@intentius/chant-lexicon-helm 0.106.4 → 0.108.0

package/dist/codegen/values-type.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A TypeScript type for a chart's values when the chart ships no
+ * `values.schema.json`, inferred from its `values.yaml` defaults.
+ *
+ * Every member is optional, since an override sets any subset. An object's
+ * keys are the ones `values.yaml` lists and no others, so a misspelled key
+ * fails to typecheck. A default that says nothing about its type becomes
+ * `unknown`: a `null` or empty value (`key:` or `key: ~`) is `unknown`, an
+ * empty object (`podAnnotations: {}`) a map of `unknown`, an empty list an
+ * array of `unknown`. An empty string is still a string. Keys are quoted
+ * when they are not identifiers and never renamed.
+ */
+/** The type expression for a parsed `values.yaml` document. */
+export declare function inferValuesType(values: unknown): string;
+//# sourceMappingURL=values-type.d.ts.map

package/dist/codegen/values-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"values-type.d.ts","sourceRoot":"","sources":["../../src/codegen/values-type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAGvD"}

package/dist/config.d.ts

@@ -77,16 +77,68 @@ export type HelmCapabilityProfileRef = string | HelmCapabilityProfile;
 export interface HelmChantConfig {
     /** Per-cluster capability profiles, keyed by profile (cluster/environment) name. */
     capabilityProfiles?: Record<string, HelmCapabilityProfileConfig>;
+    /**
+     * Charts to generate typed render factories for, with `chant generate`,
+     * keyed by a name the factory is called after (`traefik` gives
+     * `TraefikRender` and `TraefikValues`).
+     *
+     * Each factory wraps `HelmRender` with the chart's repo, name and version
+     * fixed here and its `values` typed from the chart's `values.schema.json`,
+     * or inferred from its `values.yaml` when it ships no schema. The code is
+     * written to `src/generated/helm/` (see `codegen.outDir`) and committed.
+     *
+     * ```ts
+     * helm: {
+     *   charts: {
+     *     traefik: { repo: "https://traefik.github.io/charts", chart: "traefik", version: "34.4.1" },
+     *     operator: { chart: "oci://ghcr.io/acme/charts/operator", version: "1.2.0" },
+     *     app: { path: "charts/app" },
+     *   },
+     * }
+     * ```
+     */
+    charts?: Record<string, HelmProjectChart>;
 }
+/**
+ * One `helm.charts` entry: a chart in a classic repository (`repo` + `chart`),
+ * an `oci://` chart reference (no `repo`), each pinned by `version`, or a
+ * chart directory in the project (`path`, relative to the project root).
+ */
+export type HelmProjectChart = {
+    repo?: string;
+    chart: string;
+    version: string;
+    digest?: string;
+} | {
+    path: string;
+};
 export declare const helmCapabilityProfileSchema: z.ZodObject<{
     kubeVersion: z.ZodString;
     apiVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
+/** What a `helm.charts` key may be: it names the generated factory. */
+export declare const CHART_KEY_PATTERN: RegExp;
+export declare const helmProjectChartSchema: z.ZodUnion<readonly [z.ZodObject<{
+    repo: z.ZodOptional<z.ZodString>;
+    chart: z.ZodString;
+    version: z.ZodString;
+    digest: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    path: z.ZodString;
+}, z.core.$strict>]>;
 export declare const helmConfigSchema: z.ZodObject<{
     capabilityProfiles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         kubeVersion: z.ZodString;
         apiVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>>;
+    charts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        repo: z.ZodOptional<z.ZodString>;
+        chart: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodString;
+    }, z.core.$strict>]>>>;
 }, z.core.$strict>;
 declare module "@intentius/chant/config" {
     interface ChantConfig {

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAI3D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAyB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,gGAAgG;AAChG,MAAM,WAAW,qBAAsB,SAAQ,2BAA2B;IACxE,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,qBAAqB,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;CAClE;AAED,eAAO,MAAM,2BAA2B;;;kBAKtC,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;kBAE3B,CAAC;AAEH,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,IAAI,CAAC,EAAE,eAAe,CAAC;KACxB;CACF;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAEnE;;;GAGG;AACH,KAAK,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,SAAS,eAAe,GAClF,eAAe,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GACtD,IAAI,GACJ,KAAK,GACP,KAAK,CAAC;AACV,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEhE;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAyBlF;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,wBAAwB,EAC7B,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,qBAAqB,CAyBvB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAI3D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAyB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,gGAAgG;AAChG,MAAM,WAAW,qBAAsB,SAAQ,2BAA2B;IACxE,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,qBAAqB,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACjE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB,eAAO,MAAM,2BAA2B;;;kBAKtC,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,QAA6B,CAAC;AAE5D,eAAO,MAAM,sBAAsB;;;;;;;oBAQjC,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;kBAK3B,CAAC;AAEH,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,IAAI,CAAC,EAAE,eAAe,CAAC;KACxB;CACF;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAEnE;;;GAGG;AACH,KAAK,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,SAAS,eAAe,GAClF,eAAe,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GACtD,IAAI,GACJ,KAAK,GACP,KAAK,CAAC;AACV,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEhE;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAyBlF;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,wBAAwB,EAC7B,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,qBAAqB,CAyBvB"}

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export { helmInstall, helmInstallPinned } from "./op/builders.js";
 export { Chart, Values, ValuesOverride, HelmTest, HelmNotes, HelmHook, HelmDependency, HelmMaintainer, HelmCRD } from "./resources.js";
 export { HelmRender, getHelmRenderRecords, clearHelmRenderRecords } from "./render.js";
 export type { HelmRenderProps, HelmRenderRecord } from "./render.js";
+export type { HelmProjectChart } from "./config.js";
 export { canonicalizeRender, helmContentDigest, helmInputDigest, renderStability } from "./render-digest.js";
 export type { HelmInputDigestSource, RenderStabilityGroup, RenderStabilityReport } from "./render-digest.js";
 export { helmValuesDigest, indexRenderDocuments, renderCacheKey, renderStoreRoot, persistHelmRender, loadRenderManifest, loadRenderContent, listRenderManifests, findRenderByCacheKey, readRenderDocument, } from "./render-store.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAKtC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/I,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG/D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGpI,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACpF,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1G,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG1G,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EACV,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAGhE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,YAAY,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAG9F,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,cAAc,EACd,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,OAAO,EACP,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,MAAM,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,MAAM,EACN,KAAK,EACL,MAAM,EACN,GAAG,EACH,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,MAAM,EACN,EAAE,EACF,KAAK,EACL,IAAI,EACJ,SAAS,EACT,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIlG,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,cAAc,GACf,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAKtC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/I,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG/D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGpI,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACpF,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGjD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1G,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG1G,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EACV,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAGhE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,YAAY,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAG9F,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,cAAc,EACd,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,OAAO,EACP,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,MAAM,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,MAAM,EACN,KAAK,EACL,MAAM,EACN,GAAG,EACH,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,MAAM,EACN,EAAE,EACF,KAAK,EACL,IAAI,EACJ,SAAS,EACT,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIlG,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,cAAc,GACf,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "eafb100622bda557122363a8fd4031275d47006253b9af67398079801a115cbb",
+    "manifest.json": "0ffddd1e31bf974f249ef71ee511436edff394b8a9c830ae71c874bdba8a3e14",
     "meta.json": "14243c5730a07c6a6edc35ddd351438547d58df5cf345f2233a355b0c7611ccc",
     "types/index.d.ts": "5377696ca8698cd2999e4680feb8e8e4b54a7b49fb603a87b2f27356114d1794",
     "rules/chart-metadata.ts": "8f3377e893d5e2828460b7fe5924fca098334245a9a2fdb90f6b67e490eaf091",
@@ -36,5 +36,5 @@
     "skills/chant-helm-patterns.md": "9e79e6a46391da46709d8aa57e2825a7cd9eb981cd923f02ad60836c49b2561e",
     "skills/chant-helm-security.md": "bfc367eabceed2e84f1cf94501b407df78aeed963cec104f24a321d0962063c9"
   },
-  "composite": "db633622dfc7d403d68d526906bd50ce897f09ca2359f28e4e2a576cb2f5a183"
+  "composite": "73f83be0747f857940551b69454e57a00388a775e07fe64292df42e1edcf86ac"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "helm",
-  "version": "0.106.4",
+  "version": "0.108.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Helm",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAiB7F,eAAO,MAAM,UAAU,EAAE,aAycxB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAkB7F,eAAO,MAAM,UAAU,EAAE,aA6cxB,CAAC"}

