@intentius/chant-lexicon-helm 0.41.20 → 0.42.1

package/README.md

@@ -10,6 +10,10 @@ npm install --save-dev @intentius/chant @intentius/chant-lexicon-helm
 
 **[Documentation →](https://intentius.io/chant/lexicons/helm/)**
 
+## Supported Helm versions
+
+The lexicon targets Helm 4 and CI runs against a pinned Helm 4 release. Rendering also works with a Helm 3 CLI on PATH.
+
 ## Related Packages
 
 | Package | Role |

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "81a2877c236e44aae3eb808c95020c6631749646b7f6ce2d61de0b108930392d",
+    "manifest.json": "3976c2ad819dd2c486f6a141a635f08c3d75c487616c66acd17ed1a7dd2dd08c",
     "meta.json": "14243c5730a07c6a6edc35ddd351438547d58df5cf345f2233a355b0c7611ccc",
     "types/index.d.ts": "5377696ca8698cd2999e4680feb8e8e4b54a7b49fb603a87b2f27356114d1794",
     "rules/chart-metadata.ts": "8f3377e893d5e2828460b7fe5924fca098334245a9a2fdb90f6b67e490eaf091",
@@ -30,9 +30,9 @@
     "rules/whm407.ts": "200190f5de2d86d2bcc5aee0b5ce4807919ec727b1fc14576ea17b9b3073838b",
     "rules/whm501.ts": "e6afa7c0eface9820380bf189fe8be58f4a6997dd5b74f76335022650616d080",
     "rules/whm502.ts": "c3ed7b4b5215d96e46eba758aca2171928d8f8fb1eb20452ea6b4393672755b0",
-    "skills/chant-helm.md": "94528606c7a972f478d3c716eb7fe5fd79a6520532ccc4f9a3c99e9b0d691025",
+    "skills/chant-helm.md": "89edaffd63b549045414ecdecf380daddb042b3b41a5d04754c2953ab7c5e70a",
     "skills/chant-helm-patterns.md": "9e79e6a46391da46709d8aa57e2825a7cd9eb981cd923f02ad60836c49b2561e",
     "skills/chant-helm-security.md": "bfc367eabceed2e84f1cf94501b407df78aeed963cec104f24a321d0962063c9"
   },
-  "composite": "a378ec616ea1cd9289b981285a8adb18221c57eac3ad19a8b23d4f8defc5f735"
+  "composite": "44227a56d4cf67f74bdcbda4aeb8afa90c559d1fb0f995d02143bdadf73b5ede"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "helm",
-  "version": "0.41.20",
+  "version": "0.42.1",
   "chantVersion": ">=0.1.0",
   "namespace": "Helm",
   "intrinsics": [

