@intentius/chant-lexicon-helm 0.124.48 → 0.124.50

package/dist/config.d.ts

@@ -98,6 +98,18 @@ export interface HelmChantConfig {
      * ```
      */
     charts?: Record<string, HelmProjectChart>;
+    /**
+     * One workspace member read into the graph (#3179). `chant workspace graph`
+     * writes this into the reader project it makes for a `helm-chart` member; it
+     * is not meant to be written by hand. `dir` is the chart directory, absolute;
+     * `label` names the entities, the member's name. The chart is rendered with
+     * `helm template`; with no `helm` binary the graph carries no objects for it
+     * and says why on `meta.helmMember`.
+     */
+    member?: {
+        dir: string;
+        label?: string;
+    };
 }
 /**
  * One `helm.charts` entry: a chart in a classic repository (`repo` + `chart`),
@@ -139,6 +151,10 @@ export declare const helmConfigSchema: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         path: z.ZodString;
     }, z.core.$strict>]>>>;
+    member: z.ZodOptional<z.ZodObject<{
+        dir: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 declare module "@intentius/chant/config" {
     interface ChantConfig {

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAI3D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAyB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,gGAAgG;AAChG,MAAM,WAAW,qBAAsB,SAAQ,2BAA2B;IACxE,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,qBAAqB,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACjE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB,eAAO,MAAM,2BAA2B;;;kBAKtC,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,QAA6B,CAAC;AAE5D,eAAO,MAAM,sBAAsB;;;;;;;oBAQjC,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;kBAK3B,CAAC;AAEH,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,IAAI,CAAC,EAAE,eAAe,CAAC;KACxB;CACF;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAEnE;;;GAGG;AACH,KAAK,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,SAAS,eAAe,GAClF,eAAe,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GACtD,IAAI,GACJ,KAAK,GACP,KAAK,CAAC;AACV,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEhE;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAyBlF;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,wBAAwB,EAC7B,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,qBAAqB,CAyBvB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAI3D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAyB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,gGAAgG;AAChG,MAAM,WAAW,qBAAsB,SAAQ,2BAA2B;IACxE,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,qBAAqB,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACjE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC1C;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB,eAAO,MAAM,2BAA2B;;;kBAKtC,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,QAA6B,CAAC;AAE5D,eAAO,MAAM,sBAAsB;;;;;;;oBAQjC,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;kBAM3B,CAAC;AAEH,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,IAAI,CAAC,EAAE,eAAe,CAAC;KACxB;CACF;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAEnE;;;GAGG;AACH,KAAK,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,SAAS,eAAe,GAClF,eAAe,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GACtD,IAAI,GACJ,KAAK,GACP,KAAK,CAAC;AACV,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEhE;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAyBlF;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,wBAAwB,EAC7B,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,qBAAqB,CAyBvB"}

package/dist/config.js

@@ -73,6 +73,7 @@ export const helmConfigSchema = z.strictObject({
     charts: z
         .record(z.string().regex(CHART_KEY_PATTERN, "must start with a letter and hold only letters, digits, - and _"), helmProjectChartSchema)
         .optional(),
+    member: z.strictObject({ dir: z.string().min(1), label: z.string().optional() }).optional(),
 });
 /**
  * Validate a resolved profile's fields. Returns one message per problem,

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "fea472989ef2a5c19660740b6ba32a98b8eb1e9531fbd209eb0f4801c9a2c3ef",
+    "manifest.json": "f807993cfc0f8ea40bde723a3934e777b82c7ac0914de9b17bddfd2fc9a0c1be",
     "meta.json": "14243c5730a07c6a6edc35ddd351438547d58df5cf345f2233a355b0c7611ccc",
     "types/index.d.ts": "5377696ca8698cd2999e4680feb8e8e4b54a7b49fb603a87b2f27356114d1794",
     "rules/chart-metadata.ts": "3ac9183a3bd42c657d1c4b7e45ddb302a75baf126d62284fa9d6f6226c2734cc",
@@ -36,5 +36,5 @@
     "skills/chant-helm-patterns.md": "9e79e6a46391da46709d8aa57e2825a7cd9eb981cd923f02ad60836c49b2561e",
     "skills/chant-helm-security.md": "bfc367eabceed2e84f1cf94501b407df78aeed963cec104f24a321d0962063c9"
   },
-  "composite": "9354c1eeabaf9b11c7efbeef98f008967855a6e7cd849da17dbc1e961a12d7ca"
+  "composite": "86dc1a4c881ab01e2ebc60a50d21f9fed06118f6482a2c871adf56d6deaf7980"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "helm",
-  "version": "0.124.48",
+  "version": "0.124.50",
   "chantVersion": ">=0.1.0",
   "namespace": "Helm",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAkB7F,eAAO,MAAM,UAAU,EAAE,aA6cxB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAmB7F,eAAO,MAAM,UAAU,EAAE,aA4dxB,CAAC"}

