@intentius/chant-lexicon-helm 0.46.0 → 0.50.0

package/dist/pinnability/conditions.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Tri-state evaluation of template pipeline conditions against supplied
+ * values (#1234, epic #1228).
+ *
+ * The classifier must decide whether a control-flow construct is REACHABLE
+ * under the values the render was given. That needs no template engine —
+ * only enough of Go template expression semantics to evaluate the gates
+ * charts actually write: `and` / `or` / `not` / `eq` / `ne` / `empty`,
+ * parenthesised sub-expressions, literals, and `.Values` paths.
+ *
+ * Everything else evaluates to UNKNOWN, and unknown always degrades toward
+ * refusal, never toward pinning: a gate we cannot prove closed is treated as
+ * open. The only way a control-flow `lookup` avoids refusal is a gate that
+ * DEFINITIVELY evaluates false against the supplied values.
+ *
+ * Values fidelity caveat: the evaluator sees chant's approximation of helm's
+ * value coalescing (parent-overrides-child, alias scoping, globals — see
+ * values.ts). The build-time values probe (#1251) replaces that
+ * approximation with helm's own coalescing; until then, exotic mechanisms
+ * (`import-values`, `tpl`-computed values) resolve as unknown or absent,
+ * both of which are safe directions for a gate.
+ */
+export declare const UNKNOWN: unique symbol;
+export type Tri = boolean | typeof UNKNOWN;
+/** Go template truthiness: false, zero, "", nil, empty collection are false. */
+export declare function truthy(v: unknown): boolean;
+/** The evaluation context: effective values plus dot binding. */
+export interface EvalContext {
+    /** Effective values for the chart instance being evaluated. */
+    values: unknown;
+    /**
+     * Root-scope prefix of this instance ("grafana" for the grafana subchart of
+     * an umbrella), used to report gate paths in the PARENT's coordinates.
+     */
+    scope: readonly string[];
+    /**
+     * When the dot is pinned to a `.Values` subtree by an enclosing `with`,
+     * that subtree's path; `null` when the dot is the root context;
+     * `undefined` when unresolvable.
+     */
+    dotValuesPath: string[] | null | undefined;
+}
+/** A definitively-false conjunct and the values path responsible for it. */
+export interface GatePath {
+    /** Values path in the ROOT chart's coordinates, e.g. "grafana.persistence.enabled". */
+    path: string;
+    /** The value the path currently holds (rendered for the hazard record). */
+    value: unknown;
+}
+export interface EvalResult {
+    value: Tri;
+    /** When `value` is false: the values path(s) that made it false. */
+    gates: GatePath[];
+}
+type Token = {
+    t: "lparen";
+} | {
+    t: "rparen";
+} | {
+    t: "pipe";
+} | {
+    t: "str";
+    v: string;
+} | {
+    t: "num";
+    v: number;
+} | {
+    t: "word";
+    v: string;
+};
+export declare function tokenize(expr: string): Token[] | undefined;
+export type ExprNode = {
+    type: "call";
+    op: string;
+    args: ExprNode[];
+} | {
+    type: "atom";
+    token: Token;
+} | {
+    type: "pipeline";
+    stages: ExprNode[];
+};
+/**
+ * Parse a pipeline expression into an AST. Returns undefined on anything the
+ * small grammar does not cover — which the evaluator then treats as UNKNOWN.
+ */
+export declare function parseExpr(expr: string): ExprNode | undefined;
+/**
+ * Evaluate a condition expression to a tri-state truth value. When the
+ * result is definitively false, `gates` names the values path(s)
+ * responsible — the record a conditional hazard carries so that flipping
+ * the value later re-classifies the chart.
+ */
+export declare function evaluateCondition(expr: string, ctx: EvalContext): EvalResult;
+/**
+ * Is a call to `fn` inside `expr` actually evaluated, given short-circuit
+ * `and` / `or`? Returns the gates that make it unreachable, or "reachable"
+ * when no definitive gate precedes the call.
+ *
+ * `and A (lookup ...)` with A false never calls lookup (Go templates
+ * short-circuit since 1.18, which every supported helm builds against);
+ * `or A (lookup ...)` with A true likewise skips it.
+ */
+export declare function callReachability(expr: string, fnRe: RegExp, ctx: EvalContext): {
+    reachable: Tri;
+    gates: GatePath[];
+};
+export {};
+//# sourceMappingURL=conditions.d.ts.map

