@intentius/chant-lexicon-helm 0.124.31 → 0.124.33

package/dist/pinnability/actions.js

@@ -0,0 +1,207 @@
+/**
+ * Go template action extraction and control-flow scoping (#1234, epic #1228).
+ *
+ * The pinnability gate inspects template ACTIONS (`{{ ... }}`), never raw
+ * text. That distinction is finding 9: cert-manager carries 52 textual
+ * "lookup" occurrences, all comment prose, and a real template-action count
+ * of 0 — a text-matching gate refuses a chart that is perfectly pinnable.
+ *
+ * Beyond extraction, this module reconstructs the control-flow structure of a
+ * template file — which `if` / `with` / `range` blocks enclose each action —
+ * so the classifier can ask whether a construct is REACHABLE under the
+ * supplied values, not merely present. Reachability is what separates
+ * "unpinnable" from "pinnable with a recorded conditional hazard": bundled
+ * grafana's control-flow `lookup` sits behind `persistence.enabled`, off by
+ * default, so a default-values render never consults the cluster.
+ */
+const KIND_RE = /^(if\b|else\s+if\b|else\b|with\b|range\b|define\b|block\b|end\b)/;
+function kindOf(body) {
+    const m = body.match(KIND_RE);
+    if (!m)
+        return "other";
+    const kw = m[1].replace(/\s+/g, " ").trim();
+    if (kw === "else if")
+        return "elseif";
+    return kw.replace(/\b\s.*$/, "");
+}
+/**
+ * Extract template actions from a source file, skipping comment actions
+ * (`{{/* ... *\/}}`). Text outside actions — including YAML `#` comments,
+ * where finding 9's 52 false positives lived — is never inspected by any
+ * scan built on this.
+ */
+export function extractActions(source, file) {
+    const actions = [];
+    let i = 0;
+    let line = 1;
+    let lineScanPos = 0;
+    const lineAt = (pos) => {
+        // Incremental line counting: `pos` is monotonically increasing.
+        for (; lineScanPos < pos; lineScanPos++) {
+            if (source[lineScanPos] === "\n")
+                line += 1;
+        }
+        return line;
+    };
+    while (i < source.length) {
+        const open = source.indexOf("{{", i);
+        if (open === -1)
+            break;
+        const actionLine = lineAt(open);
+        // Body starts after `{{` and an optional trim marker.
+        let bodyStart = open + 2;
+        if (source[bodyStart] === "-")
+            bodyStart += 1;
+        const rest = source.slice(bodyStart);
+        // Comment action: {{/* ... */}} — skip to its closing */}}.
+        if (/^\s*\/\*/.test(rest)) {
+            const closeComment = source.indexOf("*/", bodyStart);
+            if (closeComment === -1)
+                break;
+            const close = source.indexOf("}}", closeComment);
+            i = close === -1 ? source.length : close + 2;
+            continue;
+        }
+        const close = source.indexOf("}}", bodyStart);
+        if (close === -1)
+            break;
+        let body = source.slice(bodyStart, close);
+        if (body.endsWith("-"))
+            body = body.slice(0, -1);
+        body = body.trim();
+        actions.push({ file, line: actionLine, body, kind: kindOf(body) });
+        i = close + 2;
+    }
+    return actions;
+}
+/**
+ * The pipeline of an action, structural keyword and variable assignment
+ * stripped: `if X` → `X`, `range $i, $v := X` → `X`, `$pw := X` → `X`.
+ * This is what condition evaluation and call-reachability parse.
+ */
+export function actionPipeline(action) {
+    let expr = action.body.replace(KIND_RE, "").trim();
+    // `range $i, $v := .Values.x` / `$pw := .Values.x` — the pipeline is what
+    // follows the assignment.
+    const assign = expr.match(/^\$[\w]*\s*(?:,\s*\$[\w]*\s*)?:?=\s*(.*)$/);
+    if (assign)
+        expr = assign[1].trim();
+    return expr;
+}
+/** `.Values.a.b` (or `$.Values.a.b`) as a path array, else undefined. */
+function valuesPathOf(expr) {
+    const m = expr.match(/^\$?\.Values((?:\.[A-Za-z0-9_-]+)+)$/);
+    return m ? m[1].slice(1).split(".") : undefined;
+}
+/**
+ * Walk a file's actions and attach the enclosing control-flow frames to each.
