@intentius/chant-lexicon-helm 0.44.14 → 0.46.0

package/dist/codegen/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2FH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0W9E"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2FH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB9E"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "0db05c4aafd206c5847a8914068bcdbc20de79eea85907be5d61ac9b098f67aa",
+    "manifest.json": "08be69a5f2086ed05c3f644d996e0ce9067d64ae786d815d2058ec40631082e4",
     "meta.json": "14243c5730a07c6a6edc35ddd351438547d58df5cf345f2233a355b0c7611ccc",
     "types/index.d.ts": "5377696ca8698cd2999e4680feb8e8e4b54a7b49fb603a87b2f27356114d1794",
     "rules/chart-metadata.ts": "8f3377e893d5e2828460b7fe5924fca098334245a9a2fdb90f6b67e490eaf091",
@@ -34,5 +34,5 @@
     "skills/chant-helm-patterns.md": "9e79e6a46391da46709d8aa57e2825a7cd9eb981cd923f02ad60836c49b2561e",
     "skills/chant-helm-security.md": "bfc367eabceed2e84f1cf94501b407df78aeed963cec104f24a321d0962063c9"
   },
-  "composite": "6b1b6079175c83ebeca41d5939ae36e916ba9e9181476cf41084589a45d43e37"
+  "composite": "5e85ad5af932889cb581afbbc2a582f549037dea29d05bfb88f8de434b8bb4c7"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "helm",
-  "version": "0.44.14",
+  "version": "0.46.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Helm",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-helm",
-  "version": "0.44.14",
+  "version": "0.46.0",
   "description": "Helm chart lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -81,7 +81,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.44.14",
+    "@intentius/chant": "^0.46.0",
     "typescript": "^5.9.3"
   }
 }

package/src/codegen/docs.ts

@@ -106,347 +106,10 @@ export async function generateDocs(opts?: { verbose?: boolean }): Promise<void>
     overview,
     outputFormat,
     serviceFromType,
-    // `lint-rules` below is helm's rules documentation; the generated `rules`
-    // table duplicated it, and helm's own declared rules page was being
-    // silently overwritten by that table (#1312).
+    // `lint-rules` under docs/pages/ is helm's rules documentation; the
+    // generated `rules` table duplicated it, and helm's own declared rules
+    // page was being silently overwritten by that table (#1312).
     suppressPages: ["pseudo-parameters"],
-    // Hand-written pages under docs/src/content/docs/ that no sidebar entry
-    // pointed at.
-    sidebarExtra: [
-      { label: "Helm Concepts", slug: "helm-concepts" },
-      { label: "Lint Rules", slug: "lint-rules" },
-      { label: "Examples", slug: "examples" },
-    ],
-    extraPages: [
-      {
-        slug: "getting-started",
-        title: "Getting Started",
-        description: "Create your first typed Helm chart in 5 minutes",
-        content: `## What is the Helm lexicon?
-
-The Helm lexicon extends chant to produce **real, parameterized Helm charts** from typed TypeScript. Unlike static manifest generators (like cdk8s's Helm output), the Helm lexicon generates:
-
-- \`{{ .Values.x }}\` template directives
-- \`values.yaml\` with typed defaults
-- \`values.schema.json\` for validation
-- Conditional resources via \`{{- if }}\`
-- Standard \`_helpers.tpl\`
-- Helm hooks and tests
-
-## Install
-
-\`\`\`bash
-npm install --save-dev @intentius/chant @intentius/chant-lexicon-helm @intentius/chant-lexicon-k8s
-\`\`\`
-
-## Your first chart
-
-\`\`\`bash
-chant init --lexicon helm
-\`\`\`
-
-This creates a scaffold with a Chart, Values, Deployment, and Service. Run \`chant build\` to produce a complete Helm chart directory.