package/dist/plugin.js

@@ -17,6 +17,7 @@ import { helmSerializer } from "./serializer.js";
 import { helmCompletions } from "./lsp/completions.js";
 import { helmHover } from "./lsp/hover.js";
 import { helmConfigSchema } from "./config.js";
+import { lastMemberReport, readHelmMember, setLastMemberReport } from "./workspace-member.js";
 import { helmProjectCodegen } from "./project-codegen.js";
 import { helmDeepNormalizationHooks } from "./deep-observe-hooks.js";
 import { LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
@@ -38,6 +39,21 @@ export const helmPlugin = {
     ownershipChannel: { keys: LABEL_OWNERSHIP_KEYS, reads: ["describeResources", "observeResourcesDeep"] },
     auditCatalog: () => helmAuditCatalog,
     serializer: helmSerializer,
+    // A helm-chart workspace member's reader project (#3179): `helm template`
+    // over the chart, the rendered objects as nodes. See ./workspace-member.ts.
+    async buildRoots(ctx) {
+        setLastMemberReport(undefined);
+        const member = ctx.config.helm?.member;
+        if (!member)
+            return { entities: new Map() };
+        const read = await readHelmMember({ member });
+        setLastMemberReport(read.report);
+        return { entities: read.entities, warnings: read.warnings };
+    },
+    graphMeta() {
+        const report = lastMemberReport();
+        return report ? { helmMember: report } : undefined;
+    },
     // #1248 (epic #1228 Phase 6, via the #1078 seam) — `chant helm` mounts the
     // pinned-render surface: the pinnability gate (#1234), the double-render
     // localizer (#1236), and the recorded-render listing with digests (#1237).

package/dist/workspace-member.d.ts

@@ -0,0 +1,37 @@
+import type { Declarable } from "@intentius/chant/declarable";
+export interface HelmMemberConfig {
+    /** The chart directory, absolute. */
+    dir: string;
+    /** Names the entities (`<label>/deploymentWeb`): the member's name. */
+    label?: string;
+}
+/** What the read found, carried on the graph's `meta.helmMember`. */
+export interface HelmMemberReport {
+    rendered: boolean;
+    /** Why nothing was read; set with `rendered: false`. */
+    reason?: string;
+    objects: number;
+}
+/** Runs the helm binary with these arguments. Injectable so tests need no binary. */
+export type HelmRunner = (args: string[]) => Promise<{
+    stdout: string;
+}>;
+export declare const defaultHelmRunner: HelmRunner;
+/** The exact render argv: the release is named for the chart directory. */
+export declare function helmTemplateArgs(dir: string): string[];
+export declare function readHelmMember(opts: {
+    member: HelmMemberConfig;
+    run?: HelmRunner;
+}): Promise<{
+    entities: Map<string, Declarable>;
+    warnings: string[];
+    report: HelmMemberReport;
+}>;
+/**
+ * The report of the read in this process. `graphMeta` receives only the
+ * entities, so the hook that read the member leaves its report here for the
+ * hook that publishes it; `chant graph` runs the two in order in one process.
+ */
+export declare function setLastMemberReport(report: HelmMemberReport | undefined): void;
+export declare function lastMemberReport(): HelmMemberReport | undefined;
+//# sourceMappingURL=workspace-member.d.ts.map