+ * `else` / `else if` branches carry the prior branch conditions as
+ * `negatedConditions`. Structure that cannot be tracked (an unbalanced
+ * `end`, template text split across files) degrades to fewer frames — which
+ * only ever makes the classifier MORE conservative, never less: a missing
+ * frame means a gate we cannot prove closed.
+ */
+export function scopeActions(actions) {
+    const scoped = [];
+    const stack = [];
+    for (const action of actions) {
+        switch (action.kind) {
+            case "if": {
+                const cond = actionPipeline(action);
+                // The `if` action itself is evaluated in the ENCLOSING scope.
+                scoped.push({ action, frames: stack.map((s) => s.frame) });
+                stack.push({
+                    frame: { kind: "if", conditions: [cond], negatedConditions: [] },
+                    chain: [cond],
+                });
+                break;
+            }
+            case "elseif": {
+                scoped.push({
+                    action,
+                    frames: stack.slice(0, -1).map((s) => s.frame),
+                });
+                const top = stack[stack.length - 1];
+                const cond = action.body.replace(/^else\s+if\b/, "").trim();
+                if (top) {
+                    top.frame = {
+                        kind: "if",
+                        conditions: [cond],
+                        negatedConditions: [...top.chain],
+                    };
+                    top.chain.push(cond);
+                }
+                break;
+            }
+            case "else": {
+                scoped.push({
+                    action,
+                    frames: stack.slice(0, -1).map((s) => s.frame),
+                });
+                const top = stack[stack.length - 1];
+                if (top) {
+                    top.frame = {
+                        kind: top.frame.kind === "if" ? "if" : top.frame.kind,
+                        conditions: [],
+                        negatedConditions: [...top.chain],
+                    };
+                }
+                break;
+            }
+            case "with": {
+                const expr = actionPipeline(action);
+                scoped.push({ action, frames: stack.map((s) => s.frame) });
+                const path = valuesPathOf(expr);
+                stack.push({
+                    frame: {
+                        kind: "with",
+                        conditions: [expr],
+                        negatedConditions: [],
+                        dotValuesPath: path,
+                        dotUnresolvable: path === undefined,
+                    },
+                    chain: [expr],
+                });
+                break;
+            }
+            case "range": {
+                const expr = actionPipeline(action);
+                scoped.push({ action, frames: stack.map((s) => s.frame) });
+                stack.push({
+                    frame: {
+                        kind: "range",
+                        conditions: [expr],
+                        negatedConditions: [],
+                        dotUnresolvable: true,
+                    },
+                    chain: [expr],
+                });
+                break;
+            }
+            case "define":
+            case "block": {
+                scoped.push({ action, frames: stack.map((s) => s.frame) });
+                // A define body runs with whatever context `include`/`template`
+                // passes. Most charts pass the root context; the frame records
+                // nothing to gate on, so constructs inside a define are treated as
+                // reachable unless gated within the define itself.
+                stack.push({
+                    frame: { kind: action.kind, conditions: [], negatedConditions: [] },
+                    chain: [],
+                });
+                break;
+            }
+            case "end": {
+                scoped.push({
+                    action,
+                    frames: stack.slice(0, -1).map((s) => s.frame),
+                });
+                stack.pop();
+                break;
+            }
+            default:
+                scoped.push({ action, frames: stack.map((s) => s.frame) });
+        }
+    }
+    return scoped;
+}

package/dist/pinnability/classify.js

@@ -0,0 +1,416 @@
+/**
+ * The pinnability gate (#1234, epic #1228 Phase 1).
+ *
+ * A render is pinnable exactly when every input to it is closed. `helm
+ * template` has three inputs beyond (chart, values) that are silently
+ * defaulted or silently empty:
+ *
+ *   - cluster capabilities   — closable via --kube-version / --api-versions
+ *   - generated values       — closable by supplying the value as an input
+ *   - cluster state (lookup) — not closable offline
+ *
+ * The gate is therefore not "is this chart deterministic" but "are all of
+ * this render's inputs closed" — a property of `(chart, values)`, not of the
+ * chart alone. Concretely:
+ *
+ *   - A control-flow `lookup` that is REACHABLE under the supplied values is
+ *     a hard refusal: it changes which documents exist, and no value
+ *     substitution recovers that.