-
-## Key imports
-
-\`\`\`typescript
-// Resources
-import { Chart, Values, HelmNotes } from "@intentius/chant-lexicon-helm";
-
-// Intrinsics (produce Go template expressions)
-import { values, Release, include, printf, toYaml, If } from "@intentius/chant-lexicon-helm";
-
-// K8s resources
-import { Deployment, Service, Ingress } from "@intentius/chant-lexicon-k8s";
-\`\`\`
-`,
-      },
-      {
-        slug: "intrinsics-guide",
-        title: "Intrinsics Reference",
-        description: "All Helm template intrinsics and how they map to Go template expressions",
-        content: `## Values proxy
-
-\`\`\`typescript
-import { values } from "@intentius/chant-lexicon-helm";
-
-values.replicaCount           // {{ .Values.replicaCount }}
-values.image.repository       // {{ .Values.image.repository }}
-values.x.pipe("upper")        // {{ .Values.x | upper }}
-\`\`\`
-
-## Built-in objects
-
-\`\`\`typescript
-import { Release, ChartRef } from "@intentius/chant-lexicon-helm";
-
-Release.Name         // {{ .Release.Name }}
-Release.Namespace    // {{ .Release.Namespace }}
-Release.IsUpgrade    // {{ .Release.IsUpgrade }}
-ChartRef.Name        // {{ .Chart.Name }}
-ChartRef.Version     // {{ .Chart.Version }}
-\`\`\`
-
-## Template functions
-
-| Function | Output |
-|----------|--------|
-| \`include("name")\` | \`{{ include "name" . }}\` |
-| \`required("msg", values.x)\` | \`{{ required "msg" .Values.x }}\` |
-| \`helmDefault("val", values.x)\` | \`{{ default "val" .Values.x }}\` |
-| \`toYaml(values.x)\` | \`{{ toYaml .Values.x }}\` |
-| \`toYaml(values.x, 12)\` | \`{{ toYaml .Values.x \\| nindent 12 }}\` |
-| \`quote(values.x)\` | \`{{ .Values.x \\| quote }}\` |
-| \`printf("%s:%s", a, b)\` | \`{{ printf "%s:%s" a b }}\` |
-| \`tpl(values.x)\` | \`{{ tpl .Values.x . }}\` |
-| \`lookup("v1", "Secret", "ns", "name")\` | \`{{ lookup "v1" "Secret" "ns" "name" }}\` |
-
-## Control flow
-
-\`\`\`typescript
-import { If, Range, With, values } from "@intentius/chant-lexicon-helm";
-
-// Conditional resource
-export const ingress = If(values.ingress.enabled, new Ingress({ ... }));
-
-// Conditional value
-const image = If(values.image.tag, printf("%s:%s", values.image.repo, values.image.tag));
-\`\`\`
-
-## Resource ordering
-
-| Function | Output |
-|----------|--------|
-| \`withOrder(5)\` | \`helm.sh/hook: pre-install,pre-upgrade\` + \`helm.sh/hook-weight: "5"\` |
-| \`argoWave(2)\` | \`argocd.argoproj.io/sync-wave: "2"\` |
-
-\`\`\`typescript
-import { withOrder, argoWave } from "@intentius/chant-lexicon-helm";
-
-const job = new Job({
-  metadata: { annotations: { ...withOrder(-5) } },
-  // ...
-});
-\`\`\`
-`,
-      },
-      {
-        slug: "composites",
-        title: "Composites",
-        description: "Pre-built Helm chart patterns",
-        content: `When a composite call like these is assigned directly to a top-level \`export const\` — or destructured into a top-level export, e.g. \`export const { chart, values, deployment } = HelmWebApp({...})\` — it's one of the patterns [folding](/chant/concepts/typescript-as-data/#folded-vs-run) can reduce with no module execution (chant #1023). It still runs like any other call if it isn't a top-level export, or if its result is only reached through a nested value inside another resource's properties.
