@intentius/chant-lexicon-k3s 0.124.31 → 0.124.32

package/dist/lint/rules/token-literal.js

@@ -0,0 +1,78 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * K3S001: literal join token in source.
+ *
+ * `token` / `agent-token` are the cluster's shared join secret, and a
+ * committed config declaration is exactly the file that leaks it. The
+ * typed surface deliberately carries only the reference forms
+ * (`token-file`, `agent-token-file` — #1601), but nothing stops a raw
+ * object literal from writing the key anyway; this rule does.
+ *
+ * Flags a non-empty string-literal `token` / `agent-token` (identifier or
+ * quoted) inside a `Server(...)` / `Agent(...)` construction, with or
+ * without `new`. A bare `token:` elsewhere in the file is someone else's
+ * business.
+ */
+export const tokenLiteralRule = {
+    id: "K3S001",
+    severity: "error",
+    category: "security",
+    description: "k3s join token declared as a string literal in source",
+    check(context) {
+        const diagnostics = [];
+        const source = context.sourceFile;
+        const flag = (node, key) => {
+            const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
+            diagnostics.push({
+                ruleId: "K3S001",
+                severity: "error",
+                message: `\`${key}\` is a literal in source — a committed k3s config is a leaked cluster join ` +
+                    "secret. Point `token-file` at a path on the host, or supply K3S_TOKEN_FILE at " +
+                    "install time; the value itself never belongs in the declaration.",
+                file: context.filePath,
+                line: line + 1,
+                column: character + 1,
+            });
+        };
+        const tokenLiteral = (obj) => {
+            for (const prop of obj.properties) {
+                if (!ts.isPropertyAssignment(prop))
+                    continue;
+                const name = ts.isIdentifier(prop.name)
+                    ? prop.name.text
+                    : ts.isStringLiteral(prop.name)
+                        ? prop.name.text
+                        : undefined;
+                if (name !== "token" && name !== "agent-token")
+                    continue;
+                if ((ts.isStringLiteral(prop.initializer) ||
+                    ts.isNoSubstitutionTemplateLiteral(prop.initializer)) &&
+                    prop.initializer.text.length > 0) {
+                    return { node: prop.initializer, key: name };
+                }
+            }
+            return undefined;
+        };
+        const visit = (node) => {
+            if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
+                const callee = node.expression;
+                const name = ts.isIdentifier(callee)
+                    ? callee.text
+                    : ts.isPropertyAccessExpression(callee)
+                        ? callee.name.text
+                        : undefined;
+                if (name === "Server" || name === "Agent") {
+                    const arg = node.arguments?.[0];
+                    if (arg && ts.isObjectLiteralExpression(arg)) {
+                        const literal = tokenLiteral(arg);
+                        if (literal)
+                            flag(literal.node, literal.key);
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+        return diagnostics;
+    },
+};

package/dist/lsp/completions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAiBpF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEpE"}
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAiBpF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEpE"}

package/dist/lsp/completions.js

@@ -0,0 +1,19 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconCompletions, } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-k3s.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Provide k3s completions based on context — Server, Agent, Registries and
+ * the registry property entities, from the generated registry.
+ */
+export function completions(ctx) {
+    return lexiconCompletions(ctx, getIndex(), "k3s entity");
+}

package/dist/lsp/hover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAiB1E;;GAEG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAiB1E;;GAEG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}

package/dist/lsp/hover.js

@@ -0,0 +1,33 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconHover, } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-k3s.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Provide hover information for k3s entity types.
+ */
+export function hover(ctx) {
+    return lexiconHover(ctx, getIndex(), resourceHover);
+}
+function resourceHover(className, entry) {
+    const lines = [];
+    lines.push(`**${className}**`);
+    lines.push("");
+    lines.push(`k3s type: \`${entry.resourceType}\``);
+    lines.push("");
+    if (entry.kind === "resource") {
+        lines.push("*Resource entity — serialized as a file k3s consumes verbatim: " +
+            "config.yaml for Server/Agent, registries.yaml for Registries*");
+    }
+    else {
+        lines.push("*Property entity — a nested value in a Registries declaration*");
+    }
+    return { contents: lines.join("\n") };
+}