package/dist/project-codegen.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Typed Helm values: the helm lexicon's `projectCodegen` hook (`chant
+ * generate`, core's project-codegen.ts).
+ *
+ * For each chart a project lists under `helm.charts`, generation reads the
+ * chart's `values.schema.json` (or, without one, its `values.yaml`) and writes
+ * to `<outDir>/helm/index.ts`:
+ *
+ * - `<Name>Values`, the values type: from the schema, with every member
+ *   optional (the schema validates the values Helm merges with the chart's
+ *   defaults, so a key it requires is usually already set), or inferred from
+ *   `values.yaml` (./codegen/values-type.ts).
+ * - `<Name>Render(props)`, a factory that calls `HelmRender` with the repo,
+ *   chart and version from the config, so the type and the version it was
+ *   generated from cannot drift apart. It takes `HelmRender`'s other props.
+ *
+ * A remote chart is downloaded without the helm binary: an `oci://` chart
+ * through the registry API, a classic repository through its `index.yaml`.
+ * Both go through `ctx.fetch` when the caller passes one.
+ */
+import { type ProjectCodegen } from "@intentius/chant/project-codegen";
+import { type HelmProjectChart } from "./config.js";
+/** The chart files generation reads. */
+export interface ChartFiles {
+    chartYaml: string;
+    valuesYaml?: string;
+    valuesSchema?: string;
+}
+type RemoteChart = Extract<HelmProjectChart, {
+    chart: string;
+}>;
+/** Download a remote chart's files. Tests replace it. */
+export type ChartPuller = (chart: RemoteChart, fetchImpl: typeof fetch | undefined) => Promise<ChartFiles>;
+/** The hook, with an injectable puller for remote charts. */
+export declare function helmProjectCodegen(options?: {
+    pull?: ChartPuller;
+}): ProjectCodegen;
+/** The top-level chart's files out of a chart archive (subcharts are ignored). */
+export declare function chartFilesFromArchive(files: Map<string, Buffer>, label: string): ChartFiles;
+/** Download a remote chart: OCI through the registry API, a classic repository through its index. */
+export declare function pullRemoteChart(chart: RemoteChart, fetchImpl: typeof fetch | undefined): Promise<ChartFiles>;
+/** `ingress-nginx` -> `IngressNginx`. */
+export declare function factoryBase(key: string): string;
+export {};
+//# sourceMappingURL=project-codegen.d.ts.map

package/dist/project-codegen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-codegen.d.ts","sourceRoot":"","sources":["../src/project-codegen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,OAAO,EAAuB,KAAK,cAAc,EAA8B,MAAM,kCAAkC,CAAC;AAIxH,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGpE,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,KAAK,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhE,yDAAyD;AACzD,MAAM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,KAAK,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAI3G,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,WAAW,CAAA;CAAO,GAAG,cAAc,CAwBvF;AA6CD,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAM3F;AAED,qGAAqG;AACrG,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA8BlH;AAED,yCAAyC;AACzC,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM/C"}

package/dist/render.d.ts

@@ -30,6 +30,7 @@
  *   values: { installCRDs: true },
  * });
  */
+import { type RenderedPatch } from "@intentius/chant-lexicon-k8s/patch/rendered-patch";
 import { type HelmCapabilityProfileRef } from "./config.js";
 export interface HelmRenderProps {
     /** Logical name for the render (used in cache key + composite name). */
@@ -84,6 +85,18 @@ export interface HelmRenderProps {
      * means the manifest records `sourceRef: null`.
      */
     sourceRef?: string;
+    /**
+     * Patches applied to the rendered documents before they become entities
+     * (#3566): select by kind and name (namespace and apiVersion optional) and
+     * apply an RFC 6902 `jsonPatch` or an RFC 7386 `merge`. The patched form is
+     * what the build emits and what `lifecycle diff --live` compares. A
+     * selector matching no rendered document fails the build, so a chart
+     * upgrade that renames a resource is noticed.
+     *
+     * Patches act on the parsed render, after caching and digests: the render
+     * store and `contentDigest` still describe helm's own output.
+     */
+    patches?: RenderedPatch[];
 }
 export { getHelmRenderRecords, clearHelmRenderRecords, type HelmRenderRecord } from "./render-records.js";
 export declare const HelmRender: import("@intentius/chant").CompositeDefinition<HelmRenderProps, import("@intentius/chant").CompositeMembers>;

package/dist/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAeH,OAAO,EAAwD,KAAK,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAY/G,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA8RvG,eAAO,MAAM,UAAU,8GAsFP,CAAC"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAG7G,OAAO,EAAwD,KAAK,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAY/G,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAMD,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA8RvG,eAAO,MAAM,UAAU,8GA0FP,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-helm",
-  "version": "0.106.4",
+  "version": "0.108.0",
   "description": "Helm chart lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -86,7 +86,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.106.4",
+    "@intentius/chant": "^0.108.0",
     "typescript": "^5.9.3",
     "zod": "^4.3.6"
   }

package/src/codegen/values-type.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, test } from "vitest";
+import yaml from "js-yaml";
+import ts from "typescript";
+import { inferValuesType } from "./values-type";
+
+/** Type-check `const v: Values = <value>` against the inferred type. */
+function accepts(valuesYaml: string, value: string): string[] {
+  const code = `type Values = ${inferValuesType(yaml.load(valuesYaml))};\nexport const v: Values = ${value};\n`;
+  const fileName = "/virtual/v.ts";
+  const options: ts.CompilerOptions = { strict: true, noEmit: true, lib: ["lib.es2022.d.ts"] };
+  const host = ts.createCompilerHost(options);
+  const original = host.getSourceFile;
+  host.getSourceFile = (name, lang, ...rest) => (name === fileName ? ts.createSourceFile(name, code, lang) : original.call(host, name, lang, ...rest));
+  const program = ts.createProgram([fileName], options, host);
+  return ts.getPreEmitDiagnostics(program, program.getSourceFile(fileName)).map((d) => ts.flattenDiagnosticMessageText(d.messageText, "\n"));
+}
+
+const VALUES = `
+replicaCount: 1
+image:
+  repository: traefik
+  tag: ""
+  pullPolicy: IfNotPresent
+podAnnotations: {}
+tolerations: []
+nodeSelector:
+resources: ~
+ports:
+  - name: web
+    port: 8000
+  - name: websecure
+    port: 8443
+    tls: true
+"app.kubernetes.io/part-of": edge
+use-forwarded-headers: false
+`;
+
+describe("inferValuesType", () => {
+  test("every member is optional and typed from its default", () => {
+    const type = inferValuesType(yaml.load(VALUES));
+    expect(type).toContain("  replicaCount?: number;");
+    expect(type).toContain("    tag?: string;");
+    expect(type).toContain(`  "app.kubernetes.io/part-of"?: string;`);
+    expect(type).toContain(`  "use-forwarded-headers"?: boolean;`);
+  });
+
+  test("null and empty defaults say nothing about the type", () => {
+    const type = inferValuesType(yaml.load(VALUES));
+    expect(type).toContain("  nodeSelector?: unknown;");
+    expect(type).toContain("  resources?: unknown;");
+    expect(type).toContain("  podAnnotations?: Record<string, unknown>;");
+    expect(type).toContain("  tolerations?: unknown[];");
+  });
+
+  test("list elements merge their keys", () => {
+    const type = inferValuesType(yaml.load(VALUES));
+    expect(type).toMatch(/ports\?: Array<\{\n {4}name\?: string;\n {4}port\?: number;\n {4}tls\?: boolean;\n {2}\}>;/);
+  });
+
+  test("a subset of overrides typechecks; a misspelled or mistyped key does not", () => {
+    expect(accepts(VALUES, `{ image: { tag: "v3" }, podAnnotations: { a: "b" }, resources: { limits: {} } }`)).toEqual([]);
+    expect(accepts(VALUES, `{ image: { tga: "v3" } }`).join("\n")).toMatch(/'tga' does not exist/);
+    expect(accepts(VALUES, `{ replicaCount: "2" }`)).not.toEqual([]);
+  });
+
+  test("an empty values file is an open map", () => {
+    expect(inferValuesType(yaml.load(""))).toBe("Record<string, unknown>");
+  });
+});