package/dist/workspace-member.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-member.d.ts","sourceRoot":"","sources":["../src/workspace-member.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAK9D,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEzE,eAAO,MAAM,iBAAiB,EAAE,UAAmF,CAAC;AAEpH,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEtD;AAMD,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,gBAAgB,CAAC;IACzB,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC,CA0B/F;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,GAAG,IAAI,CAE9E;AAED,wBAAgB,gBAAgB,IAAI,gBAAgB,GAAG,SAAS,CAE/D"}

package/dist/workspace-member.js

@@ -0,0 +1,67 @@
+/**
+ * Reading a helm-chart workspace member into the graph (#3179).
+ *
+ * `chant workspace graph` writes a reader project for a member of kind
+ * `helm-chart`, with `helm.member` in its config (see `workspace-kinds.json`).
+ * The plugin's `buildRoots` hook calls {@link readHelmMember}: `helm template`
+ * over the chart directory, and the rendered objects are the member's nodes.
+ *
+ * With no `helm` binary the member contributes no objects, and its report says
+ * `rendered: false` with the reason. A render the binary ran and refused (a
+ * template that doesn't parse, a dependency that isn't built) is not that case
+ * and throws, so a broken chart is never a quiet empty graph.
+ */
+import { execFile } from "node:child_process";
+import { basename } from "node:path";
+import { promisify } from "node:util";
+import { loadAll } from "js-yaml";
+import { addRenderedEntity, renderedManifestEntity } from "@intentius/chant-lexicon-k8s/kustomize/rendered-entity";
+const execFileAsync = promisify(execFile);
+export const defaultHelmRunner = (args) => execFileAsync("helm", args, { maxBuffer: 64 * 1024 * 1024 });
+/** The exact render argv: the release is named for the chart directory. */
+export function helmTemplateArgs(dir) {
+    return ["template", basename(dir) || "release", dir];
+}
+function isMissingBinary(err) {
+    return err?.code === "ENOENT" || /ENOENT|command not found/.test(err instanceof Error ? err.message : String(err));
+}
+export async function readHelmMember(opts) {
+    const { member } = opts;
+    const label = member.label ?? basename(member.dir);
+    const entities = new Map();
+    const warnings = [];
+    let stdout;
+    try {
+        ({ stdout } = await (opts.run ?? defaultHelmRunner)(helmTemplateArgs(member.dir)));
+    }
+    catch (err) {
+        if (!isMissingBinary(err))
+            throw err;
+        const reason = `Cannot render chart "${member.dir}": the \`helm\` binary was not found on PATH. Install helm and retry.`;
+        warnings.push(`helm-chart member "${label}" was not rendered: ${reason}`);
+        return { entities, warnings, report: { rendered: false, reason, objects: 0 } };
+    }
+    for (const doc of loadAll(stdout)) {
+        if (!doc || typeof doc !== "object" || Array.isArray(doc))
+            continue;
+        const entity = renderedManifestEntity(doc, label);
+        if (!entity) {
+            warnings.push(`helm-chart member "${label}" rendered a document without apiVersion/kind; skipped`);
+            continue;
+        }
+        addRenderedEntity(entities, label, entity);
+    }
+    return { entities, warnings, report: { rendered: true, objects: entities.size } };
+}
+let lastReport;
+/**
+ * The report of the read in this process. `graphMeta` receives only the
+ * entities, so the hook that read the member leaves its report here for the
+ * hook that publishes it; `chant graph` runs the two in order in one process.
+ */
+export function setLastMemberReport(report) {
+    lastReport = report;
+}
+export function lastMemberReport() {
+    return lastReport;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-helm",
-  "version": "0.124.48",
+  "version": "0.124.50",
   "description": "Helm chart lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -23,12 +23,15 @@
   "type": "module",
   "files": [
     "src/",
-    "dist/"
+    "dist/",
+    "schemas/",
+    "workspace-kinds.json"
   ],
   "publishConfig": {
     "access": "public"
   },
   "exports": {
+    "./workspace-kinds": "./workspace-kinds.json",
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
@@ -77,7 +80,7 @@
     "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   },
   "dependencies": {
-    "@intentius/chant-lexicon-k8s": "^0.124.48",
+    "@intentius/chant-lexicon-k8s": "^0.124.50",
     "js-yaml": "^4.3.1"
   },
   "devDependencies": {
@@ -86,7 +89,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.48",
+    "@intentius/chant": "^0.124.50",
     "zod": "^4.3.6"
   }
 }