package/dist/okf/index.md

@@ -0,0 +1,39 @@
+---
+okf_version: '0.2'
+---
+
+# Resource types
+
+* [Chart](/types/Chart.md) - Helm::Chart
+* [HelmCRD](/types/HelmCRD.md) - Helm::CRD
+* [HelmNotes](/types/HelmNotes.md) - Helm::Notes
+* [HelmTest](/types/HelmTest.md) - Helm::Test
+* [Values](/types/Values.md) - Helm::Values
+
+# Rules
+
+* [WHM001](/rules/WHM001.md) - Chart Metadata Required
+* [WHM002](/rules/WHM002.md) - Values Should Not Contain Bare Secrets
+* [WHM003](/rules/WHM003.md) - Container Images Should Use Values References
+* [WHM004](/rules/WHM004.md) - HelmTpl Expression Has No Effect in Values Constructor
+* [WHM005](/rules/WHM005.md) - Chart with sub-chart dependencies but no templates should deploy upstream chart directly
+* [WHM101](/rules/WHM101.md) - Chart.yaml must have required fields (apiVersion v2, name, version)
+* [WHM102](/rules/WHM102.md) - values.schema.json should be present when Values are non-empty
+* [WHM103](/rules/WHM103.md) - Go template syntax must be valid (balanced braces)
+* [WHM104](/rules/WHM104.md) - NOTES.txt should exist for application charts
+* [WHM105](/rules/WHM105.md) - _helpers.tpl must exist in templates/
+* [WHM201](/rules/WHM201.md) - K8s resources should include standard Helm labels
+* [WHM202](/rules/WHM202.md) - Hook weights should be defined when multiple hooks exist
+* [WHM203](/rules/WHM203.md) - Values entries should be documented via schema or comments
+* [WHM204](/rules/WHM204.md) - Chart dependencies should use semver ranges, not pinned versions
+* [WHM301](/rules/WHM301.md) - Application charts should include at least one Helm test
+* [WHM302](/rules/WHM302.md) - Container resources (limits/requests) should be set via values or defaults
+* [WHM401](/rules/WHM401.md) - Container images should not use :latest tag or omit tag entirely
+* [WHM402](/rules/WHM402.md) - Containers should set runAsNonRoot in security context
+* [WHM403](/rules/WHM403.md) - Containers should set readOnlyRootFilesystem in security context
+* [WHM404](/rules/WHM404.md) - Containers must not run in privileged mode
+* [WHM405](/rules/WHM405.md) - Resource specs should include cpu and memory in limits/requests
+* [WHM406](/rules/WHM406.md) - CRDs in crds/ directory are never upgraded or deleted by Helm
+* [WHM407](/rules/WHM407.md) - Secrets with inline data should use ExternalSecret or SealedSecret
+* [WHM501](/rules/WHM501.md) - Detect values keys that are defined but never referenced in templates
+* [WHM502](/rules/WHM502.md) - Detect deprecated or invalid Kubernetes API versions

package/dist/okf/rules/WHM001.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: WHM001
+description: Chart Metadata Required
+id: WHM001
+severity: error
+category: correctness
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Chart Metadata Required
+
+## Applies to
+
+- [Chart](/types/Chart.md)

package/dist/okf/rules/WHM002.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: WHM002
+description: Values Should Not Contain Bare Secrets
+id: WHM002
+severity: warning
+category: security
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Values Should Not Contain Bare Secrets
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM003.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: WHM003
+description: Container Images Should Use Values References
+id: WHM003
+severity: warning
+category: correctness
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Container Images Should Use Values References
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM004.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: WHM004
+description: HelmTpl Expression Has No Effect in Values Constructor
+id: WHM004
+severity: warning
+category: correctness
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+HelmTpl Expression Has No Effect in Values Constructor
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM005.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM005
+description: Chart with sub-chart dependencies but no templates should deploy upstream chart directly
+id: WHM005
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Chart with sub-chart dependencies but no templates should deploy upstream chart directly
+
+## Applies to
+
+- [Chart](/types/Chart.md)

package/dist/okf/rules/WHM101.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM101
+description: Chart.yaml must have required fields (apiVersion v2, name, version)
+id: WHM101
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Chart.yaml must have required fields (apiVersion v2, name, version)
+
+## Applies to
+
+- [Chart](/types/Chart.md)

package/dist/okf/rules/WHM102.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM102
+description: values.schema.json should be present when Values are non-empty
+id: WHM102
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+values.schema.json should be present when Values are non-empty
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM103.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WHM103
+description: Go template syntax must be valid (balanced braces)
+id: WHM103
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Go template syntax must be valid (balanced braces)

package/dist/okf/rules/WHM104.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM104
+description: NOTES.txt should exist for application charts
+id: WHM104
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+NOTES.txt should exist for application charts
+
+## Applies to
+
+- [Chart](/types/Chart.md)

package/dist/okf/rules/WHM105.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WHM105
+description: _helpers.tpl must exist in templates/
+id: WHM105
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+_helpers.tpl must exist in templates/

package/dist/okf/rules/WHM201.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WHM201
+description: K8s resources should include standard Helm labels
+id: WHM201
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+K8s resources should include standard Helm labels