+ *   - A control-flow `lookup` the supplied values leave gated OFF is a
+ *     recorded conditional hazard, not a refusal — bundled grafana's
+ *     `lookup` behind `persistence.enabled: false` never runs, so the
+ *     render is pinnable; flipping that value re-classifies the pair.
+ *   - Value-position `lookup` is a declared-input requirement (epic
+ *     Decisions): it changes a field, not the document set.
+ *   - `.Capabilities.*` references require an explicit capability profile —
+ *     the default is a property of the helm BINARY (3.16.2 says v1.31.0,
+ *     4.1.1 says v1.35.0), so an unpinned render's digest depends on who
+ *     rendered it. 11 of the 13 survey charts hit this; it is the normal
+ *     case, not an error.
+ *   - Generated values (`randAlphaNum` and friends) are detected statically
+ *     and named; the double-render localizer (#1236) confirms them
+ *     dynamically. They classify as closable when a `.Values` path in the
+ *     same action can supply them.
+ *
+ * A chart that fails is refused with the specific construct and location,
+ * and keeps working unpinned. Adoption is incremental.
+ */
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { actionPipeline, extractActions, scopeActions, } from "./actions.js";
+import { UNKNOWN, callReachability, evaluateCondition, truthy, } from "./conditions.js";
+import { buildChartInstances, mergeValues, readYamlFile, valueAtPath, } from "./values.js";
+/**
+ * Matches a call to the `lookup` template function: the word `lookup`
+ * followed by whitespace (it always takes arguments), not preceded by a word
+ * character, `.` or `$` — so `.Values.persistence.lookupVolumeName` (a value
+ * named after the feature, present in grafana) is not a hit. Finding 9's
+ * word-boundary lesson: `\blookup\b` false-positives on the very chart the
+ * refusal is about.
+ */
+const LOOKUP_CALL = /(?<![.\w$])lookup\s/;
+const LOOKUP_FN = /^lookup$/;
+/**
+ * Template functions whose output differs per render: sprig's random and
+ * crypto generators, plus `now`. Detected statically so the classifier can
+ * NAME the open input; the double-render localizer (#1236) is what proves
+ * one fired.
+ */
+const GENERATED_VALUE_FNS = [
+    "randAlphaNum",
+    "randAlpha",
+    "randNumeric",
+    "randAscii",
+    "randBytes",
+    "randInt",
+    "uuidv4",
+    "derivePassword",
+    "genPrivateKey",
+    "genCA",
+    "genCAWithKey",
+    "genSelfSignedCert",
+    "genSelfSignedCertWithKey",
+    "genSignedCert",
+    "genSignedCertWithKey",
+    "htpasswd",
+    "bcrypt",
+    "now",
+];
+const GENERATED_CALL = new RegExp(`(?<![.\\w$])(${GENERATED_VALUE_FNS.join("|")})\\b`);
+const CAPABILITY_REF = /\.Capabilities\.(KubeVersion|APIVersions)/g;
+/** Structural kinds whose pipeline decides which documents exist. */
+const CONTROL_FLOW_KINDS = new Set(["if", "elseif", "with", "range"]);
+const VALUES_PATH_IN_ACTION = /\$?\.Values((?:\.[A-Za-z0-9_-]+)+)/;
+/**
+ * Template files of ONE chart directory — `templates/` at any depth below
+ * it, excluding `charts/` (subcharts are their own instances) and NOTES.txt
+ * (rendered for the console, not the cluster).
+ */
+export function collectOwnTemplateFiles(chartDir) {
+    const out = [];
+    const walk = (dir, underTemplates) => {
+        for (const entry of readdirSync(dir)) {
+            const p = join(dir, entry);
+            if (statSync(p).isDirectory()) {
+                if (entry === "charts" && !underTemplates)
+                    continue;
+                walk(p, underTemplates || entry === "templates");
+                continue;
+            }
+            if (!underTemplates)
+                continue;
+            if (entry === "NOTES.txt")
+                continue;
+            if (/\.(ya?ml|tpl)$/.test(entry))
+                out.push(p);
+        }
+    };
+    walk(chartDir, false);
+    return out;
+}
+function scanDir(chartDir) {
+    return collectOwnTemplateFiles(chartDir)
+        .sort()
+        .map((file) => {
+        const rel = file.slice(chartDir.length + 1);
+        return { rel, scoped: scopeActions(extractActions(readFileSync(file, "utf8"), rel)) };
+    });
+}
+// --- gating ----------------------------------------------------------------
+/**
+ * Walk the enclosing frames of an action and decide whether the supplied
+ * values leave it unreachable. Returns the gates that close it, or null when
+ * every frame is (or may be) open — in which case the construct counts as
+ * reachable.