package/src/codegen/values-type.ts

@@ -0,0 +1,87 @@
+/**
+ * A TypeScript type for a chart's values when the chart ships no
+ * `values.schema.json`, inferred from its `values.yaml` defaults.
+ *
+ * Every member is optional, since an override sets any subset. An object's
+ * keys are the ones `values.yaml` lists and no others, so a misspelled key
+ * fails to typecheck. A default that says nothing about its type becomes
+ * `unknown`: a `null` or empty value (`key:` or `key: ~`) is `unknown`, an
+ * empty object (`podAnnotations: {}`) a map of `unknown`, an empty list an
+ * array of `unknown`. An empty string is still a string. Keys are quoted
+ * when they are not identifiers and never renamed.
+ */
+
+import { tsPropertyKey } from "@intentius/chant/codegen/json-schema-to-ts";
+
+/** The type expression for a parsed `values.yaml` document. */
+export function inferValuesType(values: unknown): string {
+  if (values === null || values === undefined) return "Record<string, unknown>";
+  return render(shape(values), "");
+}
+
+type Shape =
+  | { kind: "unknown" }
+  | { kind: "scalar"; type: "string" | "number" | "boolean" }
+  | { kind: "array"; element: Shape }
+  | { kind: "object"; members: Map<string, Shape> }
+  | { kind: "map" }
+  | { kind: "union"; shapes: Shape[] };
+
+function shape(value: unknown): Shape {
+  if (value === null || value === undefined) return { kind: "unknown" };
+  if (typeof value === "string") return { kind: "scalar", type: "string" };
+  if (typeof value === "number") return { kind: "scalar", type: "number" };
+  if (typeof value === "boolean") return { kind: "scalar", type: "boolean" };
+  if (value instanceof Date) return { kind: "scalar", type: "string" };
+  if (Array.isArray(value)) {
+    if (value.length === 0) return { kind: "array", element: { kind: "unknown" } };
+    return { kind: "array", element: value.map(shape).reduce(merge) };
+  }
+  if (typeof value === "object") {
+    const entries = Object.entries(value as Record<string, unknown>);
+    if (entries.length === 0) return { kind: "map" };
+    return { kind: "object", members: new Map(entries.map(([k, v]) => [k, shape(v)])) };
+  }
+  return { kind: "unknown" };
+}
+
+/** Combine the shapes of two list elements: objects merge their keys, anything else unions. */
+function merge(a: Shape, b: Shape): Shape {
+  if (a.kind === "unknown" || b.kind === "unknown") return { kind: "unknown" };
+  if (a.kind === "object" && b.kind === "object") {
+    const members = new Map(a.members);
+    for (const [k, s] of b.members) members.set(k, members.has(k) ? merge(members.get(k)!, s) : s);
+    return { kind: "object", members };
+  }
+  if (a.kind === "scalar" && b.kind === "scalar" && a.type === b.type) return a;
+  if (a.kind === "map" && b.kind === "map") return a;
+  if (a.kind === "array" && b.kind === "array") return { kind: "array", element: merge(a.element, b.element) };
+  const shapes = [...(a.kind === "union" ? a.shapes : [a]), ...(b.kind === "union" ? b.shapes : [b])];
+  return { kind: "union", shapes };
+}
+
+function render(s: Shape, indent: string): string {
+  switch (s.kind) {
+    case "unknown":
+      return "unknown";
+    case "scalar":
+      return s.type;
+    case "map":
+      return "Record<string, unknown>";
+    case "array": {
+      const element = render(s.element, indent);
+      return /^[A-Za-z]+$/.test(element) ? `${element}[]` : `Array<${element}>`;
+    }
+    case "union":
+      return [...new Set(s.shapes.map((x) => render(x, indent)))].join(" | ");
+    case "object": {
+      const inner = indent + "  ";
+      const lines = ["{"];
+      for (const [key, member] of s.members) {
+        lines.push(`${inner}${tsPropertyKey(key)}?: ${render(member, inner)};`);
+      }
+      lines.push(`${indent}}`);
+      return lines.join("\n");
+    }
+  }
+}

package/src/config.ts

@@ -86,8 +86,38 @@ export type HelmCapabilityProfileRef = string | HelmCapabilityProfile;
 export interface HelmChantConfig {
   /** Per-cluster capability profiles, keyed by profile (cluster/environment) name. */
   capabilityProfiles?: Record<string, HelmCapabilityProfileConfig>;
+  /**
+   * Charts to generate typed render factories for, with `chant generate`,
+   * keyed by a name the factory is called after (`traefik` gives
+   * `TraefikRender` and `TraefikValues`).
+   *
+   * Each factory wraps `HelmRender` with the chart's repo, name and version
+   * fixed here and its `values` typed from the chart's `values.schema.json`,
+   * or inferred from its `values.yaml` when it ships no schema. The code is
+   * written to `src/generated/helm/` (see `codegen.outDir`) and committed.
+   *
+   * ```ts
+   * helm: {
+   *   charts: {
+   *     traefik: { repo: "https://traefik.github.io/charts", chart: "traefik", version: "34.4.1" },
+   *     operator: { chart: "oci://ghcr.io/acme/charts/operator", version: "1.2.0" },
+   *     app: { path: "charts/app" },
+   *   },
+   * }
+   * ```
+   */
+  charts?: Record<string, HelmProjectChart>;
 }
 
+/**
+ * One `helm.charts` entry: a chart in a classic repository (`repo` + `chart`),
+ * an `oci://` chart reference (no `repo`), each pinned by `version`, or a
+ * chart directory in the project (`path`, relative to the project root).
+ */
+export type HelmProjectChart =
+  | { repo?: string; chart: string; version: string; digest?: string }
+  | { path: string };
+
 export const helmCapabilityProfileSchema = z.strictObject({
   kubeVersion: z
     .string()
@@ -95,8 +125,24 @@ export const helmCapabilityProfileSchema = z.strictObject({
   apiVersions: z.array(z.string().min(1, "apiVersions entries must be non-empty strings")).optional(),
 });
 
