@intentius/chant-lexicon-helm 0.45.0 → 0.49.0

package/dist/archive-render.d.ts

@@ -0,0 +1,94 @@
+/**
+ * `addArchiveHelmRender` — fold a pinned render into a `BuildArchiveManifest`
+ * (#1240, epic #1228 Phase 3).
+ *
+ * #1238 gave a pinned render durable, content-addressed storage
+ * (./render-store.ts's `RenderManifest`, modeled on core's
+ * `BuildArchiveManifest`). This module is the seam between the two: it folds
+ * one render into a *build archive*'s manifest, the same self-contained
+ * bundle `docker-build`/`addArchiveTemplate` write into
+ * (packages/core/src/components/verbs/build-archive.ts), so a component that
+ * composes a `HelmRender` alongside an image/template gets one archive that
+ * carries all of it.
+ *
+ * A rendered chart is a template: it reuses `kind: "template"` rather than
+ * adding a new `BuildArchiveEntryKind`. What distinguishes a render from a
+ * synthesized CloudFormation/other IaC template is only its media type,
+ * `HELM_RENDER_MEDIA_TYPE` — and that is enough. Core's
+ * `lifecycle/oras-referrer-lookup.ts` classifies *referrers* (SBOM/
+ * provenance/signature) by the referrer's own media type, keyed only by the
+ * subject *digest* it discovers against — never by the subject entry's own
+ * `kind`/`mediaType`. A render's digest is therefore attachable exactly like
+ * an image's: `oras discover <repo>@<renderDigest>` finds the same
+ * referrers a signing/attestation pipeline would attach to any other
+ * artifact, with no change to that lookup needed (see
+ * ./archive-render.test.ts for the referrer-classification proof).
+ *
+ * Mirrors `addArchiveTemplate` (packages/core/src/components/verbs/build.ts)
+ * in every way that matters: a plain, pure function (not a registered
+ * capability — rendering happens at chant's existing build/synth time, not
+ * as a new deploy-time verb), accumulates onto a caller-supplied manifest so
+ * a component's whole build phase shares one archive, and threads an
+ * optional `sourceRef` into a `provenance` link (#614). It differs in one
+ * respect: rather than recomputing a digest from raw content bytes (core's
+ * `contentDigest`), it reuses the render's own `contentDigest` — the real
+ * `sha256:` over the canonical rendered stream that `helmContentDigest`
+ * already computed and `persistHelmRender` already wrote to the render
+ * store — so the archive entry's identity and the render store's identity
+ * are the same digest, not two independent hashes of the same bytes.
+ */
+import { type BuildArchiveManifest } from "@intentius/chant/components/verbs/build-archive";
+import type { RenderManifest } from "./render-store.js";
+/**
+ * Media type for a pinned helm render folded into a build archive as a
+ * `template`-kind entry. `v1` names the canonical-stream shape
+ * `canonicalizeRender` (./render-digest.ts) produces — a versioned suffix so
+ * a future incompatible canonicalization can be told apart from this one
+ * without guessing from content alone.
+ */
+export declare const HELM_RENDER_MEDIA_TYPE = "application/vnd.chant.helm-render.v1+yaml";
+export interface AddArchiveHelmRenderInput {
+    /** Where the render is written inside the build archive (e.g. `"external-secrets.render.yaml"`). */
+    path: string;
+    /**
+     * The persisted render this entry describes — see ./render-store.ts's
+     * `persistHelmRender`/`loadRenderManifest`. Supplies the entry's digest
+     * (`RenderManifest.contentDigest`, the same identity the render store
+     * keys its content-addressed entry under).
+     */
+    render: RenderManifest;
+    /**
+     * Manifest to extend, so a component's whole build phase (image/template +
+     * render) accumulates one manifest — the same accumulation convention
+     * `addArchiveTemplate`/`generate-sbom`'s `manifest` input uses. Omit to
+     * start a new manifest holding just this render.
+     */
+    manifest?: BuildArchiveManifest;
+    /**
+     * Source ref/commit this render was produced from (#614), recorded as the
+     * entry's `provenance.sourceRef`. Defaults to `render.sourceRef` when the
+     * caller omits it — the render already carries this when known; no
+     * `provenance` is recorded when neither supplies one.
+     */
+    sourceRef?: string;
+}
+export interface AddArchiveHelmRenderOutput {
+    /** The render's content digest — `render.contentDigest`, unchanged; returned for symmetry with `addArchiveTemplate`'s output. */
+    digest: string;
+    /** The build archive's manifest, now including this render's entry. */
+    manifest: BuildArchiveManifest;
+}
+/**
+ * Fold one pinned render into a build archive's manifest as a
+ * `template`-kind entry with `mediaType: HELM_RENDER_MEDIA_TYPE` — the
+ * render peer of `addArchiveTemplate`. The entry's digest is the render's
+ * own `contentDigest` (real `sha256:` over the canonical rendered stream,
+ * ./render-digest.ts's `helmContentDigest`), so the same digest that keys
+ * the render store's `sha256-<hex>/` entry (./render-store.ts) also keys
+ * this archive entry — one identity, not a second hash of the same bytes.
+ * Adding the entry recomputes `manifest.manifestDigest`
+ * (`computeManifestDigest`), so the render rolls into the archive's own
+ * aggregate identity exactly as an image or template does.
+ */
+export declare function addArchiveHelmRender(input: AddArchiveHelmRenderInput): AddArchiveHelmRenderOutput;
+//# sourceMappingURL=archive-render.d.ts.map