package/dist/pinnability/conditions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.d.ts","sourceRoot":"","sources":["../../src/pinnability/conditions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,eAAO,MAAM,OAAO,eAAoB,CAAC;AACzC,MAAM,MAAM,GAAG,GAAG,OAAO,GAAG,OAAO,OAAO,CAAC;AAE3C,gFAAgF;AAChF,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAM1C;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB;;;;OAIG;IACH,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;CAC5C;AAED,4EAA4E;AAC5E,MAAM,WAAW,QAAQ;IACvB,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,GAAG,CAAC;IACX,oEAAoE;IACpE,KAAK,EAAE,QAAQ,EAAE,CAAC;CACnB;AAID,KAAK,KAAK,GACN;IAAE,CAAC,EAAE,QAAQ,CAAA;CAAE,GACf;IAAE,CAAC,EAAE,QAAQ,CAAA;CAAE,GACf;IAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GACb;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7B,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,SAAS,CAiC1D;AAID,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,EAAE,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAO5D;AAuMD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,UAAU,CAW5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,WAAW,GACf;IAAE,SAAS,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,QAAQ,EAAE,CAAA;CAAE,CA8CvC"}

package/dist/pinnability/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Pinnability gate for helm renders (#1234, epic #1228 Phase 1).
+ *
+ * `classifyChart` is the entry point the pinned-render pipeline
+ * (#1235–#1240) calls before anything is pinned; the survey harness
+ * (lexicons/helm/test/survey) asserts its verdicts over a corpus of real
+ * upstream charts. This module deliberately imports nothing from the
+ * lexicon's generated artifacts, so it loads on a fresh clone and in the
+ * survey CI job without a generation step.
+ */
+export { classifyChart, type PinnabilityVerdict, type PinnabilityReport, type ClassifyChartOptions, type CapabilityRequirement, type ClosedInput, type ConditionalHazard, type ControlFlowLookup, type ValuePositionLookup, type RenderEvidence, collectOwnTemplateFiles, } from "./classify.js";
+export { actionPipeline, extractActions, scopeActions, type TemplateAction, type ActionKind, type ScopedAction, type ScopeFrame, } from "./actions.js";
+export { UNKNOWN, truthy, evaluateCondition, callReachability, parseExpr, type Tri, type EvalContext, type EvalResult, type GatePath, } from "./conditions.js";
+export { buildChartInstances, mergeValues, valueAtPath, readChartMeta, type ChartInstance, type ChartDependency, type ChartMeta, } from "./values.js";
+export { splitDocuments, sourcePath, isCrdSource, routeBySource, countDifferingLines, type RoutedDocuments, } from "./render-stream.js";
+export { localizeOpenInputs, diffRenderPair, type RenderFn, type PinStyle, type CandidatePin, type LocalizedOccurrence, type LocalizedInput, type LocalizationReport, type LocalizeOptions, } from "./localize.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/pinnability/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pinnability/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,KAAK,GAAG,EACR,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,QAAQ,GACd,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,cAAc,EACd,UAAU,EACV,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC"}