+/** What a `helm.charts` key may be: it names the generated factory. */
+export const CHART_KEY_PATTERN = /^[A-Za-z][A-Za-z0-9_-]*$/;
+
+export const helmProjectChartSchema = z.union([
+  z.strictObject({
+    repo: z.string().url().optional(),
+    chart: z.string().min(1),
+    version: z.string().min(1),
+    digest: z.string().optional(),
+  }),
+  z.strictObject({ path: z.string().min(1) }),
+]);
+
 export const helmConfigSchema = z.strictObject({
   capabilityProfiles: z.record(z.string(), helmCapabilityProfileSchema).optional(),
+  charts: z
+    .record(z.string().regex(CHART_KEY_PATTERN, "must start with a letter and hold only letters, digits, - and _"), helmProjectChartSchema)
+    .optional(),
 });
 
 declare module "@intentius/chant/config" {

package/src/index.ts

@@ -24,6 +24,7 @@ export { Chart, Values, ValuesOverride, HelmTest, HelmNotes, HelmHook, HelmDepen
 // HelmRender — render an upstream chart at chant build time
 export { HelmRender, getHelmRenderRecords, clearHelmRenderRecords } from "./render";
 export type { HelmRenderProps, HelmRenderRecord } from "./render";
+export type { HelmProjectChart } from "./config";
 
 // #1237 — render canonicalization + the contentDigest/inputDigest split.
 export { canonicalizeRender, helmContentDigest, helmInputDigest, renderStability } from "./render-digest";

package/src/plugin.ts

@@ -20,6 +20,7 @@ import { helmSerializer } from "./serializer";
 import { helmCompletions } from "./lsp/completions";
 import { helmHover } from "./lsp/hover";
 import { helmConfigSchema } from "./config";
+import { helmProjectCodegen } from "./project-codegen";
 import { helmDeepNormalizationHooks } from "./deep-observe-hooks";
 import { LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 
@@ -29,6 +30,10 @@ export const helmPlugin: LexiconPlugin = {
   // Declaring the schema makes core validate the namespace at load, so a
   // typo'd profile field fails the build instead of silently unpinning.
   configSchema: helmConfigSchema,
+  // Typed values and a render factory per chart in `helm.charts`, written by
+  // `chant generate` and checked for drift by every build. See
+  // ./project-codegen.ts.
+  projectCodegen: () => helmProjectCodegen(),
   // #1246 — helm resolves real ownership verdicts on the thin read (every row
   // is release-scoped, so helm-managed = owned via release identity), and the
   // deep read (#1247) delegates to the k8s reader, which resolves the shared