package/dist/okf/rules/WHM202.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WHM202
+description: Hook weights should be defined when multiple hooks exist
+id: WHM202
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Hook weights should be defined when multiple hooks exist

package/dist/okf/rules/WHM203.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM203
+description: Values entries should be documented via schema or comments
+id: WHM203
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Values entries should be documented via schema or comments
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM204.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM204
+description: Chart dependencies should use semver ranges, not pinned versions
+id: WHM204
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Chart dependencies should use semver ranges, not pinned versions
+
+## Applies to
+
+- [Chart](/types/Chart.md)

package/dist/okf/rules/WHM301.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: WHM301
+description: Application charts should include at least one Helm test
+id: WHM301
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Application charts should include at least one Helm test
+
+## Applies to
+
+- [Chart](/types/Chart.md)
+- [HelmTest](/types/HelmTest.md)

package/dist/okf/rules/WHM302.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM302
+description: Container resources (limits/requests) should be set via values or defaults
+id: WHM302
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Container resources (limits/requests) should be set via values or defaults
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM401.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM401
+description: Container images should not use :latest tag or omit tag entirely
+id: WHM401
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Container images should not use :latest tag or omit tag entirely
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM402.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM402
+description: Containers should set runAsNonRoot in security context
+id: WHM402
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Containers should set runAsNonRoot in security context
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM403.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM403
+description: Containers should set readOnlyRootFilesystem in security context
+id: WHM403
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Containers should set readOnlyRootFilesystem in security context
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM404.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WHM404
+description: Containers must not run in privileged mode
+id: WHM404
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Containers must not run in privileged mode

package/dist/okf/rules/WHM405.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM405
+description: Resource specs should include cpu and memory in limits/requests
+id: WHM405
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Resource specs should include cpu and memory in limits/requests
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM406.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM406
+description: CRDs in crds/ directory are never upgraded or deleted by Helm
+id: WHM406
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+CRDs in crds/ directory are never upgraded or deleted by Helm
+
+## Applies to
+
+- [Chart](/types/Chart.md)

package/dist/okf/rules/WHM407.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM407
+description: Secrets with inline data should use ExternalSecret or SealedSecret
+id: WHM407
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Secrets with inline data should use ExternalSecret or SealedSecret
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM501.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM501
+description: Detect values keys that are defined but never referenced in templates
+id: WHM501
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Detect values keys that are defined but never referenced in templates
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM502.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WHM502
+description: Detect deprecated or invalid Kubernetes API versions
+id: WHM502
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Detect deprecated or invalid Kubernetes API versions

package/dist/okf/types/Chart.md

@@ -0,0 +1,19 @@
+---
+type: resource-type
+title: Chart
+description: Chart.yaml metadata — defines the chart identity, version, and type.
+name: Chart
+lexicon: helm
+resource_type: Helm::Chart
+---
+Chart.yaml metadata — defines the chart identity, version, and type.
+
+## Governed by
+
+- [WHM001](/rules/WHM001.md): Chart Metadata Required
+- [WHM005](/rules/WHM005.md): Chart with sub-chart dependencies but no templates should deploy upstream chart directly
+- [WHM101](/rules/WHM101.md): Chart.yaml must have required fields (apiVersion v2, name, version)
+- [WHM104](/rules/WHM104.md): NOTES.txt should exist for application charts
+- [WHM204](/rules/WHM204.md): Chart dependencies should use semver ranges, not pinned versions
+- [WHM301](/rules/WHM301.md): Application charts should include at least one Helm test
+- [WHM406](/rules/WHM406.md): CRDs in crds/ directory are never upgraded or deleted by Helm

package/dist/okf/types/HelmCRD.md

@@ -0,0 +1,9 @@
+---
+type: resource-type
+title: HelmCRD
+description: Custom Resource Definition — placed in the crds/ directory.
+name: HelmCRD
+lexicon: helm
+resource_type: Helm::CRD
+---
+Custom Resource Definition — placed in the crds/ directory.