package/dist/pinnability/localize.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Double-render localizer for open generated inputs (#1236, epic #1228
+ * Phase 1).
+ *
+ * The static classifier (#1234) NAMES generator sites; this module proves
+ * which of them actually fire and maps every unstable output line back to
+ * the input that produced it. The mechanism is the epic's own: pin the
+ * input, not the output. For each candidate values path that could close a
+ * generator, render the chart twice with that path pinned — the lines that
+ * stop differing are the lines that input produced, cascades included
+ * (finding 6: one `randAlphaNum` admin password differed as the secret line
+ * PLUS a `checksum/secret` annotation derived from it; hoisting the secret
+ * alone would have desynchronized the checksum and silently broken
+ * restart-on-change).
+ *
+ * Candidate pins come from three static sources, each validated dynamically
+ * before being suggested:
+ *
+ *   1. the generator's own action (`x | default (randAlphaNum 16)` — the
+ *      classifier already names `x`),
+ *   2. enclosing control-flow gates (`if not .Values.core.existingSecret`
+ *      around the generator: supplying the existing-secret slot closes it),
+ *   3. the include chain — a generator inside `define "grafana.password"`
+ *      inherits the gates of every `include "grafana.password"` site, which
+ *      is where grafana's `{{- if .Values.adminPassword }} ... {{- else }}`
+ *      supply slot lives.
+ *
+ * A differing line no probe and no source mapping can explain is reported as
+ * UNLOCALIZED instability — never silently pinnable. A base double render
+ * with zero differing lines confirms the chart deterministic.
+ */
+import { type PinnabilityReport } from "./classify.js";
+/** Renders the chart with the given values paths pinned to literal strings. */
+export type RenderFn = (pins: Record<string, string>) => string;
+export type PinStyle = "supply" | "existing-slot" | "gate";
+export interface CandidatePin {
+    /** Root-scoped values path. */
+    path: string;
+    style: PinStyle;
+}
+/** One unstable output line, located in the rendered document set. */
+export interface LocalizedOccurrence {
+    /** Source template of the rendered document (`# Source:` origin). */
+    doc: string;
+    /** `Kind/name` of the document, when parseable. */
+    docId: string;
+    /** YAML key of the differing line (`admin-password`, `checksum/secret`). */
+    key: string;
+    /** 1-based line within the document, from the first base render. */
+    line: number;
+    /**
+     * The line lives in a different template than the generator — a derived
+     * field (checksum annotation, re-included secret) grouped under its root
+     * input rather than reported as independent instability.
+     */
+    derived: boolean;
+}
+/** One open generated input with the unstable lines localized to it. */
+export interface LocalizedInput {
+    fn: string;
+    /** Template file and line of the generator (classifier coordinates). */
+    file: string;
+    line: number;
+    /** The values path a supply-style pin uses, when one validated. */
+    valuesPath?: string;
+    /** A validated pin exists — supplying a value closes this input. */
+    suppliable: boolean;
+    /**
+     * The concrete values entry a user adds to close the input, e.g.
+     * `adminPassword: <generate once and supply>`. Absent when no candidate
+     * pin validated (the input is real but not closable via values).
+     */
+    suggestedPin?: string;
+    /** Chart-provided slots that also close it (`admin.existingSecret`). */
+    existingSlots: string[];
+    occurrences: LocalizedOccurrence[];
+}
+export interface LocalizationReport {
+    /** The base double render differed on zero lines. */
+    deterministic: boolean;
+    /** Differing line count of the base double render (per-render lines). */
+    differingLines: number;
+    inputs: LocalizedInput[];
+    /** Differing lines no probe and no source mapping explains. */
+    unlocalized: LocalizedOccurrence[];
+    /**
+     * Pinning every validated pin at once yields a stable render. Present
+     * only when at least one pin validated.
+     */
+    stableWithAllPins?: boolean;
+    /** How many `helm template` invocations the localization used. */
+    renders: number;
+}
+export interface LocalizeOptions {
+    render: RenderFn;
+    /** Values overrides, as `helm template --values` would merge them. */
+    values?: unknown;
+    /** Values files merged (in order) over the chart defaults. */
+    valuesFiles?: string[];
+    /** Probe budget per generator site (default 6). */
+    maxProbesPerInput?: number;
+}
+interface DiffOccurrence {
+    ident: string;
+    doc: string;
+    docId: string;
+    key: string;
+    line: number;
+}
+/**
+ * Diff two renders of the SAME inputs into a set of differing-line
+ * occurrences with identities stable across separate probe runs: documents
+ * pair by (`# Source:` origin, ordinal), lines identify by their YAML key
+ * plus ordinal rather than raw content — the content is exactly what varies.
+ */
+export declare function diffRenderPair(a: string, b: string): Map<string, DiffOccurrence>;
+/**
+ * Localize the open generated inputs of a chart: double-render, and map
+ * every differing line back to the input that produced it by pinning
+ * candidate inputs one at a time. See the module doc for the mechanism.
+ */
+export declare function localizeOpenInputs(chartDir: string, report: PinnabilityReport, options: LocalizeOptions): LocalizationReport;
+export {};
+//# sourceMappingURL=localize.d.ts.map