package/src/project-codegen.e2e.test.ts

@@ -0,0 +1,307 @@
+/**
+ * Typed Helm values end to end: a project lists charts under `helm.charts`,
+ * `chant generate` writes a values type and a render factory per chart, the
+ * types catch a misspelled value, a remote chart is read through an injected
+ * fetch, and editing a local chart's schema without regenerating is drift.
+ * The one step that renders needs the helm binary and is skipped without it.
+ */
+import { afterAll, describe, expect, test } from "vitest";
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { gzipSync } from "node:zlib";
+import ts from "typescript";
+import { buildCommand } from "@intentius/chant/cli/commands/build";
+import { loadPlugins } from "@intentius/chant/cli";
+import { loadChantConfig } from "@intentius/chant/config";
+import { checkProjectCodegen, generateProjectCode } from "@intentius/chant/project-codegen";
+import { helmPlugin } from "./plugin";
+import { factoryBase, helmProjectCodegen } from "./project-codegen";
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
+const made: string[] = [];
+afterAll(() => {
+  for (const dir of made) rmSync(dir, { recursive: true, force: true });
+});
+
+function helmOnPath(): boolean {
+  try {
+    execFileSync("helm", ["version"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const EDGE_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  type: "object",
+  additionalProperties: false,
+  required: ["image"],
+  properties: {
+    image: { $ref: "#/$defs/image" },
+    logLevel: { type: "string", enum: ["debug", "info", "error"] },
+    ports: {
+      type: "object",
+      additionalProperties: {
+        type: "object",
+        additionalProperties: false,
+        properties: { port: { type: "integer" }, expose: { type: "boolean" } },
+      },
+    },
+    podLabels: { type: "object", additionalProperties: { type: "string" } },
+    "app.kubernetes.io/part-of": { type: "string" },
+    "use-forwarded-headers": { type: "boolean" },
+    replicas: { oneOf: [{ type: "integer" }, { type: "string", pattern: "^auto$" }] },
+  },
+  $defs: {
+    image: {
+      type: "object",
+      additionalProperties: false,
+      required: ["repository"],
+      properties: { repository: { type: "string" }, tag: { type: "string" } },
+    },
+  },
+};
+
+const EDGE_VALUES = `image:\n  repository: nginx\n  tag: "1.27"\nlogLevel: info\nports:\n  web:\n    port: 8000\n`;
+const EDGE_TEMPLATE = `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-settings
+data:
+  image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+  logLevel: {{ .Values.logLevel | quote }}
+`;
+
+const PLAIN_VALUES = `replicaCount: 1\nservice:\n  type: ClusterIP\n  port: 80\nextraEnv: []\nresources:\n`;
+
+/** A minimal ustar writer, enough to stand in for a chart archive. */
+function tarGz(entries: Array<{ name: string; body: string }>): Buffer {
+  const blocks: Buffer[] = [];
+  for (const { name, body } of entries) {
+    const data = Buffer.from(body, "utf8");
+    const header = Buffer.alloc(512);
+    header.write(name, 0, "utf8");
+    header.write("0000644\0", 100);
+    header.write("0000000\0", 108);
+    header.write("0000000\0", 116);
+    header.write(data.length.toString(8).padStart(11, "0") + "\0", 124);
+    header.write("00000000000\0", 136);
+    header.write("        ", 148);
+    header.write("0", 156);
+    header.write("ustar\0", 257);
+    header.write("00", 263);
+    let sum = 0;
+    for (const b of header) sum += b;
+    header.write(sum.toString(8).padStart(6, "0") + "\0 ", 148);
+    blocks.push(header, data, Buffer.alloc((512 - (data.length % 512)) % 512));
+  }
+  blocks.push(Buffer.alloc(1024));
+  return gzipSync(Buffer.concat(blocks));
+}
+
+/** A classic chart repository at https://charts.example.test serving one chart, as a fetch. */
+function fakeRepository(): { fetch: typeof fetch; seen: string[] } {
+  const tgz = tarGz([
+    { name: "remote/Chart.yaml", body: "apiVersion: v2\nname: remote\nversion: 1.2.3\n" },
+    { name: "remote/values.yaml", body: "enabled: true\nmode: fast\n" },
+    { name: "remote/charts/sub/Chart.yaml", body: "apiVersion: v2\nname: sub\nversion: 0.1.0\n" },
+  ]);
+  const index = `apiVersion: v1\nentries:\n  remote:\n    - version: 1.2.3\n      urls: [remote-1.2.3.tgz]\n      digest: ${createHash("sha256").update(tgz).digest("hex")}\n`;
+  const seen: string[] = [];
+  const fake = (async (input: string | URL | Request) => {
+    const url = String(input);
+    seen.push(url);
+    if (url === "https://charts.example.test/index.yaml") return new Response(index);
+    if (url === "https://charts.example.test/remote-1.2.3.tgz") return new Response(new Uint8Array(tgz));
+    return new Response("not found", { status: 404 });
+  }) as typeof fetch;
+  return { fetch: fake, seen };
+}
+
+function project(): string {
+  const root = mkdtempSync(join(tmpdir(), "chant-helm-codegen-"));
+  made.push(root);
+  mkdirSync(join(root, ".git"));
+  mkdirSync(join(root, "src"));
+  const edge = join(root, "charts", "edge");
+  mkdirSync(join(edge, "templates"), { recursive: true });
+  writeFileSync(join(edge, "Chart.yaml"), "apiVersion: v2\nname: edge\nversion: 0.3.0\n");
+  writeFileSync(join(edge, "values.yaml"), EDGE_VALUES);
+  writeFileSync(join(edge, "values.schema.json"), JSON.stringify(EDGE_SCHEMA, null, 2));
+  writeFileSync(join(edge, "templates", "configmap.yaml"), EDGE_TEMPLATE);
+  const plain = join(root, "charts", "plain");
+  mkdirSync(plain, { recursive: true });
+  writeFileSync(join(plain, "Chart.yaml"), "apiVersion: v2\nname: plain\nversion: 2.0.0\n");
+  writeFileSync(join(plain, "values.yaml"), PLAIN_VALUES);
+  writeFileSync(
+    join(root, "chant.config.ts"),
+    `export default {
+  lexicons: ["helm", "k8s"],
+  helm: {
+    charts: {
+      edge: { path: "charts/edge" },
+      "plain-app": { path: "charts/plain" },
+      remote: { repo: "https://charts.example.test", chart: "remote", version: "1.2.3" },
+    },
+  },
+};
+`,
+  );
+  symlinkSync(join(repoRoot, "node_modules"), join(root, "node_modules"), "dir");
+  return root;
+}
+
+async function config(root: string): Promise<Record<string, unknown>> {
+  return (await loadChantConfig(root)).config as unknown as Record<string, unknown>;
+}
+
+let previousProgram: ts.Program | undefined;
+
+function typecheck(root: string, app: string): string[] {
+  writeFileSync(join(root, "src", "app.ts"), app);
+  const options: ts.CompilerOptions = {
+    strict: true,
+    noEmit: true,
+    skipLibCheck: true,
+    target: ts.ScriptTarget.ES2022,
+    module: ts.ModuleKind.ESNext,
+    moduleResolution: ts.ModuleResolutionKind.Bundler,
+    customConditions: ["development"],
+    types: ["node"],
+    typeRoots: [join(repoRoot, "node_modules", "@types")],
+  };
+  const files = [join(root, "src", "app.ts"), join(root, "src", "generated", "helm", "index.ts")];
+  // Reusing the previous program skips re-parsing the lexicon sources.
+  const program = ts.createProgram(files, options, undefined, previousProgram);