-
-## Available composites
-
-| Composite | Description | Resources |
-|-----------|-------------|-----------|
-| \`HelmWebApp\` | Web application | Deployment, Service, Ingress?, HPA?, ServiceAccount? |
-| \`HelmStatefulService\` | Stateful workload | StatefulSet, headless Service, PVC |
-| \`HelmCronJob\` | Scheduled job | CronJob |
-| \`HelmMicroservice\` | Full microservice | Deployment, Service, Ingress?, HPA?, PDB?, ServiceAccount, ConfigMap? |
-| \`HelmLibrary\` | Library chart | Chart.yaml (type: library), _helpers.tpl |
-| \`HelmCRDLifecycle\` | Managed CRD lifecycle | Job (hook), ConfigMap, ServiceAccount, ClusterRole, ClusterRoleBinding |
-| \`HelmDaemonSet\` | Node-level workload | DaemonSet, ServiceAccount? |
-| \`HelmWorker\` | Background processor | Deployment (no Service), ServiceAccount, HPA?, PDB? |
-| \`HelmExternalSecret\` | Secret management | ExternalSecret CR (external-secrets.io) |
-| \`HelmBatchJob\` | One-shot batch job | Job, ServiceAccount?, Role?, RoleBinding? |
-| \`HelmMonitoredService\` | Service with monitoring | Deployment, Service, ServiceAccount?, ServiceMonitor, PrometheusRule? |
-| \`HelmSecureIngress\` | TLS ingress + cert-manager | Ingress, Certificate? |
-| \`HelmNamespaceEnv\` | Namespace environment | Namespace, ResourceQuota?, LimitRange?, NetworkPolicy? |
-
-## Example
-
-\`\`\`typescript
-import { HelmWebApp } from "@intentius/chant-lexicon-helm";
-
-const result = HelmWebApp({
-  name: "my-app",
-  imageRepository: "myregistry/app",
-  port: 3000,
-  replicas: 3,
-  ingress: true,
-  autoscaling: true,
-});
-
-// result.chart, result.values, result.deployment, result.service, result.ingress, result.hpa
-\`\`\`
-`,
-      },
-      {
-        slug: "security",
-        title: "Security",
-        description: "Security best practices and checks for Helm charts",
-        content: `## Secret management
-
-Avoid inline secrets in Kubernetes Secret manifests. Use ExternalSecret or SealedSecret instead:
-
-\`\`\`typescript
-import { HelmExternalSecret } from "@intentius/chant-lexicon-helm";
-
-const { externalSecret, values } = HelmExternalSecret({
-  name: "app-secrets",
-  secretStoreName: "vault",
-  data: {
-    DB_PASSWORD: "secret/data/db-password",
-    API_KEY: "secret/data/api-key",
-  },
-});
-\`\`\`
-
-WHM407 warns when a \`kind: Secret\` template contains inline data values without an ExternalSecret or SealedSecret in the chart.