package/dist/okf/types/HelmNotes.md

@@ -0,0 +1,9 @@
+---
+type: resource-type
+title: HelmNotes
+description: NOTES.txt template content — displayed after helm install.
+name: HelmNotes
+lexicon: helm
+resource_type: Helm::Notes
+---
+NOTES.txt template content — displayed after helm install.

package/dist/okf/types/HelmTest.md

@@ -0,0 +1,13 @@
+---
+type: resource-type
+title: HelmTest
+description: 'Helm test pod — annotated with helm.sh/hook: test.'
+name: HelmTest
+lexicon: helm
+resource_type: Helm::Test
+---
+Helm test pod — annotated with helm.sh/hook: test.
+
+## Governed by
+
+- [WHM301](/rules/WHM301.md): Application charts should include at least one Helm test

package/dist/okf/types/Values.md

@@ -0,0 +1,24 @@
+---
+type: resource-type
+title: Values
+description: Typed values definition — emits values.yaml and values.schema.json.
+name: Values
+lexicon: helm
+resource_type: Helm::Values
+---
+Typed values definition — emits values.yaml and values.schema.json.
+
+## Governed by
+
+- [WHM002](/rules/WHM002.md): Values Should Not Contain Bare Secrets
+- [WHM003](/rules/WHM003.md): Container Images Should Use Values References
+- [WHM004](/rules/WHM004.md): HelmTpl Expression Has No Effect in Values Constructor
+- [WHM102](/rules/WHM102.md): values.schema.json should be present when Values are non-empty
+- [WHM203](/rules/WHM203.md): Values entries should be documented via schema or comments
+- [WHM302](/rules/WHM302.md): Container resources (limits/requests) should be set via values or defaults
+- [WHM401](/rules/WHM401.md): Container images should not use :latest tag or omit tag entirely
+- [WHM402](/rules/WHM402.md): Containers should set runAsNonRoot in security context
+- [WHM403](/rules/WHM403.md): Containers should set readOnlyRootFilesystem in security context
+- [WHM405](/rules/WHM405.md): Resource specs should include cpu and memory in limits/requests
+- [WHM407](/rules/WHM407.md): Secrets with inline data should use ExternalSecret or SealedSecret
+- [WHM501](/rules/WHM501.md): Detect values keys that are defined but never referenced in templates

package/dist/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAeH,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAoHD,eAAO,MAAM,UAAU,8GA8BP,CAAC"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAeH,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAuHD,eAAO,MAAM,UAAU,8GA8BP,CAAC"}