package/dist/archive-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-render.d.ts","sourceRoot":"","sources":["../src/archive-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,iDAAiD,CAAC;AAGzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,8CAA8C,CAAC;AAElF,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,cAAc,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,iIAAiI;IACjI,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,QAAQ,EAAE,oBAAoB,CAAC;CAChC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,0BAA0B,CAejG"}

package/dist/commands.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `chant helm <verb>` — the pinned-renders surface (#1248, epic #1228
+ * Phase 6), mounted through the command-group seam (#1078).
+ *
+ * Four verbs over machinery that already exists but had no CLI reach:
+ *
+ * - `classify` runs the pinnability gate (#1234) over a chart directory and
+ *   prints the verdict with every finding located — capability references,
+ *   open generated inputs, conditional hazards, lookup sites.
+ * - `localize` runs the double-render localizer (#1236): it renders the
+ *   chart twice, maps every unstable output line to the open input that
+ *   produced it, and prints the validated pins that would close each one.
+ * - `renders` discovers the current project and lists every `HelmRender`
+ *   record with its digests (#1237) and capability profile, plus the
+ *   stability report grouping renders by input identity.
+ * - `diff` (#1238) reports what changed between two renders, dispatching on
+ *   its arguments and `--live`: `diff <from-digest> <to-digest>` resolves
+ *   two content digests from the render store and reports added/removed/
+ *   changed documents with field-level changes inside each changed one —
+ *   no cluster, no credentials (#1249, render-to-render, offline).
+ *   `diff <content-digest> <environment> --live` resolves a single stored
+ *   render and diffs every one of its documents against the live cluster,
+ *   property by property (#1250, render-to-live). Both modes share
+ *   ./render-diff.ts and this file's formatting.
+ *
+ * This module is plain data reachable from plugin.ts — every implementation
+ * (classifier, localizer, discovery, differ) sits behind a dynamic import,
+ * following `lexicons/k8s/src/kube/group.ts`'s discipline, so loading the
+ * plugin never pays for machinery no verb was asked to run.
+ */
+import type { CommandGroup } from "@intentius/chant/cli/command-group";
+import type { PinnabilityReport } from "./pinnability/classify.js";
+import type { LocalizationReport } from "./pinnability/localize.js";
+import type { HelmRenderRecord } from "./render.js";
+import type { RenderStabilityReport } from "./render-digest.js";
+import type { DeepDiffResult } from "@intentius/chant/lifecycle/deep-diff";
+import type { RenderDiffResult } from "./render-diff.js";
+/** The printed classify report — one line per finding, locations included. */
+export declare function formatPinnabilityReport(report: PinnabilityReport): string;
+/**
+ * The printed localization table: one block per open input, then the lines
+ * nothing explains. Same shape the survey harness prints, kept here so the
+ * CLI does not reach into test code.
+ */
+export declare function formatLocalizationReport(loc: LocalizationReport): string;
+/** The printed render-record table plus the stability summary. */
+export declare function formatRenderRecords(records: readonly HelmRenderRecord[], stability: RenderStabilityReport): string;
+/** The printed render-diff report: one line per added/removed document, a block per changed one. */
+export declare function formatRenderDiff(diff: RenderDiffResult): string;
+/** The printed render-to-live diff report: property drift per document, then holes. */
+export declare function formatRenderLiveDiff(contentDigest: string, environment: string, diff: DeepDiffResult): string;
+/** The `chant helm` verb group (#1248). */
+export declare function helmCommandGroup(): CommandGroup;
+//# sourceMappingURL=commands.d.ts.map