+  previousProgram = program;
+  return files
+    .flatMap((f) => [...program.getSyntacticDiagnostics(program.getSourceFile(f)), ...program.getSemanticDiagnostics(program.getSourceFile(f))])
+    .map((d) => ts.flattenDiagnosticMessageText(d.messageText, "\n"));
+}
+
+describe("typed Helm values (helm.charts)", () => {
+  test("factory names come from the chart key", () => {
+    expect(factoryBase("traefik")).toBe("Traefik");
+    expect(factoryBase("ingress-nginx")).toBe("IngressNginx");
+    expect(factoryBase("cert_manager")).toBe("CertManager");
+  });
+
+  test("generate writes a values type and a factory per chart, and the types catch bad values", async () => {
+    const root = project();
+    const repository = fakeRepository();
+    const result = await generateProjectCode(helmPlugin, root, await config(root), { fetch: repository.fetch });
+    expect(result?.files).toEqual(["index.ts"]);
+    expect(result?.summary).toEqual([
+      "EdgeRender (edge 0.3.0, values from values.schema.json)",
+      "PlainAppRender (plain 2.0.0, values from values.yaml)",
+      "RemoteRender (remote 1.2.3, values from values.yaml)",
+    ]);
+    expect(repository.seen).toEqual(["https://charts.example.test/index.yaml", "https://charts.example.test/remote-1.2.3.tgz"]);
+
+    const module = readFileSync(join(root, "src", "generated", "helm", "index.ts"), "utf8");
+    expect(module).toContain("export type EdgeValuesImage = {");
+    expect(module).toContain("  image?: EdgeValuesImage;");
+    expect(module).toContain(`  "app.kubernetes.io/part-of"?: string;`);
+    expect(module).toContain(`  logLevel?: "debug" | "info" | "error";`);
+    expect(module).toContain("  replicas?: number | string;");
+    expect(module).toContain(`chart: chartPath("../../../charts/edge"),`);
+    expect(module).toContain(`repo: "https://charts.example.test",`);
+    expect(module).toContain(`version: "1.2.3",`);
+    expect(module).toContain("export type RemoteValues = {\n  enabled?: boolean;\n  mode?: string;\n};");
+
+    const good = `import { EdgeRender, PlainAppRender, RemoteRender } from "./generated/helm";
+export const edge = EdgeRender({
+  name: "edge",
+  namespace: "edge",
+  values: { image: { tag: "1.28" }, ports: { web: { port: 9000 } }, podLabels: { team: "a" }, "use-forwarded-headers": true },
+});
+export const plain = PlainAppRender({ name: "plain", values: { service: { port: 8080 }, resources: { limits: {} } } });
+export const remote = RemoteRender({ name: "remote", values: { mode: "slow" } });
+`;
+    expect(typecheck(root, good)).toEqual([]);
+
+    const bad = (values: string) => `import { EdgeRender, PlainAppRender } from "./generated/helm";
+export const x = ${values.startsWith("plain:") ? `PlainAppRender({ name: "p", values: ${values.slice(6)} })` : `EdgeRender({ name: "e", values: ${values} })`};
+`;
+    expect(typecheck(root, bad(`{ imgae: { tag: "x" } }`)).join("\n")).toMatch(/'imgae' does not exist/);
+    expect(typecheck(root, bad(`{ ports: { web: { prot: 1 } } }`)).join("\n")).toMatch(/'prot' does not exist/);
+    expect(typecheck(root, bad(`{ logLevel: "verbose" }`))).not.toEqual([]);
+    expect(typecheck(root, bad(`plain:{ service: { prot: 1 } }`)).join("\n")).toMatch(/'prot' does not exist/);
+    // The chart is fixed by the config, not by the caller.
+    expect(typecheck(root, bad(`{}, version: "9.9.9"`))).not.toEqual([]);
+  }, 120_000);
+
+  test("editing a local chart's schema without regenerating is drift; a remote chart is checked by its pin", async () => {
+    const root = project();
+    const repository = fakeRepository();
+    await generateProjectCode(helmPlugin, root, await config(root), { fetch: repository.fetch });
+    expect(await checkProjectCodegen(helmPlugin, root, await config(root))).toEqual({ status: "current" });
+
+    // The check is offline: the remote chart is not fetched again.
+    expect(repository.seen).toHaveLength(2);
+
+    const schemaPath = join(root, "charts", "edge", "values.schema.json");
+    writeFileSync(schemaPath, readFileSync(schemaPath, "utf8").replace('"error"', '"warn"'));
+    const check = await checkProjectCodegen(helmPlugin, root, await config(root));
+    expect(check.status).toBe("drift");
+  });
+
+  test("a remote chart needs a version and a repo or an oci reference", () => {
+    const codegen = helmProjectCodegen();
+    const ctx = (charts: Record<string, unknown>) => ({ projectRoot: "/p", outDir: "/p/out", config: { helm: { charts } } });
+    expect(() => codegen.inputs(ctx({ a: { repo: "https://x.test", chart: "a", version: "" } }))).toThrow(/needs a version/);
+    expect(() => codegen.inputs(ctx({ a: { chart: "a", version: "1.0.0" } }))).toThrow(/needs a repo, or must be an oci:\/\/ reference/);
+    expect(() => codegen.inputs(ctx({ "1a": { chart: "oci://x.test/a", version: "1.0.0" } }))).toThrow(/must start with a letter/);
+  });
+
+  test("an archive whose digest does not match the repository index is refused", async () => {
+    const codegen = helmProjectCodegen();
+    const tampered = (async (input: string | URL | Request) => {
+      const url = String(input);
+      if (url.endsWith("index.yaml")) {
+        return new Response(`entries:\n  r:\n    - version: 1.0.0\n      urls: [r.tgz]\n      digest: ${"0".repeat(64)}\n`);
+      }
+      return new Response(new Uint8Array(tarGz([{ name: "r/Chart.yaml", body: "name: r\nversion: 1.0.0\n" }])));
+    }) as typeof fetch;
+    await expect(
+      codegen.generate({
+        projectRoot: "/p",
+        outDir: "/p/out",
+        config: { helm: { charts: { r: { repo: "https://r.test", chart: "r", version: "1.0.0" } } } },
+        fetch: tampered,
+      }),
+    ).rejects.toThrow(/the repository index says 0{64}/);
+  });
+
+  test.skipIf(!helmOnPath())("a generated factory renders its local chart in a build", async () => {
+    const root = project();
+    // Only the local chart, so the build needs no network.
+    writeFileSync(
+      join(root, "chant.config.ts"),
+      `export default { lexicons: ["helm", "k8s"], helm: { charts: { edge: { path: "charts/edge" } } } };\n`,
+    );
+    await generateProjectCode(helmPlugin, root, await config(root));
+    writeFileSync(
+      join(root, "src", "app.ts"),
+      `import { EdgeRender } from "./generated/helm";\nexport const edge = EdgeRender({ name: "edge", namespace: "edge", noCache: true, values: { image: { repository: "nginx", tag: "1.28" }, logLevel: "debug" } });\n`,
+    );
+    const plugins = await loadPlugins(["helm", "k8s"]);
+    const output = join(root, "out.yaml");
+    const result = await buildCommand({
+      path: join(root, "src"),
+      output,
+      format: "yaml",
+      serializers: plugins.map((p) => p.serializer).filter((s) => s.name === "k8s"),
+      plugins,
+    });
+    expect(result.errors).toEqual([]);
+    const yamlOut = readFileSync(output, "utf8");
+    expect(yamlOut).toContain("image: nginx:1.28");
+    expect(yamlOut).toContain("logLevel: debug");
+  }, 120_000);
+});