package/dist/pinnability/localize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localize.d.ts","sourceRoot":"","sources":["../../src/pinnability/localize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AASH,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAWpB,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC;AAEhE,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,eAAe,GAAG,MAAM,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,aAAa,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,+DAA+D;IAC/D,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,QAAQ,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAMD,UAAU,cAAc;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAmCD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CA4ChF;AA0ND;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,eAAe,GACvB,kBAAkB,CA8LpB"}

package/dist/pinnability/render-stream.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Helpers over a `helm template` output stream (#1234, epic #1228).
+ *
+ * The CRD routing rule here is what the structure-preserving wrapper
+ * (#1239) builds on, and the line diff seeds the double-render localizer
+ * (#1236). Both were proven in the survey harness before promotion.
+ */
+/** Split a `helm template` stream into non-empty documents. */
+export declare function splitDocuments(rendered: string): string[];
+/** The `# Source: <chart>/<path>` origin of a rendered document, if any. */
+export declare function sourcePath(doc: string): string | undefined;
+/**
+ * Finding 10: segment matching, not prefix matching. A subchart's CRDs
+ * arrive as `charts/<child>/crds/<file>`; `startsWith("crds/")` catches
+ * 0 of them and would route every one into templates/, making it deletable
+ * on uninstall.
+ */
+export declare function isCrdSource(path: string): boolean;
+export interface RoutedDocuments {
+    crds: string[];
+    templates: string[];
+}
+/** Route rendered documents by origin: `crds/`-segment sources vs the rest. */
+export declare function routeBySource(rendered: string): RoutedDocuments;
+/** Count lines that differ between two renders (symmetric, order-blind). */
+export declare function countDifferingLines(a: string, b: string): number;
+//# sourceMappingURL=render-stream.d.ts.map

package/dist/pinnability/render-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-stream.d.ts","sourceRoot":"","sources":["../../src/pinnability/render-stream.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAKzD;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAO/D;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAUhE"}