+ */
+function framesGate(frames, instance) {
+    // Dot binding threads through the frames: `with .Values.persistence`
+    // rebinds bare `.enabled` to `persistence.enabled` for everything inside.
+    let dot = null;
+    let allKnown = true;
+    for (const frame of frames) {
+        const ctx = {
+            values: instance.values,
+            scope: instance.scope,
+            dotValuesPath: dot,
+        };
+        for (const cond of frame.conditions) {
+            const r = evaluateCondition(cond, ctx);
+            if (r.value === false)
+                return { gates: r.gates, allKnown };
+            if (r.value === UNKNOWN)
+                allKnown = false;
+        }
+        for (const negated of frame.negatedConditions) {
+            // An else/else-if branch runs only when every earlier condition was
+            // false; a definitively TRUE earlier condition closes the branch.
+            const r = evaluateCondition(negated, ctx);
+            if (r.value === true) {
+                const m = negated.match(VALUES_PATH_IN_ACTION);
+                return {
+                    gates: m
+                        ? [{ path: [...instance.scope, ...m[1].slice(1).split(".")].join("."), value: true }]
+                        : [],
+                    allKnown,
+                };
+            }
+            if (r.value === UNKNOWN)
+                allKnown = false;
+        }
+        if (frame.kind === "with")
+            dot = frame.dotUnresolvable ? undefined : (frame.dotValuesPath ?? undefined);
+        else if (frame.kind === "range")
+            dot = undefined;
+        else if (frame.kind === "define" || frame.kind === "block")
+            dot = null;
+    }
+    return { gates: null, allKnown };
+}
+/** Reachability of a function call inside an action, frames + same-action gates. */
+function assessCall(scopedAction, fnRe, instance) {
+    if (instance.disabledBy !== undefined) {
+        return {
+            reachable: false,
+            gates: [{ path: instance.disabledBy, value: false }],
+        };
+    }
+    const enclosing = framesGate(scopedAction.frames, instance);
+    if (enclosing.gates !== null)
+        return { reachable: false, gates: enclosing.gates };
+    // Same-action short-circuit gating: `if and .Values.gate (lookup ...)`
+    // never calls lookup when the gate is false.
+    let dot = null;
+    for (const frame of scopedAction.frames) {
+        if (frame.kind === "with")
+            dot = frame.dotUnresolvable ? undefined : (frame.dotValuesPath ?? undefined);
+        else if (frame.kind === "range")
+            dot = undefined;
+        else if (frame.kind === "define" || frame.kind === "block")
+            dot = null;
+    }
+    const ctx = { values: instance.values, scope: instance.scope, dotValuesPath: dot };
+    const inAction = callReachability(actionPipeline(scopedAction.action), fnRe, ctx);
+    // An enclosing gate we could not resolve leaves reachability unproven even
+    // when nothing in the action itself gates the call.
+    if (inAction.reachable === true && !enclosing.allKnown) {
+        return { reachable: UNKNOWN, gates: [] };
+    }
+    return inAction;
+}
+// --- classification --------------------------------------------------------
+/**
+ * Classify a chart directory against the values a render would be given.
+ * Subchart-recursive: dependencies vendored under `charts/` are scanned with
+ * their own effective values (aliases get their own scope, `condition:`-
+ * disabled dependencies gate their contents — findings 11 and 12).
+ */
+export function classifyChart(chartDir, options = {}) {
+    let supplied;
+    for (const file of options.valuesFiles ?? []) {
+        supplied = mergeValues(supplied ?? {}, readYamlFile(file));
+    }
+    if (options.values !== undefined)
+        supplied = mergeValues(supplied ?? {}, options.values);
+    const valuesSupplied = supplied !== undefined;
+    const { instances, warnings } = buildChartInstances(chartDir, supplied);
+    const requiresProfile = [];
+    const valuePosition = [];
+    const controlFlowSites = new Map();
+    const generatedSites = new Map();
+    const dirScans = new Map();
+    const staticallyRecordedDirs = new Set();
+    for (const instance of instances) {
+        let files = dirScans.get(instance.dir);
+        if (files === undefined) {
+            files = scanDir(instance.dir);
+            dirScans.set(instance.dir, files);
+        }
+        // Static findings (capability refs, value-position lookups) are
+        // per-FILE: an aliased dependency scans the same directory for two
+        // instances but its files exist once.