package/src/project-codegen.ts

@@ -0,0 +1,253 @@
+/**
+ * Typed Helm values: the helm lexicon's `projectCodegen` hook (`chant
+ * generate`, core's project-codegen.ts).
+ *
+ * For each chart a project lists under `helm.charts`, generation reads the
+ * chart's `values.schema.json` (or, without one, its `values.yaml`) and writes
+ * to `<outDir>/helm/index.ts`:
+ *
+ * - `<Name>Values`, the values type: from the schema, with every member
+ *   optional (the schema validates the values Helm merges with the chart's
+ *   defaults, so a key it requires is usually already set), or inferred from
+ *   `values.yaml` (./codegen/values-type.ts).
+ * - `<Name>Render(props)`, a factory that calls `HelmRender` with the repo,
+ *   chart and version from the config, so the type and the version it was
+ *   generated from cannot drift apart. It takes `HelmRender`'s other props.
+ *
+ * A remote chart is downloaded without the helm binary: an `oci://` chart
+ * through the registry API, a classic repository through its `index.yaml`.
+ * Both go through `ctx.fetch` when the caller passes one.
+ */
+
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { join, relative, resolve, sep } from "node:path";
+import yaml from "js-yaml";
+import { GENERATED_TS_HEADER, type ProjectCodegen, type ProjectCodegenContext } from "@intentius/chant/project-codegen";
+import { jsdocLines, schemaToTypeScript } from "@intentius/chant/codegen/json-schema-to-ts";
+import { fetchWithRetry } from "@intentius/chant/codegen/fetch";
+import { pullOciChart, readTarGz } from "@intentius/chant-lexicon-k8s/crd/oci-chart";
+import { CHART_KEY_PATTERN, type HelmProjectChart } from "./config";
+import { inferValuesType } from "./codegen/values-type";
+
+/** The chart files generation reads. */
+export interface ChartFiles {
+  chartYaml: string;
+  valuesYaml?: string;
+  valuesSchema?: string;
+}
+
+type RemoteChart = Extract<HelmProjectChart, { chart: string }>;
+
+/** Download a remote chart's files. Tests replace it. */
+export type ChartPuller = (chart: RemoteChart, fetchImpl: typeof fetch | undefined) => Promise<ChartFiles>;
+
+const CHART_FILES = ["Chart.yaml", "values.yaml", "values.schema.json"] as const;
+
+/** The hook, with an injectable puller for remote charts. */
+export function helmProjectCodegen(options: { pull?: ChartPuller } = {}): ProjectCodegen {
+  const pull = options.pull ?? pullRemoteChart;
+  return {
+    inputs(ctx) {
+      const charts = declaredCharts(ctx);
+      if (!charts) return undefined;
+      return Object.fromEntries(charts.map(([key, chart]) => [key, describeChart(key, chart, ctx.projectRoot)]));
+    },
+
+    async generate(ctx) {
+      const charts = declaredCharts(ctx) ?? [];
+      const blocks: string[] = [];
+      const summary: string[] = [];
+      for (const [key, chart] of charts) {
+        describeChart(key, chart, ctx.projectRoot); // validates before any download
+        const files = "path" in chart ? readLocalChart(resolve(ctx.projectRoot, chart.path)) : await pull(chart, ctx.fetch);
+        const generated = renderChart(key, chart, files, ctx);
+        blocks.push(generated.code);
+        summary.push(generated.summary);
+      }
+      const local = charts.some(([, chart]) => "path" in chart);
+      return { files: { "index.ts": renderModule(blocks, local) }, summary };
+    },
+  };
+}
+
+function declaredCharts(ctx: ProjectCodegenContext): Array<[string, HelmProjectChart]> | undefined {
+  const charts = (ctx.config.helm as { charts?: Record<string, HelmProjectChart> } | undefined)?.charts;
+  if (!charts || Object.keys(charts).length === 0) return undefined;
+  return Object.entries(charts).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+}
+
+/**
+ * A chart as a JSON value for the drift digest: a local chart by the hashes
+ * of the files generation reads, a remote one by its pin.
+ */
+function describeChart(key: string, chart: HelmProjectChart, projectRoot: string): Record<string, unknown> {
+  if (!CHART_KEY_PATTERN.test(key)) {
+    throw new Error(`helm.charts.${key}: the key names the generated factory, so it must start with a letter and hold only letters, digits, - and _`);
+  }
+  if ("path" in chart) {
+    const dir = resolve(projectRoot, chart.path);
+    if (!existsSync(join(dir, "Chart.yaml"))) throw new Error(`helm.charts.${key}: no Chart.yaml in ${chart.path}`);
+    const hashes: Record<string, string> = {};
+    for (const file of CHART_FILES) {
+      const path = join(dir, file);
+      if (existsSync(path)) hashes[file] = createHash("sha256").update(readFileSync(path)).digest("hex");
+    }
+    return { path: chart.path, files: hashes };
+  }
+  if (!chart.version) {
+    throw new Error(`helm.charts.${key}: ${chart.chart} needs a version. An unpinned chart makes the generated types depend on when they were generated.`);
+  }
+  if (!chart.repo && !chart.chart.startsWith("oci://")) {
+    throw new Error(`helm.charts.${key}: ${chart.chart} needs a repo, or must be an oci:// reference`);
+  }
+  return {
+    ...(chart.repo ? { repo: chart.repo } : {}),
+    chart: chart.chart,
+    version: chart.version,
+    ...(chart.digest ? { digest: chart.digest } : {}),
+  };
+}
+
+function readLocalChart(dir: string): ChartFiles {
+  const read = (f: string) => (existsSync(join(dir, f)) ? readFileSync(join(dir, f), "utf8") : undefined);
+  return { chartYaml: read("Chart.yaml")!, valuesYaml: read("values.yaml"), valuesSchema: read("values.schema.json") };
+}
+
+/** The top-level chart's files out of a chart archive (subcharts are ignored). */
+export function chartFilesFromArchive(files: Map<string, Buffer>, label: string): ChartFiles {
+  const chartYamlPath = [...files.keys()].find((p) => p.split("/").length === 2 && p.endsWith("/Chart.yaml"));
+  if (!chartYamlPath) throw new Error(`${label}: the archive has no top-level Chart.yaml`);
+  const dir = chartYamlPath.split("/")[0];
+  const read = (f: string) => files.get(`${dir}/${f}`)?.toString("utf8");
+  return { chartYaml: read("Chart.yaml")!, valuesYaml: read("values.yaml"), valuesSchema: read("values.schema.json") };
+}
+
+/** Download a remote chart: OCI through the registry API, a classic repository through its index. */
+export async function pullRemoteChart(chart: RemoteChart, fetchImpl: typeof fetch | undefined): Promise<ChartFiles> {
+  const label = `${chart.repo ? `${chart.repo} ` : ""}${chart.chart} ${chart.version}`;
+  if (!chart.repo) {
+    const http = fetchImpl ? { probe: fetchImpl, get: fetchImpl } : undefined;
+    const tgz = await pullOciChart(chart.chart, chart.version, chart.digest, http);
+    return chartFilesFromArchive(readTarGz(tgz), label);
+  }
+
+  const get = async (url: string): Promise<Response> => {
+    const response = fetchImpl ? await fetchImpl(url) : await fetchWithRetry(url);
+    if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`);
+    return response;
+  };
+  const base = chart.repo.endsWith("/") ? chart.repo : `${chart.repo}/`;
+  // Failsafe: every scalar stays a string, so a digest of all digits or a
+  // version like 1.10 is read as written.
+  const index = yaml.load(await (await get(new URL("index.yaml", base).href)).text(), { schema: yaml.FAILSAFE_SCHEMA }) as {
+    entries?: Record<string, Array<{ version?: string; urls?: string[]; digest?: string }>>;
+  };
+  const entry = index?.entries?.[chart.chart]?.find((e) => e.version === chart.version);
+  if (!entry?.urls?.length) throw new Error(`${label}: not in the repository's index.yaml`);
+  const tgz = Buffer.from(await (await get(new URL(entry.urls[0], base).href)).arrayBuffer());
+  const digest = createHash("sha256").update(tgz).digest("hex");
+  if (entry.digest && entry.digest !== digest) {
+    throw new Error(`${label}: the archive's sha256 is ${digest}, but the repository index says ${entry.digest}`);
+  }
+  if (chart.digest && chart.digest.replace(/^sha256:/, "") !== digest) {
+    throw new Error(`${label}: the archive's sha256 is ${digest}, but the config pins ${chart.digest}`);
+  }
+  return chartFilesFromArchive(readTarGz(tgz), label);
+}
+
+/** `ingress-nginx` -> `IngressNginx`. */
+export function factoryBase(key: string): string {
+  return key
+    .split(/[^A-Za-z0-9]+/)
+    .filter(Boolean)
+    .map((p) => p.charAt(0).toUpperCase() + p.slice(1))
+    .join("");
+}
+
+function renderChart(
+  key: string,
+  chart: HelmProjectChart,
+  files: ChartFiles,
+  ctx: ProjectCodegenContext,
+): { code: string; summary: string } {
+  const meta = (yaml.load(files.chartYaml) ?? {}) as { name?: string; version?: string };
+  const base = factoryBase(key);
+  const valuesName = `${base}Values`;
+  const fnName = `${base}Render`;
+
+  const local = "path" in chart;
+  const chartName = local ? chart.path : chart.chart;
+  // A local chart is located from the generated module, so the render finds
+  // it whatever directory the build runs in.
+  const chartExpr = local
+    ? `chartPath(${JSON.stringify(relative(ctx.outDir, resolve(ctx.projectRoot, chart.path)).split(sep).join("/"))})`
+    : JSON.stringify(chart.chart);
+  const version = local ? meta.version : chart.version;
+  if (!version) throw new Error(`helm.charts.${key}: ${chartName} has no version in Chart.yaml`);
+  const repo = local ? "" : (chart.repo ?? "");
+  const from = local ? `the chart at ${chartName}` : `${chart.chart} ${version}${chart.repo ? ` from ${chart.repo}` : ""}`;
+
+  const lines: string[] = [];
+  let source: string;
+  if (files.valuesSchema) {
+    let schema: unknown;
+    try {
+      schema = JSON.parse(files.valuesSchema);
+    } catch (err) {
+      throw new Error(`helm.charts.${key}: values.schema.json does not parse: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const { type, declarations } = schemaToTypeScript(schema, { allOptional: true, namePrefix: valuesName, rootName: valuesName });
+    for (const d of declarations) lines.push(...jsdocLines(d.description, ""), `export type ${d.name} = ${d.type};`, "");
+    lines.push(`/** Values for ${from}, from its values.schema.json. */`, `export type ${valuesName} = ${type};`);
+    source = "values.schema.json";
+  } else {
+    let values: unknown;
+    try {
+      values = files.valuesYaml ? yaml.load(files.valuesYaml) : undefined;
+    } catch (err) {
+      throw new Error(`helm.charts.${key}: values.yaml does not parse: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    lines.push(`/** Values for ${from}, inferred from its values.yaml defaults. */`, `export type ${valuesName} = ${inferValuesType(values)};`);
+    source = files.valuesYaml ? "values.yaml" : "no values file";
+  }
+
+  lines.push(
+    "",
+    `/** \`${fnName}\`'s props: \`HelmRender\`'s, with the chart fixed by chant.config and \`values\` typed. */`,
+    `export type ${fnName}Props = Omit<HelmRenderProps, "repo" | "chart" | "version" | "values"> & { values?: ${valuesName} };`,
+    "",
+    `/** Render ${from}. */`,
+    `export function ${fnName}(props: ${fnName}Props) {`,
+    "  return HelmRender({",
+    "    ...props,",
+    `    repo: ${JSON.stringify(repo)},`,
+    `    chart: ${chartExpr},`,
+    `    version: ${JSON.stringify(version)},`,
+    "    values: props.values as Record<string, unknown> | undefined,",
+    "  });",
+    "}",
+  );
+  return { code: lines.join("\n"), summary: `${fnName} (${meta.name ?? chartName} ${version}, values from ${source})` };
+}
+
+function renderModule(blocks: string[], local: boolean): string {
+  return [
+    GENERATED_TS_HEADER,
+    "// Typed render factories for the charts helm.charts declares in chant.config.",
+    ...(local ? ['import { relative } from "node:path";', 'import { fileURLToPath } from "node:url";'] : []),
+    'import { HelmRender, type HelmRenderProps } from "@intentius/chant-lexicon-helm";',
+    ...(local
+      ? [
+          "",
+          "/** A chart directory given relative to this module, as a path from the working directory. */",
+          "function chartPath(fromHere: string): string {",
+          '  return relative(process.cwd(), fileURLToPath(new URL(fromHere, import.meta.url))) || ".";',
+          "}",
+        ]
+      : []),
+    "",
+    blocks.join("\n\n"),
+    "",
+  ].join("\n");
+}