-
-## Security context best practices
-
-Always set security context on pods and containers:
-
-\`\`\`typescript
-spec: {
-  securityContext: {
-    runAsNonRoot: true,
-    runAsUser: 1000,
-  },
-  containers: [{
-    securityContext: {
-      readOnlyRootFilesystem: true,
-      allowPrivilegeEscalation: false,
-    },
-  }],
-}
-\`\`\`
-
-### Related checks
-
-| Check | Severity | Description |
-|-------|----------|-------------|
-| WHM401 | warning | Image uses :latest tag or no tag |
-| WHM402 | warning | runAsNonRoot not set |
-| WHM403 | info | readOnlyRootFilesystem not set |
-| WHM404 | error | privileged: true detected |
-| WHM405 | warning | Resource spec missing cpu/memory |
-| WHM406 | info | CRD lifecycle limitation |
-| WHM407 | warning | Secret with inline data |
-
-## Image pinning
-
-Always pin container images to specific tags or digests:
-
-\`\`\`typescript
-// Bad — triggers WHM401
-image: "nginx:latest"
-image: "nginx"
-
-// Good
-image: printf("%s:%s", values.image.repository, values.image.tag)
-\`\`\`
-
-Set a specific default tag in your values:
-
-\`\`\`typescript
-const valuesSchema = new Values({
-  image: {
-    repository: "nginx",
-    tag: "1.25.0",       // Pinned version
-    pullPolicy: "IfNotPresent",
-  },
-});
-\`\`\`
-`,
-      },
-      {
-        slug: "best-practices",
-        title: "Best Practices",
-        description: "Common patterns and recommendations for Helm charts with chant",
-        content: `## CRD lifecycle
-
-Helm installs CRDs from the \`crds/\` directory but **never upgrades or deletes them**. For managed CRD lifecycle, use the \`HelmCRDLifecycle\` composite:
-
-\`\`\`typescript
-import { HelmCRDLifecycle } from "@intentius/chant-lexicon-helm";
-
-const lifecycle = HelmCRDLifecycle({
-  name: "my-operator",
-  crdContent: crdYaml,
-  kubectlImage: "bitnami/kubectl",
-  kubectlTag: "1.28",
-});
-\`\`\`
-
-This creates a Job-based hook that runs \`kubectl apply\` for CRDs during pre-install/pre-upgrade, with proper RBAC.
-
-## Resource ordering
-
-Use \`withOrder()\` for Helm hook ordering and \`argoWave()\` for Argo CD sync waves:
-
-\`\`\`typescript
-import { withOrder, argoWave } from "@intentius/chant-lexicon-helm";
-
-// Helm hook ordering (lower weight = runs first)
-metadata: { annotations: { ...withOrder(-5) } }
-
-// Argo CD sync waves
-metadata: { annotations: { ...argoWave(1) } }
-\`\`\`
-
-## Multi-environment values
-
-Structure your chant project with base values and environment overlays:
-
-\`\`\`
-src/
-  chart.ts          ← Base chart with shared values
-values-dev.yaml     ← Override for dev
-values-staging.yaml ← Override for staging
-values-prod.yaml    ← Override for production
-\`\`\`
-
-Use \`helm install -f values-prod.yaml\` to merge environment-specific values.
-
-## List merge workaround
-
-Helm's strategic merge patch does not merge lists — it replaces them. Use map-of-maps instead:
-
-\`\`\`typescript
-// Instead of a list (hard to override per-environment)
-hosts: [{ host: "app.example.com" }]
-
-// Use a map-of-maps pattern
-hosts:
-  primary:
-    host: "app.example.com"
-    paths: [{ path: "/", pathType: "Prefix" }]
-\`\`\`
-
-## Unused values
-
-WHM501 detects values keys that are defined but never referenced in templates. This helps keep \`values.yaml\` clean and avoids confusion.
-
-## Deprecated API versions
-
-WHM502 detects deprecated Kubernetes API versions (like \`extensions/v1beta1\` for Ingress) and suggests current replacements.
-`,
-      },
-      {
-        slug: "skills",
-        title: "AI Skills",
-        description: "AI agent skills bundled with the Helm lexicon",
-        content: `## What are skills?
-
-Skills are structured markdown documents bundled with a lexicon. When an AI agent works in a chant project, it discovers and loads relevant skills automatically — giving it operational knowledge about the Helm chart workflow.
-
-## Bundled skill: chant-helm
-
-The \`chant-helm\` skill teaches AI agents how to:
-
-- Scaffold new Helm chart projects with \`chant init --lexicon helm\`
-- Use Helm intrinsics (values proxy, include, printf, toYaml, If/Range/With)
-- Build and validate charts with chant + helm CLI
-- Debug common issues (unbalanced braces, hardcoded images, missing metadata)
-- Use composites for common patterns (WebApp, Microservice, StatefulService)
-
-When you scaffold a new project with \`chant init --lexicon helm\`, the skill is installed to \`skills/chant-helm/SKILL.md\` for automatic discovery by Claude Code.
-`,
-      },
-    ],
   };
 
   const result = docsPipeline(config);