package/dist/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,oCAAoC,CAAC;AAG5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAwEtD,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CA8BzE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAqBxE;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,SAAS,EAAE,qBAAqB,GAC/B,MAAM,CAqBR;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA6B/D;AAwGD,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,CA6B7G;AAoDD,2CAA2C;AAC3C,wBAAgB,gBAAgB,IAAI,YAAY,CA4B/C"}

package/dist/config.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Helm capability profiles — the `helm` namespace in `chant.config.ts` (#1235,
+ * epic #1228 Phase 1).
+ *
+ * `helm template` looks like a pure function of (chart, values) and is not:
+ * `.Capabilities.KubeVersion` defaults to a version baked into the helm
+ * binary (v1.31.0 on helm 3.16.2, v1.35.0 on 4.1.1), and
+ * `.Capabilities.APIVersions` is silently empty offline. Two engineers on
+ * different helm versions therefore render different bytes from identical
+ * inputs unless the capability profile is declared. Declaring it closes both
+ * inputs: `--kube-version` and `--api-versions` are passed on every render
+ * that references a profile, so the render is a function of
+ * (chart, values, profile) and its digest means something.
+ *
+ * Profiles are scoped **per cluster** (see the epic's Decisions): each
+ * cluster declares its own `kubeVersion` / `apiVersions`, and a render is
+ * pinned against exactly one profile. This mirrors how the k8s lexicon binds
+ * environments to clusters (`k8s.profiles.<env>.context`, chant #1100) — a
+ * capability profile is the same per-cluster fact seen from the render side.
+ *
+ * ```ts
+ * export default {
+ *   lexicons: ["helm", "k8s"],
+ *   helm: {
+ *     capabilityProfiles: {
+ *       prod: { kubeVersion: "1.33.6", apiVersions: ["monitoring.coreos.com/v1"] },
+ *       staging: { kubeVersion: "1.31.4", apiVersions: [] },
+ *     },
+ *   },
+ * };
+ * ```
+ *
+ * A `HelmRender` references a profile by name (`capabilityProfile: "prod"`)
+ * or carries one inline. No profile keeps today's unpinned behavior; a
+ * reference that resolves to nothing is a build error naming the profile —
+ * never a silent fallback to the binary's default.
+ *
+ * Follows the k8s lexicon's config seam (#1344): the zod schema is the
+ * runtime half core validates the namespace with, the interface is the
+ * compile-time half projects write `satisfies` against, and the agreement
+ * type at the bottom keeps the two from drifting.
+ */
+import { z } from "zod";
+import type { ChantConfig } from "@intentius/chant/config";
+/**
+ * What `--kube-version` accepts: `1.33`, `1.33.6`, `v1.33.6`. Deliberately
+ * looser than full semver (no prerelease/build tags — helm's capability
+ * parsing does not want them) and tighter than "any string" (a typo like
+ * `"latest"` must fail at declaration, not render as garbage).
+ */
+export declare const KUBE_VERSION_PATTERN: RegExp;
+/**
+ * One cluster's declared capabilities, as written in
+ * `helm.capabilityProfiles.<name>`. The profile's name is the record key.
+ */
+export interface HelmCapabilityProfileConfig {
+    /** Kubernetes version the cluster runs, e.g. `"1.33.6"` — passed as `--kube-version`. */
+    kubeVersion: string;
+    /**
+     * API versions available on the cluster beyond the core set, e.g.
+     * `"monitoring.coreos.com/v1"` — each passed as `--api-versions`. Omit (or
+     * declare empty) for a cluster with no extra API groups charts probe for.
+     */
+    apiVersions?: string[];
+}
+/** A resolved capability profile: the declared facts plus the name they were declared under. */
+export interface HelmCapabilityProfile extends HelmCapabilityProfileConfig {
+    /** The profile's declared name (the `helm.capabilityProfiles` key, or the inline `name`). */
+    name: string;
+}
+/**
+ * How a `HelmRender` names its profile: a string resolved against
+ * `helm.capabilityProfiles`, or an inline profile object for the rare render