package/dist/op/activities/index.js

@@ -0,0 +1,21 @@
+/**
+ * k3s Op activities — resolved by the core activity registry when a project's
+ * `chant.config.ts` lists the `k3s` lexicon. Lifecycle activities for the
+ * reachable-host case (chant#1601, epic #1598):
+ *   - k3sInstall — run the pinned installer (`INSTALL_K3S_VERSION`), idempotent
+ *     on an already-installed matching version.
+ *   - k3sUninstall — the uninstall script, gated the way k3dDown is.
+ *
+ * Bounded exactly as k3dUp/k3dDown were (chant#1410): no SSH orchestration,
+ * no host provisioning. The join token never travels through these activities
+ * as a value — only `tokenFile`, a path — see the token-boundary note on
+ * {@link k3sInstall} in ./k3s.
+ *
+ * The step builders (k3sInstall, k3sUninstall) live in core and reach authors
+ * through `@intentius/chant/op` like k3dUp/k3dDown. The activities here are
+ * dependency-light — they shell out to the k3s installer/uninstall scripts and
+ * only pull in the lexicon's version pin, not its declarable surface — so
+ * `loadActivities` (`packages/core/src/op/activity-registry.ts`), which imports
+ * this module at run time, pulls in nothing expensive.
+ */
+export { k3sInstall, k3sUninstall, k3sInstallCommand, k3sInstallEnv, k3sUninstallCommand, k3sUninstallScript, k3sVersionCommand, parseK3sVersion, } from "./k3s.js";