+        const recordStatic = !staticallyRecordedDirs.has(instance.dir);
+        staticallyRecordedDirs.add(instance.dir);
+        for (const { rel, scoped } of files) {
+            const file = instance.relDir === "" ? rel : `${instance.relDir}/${rel}`;
+            for (const s of scoped) {
+                const { action } = s;
+                if (recordStatic) {
+                    for (const m of action.body.matchAll(CAPABILITY_REF)) {
+                        requiresProfile.push({
+                            file,
+                            line: action.line,
+                            capability: m[1],
+                        });
+                    }
+                }
+                if (LOOKUP_CALL.test(action.body)) {
+                    if (CONTROL_FLOW_KINDS.has(action.kind)) {
+                        const key = `${file}:${action.line}`;
+                        let site = controlFlowSites.get(key);
+                        if (site === undefined) {
+                            site = { file, line: action.line, action: action.body, assessments: [] };
+                            controlFlowSites.set(key, site);
+                        }
+                        const a = assessCall(s, LOOKUP_FN, instance);
+                        site.assessments.push({
+                            chart: instance.scope.join("."),
+                            reachable: a.reachable,
+                            gates: a.gates,
+                        });
+                    }
+                    else if (recordStatic) {
+                        valuePosition.push({ file, line: action.line, action: action.body });
+                    }
+                }
+                const gen = action.body.match(GENERATED_CALL);
+                if (gen !== null) {
+                    const a = assessCall(s, new RegExp(`^${gen[1]}$`), instance);
+                    // A generator whose enclosing gates are definitively closed cannot
+                    // fire for this render; re-classification on a values flip
+                    // rediscovers it.
+                    if (a.reachable !== false) {
+                        const valuesRef = action.body.match(VALUES_PATH_IN_ACTION);
+                        // A value closes a generator only through the `x | default
+                        // (rand)` shape, where a truthy x discards the generated result.
+                        // A generator that CONSUMES values (`htpasswd .Values.user
+                        // .Values.password` — random salt per render) stays open no
+                        // matter what the values hold, so the path it reads is not a
+                        // suppliable slot; the localizer (#1236) finds the real pin
+                        // (harbor's `registry.credentials.htpasswdString` else-branch).
+                        const closable = valuesRef !== null && /\bdefault\b/.test(action.body);
+                        const relPath = closable && valuesRef ? valuesRef[1].slice(1).split(".") : undefined;
+                        // Open unless the suppliable value is already set (a truthy
+                        // value makes `x | default (randAlphaNum ...)` deterministic).
+                        const open = relPath === undefined || !truthy(valueAtPath(instance.values, relPath));
+                        const key = `${file}:${action.line}:${gen[1]}`;
+                        const existing = generatedSites.get(key);
+                        if (existing === undefined) {
+                            generatedSites.set(key, {
+                                file,
+                                line: action.line,
+                                fn: gen[1],
+                                open,
+                                valuesPath: relPath ? [...instance.scope, ...relPath].join(".") : undefined,
+                                suppliable: relPath !== undefined,
+                            });
+                        }
+                        else if (open) {
+                            existing.open = true;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    // --- fold findings into the report ---------------------------------------
+    const reasons = [];
+    const hazards = [];
+    const controlFlow = [];
+    let refusals = 0;
+    for (const site of controlFlowSites.values()) {
+        const reachableIn = site.assessments.filter((a) => a.reachable !== false);
+        if (reachableIn.length > 0) {
+            refusals += 1;
+            controlFlow.push({
+                file: site.file,
+                line: site.line,
+                action: site.action,
+                status: "refused",
+                charts: site.assessments.map((a) => a.chart),
+            });
+            for (const a of reachableIn) {
+                const where = a.chart === "" ? "" : ` (subchart ${a.chart})`;
+                const proof = a.reachable === UNKNOWN
+                    ? "not provably gated off by the supplied values"
+                    : "reachable with the supplied values";
+                reasons.push(`lookup in control flow at ${site.file}:${site.line}${where} — ${proof}; which documents exist depends on cluster state`);
+            }
+        }
+        else {
+            controlFlow.push({
+                file: site.file,
+                line: site.line,
+                action: site.action,
+                status: "hazard",
+                charts: site.assessments.map((a) => a.chart),
+            });
+            for (const a of site.assessments) {
+                const gateText = a.gates.map((g) => `${g.path}=${JSON.stringify(g.value ?? null)}`).join(", ");
+                hazards.push({
+                    chart: a.chart,
+                    file: site.file,
+                    line: site.line,
+                    gates: a.gates,
+                    detail: `control-flow lookup at ${site.file}:${site.line} is gated off by ${gateText} — flipping it makes this render unpinnable`,
+                });
+            }
+        }
+    }
+    // The report stays fully populated even for a refused chart: the caller
+    // renders unpinned and still benefits from knowing the other open inputs.