+ * whose cluster facts live nowhere else.
+ */
+export type HelmCapabilityProfileRef = string | HelmCapabilityProfile;
+export interface HelmChantConfig {
+    /** Per-cluster capability profiles, keyed by profile (cluster/environment) name. */
+    capabilityProfiles?: Record<string, HelmCapabilityProfileConfig>;
+}
+export declare const helmCapabilityProfileSchema: z.ZodObject<{
+    kubeVersion: z.ZodString;
+    apiVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export declare const helmConfigSchema: z.ZodObject<{
+    capabilityProfiles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        kubeVersion: z.ZodString;
+        apiVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+declare module "@intentius/chant/config" {
+    interface ChantConfig {
+        helm?: HelmChantConfig;
+    }
+}
+/**
+ * Compile-time proof the augmentation above reaches `ChantConfig` — the same
+ * guard the k8s and forgejo lexicons carry (#1344). Without it, a project
+ * writing the documented snippet with `satisfies ChantConfig` fails to
+ * compile and nothing in this repo notices.
+ */
+export type HelmConfigNamespace = NonNullable<ChantConfig["helm"]>;
+/**
+ * The schema and the documented interface describe the same namespace. If a
+ * field is added to one and not the other, this stops compiling.
+ */
+type SchemaMatchesInterface = z.infer<typeof helmConfigSchema> extends HelmChantConfig ? HelmChantConfig extends z.infer<typeof helmConfigSchema> ? true : never : never;
+export type _SchemaAgreesWithInterface = SchemaMatchesInterface;
+/**
+ * Validate a resolved profile's fields. Returns one message per problem,
+ * each naming the profile — empty when the profile is sound.
+ *
+ * Config-declared profiles are already schema-checked at config load
+ * (`helmConfigSchema` via the plugin's `configSchema`); this covers inline
+ * profiles handed straight to `HelmRender`, and re-checks resolved ones so a
+ * config loaded outside the CLI (a bare API caller) fails identically.
+ */
+export declare function validateCapabilityProfile(profile: HelmCapabilityProfile): string[];
+/**
+ * Resolve a `HelmRender`'s profile reference to a concrete profile.
+ *
+ * - An inline profile object is validated and returned as-is.
+ * - A string is looked up in `helm.capabilityProfiles` of the nearest
+ *   `chant.config.ts`/`.json` above `opts.startDir` (default: cwd).
+ *
+ * A reference that resolves to nothing throws, naming the missing profile,
+ * the profiles that ARE declared, and where to declare it — a declared but
+ * unresolvable profile must be a build error, never a silent fall-through to
+ * the helm binary's default capabilities (epic #1228, finding 1).
+ */
+export declare function resolveCapabilityProfile(ref: HelmCapabilityProfileRef, opts?: {
+    startDir?: string;
+}): HelmCapabilityProfile;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAI3D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAyB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,gGAAgG;AAChG,MAAM,WAAW,qBAAsB,SAAQ,2BAA2B;IACxE,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,qBAAqB,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;CAClE;AAED,eAAO,MAAM,2BAA2B;;;kBAKtC,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;kBAE3B,CAAC;AAEH,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,IAAI,CAAC,EAAE,eAAe,CAAC;KACxB;CACF;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAEnE;;;GAGG;AACH,KAAK,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,SAAS,eAAe,GAClF,eAAe,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GACtD,IAAI,GACJ,KAAK,GACP,KAAK,CAAC;AACV,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEhE;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAyBlF;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,wBAAwB,EAC7B,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,qBAAqB,CAyBvB"}

package/dist/deep-observe-hooks.d.ts

@@ -0,0 +1,2 @@
+export declare const helmDeepNormalizationHooks: import("packages/core/src").DeepNormalizationHooks;
+//# sourceMappingURL=deep-observe-hooks.d.ts.map