package/dist/pinnability/values.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Chart model and value coalescing for the pinnability classifier (#1234,
+ * epic #1228).
+ *
+ * Pinnability is a property of `(chart, values)`, not of the chart alone —
+ * so the classifier needs each subchart instance's EFFECTIVE values to ask
+ * whether a gate is open. This module walks `Chart.yaml` dependencies
+ * (aliases and `condition:` included — finding 12: dependency conditions are
+ * values-driven and therefore closed inputs) and approximates helm's
+ * coalescing: child defaults, overridden by the parent's `<alias-or-name>`
+ * subtree, with `global` propagated down.
+ *
+ * The approximation is deliberate and bounded. `import-values`, `tags`, and
+ * `tpl`-computed values are not modeled; a gate they would decide resolves
+ * as UNKNOWN and the classifier refuses rather than pins (see
+ * conditions.ts). The build-time values probe (#1251) replaces this with
+ * helm's own coalescing.
+ */
+export interface ChartDependency {
+    name: string;
+    alias?: string;
+    /** Comma-separated values paths, evaluated against the ROOT values. */
+    condition?: string;
+}
+export interface ChartMeta {
+    name: string;
+    dependencies: ChartDependency[];
+}
+export declare function readChartMeta(chartDir: string): ChartMeta;
+export declare function readYamlFile(path: string): unknown;
+/**
+ * Helm-style deep merge: `override` wins, maps merge recursively, a `null`
+ * override deletes the key, arrays replace wholesale.
+ */
+export declare function mergeValues(base: unknown, override: unknown): unknown;
+/** Resolve a dot path against a values tree; undefined when absent. */
+export declare function valueAtPath(values: unknown, path: string[]): unknown;
+/**
+ * One chart in the tree, with the values IT sees. An aliased dependency
+ * yields two instances over the same directory — each with its own value
+ * scope, which is why findings are evaluated per instance but reported per
+ * file.
+ */
+export interface ChartInstance {
+    /** Directory of the (sub)chart. */
+    dir: string;
+    /** Directory relative to the root chart ("" for the root). */
+    relDir: string;
+    /** Values scope from the root, e.g. ["grafana"] or ["kidtwo"]; [] for root. */
+    scope: readonly string[];
+    /** Effective values as this instance sees them. */
+    values: unknown;
+    /**
+     * When a `condition:` on the dependency chain disables this instance under
+     * the supplied values: the first condition path that resolved false, in
+     * root coordinates. Constructs inside a disabled instance are gated by it.
+     */
+    disabledBy?: string;
+}
+/**
+ * Build the instance tree for a chart directory and the values the render
+ * was given. `suppliedValues` merges over the root chart's `values.yaml`
+ * exactly like `helm template --values`.
+ */
+export declare function buildChartInstances(chartDir: string, suppliedValues?: unknown): {
+    instances: ChartInstance[];
+    warnings: string[];
+};
+//# sourceMappingURL=values.d.ts.map

package/dist/pinnability/values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../src/pinnability/values.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAqBzD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlD;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAYrE;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAOpE;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,mDAAmD;IACnD,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,OAAO,GACvB;IAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA8EpD"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAY7F,eAAO,MAAM,UAAU,EAAE,aAqXxB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAiB7F,eAAO,MAAM,UAAU,EAAE,aAqcxB,CAAC"}