package/schemas/chart.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Chart.yaml",
+  "type": "object",
+  "required": [
+    "apiVersion",
+    "name",
+    "version"
+  ],
+  "properties": {
+    "apiVersion": {
+      "enum": [
+        "v1",
+        "v2"
+      ]
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1
+    },
+    "version": {
+      "type": "string",
+      "minLength": 1
+    },
+    "type": {
+      "enum": [
+        "application",
+        "library"
+      ]
+    }
+  }
+}

package/src/config.ts

@@ -107,6 +107,15 @@ export interface HelmChantConfig {
    * ```
    */
   charts?: Record<string, HelmProjectChart>;
+  /**
+   * One workspace member read into the graph (#3179). `chant workspace graph`
+   * writes this into the reader project it makes for a `helm-chart` member; it
+   * is not meant to be written by hand. `dir` is the chart directory, absolute;
+   * `label` names the entities, the member's name. The chart is rendered with
+   * `helm template`; with no `helm` binary the graph carries no objects for it
+   * and says why on `meta.helmMember`.
+   */
+  member?: { dir: string; label?: string };
 }
 
 /**
@@ -143,6 +152,7 @@ export const helmConfigSchema = z.strictObject({
   charts: z
     .record(z.string().regex(CHART_KEY_PATTERN, "must start with a letter and hold only letters, digits, - and _"), helmProjectChartSchema)
     .optional(),
+  member: z.strictObject({ dir: z.string().min(1), label: z.string().optional() }).optional(),
 });
 
 declare module "@intentius/chant/config" {

package/src/plugin.ts

@@ -20,6 +20,7 @@ import { helmSerializer } from "./serializer";
 import { helmCompletions } from "./lsp/completions";
 import { helmHover } from "./lsp/hover";
 import { helmConfigSchema } from "./config";
+import { lastMemberReport, readHelmMember, setLastMemberReport } from "./workspace-member";
 import { helmProjectCodegen } from "./project-codegen";
 import { helmDeepNormalizationHooks } from "./deep-observe-hooks";
 import { LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
@@ -43,6 +44,21 @@ export const helmPlugin: LexiconPlugin = {
   auditCatalog: () => helmAuditCatalog,
   serializer: helmSerializer,
 
+  // A helm-chart workspace member's reader project (#3179): `helm template`
+  // over the chart, the rendered objects as nodes. See ./workspace-member.ts.
+  async buildRoots(ctx) {
+    setLastMemberReport(undefined);
+    const member = (ctx.config as { helm?: { member?: { dir: string; label?: string } } }).helm?.member;
+    if (!member) return { entities: new Map() };
+    const read = await readHelmMember({ member });
+    setLastMemberReport(read.report);
+    return { entities: read.entities, warnings: read.warnings };
+  },
+  graphMeta() {
+    const report = lastMemberReport();
+    return report ? { helmMember: report } : undefined;
+  },
+
   // #1248 (epic #1228 Phase 6, via the #1078 seam) — `chant helm` mounts the
   // pinned-render surface: the pinnability gate (#1234), the double-render
   // localizer (#1236), and the recorded-render listing with digests (#1237).

package/src/testdata/web-chart/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+name: web
+version: 0.1.0