package/dist/deep-observe-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,0BAA0B,oDAA4B,CAAC"}

package/dist/deep-observe.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Helm deep observation (#1247, epic #1228 phase 5) — property-level live
+ * trees for the resources a release manages, read through the k8s lexicon's
+ * machinery rather than a second implementation.
+ *
+ * The objects a release deploys are Kubernetes objects, so the deep read
+ * composes rather than reimplements:
+ *
+ *   1. The helm half (shared with `describeResources`, `./release-observe.ts`)
+ *      resolves each declared `Helm::Chart` to its release and parses what
+ *      the release holds — `helm get manifest` plus `helm get hooks`, both
+ *      channels. Each rendered document becomes a synthetic declared entity:
+ *      the release's stored manifest IS the declared side of a helm deep
+ *      diff — what the cluster is supposed to hold is what the release
+ *      applied.
+ *   2. The k8s half (`observeResourcesDeepK8s`) reads the live property tree
+ *      for each of those entities over the typed API client, resolves
+ *      per-field ownership from `metadata.managedFields` (#1189), and
+ *      normalizes with `k8sDeepNormalizationHooks` — so Secret-value masking
+ *      and the managed-fields rules apply to helm rows exactly as they do to
+ *      k8s rows, from the same hook object (see `./deep-observe-hooks.ts`).
+ *
+ * Verdicts compose per the deep contract (#1014/#1089): a helm-side failure
+ * (missing binary, unreachable cluster, unreadable release) lands the chart
+ * entity in `unobserved` with a total reason; a k8s-side failure lands the
+ * specific resource row there. Chart-authoring entities (`Helm::Chart`,
+ * `Helm::Values`, …) have no property tree of their own — their deep form is
+ * the per-resource rows this read returns — so on a successful read they are
+ * deliberately in neither map, which core's deep diff treats as
+ * nothing-to-compare rather than drift.
+ */
+import type { DeepObservationResult } from "@intentius/chant/lexicon";
+import type { K8sConnector } from "@intentius/chant-lexicon-k8s/api/connect";
+import { type HelmRunner } from "./release-observe.js";
+export interface HelmDeepObserveOptions {
+    environment: string;
+    buildOutput: string;
+    entityNames: string[];
+    entities: Map<string, {
+        entityType: string;
+        props: Record<string, unknown>;
+    }>;
+    stack?: string;
+    region?: string;
+    owned?: boolean;
+}
+/** Injectable seams, so tests run without a helm binary or a kubeconfig. */
+export interface HelmDeepObserveDeps {
+    run?: HelmRunner;
+    /** Forwarded to the k8s reader — a test passes a fake cluster's connector. */
+    connect?: K8sConnector;
+}
+export declare function observeResourcesDeepHelm(options: HelmDeepObserveOptions, deps?: HelmDeepObserveDeps): Promise<DeepObservationResult>;
+//# sourceMappingURL=deep-observe.d.ts.map

package/dist/deep-observe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAoB,MAAM,0BAA0B,CAAC;AAIxF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAeD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,sBAAsB,EAC/B,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CA6ChC"}

package/dist/describe-resources.d.ts

@@ -0,0 +1,17 @@
+import type { ObservationResult } from "@intentius/chant/observation";
+import { type HelmRunner } from "./release-observe.js";
+export interface HelmDescribeOptions {
+    environment: string;
+    buildOutput: string;
+    entityNames: string[];
+    entities: Map<string, {
+        entityType: string;
+        props: Record<string, unknown>;
+    }>;
+    stack?: string;
+    region?: string;
+    owned?: boolean;
+    namespace?: string;
+}
+export declare function describeResources(options: HelmDescribeOptions, run?: HelmRunner): Promise<ObservationResult>;
+//# sourceMappingURL=describe-resources.d.ts.map

package/dist/describe-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAGtE,OAAO,EAKL,KAAK,UAAU,EAEhB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA2BD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,GAAG,GAAE,UAA8B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CAwG5B"}