package/dist/op/activities/k3s.js

@@ -0,0 +1,112 @@
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { K3S_VERSION } from "../../spec/fetch.js";
+const execAsync = promisify(exec);
+/**
+ * `k3s --version` output, first line: `k3s version v1.36.3+k3s1 (hash)`.
+ * Returns `undefined` when k3s is not installed or the output doesn't match.
+ */
+export function parseK3sVersion(stdout) {
+    return stdout.match(/k3s version (\S+)/)?.[1];
+}
+/** Check-install-version command — errors (non-zero exit) when k3s is absent. */
+export function k3sVersionCommand() {
+    return "k3s --version";
+}
+/**
+ * Build the get.k3s.io installer command. The version pin and the join-token
+ * reference (if any) travel as environment variables via {@link k3sInstallEnv},
+ * not interpolated into this string — see the token-boundary note on
+ * {@link k3sInstall}.
+ */
+export function k3sInstallCommand(args) {
+    return `curl -sfL https://get.k3s.io | sh -s - ${args.role} --config ${args.configFile}`;
+}
+/**
+ * Environment for {@link k3sInstallCommand}: `INSTALL_K3S_VERSION` (the pin)
+ * and, only when a `tokenFile` path is given, `K3S_TOKEN_FILE`.
+ *
+ * ## The token boundary (#1601)
+ *
+ * This is the only token-shaped input the install activity accepts, and it
+ * is a path, not a secret — the join token itself never passes through
+ * activity args, never gets logged, and never lands in an emitted
+ * config.yaml (K3S001 rejects a literal `token`/`agent-token` at lint). A
+ * `K3S_TOKEN` (the literal, env-var form k3s itself supports for agents) is
+ * deliberately not modeled here: the reference form the lexicon carries
+ * end-to-end is a file path, matching `token-file`/`agent-token-file` on the
+ * declared config surface (chant#1365's provenance stance applied at this
+ * surface, not a new mechanism).
+ */
+export function k3sInstallEnv(args) {
+    const env = { INSTALL_K3S_VERSION: args.version ?? K3S_VERSION };
+    if (args.tokenFile)
+        env.K3S_TOKEN_FILE = args.tokenFile;
+    return env;
+}
+/** Path k3s installs its uninstall script at — one per role. */
+export function k3sUninstallScript(role) {
+    return role === "agent" ? "/usr/local/bin/k3s-agent-uninstall.sh" : "/usr/local/bin/k3s-uninstall.sh";
+}
+/**
+ * Build the uninstall command. Gated the way `k3dDown` is (chant#1410): no
+ * pre-check activity, no SSH orchestration — just the native idempotent
+ * behavior. Unlike `k3d cluster delete` (idempotent on its own), the k3s
+ * uninstall script does not exist at all on a host where k3s was never
+ * installed, so the command guards on the script's presence itself rather
+ * than assume it errors safely.
+ */
+export function k3sUninstallCommand(args) {
+    const script = k3sUninstallScript(args.role);
+    return `test -x ${script} && ${script} || echo "k3s ${args.role} already uninstalled"`;
+}
+/**
+ * Run the pinned k3s installer against a reachable host. Idempotent on an
+ * already-installed matching version: if `k3s --version` already reports the
+ * target version, the install is skipped. Uses the longInfra profile: a 20m
+ * timeout, wide enough for the installer to download and start the k3s binary,
+ * and three attempts backing off from 30s.
+ *
+ * Bounded exactly as `k3dUp`/`k3dDown` were (chant#1410, epic #1598): this