package/src/testdata/web-chart/templates/deployment.yaml

@@ -0,0 +1,6 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}

package/src/testdata/web-chart/values.yaml

@@ -0,0 +1 @@
+replicas: 2

package/src/workspace-kinds.test.ts

@@ -0,0 +1,37 @@
+/**
+ * The helm-chart member kind this lexicon supplies to a chant workspace
+ * (#3179): data in `workspace-kinds.json`, exported at `./workspace-kinds`.
+ */
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { describeWorkspaceKindConformance } from "@intentius/chant-test-utils";
+import { checkMemberFile, loadMemberFileSchema, readPackageKinds } from "../../../packages/core/src/workspace/kinds";
+
+const packageDir = join(import.meta.dirname, "..");
+
+/** What each kind's own file must do: pass for a good one, fail for a bad one (#3672). */
+function memberFileChecks(kind: string, good: string, bad: string): void {
+  describe(`${kind} member file`, () => {
+    const memberFile = readPackageKinds(packageDir).kinds.find((k) => k.name === kind)!.memberFile!;
+    it("names a schema that loads", () => {
+      expect(loadMemberFileSchema(memberFile, packageDir)).toBeUndefined();
+    });
+    it("passes a valid file", () => {
+      expect(checkMemberFile(memberFile, memberFile.path, good)).toEqual([]);
+    });
+    it("fails an invalid one", () => {
+      expect(checkMemberFile(memberFile, memberFile.path, bad).length).toBeGreaterThan(0);
+    });
+  });
+}
+
+describeWorkspaceKindConformance({
+  packageDir,
+  scenarios: [
+    { name: "a chart", kind: "helm-chart", files: { "Chart.yaml": "apiVersion: v2\nname: web\nversion: 0.1.0\n", "values.yaml": "" }, claims: true },
+    { name: "a chart whose templates sit one level down", kind: "helm-chart", files: { "web/Chart.yaml": "apiVersion: v2\nname: web\nversion: 0.1.0\n" }, claims: false },
+    { name: "values without a Chart.yaml", kind: "helm-chart", files: { "values.yaml": "a: 1\n" }, claims: false },
+  ],
+});
+
+memberFileChecks("helm-chart", "apiVersion: v2\nname: web\nversion: 0.1.0\n", "apiVersion: v3\nname: web\n");