package/dist/release-observe.d.ts

@@ -0,0 +1,109 @@
+import type { UnobservedEntity, UnobservedReason } from "@intentius/chant/lexicon";
+declare const defaultRunner: (command: string) => Promise<{
+    stdout: string;
+}>;
+/** Injectable command runner, so tests drive every branch without helm or a cluster. */
+export type HelmRunner = (command: string) => Promise<{
+    stdout: string;
+}>;
+export { defaultRunner as defaultHelmRunner };
+export declare const HELM_CHART_ENTITY_TYPE = "Helm::Chart";
+export declare const HELM_RELEASE_TYPE = "Helm::Release";
+/** Shell-quote one argv element, same convention as `helm-upgrade.ts`. */
+export declare function q(arg: string): string;
+/**
+ * The environment's kube context (#1488): the declared binding when present,
+ * ambient otherwise. Unresolvable config is ambient, chant's own fallback —
+ * identical to `list-artifacts.ts`.
+ */
+export declare function resolveHelmContext(environment: string): Promise<string | undefined>;
+/**
+ * Total verdict for a failed helm invocation (#1089/#1246). A missing binary
+ * and a missing/unusable kubeconfig are both `no-credentials` — the read had
+ * no usable way to reach the target. Anything else the CLI refused is
+ * `read-failed`.
+ */
+export declare function classifyHelmFailure(err: unknown): {
+    reason: UnobservedReason;
+    detail: string;
+};
+/**
+ * Kinds that are cluster-scoped, so a document without `metadata.namespace`
+ * must not inherit the release namespace. Well-known built-ins only; a
+ * cluster-scoped CRD instance this set does not name defaults to the release
+ * namespace, which affects the row's address, never its verdict.
+ */
+export declare const CLUSTER_SCOPED_KINDS: Set<string>;
+/** One rendered document a release holds, from either channel. */
+export interface ParsedReleaseResource {
+    /**
+     * Row key, following the k8s runtime-sweep convention
+     * (`<Kind>/<namespace>/<name>`, `cluster:<Kind>/<name>`) so a helm row and
+     * a k8s row for the same object spell the same identity.
+     */
+    key: string;
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+    /** Which read reported it — hooks are invisible to the manifest channel. */
+    channel: "manifest" | "hooks";
+    /** chant's k8s entity type for the document's GVK (`K8s::Apps::Deployment`). */
+    entityType: string;
+    /** The document itself, minus nothing — the release's stored declaration. */
+    doc: Record<string, unknown>;
+    /** `helm.sh/hook*` annotations, for hook-channel rows. */
+    hook?: {
+        hook: string;
+        weight?: string;
+        deletePolicy?: string;
+    };
+}
+/** One declared chart resolved to a live release, with what the release holds. */
+export interface ObservedRelease {
+    entityName: string;
+    release: string;
+    namespace: string;
+    status?: string;
+    revision?: string;
+    chart?: string;
+    appVersion?: string;
+    updated?: string;
+    resources: ParsedReleaseResource[];
+}
+export interface ReleaseObservation {
+    /** Charts whose release was found and fully read. */
+    releases: ObservedRelease[];
+    /** Chart entities whose release `helm list` did not report — a real absence. */
+    absent: string[];
+    /** Chart entities that could not be read, with a total reason (#1089). */
+    unobserved: Record<string, UnobservedEntity>;
+    /** The helm command issued per chart entity (#1620). */
+    queried: Record<string, string>;
+}
+export interface ReleaseObserveOptions {
+    environment: string;
+    entities: Map<string, {
+        entityType: string;
+        props: Record<string, unknown>;
+    }>;
+    /** Deploy unit, `<namespace>/<release>` or `<release>` (see `describeStackStatus`). */
+    stack?: string;
+}
+/** The declared chart entities, with the release name each one deploys as. */
+export declare function chartEntities(entities: Map<string, {
+    entityType: string;
+    props: Record<string, unknown>;
+}>): Array<{
+    entityName: string;
+    release: string;
+}>;
+/** Parse one channel's multi-document YAML stream into per-resource rows. */
+export declare function parseReleaseDocuments(text: string, channel: "manifest" | "hooks", releaseNamespace: string): ParsedReleaseResource[];
+/**
+ * Resolve every declared chart to its release and read both channels.
+ * Never throws for a per-release failure; a whole-read failure (the `helm
+ * list` itself) lands every chart entity in `unobserved` with one reason.
+ */
+export declare function observeReleases(options: ReleaseObserveOptions, run?: HelmRunner): Promise<ReleaseObservation>;
+//# sourceMappingURL=release-observe.d.ts.map

package/dist/release-observe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-observe.d.ts","sourceRoot":"","sources":["../src/release-observe.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQnF,QAAA,MAAM,aAAa,GAAI,SAAS,MAAM,KAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAClB,CAAC;AAElD,wFAAwF;AACxF,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1E,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC;AAE9C,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AACpD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,0EAA0E;AAC1E,wBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAErC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAOzF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAc9F;AAiBD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,aAe/B,CAAC;AAEH,kEAAkE;AAClE,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;IAC9B,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,0DAA0D;IAC1D,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,qBAAqB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,gFAAgF;IAChF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAC5E,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAQhD;AA2CD,6EAA6E;AAC7E,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,GAAG,OAAO,EAC7B,gBAAgB,EAAE,MAAM,GACvB,qBAAqB,EAAE,CA2DzB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,qBAAqB,EAC9B,GAAG,GAAE,UAA0B,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CAoF7B"}