+ * drives the case where the host is reachable from where the Op runs. It
+ * does not provision the host, and it is not an SSH orchestrator.
+ */
+export async function k3sInstall(args, signal) {
+    const target = args.version ?? K3S_VERSION;
+    try {
+        const { stdout } = await execAsync(k3sVersionCommand(), { signal });
+        const installed = parseK3sVersion(stdout);
+        if (installed === target) {
+            console.log(`k3s ${target} already installed (${args.role}) — skipping install`);
+            return { version: target, installed: false };
+        }
+        if (installed) {
+            console.log(`k3s ${installed} installed, target is ${target} — reinstalling`);
+        }
+    }
+    catch {
+        // `k3s --version` errors when k3s is absent — fall through to install.
+    }
+    const { stdout, stderr } = await execAsync(k3sInstallCommand(args), {
+        signal,
+        env: { ...process.env, ...k3sInstallEnv(args) },
+    });
+    if (stdout)
+        console.log(stdout);
+    if (stderr)
+        console.error(stderr);
+    return { version: target, installed: true };
+}
+/**
+ * Uninstall k3s from a reachable host. Uses fastIdempotent profile — 5m
+ * timeout. A host where k3s was never installed (no uninstall script present)
+ * is a no-op success, the same idempotent shape as `k3dDown` against an
+ * already-gone cluster.
+ */
+export async function k3sUninstall(args, signal) {
+    const { stdout, stderr } = await execAsync(k3sUninstallCommand(args), { signal });
+    if (stdout)
+        console.log(stdout);
+    if (stderr)
+        console.error(stderr);
+}

package/dist/op/builders.js

@@ -0,0 +1,31 @@
+/**
+ * Typed step-builder wrappers for this lexicon's activities (chant #1288
+ * Stage 2). See `lexicons/k8s/src/op/builders.ts`'s module doc for why these
+ * live beside their `*Args` interfaces rather than in core: core cannot
+ * import a lexicon's types, so a wrapper whose `opts` IS the activity's own
+ * `*Args` interface can only sit in the lexicon that declares that
+ * interface. `opts`'s type in each wrapper below IS the activity's own
+ * `*Args` interface (via `Omit`/`WithStepRefs`) — never restated. `core`'s own
+ * `k3sInstall`/`k3sUninstall` are unchanged and produce byte-identical
+ * `ActivityStep` output; these are purely additive.
+ */
+import { activity, takeProfileAndId, } from "@intentius/chant/op";
+/**
+ * Run the pinned k3s installer against a reachable host — the fully typed
+ * twin of core's `k3sInstall`. `opts` is {@link K3sInstallArgs} itself,
+ * minus the positional `role` (`configFile` remains required). Defaults to
+ * the `longInfra` profile.
+ */
+export const k3sInstall = (role, opts) => {
+    const { args, profile, id } = takeProfileAndId(opts);
+    return activity("k3sInstall", { role, ...args }, { profile: profile ?? "longInfra", ...(id ? { id } : {}) });
+};
+/**
+ * Uninstall k3s from a reachable host — the fully typed twin of core's
+ * `k3sUninstall`. `opts` is {@link K3sUninstallArgs} itself, minus the
+ * positional `role`. Defaults to the `fastIdempotent` profile.
+ */
+export const k3sUninstall = (role, opts) => {
+    const { args, profile, id } = takeProfileAndId(opts);
+    return activity("k3sUninstall", { role, ...args }, { profile: profile ?? "fastIdempotent", ...(id ? { id } : {}) });
+};