package/dist/index.d.ts

@@ -3,8 +3,22 @@ export { helmPlugin } from "./plugin.js";
 export { helmCapabilityPlugin, HELM_VERB_FAMILIES } from "./components/capability-plugin.js";
 export { helmUpgradeCapability, createHelmUpgradeCapability, type HelmUpgradeInput, type HelmUpgradeOutcome } from "./components/helm-upgrade.js";
 export { Chart, Values, ValuesOverride, HelmTest, HelmNotes, HelmHook, HelmDependency, HelmMaintainer, HelmCRD } from "./resources.js";
-export { HelmRender } from "./render.js";
-export type { HelmRenderProps } from "./render.js";
+export { HelmRender, getHelmRenderRecords, clearHelmRenderRecords } from "./render.js";
+export type { HelmRenderProps, HelmRenderRecord } from "./render.js";
+export { canonicalizeRender, helmContentDigest, helmInputDigest, renderStability } from "./render-digest.js";
+export type { HelmInputDigestSource, RenderStabilityGroup, RenderStabilityReport } from "./render-digest.js";
+export { helmValuesDigest, indexRenderDocuments, renderCacheKey, renderStoreRoot, persistHelmRender, loadRenderManifest, loadRenderContent, listRenderManifests, findRenderByCacheKey, readRenderDocument, } from "./render-store.js";
+export type { RenderManifest, RenderDocumentEntry, RenderDocumentRef, RenderCacheKeySource, RenderInputsIndexEntry, PersistHelmRenderInput, PersistedHelmRender, } from "./render-store.js";
+export { routeRender, routeStoredRender } from "./render-wrapper.js";
+export type { RoutedRender, RoutedDocument, RoutedRenderWarning, RoutedRenderWarningCode, RouteRenderOptions, } from "./render-wrapper.js";
+export { materializeWrapperChart, wrapperChartName } from "./wrapper-chart.js";
+export type { MaterializedWrapperChart } from "./wrapper-chart.js";
+export { addArchiveHelmRender, HELM_RENDER_MEDIA_TYPE } from "./archive-render.js";
+export type { AddArchiveHelmRenderInput, AddArchiveHelmRenderOutput } from "./archive-render.js";
+export { probeCoalescedValues, coalescedValuesDigest, computeValueSources, findDeadAssignments, rootCoalescedValues, getValuesProbeRecords, recordValuesProbe, clearValuesProbeRecords, } from "./values-probe.js";
+export type { ValuesProbeOptions, CoalescedValuesProbe, CoalescedChartValues, DisabledDependency, SuppliedValuesLayer, ValueOrigin, ValuesAttributionInput, DeadAssignment, HelmValuesProbeRecord, } from "./values-probe.js";
+export { helmConfigSchema, helmCapabilityProfileSchema, resolveCapabilityProfile, validateCapabilityProfile, KUBE_VERSION_PATTERN, } from "./config.js";
+export type { HelmChantConfig, HelmCapabilityProfile, HelmCapabilityProfileConfig, HelmCapabilityProfileRef, } from "./config.js";
 export { HelmTpl, HELM_TPL_KEY, HELM_IF_KEY, HELM_RANGE_KEY, HELM_WITH_KEY, RuntimeSlot, RUNTIME_SLOT_KEY, runtimeSlot, values, Release, ChartRef, include, required, helmDefault, toYaml, quote, printf, tpl, lookup, Capabilities, Template, filesGet, filesGlob, filesAsConfig, filesAsSecrets, ElseIf, If, Range, With, withOrder, argoWave, } from "./intrinsics.js";
 export type { HelmConditional } from "./intrinsics.js";
 export { generateHelpers } from "./helpers.js";
@@ -18,6 +32,8 @@ export { HelmParser } from "./import/parser.js";
 export { HelmGenerator } from "./import/generator.js";
 export { stripTemplateExpressions, classifyExpression } from "./import/template-stripper.js";
 export type { StrippedExpression, StripResult, ExpressionKind } from "./import/template-stripper.js";
+export { classifyChart } from "./pinnability/index.js";
+export type { PinnabilityVerdict, PinnabilityReport, ClassifyChartOptions, CapabilityRequirement, ClosedInput, ConditionalHazard, RenderEvidence, } from "./pinnability/index.js";
 export { helmCompletions } from "./lsp/completions.js";
 export { helmHover } from "./lsp/hover.js";
 export { generateDocs } from "./codegen/docs.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAKtC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG/I,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGpI,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAGhD,OAAO,EACL,OAAO,EACP,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,MAAM,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,MAAM,EACN,KAAK,EACL,MAAM,EACN,GAAG,EACH,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,MAAM,EACN,EAAE,EACF,KAAK,EACL,IAAI,EACJ,SAAS,EACT,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGlG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAKtC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG/I,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGpI,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACpF,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1G,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG1G,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EACV,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAGhE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,YAAY,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAG9F,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,cAAc,EACd,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,OAAO,EACP,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,MAAM,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,MAAM,EACN,KAAK,EACL,MAAM,EACN,GAAG,EACH,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,MAAM,EACN,EAAE,EACF,KAAK,EACL,IAAI,EACJ,SAAS,EACT,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIlG,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,cAAc,GACf,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "28a09cec2e206b150612f92a7979f33ff07a689619e3e423949fbd3fa810376e",
+    "manifest.json": "e240eeef5865a87bce3a27111adc0c59a76c410ceb701f6510c4d559c5320767",
     "meta.json": "14243c5730a07c6a6edc35ddd351438547d58df5cf345f2233a355b0c7611ccc",
     "types/index.d.ts": "5377696ca8698cd2999e4680feb8e8e4b54a7b49fb603a87b2f27356114d1794",
     "rules/chart-metadata.ts": "8f3377e893d5e2828460b7fe5924fca098334245a9a2fdb90f6b67e490eaf091",
@@ -30,9 +30,11 @@
     "rules/whm407.ts": "200190f5de2d86d2bcc5aee0b5ce4807919ec727b1fc14576ea17b9b3073838b",
     "rules/whm501.ts": "e6afa7c0eface9820380bf189fe8be58f4a6997dd5b74f76335022650616d080",
     "rules/whm502.ts": "c3ed7b4b5215d96e46eba758aca2171928d8f8fb1eb20452ea6b4393672755b0",
-    "skills/chant-helm.md": "89edaffd63b549045414ecdecf380daddb042b3b41a5d04754c2953ab7c5e70a",
+    "rules/whm503.ts": "72808bba7c66ef71757a2dc73c9c3afff5980fd729bbdd5ba00af9c0c2213304",
+    "rules/whm504.ts": "15c03b47c271270eee93de45310ff6dfc2665dfe221d457665a638cfd9637005",
+    "skills/chant-helm.md": "828a169f9275c58df0a079287befb14c450ad8a92257e3cb6960450221941973",
     "skills/chant-helm-patterns.md": "9e79e6a46391da46709d8aa57e2825a7cd9eb981cd923f02ad60836c49b2561e",
     "skills/chant-helm-security.md": "bfc367eabceed2e84f1cf94501b407df78aeed963cec104f24a321d0962063c9"
   },
-  "composite": "8b708aafacdaa06d0d5d7a3ab9f16539a8df803fc0dc86a9d1a66629a58e0043"
+  "composite": "b26091a74a2371c308b68c2a63b99428d753ef68dc49564774295ac611a4e094"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAsBrD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAwBrD,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAuBvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAsB3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAyBvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAwB3C,CAAC"}