package/dist/skills/chant-helm.md

@@ -292,7 +292,7 @@ const lifecycle = HelmCRDLifecycle({
 
 ## OCI registry workflow
 
-Helm 3.8+ supports OCI registries as first-class chart repositories.
+Helm 4 supports OCI registries as first-class chart repositories.
 
 ```bash
 # Login to an OCI registry
@@ -407,7 +407,7 @@ helm uninstall my-app --keep-history      # preserve history for rollback
 ### Common errors
 
 #### "apiVersion must be v2"
-Helm 3 requires `apiVersion: v2` in Chart.yaml. Update your Chart metadata.
+Helm requires `apiVersion: v2` in Chart.yaml. Update your Chart metadata.
 
 #### "unbalanced template braces"
 A Go template expression has mismatched `{{` / `}}`. Check your intrinsic usage.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-helm",
-  "version": "0.41.20",
+  "version": "0.42.1",
   "description": "Helm chart lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -81,7 +81,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.41.20",
+    "@intentius/chant": "^0.42.1",
     "typescript": "^5.9.3"
   }
 }

package/src/render.test.ts

@@ -87,6 +87,80 @@ spec:
 `,
   );
 
+  // CRDs shipped in the chart's crds/ directory — helm template drops these
+  // unless --include-crds is passed.
+  mkdirSync(join(CHART_DIR, "crds"), { recursive: true });
+  writeFileSync(
+    join(CHART_DIR, "crds", "widgets.yaml"),
+    `apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: widgets.example.com
+spec:
+  group: example.com
+  names:
+    kind: Widget
+    listKind: WidgetList
+    plural: widgets
+    singular: widget
+  scope: Namespaced
+  versions:
+  - name: v1
+    served: true
+    storage: true
+    schema:
+      openAPIV3Schema:
+        type: object
+`,
+  );
+
+  // A subchart with its own crds/ directory — must also survive the render.
+  const SUBCHART_DIR = join(CHART_DIR, "charts", "tiny-sub");
+  mkdirSync(join(SUBCHART_DIR, "crds"), { recursive: true });
+  mkdirSync(join(SUBCHART_DIR, "templates"), { recursive: true });
+  writeFileSync(
+    join(SUBCHART_DIR, "Chart.yaml"),
+    `apiVersion: v2
+name: tiny-sub
+description: Subchart fixture with its own CRD
+type: application
+version: 0.1.0
+`,
+  );
+  writeFileSync(
+    join(SUBCHART_DIR, "crds", "gadgets.yaml"),
+    `apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: gadgets.example.com
+spec:
+  group: example.com
+  names:
+    kind: Gadget
+    listKind: GadgetList
+    plural: gadgets
+    singular: gadget
+  scope: Namespaced
+  versions:
+  - name: v1
+    served: true
+    storage: true
+    schema:
+      openAPIV3Schema:
+        type: object
+`,
+  );
+  writeFileSync(
+    join(SUBCHART_DIR, "templates", "configmap.yaml"),
+    `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-tiny-sub
+data:
+  role: subchart
+`,
+  );
+
   // Package the chart into a .tgz and create a repo index.yaml.
   execFileSync("helm", ["package", CHART_DIR, "-d", REPO_DIR], { stdio: "ignore" });
   execFileSync("helm", ["repo", "index", REPO_DIR], { stdio: "ignore" });
@@ -118,6 +192,17 @@ describe.skipIf(!fixtureAvailable)("HelmRender", () => {
     expect(service).toBeDefined();
   });
 
+  test("CRDs from crds/ directories are included (top level + subchart)", () => {
+    const result = HelmRender({
+      name: "rel",
+      chart: CHART_DIR,
+      noCache: true,
+    });
+    const keys = Object.keys(result.members as Record<string, unknown>);
+    expect(keys).toContain("CustomResourceDefinition_widgets_example_com");
+    expect(keys).toContain("CustomResourceDefinition_gadgets_example_com");
+  });
+
   test("createNamespace adds a Namespace declarable", () => {
     const result = HelmRender({
       name: "rel",

package/src/render.ts

@@ -121,6 +121,9 @@ function renderViaHelm(props: HelmRenderProps): string {
     "template",
     props.name,
     props.chart,
+    // Without this, `helm template` silently drops manifests shipped in the
+    // chart's (or a subchart's) crds/ directory.
+    "--include-crds",
     ...fetchArgs,
     ...isolationArgs,
     ...(props.namespace ? ["--namespace", props.namespace] : []),

package/src/skills/chant-helm.md

@@ -292,7 +292,7 @@ const lifecycle = HelmCRDLifecycle({
 
 ## OCI registry workflow
 
-Helm 3.8+ supports OCI registries as first-class chart repositories.
+Helm 4 supports OCI registries as first-class chart repositories.
 
 ```bash
 # Login to an OCI registry
@@ -407,7 +407,7 @@ helm uninstall my-app --keep-history      # preserve history for rollback
 ### Common errors
 
 #### "apiVersion must be v2"
-Helm 3 requires `apiVersion: v2` in Chart.yaml. Update your Chart metadata.
+Helm requires `apiVersion: v2` in Chart.yaml. Update your Chart metadata.
 
 #### "unbalanced template braces"
 A Go template expression has mismatched `{{` / `}}`. Check your intrinsic usage.