+    const closedInputs = [];
+    if (requiresProfile.length > 0) {
+        reasons.push(`declare capability profile (${requiresProfile.length} .Capabilities refs)`);
+    }
+    for (const v of valuePosition) {
+        closedInputs.push({
+            kind: "value-position-lookup",
+            file: v.file,
+            line: v.line,
+            suppliable: true,
+            detail: `declare input for value-position lookup at ${v.file}:${v.line}`,
+        });
+        reasons.push(`declare input for value-position lookup at ${v.file}:${v.line}`);
+    }
+    for (const g of generatedSites.values()) {
+        if (!g.open)
+            continue;
+        const supply = g.suppliable
+            ? `suppliable via ${g.valuesPath}`
+            : "no suppliable value found in the action — the double-render localizer (#1236) must confirm and localize it";
+        closedInputs.push({
+            kind: "generated-value",
+            file: g.file,
+            line: g.line,
+            fn: g.fn,
+            valuesPath: g.valuesPath,
+            suppliable: g.suppliable,
+            detail: `open generated input ${g.fn} at ${g.file}:${g.line} — ${supply}`,
+        });
+        reasons.push(`open generated input ${g.fn} at ${g.file}:${g.line} — ${supply}`);
+    }
+    if (options.renderEvidence !== undefined && !options.renderEvidence.stable) {
+        reasons.push(`open generated input: double render differs on ${options.renderEvidence.unstableLines} lines — supply the value(s) as declared inputs`);
+    }
+    for (const h of hazards) {
+        reasons.push(`conditional hazard: ${h.detail}`);
+    }
+    if (valuesSupplied) {
+        closedInputs.push({ kind: "supplied-values", detail: "values supplied as closed input" });
+        reasons.push("values supplied as closed input");
+    }
+    for (const w of warnings)
+        reasons.push(`warning: ${w}`);
+    let verdict;
+    if (refusals > 0) {
+        verdict = "unpinnable";
+    }
+    else if (requiresProfile.length > 0 ||
+        closedInputs.length > 0 ||
+        hazards.length > 0 ||
+        (options.renderEvidence !== undefined && !options.renderEvidence.stable)) {
+        verdict = "pinnable";
+    }
+    else {
+        verdict = "deterministic";
+    }
+    return {
+        verdict,
+        requiresProfile,
+        closedInputs,
+        hazards,
+        reasons,
+        lookups: { controlFlow, valuePosition },
+        warnings,
+    };
+}

package/dist/pinnability/index.js

@@ -0,0 +1,16 @@
+/**
+ * Pinnability gate for helm renders (#1234, epic #1228 Phase 1).
+ *
+ * `classifyChart` is the entry point the pinned-render pipeline
+ * (#1235–#1240) calls before anything is pinned; the survey harness
+ * (lexicons/helm/test/survey) asserts its verdicts over a corpus of real
+ * upstream charts. This module deliberately imports nothing from the
+ * lexicon's generated artifacts, so it loads on a fresh clone and in the
+ * survey CI job without a generation step.
+ */
+export { classifyChart, collectOwnTemplateFiles, } from "./classify.js";
+export { actionPipeline, extractActions, scopeActions, } from "./actions.js";
+export { UNKNOWN, truthy, evaluateCondition, callReachability, parseExpr, } from "./conditions.js";
+export { buildChartInstances, mergeValues, valueAtPath, readChartMeta, } from "./values.js";
+export { splitDocuments, sourcePath, isCrdSource, routeBySource, countDifferingLines, } from "./render-stream.js";
+export { localizeOpenInputs, diffRenderPair, } from "./localize.js";