package/dist/lint/post-synth/whm503.d.ts

@@ -0,0 +1,34 @@
+/**
+ * WHM503: Pinned render artifact carries Secret data.
+ *
+ * WHM407 covers the pre-render concern — a chart TEMPLATE with an inline,
+ * literal `data`/`stringData` value baked into `templates/`. This rule
+ * covers a different concern (#1241, epic #1228 Phase 3): the STORED,
+ * POST-RENDER artifact (`render-store.ts`, #1238). A pinned render is
+ * durable, promoted, and pushed to a registry — unlike a normal `helm
+ * upgrade`, whose rendered bytes are computed at deploy time and discarded.
+ * By the time a render lands in the store, every `.Values` reference and
+ * `{{ }}` expression is resolved, so a `kind: Secret` document with
+ * populated `data`/`stringData` there is a live credential baked into
+ * something that outlives the deploy that produced it.
+ *
+ * Scans every pinned render recorded so far in this process
+ * (`getHelmRenderRecords()` from `../../render`) that carries a
+ * `contentDigest`, loads its manifest + canonical content from the render
+ * store, and flags any `Secret` document whose `data` or `stringData` is
+ * non-empty.
+ */
+import type { PostSynthCheck, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import type { HelmRenderRecord } from "../../render.js";
+/**
+ * Scan a set of `HelmRenderRecord`s for pinned renders whose stored artifact
+ * carries a `Secret` document with populated `data`/`stringData`. Exported
+ * separately from `whm503` so tests can drive it directly with hand-built
+ * records — no real `helm` binary required, unlike a `HelmRender()` call.
+ * `opts.root` overrides the render store root (test isolation).
+ */
+export declare function checkRenderRecordsForSecrets(records: readonly HelmRenderRecord[], opts?: {
+    root?: string;
+}): PostSynthDiagnostic[];
+export declare const whm503: PostSynthCheck;
+//# sourceMappingURL=whm503.d.ts.map