package/dist/package-cli.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env tsx
+/**
+ * Thin entry point for `npm run bundle` in lexicon-k3s.
+ */
+import { generate, writeGeneratedFiles } from "./codegen/generate.js";
+import { packageLexicon } from "./codegen/package.js";
+import { writeBundleSpec } from "@intentius/chant/codegen/package";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+const pkgDir = dirname(fileURLToPath(import.meta.url));
+// 1. Generate src/generated/ files (writeGeneratedFiles resolves its own target)
+const genResult = await generate({ verbose: true });
+writeGeneratedFiles(genResult);
+// 2. Run package pipeline and write dist/
+const { spec, stats } = await packageLexicon({ verbose: true });
+const distDir = join(dirname(pkgDir), "dist");
+writeBundleSpec(spec, distDir);
+console.error(`Packaged ${stats.resources} entities, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
+console.error(`dist/ written to ${distDir}`);

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAgB7F;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,aA4HvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAiB7F;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,aA4HvB,CAAC"}

package/dist/plugin.js

@@ -0,0 +1,119 @@
+import { readFileSync } from "fs";
+import { join } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+import { LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+import { k3sSerializer } from "./serializer.js";
+import { rules } from "./lint/rules/index.js";
+import { postSynthChecks } from "./lint/post-synth/index.js";
+import { k3sAuditCatalog } from "./lint/audit-catalog.js";
+import { completions } from "./lsp/completions.js";
+import { hover } from "./lsp/hover.js";
+/**
+ * k3s lexicon plugin.
+ *
+ * Implements all required LexiconPlugin lifecycle methods.
+ */
+export const k3sPlugin = {
+    name: "k3s",
+    serializer: k3sSerializer,
+    /**
+     * Where the upstream pin lives and where to look for a newer one, for
+     * the self-upgrade tooling (#523). k3s releases carry a `+k3s1` build
+     * suffix; the release tag is the version constant verbatim.
+     */
+    upstreamPin: {
+        file: "src/spec/fetch.ts",
+        pattern: /export const K3S_VERSION\s*=\s*"([^"]+)"/,
+        replace: (v, line) => line.replace(/= "[^"]+"/, `= "${v}"`),
+        upstream: { owner: "k3s-io", repo: "k3s", kind: "releases" },
+    },
+    /**
+     * The marker rides `node-label` (the serializer stamps it there when a
+     * build carries ownership) and lands on the registered Node as ordinary
+     * Kubernetes labels — read back the same way every label-based lexicon
+     * does. See `./describe-resources.ts` (#1603).
+     */
+    ownershipChannel: {
+        keys: LABEL_OWNERSHIP_KEYS,
+        reads: ["describeResources"],
+    },
+    async describeResources(options) {
+        const { describeResources } = await import("./describe-resources.js");
+        return describeResources(options);
+    },
+    // ── Required lifecycle methods ────────────────────────────────
+    async generate(options) {
+        const { generate } = await import("./codegen/generate.js");
+        await generate(options);
+    },
+    async validate(options) {
+        const { validate } = await import("./validate.js");
+        const { printValidationResult } = await import("@intentius/chant/codegen/validate");
+        const result = await validate();
+        printValidationResult(result);
+    },
+    async coverage(options) {
+        // TODO: Implement coverage analysis
+        console.error("Coverage analysis not yet implemented");
+    },
+    async package(options) {
+        const { packageLexicon } = await import("./codegen/package.js");
+        const { writeBundleSpec } = await import("@intentius/chant/codegen/package");
+        const { join, dirname } = await import("path");
+        const { fileURLToPath } = await import("url");
+        const { spec, stats } = await packageLexicon(options);
+        const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+        writeBundleSpec(spec, join(pkgDir, "dist"));
+        console.error(`Packaged ${stats.resources} resources, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
+    },
+    // ── Optional extensions ────────────────────────────────────
+    lintRules() {
+        return rules;
+    },
+    postSynthChecks() {
+        return postSynthChecks;
+    },
+    auditCatalog() {
+        return k3sAuditCatalog;
+    },
+    skills() {
+        const skills = [];
+        const dir = moduleSourceDir(import.meta.url);
+        const entries = [
+            {
+                file: "chant-k3s.md",
+                name: "chant-k3s",
+                description: "Declare k3s host configuration — server/agent config.yaml and registries.yaml — as typed chant source",
+            },
+        ];
+        for (const entry of entries) {
+            try {
+                const content = readFileSync(join(dir, "skills", entry.file), "utf-8");
+                skills.push({ name: entry.name, description: entry.description, content });
+            }
+            catch {
+                // skill file missing from a partial checkout — skip rather than throw
+            }
+        }
+        return skills;
+    },
+    mcpTools() {
+        return []; // TODO: Implement MCP tools
+    },
+    mcpResources() {
+        return []; // TODO: Implement MCP resources
+    },
+    detectTemplate(data) {
+        return false; // TODO: Detect if a template belongs to this lexicon
+    },
+    completionProvider(ctx) {
+        return completions(ctx);
+    },
+    hoverProvider(ctx) {
+        return hover(ctx);
+    },
+    async docs(options) {
+        const { generateDocs } = await import("./codegen/docs.js");
+        return generateDocs(options);
+    },
+};