package/src/workspace-member.test.ts

@@ -0,0 +1,140 @@
+/**
+ * The helm-chart member kind's graph block (#3179). The test builds the reader
+ * project the way chant workspace graph does (the kind's graph config,
+ * placeholders substituted, written to a chant.config.json) and runs chant
+ * graph over it. The render is a canned runner, so no test needs helm; the last
+ * test uses the real binary when one is installed.
+ */
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { execFileSync } from "node:child_process";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import type { GraphIR } from "@intentius/chant/graph-ir";
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+import { runGraph } from "@intentius/chant/cli/handlers/graph";
+import { readPackageKinds, substituteGraphConfig } from "../../../packages/core/src/workspace/kinds";
+import { helmPlugin } from "./plugin";
+import { helmTemplateArgs, readHelmMember, setLastMemberReport, type HelmMemberConfig, type HelmRunner } from "./workspace-member";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const packageDir = join(here, "..");
+const chart = join(here, "testdata", "web-chart");
+
+const RENDERED = `---
+# Source: web/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web-chart
+spec:
+  replicas: 2
+---
+# Source: web/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: web-chart
+spec:
+  ports:
+    - port: 80
+`;
+
+const noBinary: HelmRunner = async () => {
+  throw Object.assign(new Error("spawn helm ENOENT"), { code: "ENOENT" });
+};
+
+function pluginWith(run?: HelmRunner): LexiconPlugin {
+  if (!run) return helmPlugin;
+  return {
+    ...helmPlugin,
+    buildRoots: async (ctx) => {
+      const member = (ctx.config as { helm?: { member?: HelmMemberConfig } }).helm?.member;
+      setLastMemberReport(undefined);
+      if (!member) return { entities: new Map() };
+      const read = await readHelmMember({ member, run });
+      setLastMemberReport(read.report);
+      return { entities: read.entities, warnings: read.warnings };
+    },
+  };
+}
+
+const scratch: string[] = [];
+afterEach(async () => {
+  vi.restoreAllMocks();
+  await Promise.all(scratch.splice(0).map((d) => rm(d, { recursive: true, force: true })));
+});
+
+async function graphOf(plugin: LexiconPlugin): Promise<{ ir: GraphIR; err: string[]; exit: number }> {
+  const graph = readPackageKinds(packageDir).kinds.find((k) => k.name === "helm-chart")!.graph!;
+  expect(graph.lexicon).toBe("helm");
+  const config = substituteGraphConfig(graph.config, { member: "web", dir: chart, workspace: dirname(chart) });
+  const project = await mkdtemp(join(tmpdir(), "chant-helm-member-"));
+  scratch.push(project);
+  await writeFile(join(project, "chant.config.json"), JSON.stringify({ lexicons: ["helm"], helm: config, graph: { lint: "report" } }));
+  const out: string[] = [];
+  const err: string[] = [];
+  vi.spyOn(console, "log").mockImplementation((line: unknown) => void out.push(String(line)));
+  vi.spyOn(console, "error").mockImplementation((line: unknown) => void err.push(String(line)));
+  const cwd = process.cwd();
+  process.chdir(project);
+  try {
+    const exit = await runGraph({ args: { command: "graph", path: ".", format: "ir" } as never, plugins: [plugin], serializers: [] });
+    return { ir: exit === 0 ? (JSON.parse(out.join("\n")) as GraphIR) : { nodes: [], edges: [], groups: {} }, err, exit };
+  } finally {
+    process.chdir(cwd);
+  }
+}
+
+describe("helm-chart member graph block (#3179)", () => {
+  test("renders the chart and draws its objects", async () => {
+    let argv: string[] = [];
+    const { ir, err, exit } = await graphOf(
+      pluginWith(async (args) => {
+        argv = args;
+        return { stdout: RENDERED };
+      }),
+    );
+    expect(exit, err.join("\n")).toBe(0);
+    expect(argv).toEqual(helmTemplateArgs(chart));
+    expect(ir.nodes.map((n) => n.id).sort()).toEqual(["web/deploymentWebChart", "web/serviceWebChart"]);
+    expect(ir.meta?.helmMember).toEqual({ rendered: true, objects: 2 });
+  });
+
+  test("with no helm binary the member says rendered: false and why", async () => {
+    const { ir, err, exit } = await graphOf(pluginWith(noBinary));
+    expect(exit, err.join("\n")).toBe(0);
+    expect(ir.nodes).toEqual([]);
+    const report = ir.meta?.helmMember as { rendered: boolean; reason: string };
+    expect(report.rendered).toBe(false);
+    expect(report.reason).toMatch(/`helm` binary was not found/);
+    expect(err.join("\n")).toMatch(/was not rendered/);
+  });
+
+  test("a render helm refused still fails", async () => {
+    const { exit, err } = await graphOf(
+      pluginWith(async () => {
+        throw new Error("Error: parse error in templates/deployment.yaml");
+      }),
+    );
+    expect(exit).not.toBe(0);
+    expect(err.join("\n")).toMatch(/parse error/);
+  });
+
+  const haveHelm = (() => {
+    try {
+      execFileSync("helm", ["version"], { stdio: "ignore" });
+      return true;
+    } catch {
+      return false;
+    }
+  })();
+
+  test.skipIf(!haveHelm)("the real helm binary renders the chart", async () => {
+    const { ir, err, exit } = await graphOf(pluginWith());
+    expect(exit, err.join("\n")).toBe(0);
+    expect((ir.meta?.helmMember as { rendered: boolean }).rendered).toBe(true);
+    expect(ir.nodes.map((n) => n.id)).toEqual(["web/deploymentWebChart"]);
+  });
+});