package/dist/lint/post-synth/whm503.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whm503.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/whm503.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAcrD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB,mBAAmB,EAAE,CAwCvB;AAED,eAAO,MAAM,MAAM,EAAE,cAUpB,CAAC"}

package/dist/lint/post-synth/whm504.d.ts

@@ -0,0 +1,20 @@
+/**
+ * WHM504: Dead value assignment (#1252, epic #1228 Phase 7).
+ *
+ * A supplied value that never survives coalescing is a lie in the config:
+ * it reads as if it configures something, and nothing ever sees it. The
+ * coalesced-values probe (#1251, ../../values-probe.ts) knows three ways a
+ * supplied value dies — shadowed by a later supplied layer, targeting a
+ * dependency a `condition:` disabled, or a values map under a top-level key
+ * that names no dependency at all (the silently-ignored subchart typo).
+ *
+ * The check reports over the probe records of the current process
+ * (`getValuesProbeRecords`): whatever ran the probe — the pinned-render
+ * build path, a test, a direct call — this check turns its dead assignments
+ * into diagnostics. No probe run, nothing to report; the probe itself needs
+ * the helm binary and the chart source, which a post-synth check must not
+ * require on its own.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const whm504: PostSynthCheck;
+//# sourceMappingURL=whm504.d.ts.map

package/dist/lint/post-synth/whm504.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whm504.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/whm504.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAc9G,eAAO,MAAM,MAAM,EAAE,cAmBpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "helm",
-  "version": "0.45.0",
+  "version": "0.49.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Helm",
   "intrinsics": [

package/dist/okf/index.md

@@ -37,3 +37,5 @@ okf_version: '0.2'
 * [WHM407](/rules/WHM407.md) - Secrets with inline data should use ExternalSecret or SealedSecret
 * [WHM501](/rules/WHM501.md) - Detect values keys that are defined but never referenced in templates
 * [WHM502](/rules/WHM502.md) - Detect deprecated or invalid Kubernetes API versions
+* [WHM503](/rules/WHM503.md) - Pinned render artifact must not carry populated Secret data/stringData
+* [WHM504](/rules/WHM504.md) - Detect supplied values that never survive coalescing (shadowed, disabled subchart, unknown subchart)

package/dist/okf/rules/WHM503.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WHM503
+description: Pinned render artifact must not carry populated Secret data/stringData
+id: WHM503
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Pinned render artifact must not carry populated Secret data/stringData
+
+## Applies to
+
+- [Values](/types/Values.md)

package/dist/okf/rules/WHM504.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WHM504
+description: Detect supplied values that never survive coalescing (shadowed, disabled subchart, unknown subchart)
+id: WHM504
+severity: error
+category: post-synth
+lexicon: helm
+docs: https://intentius.io/chant/lexicons/helm/rules/
+---
+Detect supplied values that never survive coalescing (shadowed, disabled subchart, unknown subchart)

package/dist/okf/types/Values.md

@@ -22,3 +22,4 @@ Typed values definition — emits values.yaml and values.schema.json.
 - [WHM405](/rules/WHM405.md): Resource specs should include cpu and memory in limits/requests
 - [WHM407](/rules/WHM407.md): Secrets with inline data should use ExternalSecret or SealedSecret
 - [WHM501](/rules/WHM501.md): Detect values keys that are defined but never referenced in templates
+- [WHM503](/rules/WHM503.md): Pinned render artifact must not carry populated Secret data/stringData