package/src/render.test.ts

@@ -11,6 +11,8 @@ import { helmContentDigest, helmInputDigest, renderStability } from "./render-di
 import { loadRenderManifest } from "./render-store";
 import { clearValuesProbeRecords, getValuesProbeRecords } from "./values-probe";
 import { whm504 } from "./lint/post-synth/whm504";
+import type { Declarable } from "@intentius/chant/declarable";
+import { k8sSerializer } from "@intentius/chant-lexicon-k8s/serializer";
 
 const FIXTURE_DIR = join(tmpdir(), "chant-helm-render-fixture");
 const CHART_DIR = join(FIXTURE_DIR, "tiny-chart");
@@ -668,3 +670,117 @@ describe.skipIf(!fixtureAvailable)("coalesced-values probe wired into the render
     expect(diags[0].message).toContain("target no subchart");
   });
 });
+
+/**
+ * Patches on a render (#3566), against a scripted `helm` double that prints
+ * a recorded render, so no real helm binary, chart or network is involved.
+ */
+describe("HelmRender patches", () => {
+  const FAKE_BIN = join(tmpdir(), "chant-helm-render-patch-bin");
+  let origPath: string | undefined;
+
+  beforeAll(() => {
+    mkdirSync(FAKE_BIN, { recursive: true });
+    writeFileSync(
+      join(FAKE_BIN, "helm"),
+      `#!/bin/sh
+cat <<'EOF'
+---
+# Source: widget/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rel-widget
+  namespace: widgets
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+      - name: app
+        image: example.com/widget:1.0
+---
+# Source: widget/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: rel-widget
+  namespace: widgets
+spec:
+  ports:
+  - port: 80
+EOF
+`,
+      { mode: 0o755 },
+    );
+  });
+
+  beforeEach(() => {
+    origPath = process.env.PATH;
+    process.env.PATH = FAKE_BIN + delimiter + (origPath ?? "");
+    clearHelmRenderRecords();
+  });
+
+  afterEach(() => {
+    process.env.PATH = origPath;
+  });
+
+  function memberProps(result: ReturnType<typeof HelmRender>, key: string): Record<string, unknown> {
+    const member = (result.members as Record<string, { props: Record<string, unknown> }>)[key];
+    expect(member).toBeDefined();
+    return member.props;
+  }
+
+  test("a merge patch and a JSON patch change the rendered documents before they become members", () => {
+    const result = HelmRender({
+      name: "rel",
+      chart: "/dev/null/widget",
+      noCache: true,
+      patches: [
+        { kind: "Deployment", name: "rel-widget", namespace: "widgets", merge: { spec: { replicas: 3 } } },
+        {
+          kind: "Service",
+          name: "rel-widget",
+          jsonPatch: [
+            { op: "test", path: "/spec/ports/0/port", value: 80 },
+            { op: "add", path: "/spec/ports/0/name", value: "http" },
+            { op: "add", path: "/metadata/annotations", value: { "example.com/scrape": "true" } },
+          ],
+        },
+      ],
+    } as Parameters<typeof HelmRender>[0]);
+
+    expect((memberProps(result, "Deployment_rel_widget").spec as { replicas: number }).replicas).toBe(3);
+    const service = memberProps(result, "Service_rel_widget");
+    expect((service.spec as { ports: unknown[] }).ports).toEqual([{ port: 80, name: "http" }]);
+    expect((service.metadata as { annotations: unknown }).annotations).toEqual({ "example.com/scrape": "true" });
+  });
+
+  test("the patched form is what the k8s serializer emits", () => {
+    const result = HelmRender({
+      name: "rel",
+      chart: "/dev/null/widget",
+      noCache: true,
+      patches: [{ kind: "Deployment", name: "rel-widget", merge: { spec: { replicas: 7 } } }],
+    } as Parameters<typeof HelmRender>[0]);
+    const entities = new Map(Object.entries(result.members as Record<string, Declarable>));
+    const out = k8sSerializer.serialize(entities);
+    const yamlText = typeof out === "string" ? out : out.primary;
+    expect(yamlText).toContain("replicas: 7");
+    expect(yamlText).not.toContain("replicas: 1");
+  });
+
+  test("a selector matching no rendered document fails the render, naming it", () => {
+    expect(() =>
+      HelmRender({
+        name: "rel",
+        chart: "/dev/null/widget",
+        version: "1.2.0",
+        noCache: true,
+        patches: [{ kind: "Deployment", name: "widget", merge: { spec: { replicas: 2 } } }],
+      } as Parameters<typeof HelmRender>[0]),
+    ).toThrow(
+      /HelmRender "rel" \(\/dev\/null\/widget@1\.2\.0\): patch 0 \(kind Deployment, name widget\) matched no document\. Deployment documents present: widgets\/rel-widget\./,
+    );
+  });
+});

package/src/render.ts

@@ -42,6 +42,7 @@ import { Composite } from "@intentius/chant";
 // arbitrary K8s manifests. The k8s serializer reads props.apiVersion and
 // props.kind verbatim when set, so the actual class doesn't matter.
 import { Deployment } from "@intentius/chant-lexicon-k8s/generated/index";
+import { applyRenderedPatches, type RenderedPatch } from "@intentius/chant-lexicon-k8s/patch/rendered-patch";
 import yaml from "js-yaml";
 
 import { resolveCapabilityProfile, type HelmCapabilityProfile, type HelmCapabilityProfileRef } from "./config";
@@ -109,6 +110,18 @@ export interface HelmRenderProps {
    * means the manifest records `sourceRef: null`.
    */
   sourceRef?: string;
+  /**
+   * Patches applied to the rendered documents before they become entities
+   * (#3566): select by kind and name (namespace and apiVersion optional) and
+   * apply an RFC 6902 `jsonPatch` or an RFC 7386 `merge`. The patched form is
+   * what the build emits and what `lifecycle diff --live` compares. A
+   * selector matching no rendered document fails the build, so a chart
+   * upgrade that renames a resource is noticed.
+   *
+   * Patches act on the parsed render, after caching and digests: the render
+   * store and `contentDigest` still describe helm's own output.
+   */
+  patches?: RenderedPatch[];
 }
 
 // The invocation-record ledger lives in ./render-records.ts — a module with
@@ -427,7 +440,11 @@ export const HelmRender = Composite<HelmRenderProps>((props) => {
   const valuesProbe = profile ? runValuesProbeBestEffort(props) : undefined;
 
   const yamlText = profile ? loadOrRenderPinned(props, profile, valuesProbe) : loadOrRender(props, undefined);
-  const docs = parseMultiDoc(yamlText);
+  const docs = applyRenderedPatches(
+    parseMultiDoc(yamlText),
+    props.patches,
+    `HelmRender "${props.name}" (${props.chart}${props.version ? `@${props.version}` : ""})`,
+  ) as RenderedDoc[];
 
   // Digests are recorded only for pinned renders (#1237). Profile presence
   // is the v1 gate: the classifier (#1234) needs the chart source on disk,