+      this.embedded = undefined;
+    }
+  }
+
+  private parseInput(input: string): TemplateIR {
     const trimmed = input.trim();
     if (!trimmed) return { resources: [], parameters: [] };
 
@@ -179,6 +199,7 @@ export class FlyParser extends BaseValueParser implements TemplateParser {
     }
     // Always carry a name so the round-trip keeps the machine's identity.
     properties.name = name;
+    if (this.embedded) delegateEmbedded(name, properties, this.embedded);
 
     return { logicalId: name, type: MACHINE_TYPE, properties };
   }