package/src/workspace-member.ts

@@ -0,0 +1,96 @@
+/**
+ * Reading a helm-chart workspace member into the graph (#3179).
+ *
+ * `chant workspace graph` writes a reader project for a member of kind
+ * `helm-chart`, with `helm.member` in its config (see `workspace-kinds.json`).
+ * The plugin's `buildRoots` hook calls {@link readHelmMember}: `helm template`
+ * over the chart directory, and the rendered objects are the member's nodes.
+ *
+ * With no `helm` binary the member contributes no objects, and its report says
+ * `rendered: false` with the reason. A render the binary ran and refused (a
+ * template that doesn't parse, a dependency that isn't built) is not that case
+ * and throws, so a broken chart is never a quiet empty graph.
+ */
+import { execFile } from "node:child_process";
+import { basename } from "node:path";
+import { promisify } from "node:util";
+import { loadAll } from "js-yaml";
+import type { Declarable } from "@intentius/chant/declarable";
+import { addRenderedEntity, renderedManifestEntity } from "@intentius/chant-lexicon-k8s/kustomize/rendered-entity";
+
+const execFileAsync = promisify(execFile);
+
+export interface HelmMemberConfig {
+  /** The chart directory, absolute. */
+  dir: string;
+  /** Names the entities (`<label>/deploymentWeb`): the member's name. */
+  label?: string;
+}
+
+/** What the read found, carried on the graph's `meta.helmMember`. */
+export interface HelmMemberReport {
+  rendered: boolean;
+  /** Why nothing was read; set with `rendered: false`. */
+  reason?: string;
+  objects: number;
+}
+
+/** Runs the helm binary with these arguments. Injectable so tests need no binary. */
+export type HelmRunner = (args: string[]) => Promise<{ stdout: string }>;
+
+export const defaultHelmRunner: HelmRunner = (args) => execFileAsync("helm", args, { maxBuffer: 64 * 1024 * 1024 });
+
+/** The exact render argv: the release is named for the chart directory. */
+export function helmTemplateArgs(dir: string): string[] {
+  return ["template", basename(dir) || "release", dir];
+}
+
+function isMissingBinary(err: unknown): boolean {
+  return (err as NodeJS.ErrnoException | undefined)?.code === "ENOENT" || /ENOENT|command not found/.test(err instanceof Error ? err.message : String(err));
+}
+
+export async function readHelmMember(opts: {
+  member: HelmMemberConfig;
+  run?: HelmRunner;
+}): Promise<{ entities: Map<string, Declarable>; warnings: string[]; report: HelmMemberReport }> {
+  const { member } = opts;
+  const label = member.label ?? basename(member.dir);
+  const entities = new Map<string, Declarable>();
+  const warnings: string[] = [];
+
+  let stdout: string;
+  try {
+    ({ stdout } = await (opts.run ?? defaultHelmRunner)(helmTemplateArgs(member.dir)));
+  } catch (err) {
+    if (!isMissingBinary(err)) throw err;
+    const reason = `Cannot render chart "${member.dir}": the \`helm\` binary was not found on PATH. Install helm and retry.`;
+    warnings.push(`helm-chart member "${label}" was not rendered: ${reason}`);
+    return { entities, warnings, report: { rendered: false, reason, objects: 0 } };
+  }
+
+  for (const doc of loadAll(stdout)) {
+    if (!doc || typeof doc !== "object" || Array.isArray(doc)) continue;
+    const entity = renderedManifestEntity(doc as Record<string, unknown>, label);
+    if (!entity) {
+      warnings.push(`helm-chart member "${label}" rendered a document without apiVersion/kind; skipped`);
+      continue;
+    }
+    addRenderedEntity(entities, label, entity);
+  }
+  return { entities, warnings, report: { rendered: true, objects: entities.size } };
+}
+
+let lastReport: HelmMemberReport | undefined;
+
+/**
+ * The report of the read in this process. `graphMeta` receives only the
+ * entities, so the hook that read the member leaves its report here for the
+ * hook that publishes it; `chant graph` runs the two in order in one process.
+ */
+export function setLastMemberReport(report: HelmMemberReport | undefined): void {
+  lastReport = report;
+}
+
+export function lastMemberReport(): HelmMemberReport | undefined {
+  return lastReport;
+}

package/workspace-kinds.json

@@ -0,0 +1,29 @@
+{
+  "$comment": "Member kinds this lexicon supplies to a chant workspace (#3179). chant reads this file as data and never imports the lexicon. A Helm chart is a directory with a Chart.yaml, and Chart.yaml is the member's own file, checked against schemas/chart.schema.json. The graph block (#3179) reads a chart through helm template (src/workspace-member.ts); with no helm binary the member says rendered: false on meta.helmMember.",
+  "schema": 1,
+  "kinds": [
+    {
+      "name": "helm-chart",
+      "description": "a Helm chart, with a Chart.yaml in its directory",
+      "precedence": 330,
+      "probe": {
+        "anyFile": [
+          "Chart.yaml"
+        ]
+      },
+      "memberFile": {
+        "path": "Chart.yaml",
+        "schema": "schemas/chart.schema.json"
+      },
+      "graph": {
+        "lexicon": "helm",
+        "config": {
+          "member": {
+            "dir": "{dir}",
+            "label": "{member}"
+          }
+        }
+      }
+    }
+  ]
+}