package/dist/serializer.js

@@ -0,0 +1,169 @@
+/**
+ * k3s config YAML serializer.
+ *
+ * Emits the files k3s consumes verbatim — the walk-away artifacts that
+ * justify a lexicon here at all (#1600):
+ *
+ *   K3s::Server / K3s::Agent → config.yaml   (`k3s server --config <file>`)
+ *   K3s::Registries          → registries.yaml
+ *
+ * One document per declared entity: the first config is the primary
+ * output, every further entity lands in files[] keyed `<name>.config.yaml`
+ * / `<name>.registries.yaml`. A config.yaml's keys are exactly the CLI
+ * flag names, so the emitted file diffs cleanly against any hand-written
+ * one and `k3s check-config` style tooling sees nothing unusual.
+ *
+ * ## Ownership rides node-label (#1603)
+ *
+ * config.yaml has no free-form metadata channel, but `node-label` is a
+ * first-class key on both server and agent and lands on the registered
+ * Node as ordinary Kubernetes labels. When a build carries ownership,
+ * the serializer appends the chant label pair to `node-label` — readable
+ * back through any kubectl against the cluster, and inert to k3s itself.
+ * An author's own label with the same key wins.
+ *
+ * ## What never appears
+ *
+ * `token` / `agent-token` literals are not part of the typed surface
+ * (#1601), and K3SC001 fails the build if one arrives through untyped
+ * props anyway. The file k3s reads secrets from is the file's business
+ * (`token-file`), not the artifact's.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { walkValue } from "@intentius/chant/serializer-walker";
+import { emitYAMLEntry } from "@intentius/chant/yaml";
+import { ownershipEntries, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+export const SERVER_TYPE = "K3s::Server";
+export const AGENT_TYPE = "K3s::Agent";
+export const REGISTRIES_TYPE = "K3s::Registries";
+/**
+ * Keys that lead the document; everything else follows alphabetically.
+ * The identity-and-join block first is how the documented examples read,
+ * so a chant emission diffs cleanly against them.
+ */
+const KEY_PRIORITY = [
+    "cluster-init",
+    "server",
+    "token-file",
+    "agent-token-file",
+    "data-dir",
+    "node-name",
+];
+const visitor = {
+    attrRef: (name) => name,
+    resourceRef: (name) => name,
+    propertyDeclarable: (entity, walk) => {
+        if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
+            return undefined;
+        }
+        const props = entity.props;
+        const result = {};
+        for (const [key, value] of Object.entries(props)) {
+            if (value !== undefined)
+                result[key] = walk(value);
+        }
+        return result;
+    },
+};
+function orderedKeys(props) {
+    const rest = Object.keys(props)
+        .filter((k) => !KEY_PRIORITY.includes(k))
+        .sort();
+    return [...KEY_PRIORITY.filter((k) => props[k] !== undefined), ...rest];
+}
+/**
+ * Append the ownership marker to `node-label`. The key survives into the
+ * registered Node's labels, which is the only durable channel a host
+ * config file has. An author-set key of the same name wins.
+ */
+function stampOwnership(props, ownership) {
+    const existing = props["node-label"];
+    const labels = existing === undefined ? [] : Array.isArray(existing) ? [...existing] : [String(existing)];
+    const present = new Set(labels.map((l) => String(l).split("=")[0]));
+    for (const [key, value] of Object.entries(ownershipEntries(LABEL_OWNERSHIP_KEYS, ownership))) {
+        if (present.has(key))
+            continue;
+        labels.push(`${key}=${value}`);
+    }
+    props["node-label"] = labels;
+}
+function configDocument(entity, entityNames, context) {
+    const raw = (isResourceDeclarable(entity) ? entity.props : {});
+    const props = (walkValue(raw, entityNames, visitor) ?? {});
+    if (context?.ownership)
+        stampOwnership(props, context.ownership);
+    const doc = {};
+    for (const key of orderedKeys(props)) {
+        if (props[key] !== undefined)
+            doc[key] = props[key];
+    }
+    return doc;
+}
+function registriesDocument(entity, entityNames) {
+    const raw = (isResourceDeclarable(entity) ? entity.props : {});
+    const props = (walkValue(raw, entityNames, visitor) ?? {});
+    const doc = {};
+    // mirrors before configs, matching the documented examples.
+    if (props.mirrors !== undefined)
+        doc.mirrors = props.mirrors;
+    if (props.configs !== undefined)
+        doc.configs = props.configs;
+    for (const [key, value] of Object.entries(props)) {
+        if (key === "mirrors" || key === "configs" || value === undefined)
+            continue;
+        doc[key] = value;
+    }
+    return doc;
+}
+function emitDocument(doc) {
+    const sections = [];
+    for (const [key, value] of Object.entries(doc)) {
+        if (value === undefined)
+            continue;
+        if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+            sections.push(`${key}: ${scalar(value)}`);
+        }
+        else {
+            sections.push(emitYAMLEntry(key, value));
+        }
+    }
+    return sections.join("\n") + "\n";
+}
+function scalar(value) {
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (typeof value === "number")
+        return String(value);
+    if (/[:#\[\]{}|>&*!%@`'"]|^[\s\d]|\s$|^$|^(true|false|null|yes|no|on|off)$/i.test(value)) {
+        return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+    }
+    return value;
+}
+export const k3sSerializer = {
+    name: "k3s",
+    rulePrefix: "K3S",
+    serialize(entities, _outputs, context) {
+        const entityNames = new Map();
+        for (const [name, entity] of entities)
+            entityNames.set(entity, name);
+        const configs = [...entities].filter(([, e]) => e.entityType === SERVER_TYPE || e.entityType === AGENT_TYPE);
+        const registries = [...entities].filter(([, e]) => e.entityType === REGISTRIES_TYPE);
+        let primary = "";
+        const files = {};
+        configs.forEach(([name, entity], i) => {
+            const content = emitDocument(configDocument(entity, entityNames, context));
+            if (i === 0)
+                primary = content;
+            else
+                files[`${name}.config.yaml`] = content;
+        });
+        registries.forEach(([name, entity], i) => {
+            const content = emitDocument(registriesDocument(entity, entityNames));
+            if (primary === "" && i === 0 && configs.length === 0)
+                primary = content;
+            else
+                files[i === 0 && configs.length > 0 ? "registries.yaml" : `${name}.registries.yaml`] = content;
+        });
+        return Object.keys(files).length > 0 ? { primary, files } : primary;
+    },
+};