@intentius/chant-lexicon-k3s 0.44.3

package/README.md

@@ -0,0 +1,36 @@
+# @intentius/chant-lexicon-k3s
+
+k3s lexicon for [chant](https://github.com/intentius/chant) — the k3s
+distro's host configuration as declarable data.
+
+Declares the files k3s itself consumes: `config.yaml` for `k3s server` /
+`k3s agent` (every CLI flag as a YAML key, typed from the pinned release's
+own flag definitions), and `registries.yaml` for the embedded containerd.
+The emitted files are exactly what the native tool accepts.
+
+The join token is deliberately not declarable: the surface carries only the
+reference forms (`token-file`, `agent-token-file`), and K3S001/K3S101 fail
+a literal that arrives anyway.
+
+## Getting started
+
+```bash
+# Generate types from the pinned k3s release (v1.36.3+k3s1)
+npm run generate
+
+# Validate generated artifacts
+npm run validate
+
+# Tests (the Docker-gated acceptance test boots rancher/k3s on the emitted config)
+npx vitest run lexicons/k3s
+```
+
+## Project structure
+
+- `src/plugin.ts` — LexiconPlugin with all lifecycle methods
+- `src/serializer.ts` — config.yaml / registries.yaml emitter
+- `src/spec/fetch.ts` — pinned upstream sources (the CLI flag definitions)
+- `src/codegen/parse.ts` — Go flag-definition parser
+- `src/lint/` — K3S001 pre-synth rule, K3S101–K3S105 post-synth checks
+- `src/lsp/` — completions and hover from the generated registry
+- `src/generated/` — generated artifacts (do not edit)

package/dist/codegen/docs.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Generate documentation site for the k3s lexicon.
+ */
+export declare function generateDocs(options?: {
+    verbose?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=docs.d.ts.map

package/dist/codegen/docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBjF"}

package/dist/codegen/generate-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=generate-cli.d.ts.map

package/dist/codegen/generate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-cli.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-cli.ts"],"names":[],"mappings":""}

package/dist/codegen/generate-lexicon.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Lexicon JSON generator — produces lexicon-k3s.json with metadata
+ * for all k3s entities.
+ */
+import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
+import type { K3sParseResult } from "./parse.js";
+import type { NamingStrategy } from "./naming.js";
+export interface LexiconEntry {
+    resourceType: string;
+    kind: "resource" | "property";
+    lexicon: "k3s";
+    deprecatedProperties?: string[];
+    constraints?: Record<string, PropertyConstraints>;
+}
+/**
+ * Generate the lexicon-k3s.json content.
+ */
+export declare function generateLexiconJSON(results: K3sParseResult[], naming: NamingStrategy): string;
+//# sourceMappingURL=generate-lexicon.d.ts.map

package/dist/codegen/generate-lexicon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-lexicon.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-lexicon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAO/C,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,GAAG,MAAM,CA+B7F"}

package/dist/codegen/generate-typescript.d.ts

@@ -0,0 +1,11 @@
+/**
+ * TypeScript declaration file generator — produces index.d.ts with all
+ * k3s entity classes.
+ */
+import type { K3sParseResult } from "./parse.js";
+import type { NamingStrategy } from "./naming.js";
+/**
+ * Generate the complete .d.ts file content.
+ */
+export declare function generateTypeScriptDeclarations(results: K3sParseResult[], naming: NamingStrategy): string;
+//# sourceMappingURL=generate-typescript.d.ts.map

package/dist/codegen/generate-typescript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-typescript.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-typescript.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAc/C;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,cAAc,EAAE,EACzB,MAAM,EAAE,cAAc,GACrB,MAAM,CAoCR"}

package/dist/codegen/generate.d.ts

@@ -0,0 +1,15 @@
+/**
+ * k3s generation pipeline — uses core generatePipeline with k3s-specific
+ * fetch, parse, naming, and generation callbacks.
+ */
+import { type GenerateOptions, type GenerateResult } from "@intentius/chant/codegen/generate";
+export type { GenerateResult };
+/**
+ * Run the full k3s generation pipeline.
+ */
+export declare function generate(opts?: GenerateOptions): Promise<GenerateResult>;
+/**
+ * Write generated artifacts to disk.
+ */
+export declare function writeGeneratedFiles(result: GenerateResult, pkgDir?: string): void;
+//# sourceMappingURL=generate.d.ts.map

package/dist/codegen/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EAEpB,MAAM,mCAAmC,CAAC;AAc3C,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA6ClF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAWjF"}

package/dist/codegen/naming.d.ts

@@ -0,0 +1,13 @@
+/**
+ * k3s naming strategy — flat namespace, one short name per entity.
+ */
+import { NamingStrategy as CoreNamingStrategy } from "@intentius/chant/codegen/naming";
+import { type K3sParseResult } from "./parse.js";
+export { propertyTypeName, extractDefName } from "@intentius/chant/codegen/naming";
+/**
+ * k3s naming strategy.
+ */
+export declare class NamingStrategy extends CoreNamingStrategy {
+    constructor(results: K3sParseResult[]);
+}
+//# sourceMappingURL=naming.d.ts.map

package/dist/codegen/naming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../src/codegen/naming.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,cAAc,IAAI,kBAAkB,EAGrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAE5E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAmBnF;;GAEG;AACH,qBAAa,cAAe,SAAQ,kBAAkB;gBACxC,OAAO,EAAE,cAAc,EAAE;CAOtC"}

package/dist/codegen/package.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Package the k3s lexicon for distribution.
+ */
+export declare function packageLexicon(options?: {
+    verbose?: boolean;
+    force?: boolean;
+}): Promise<{
+    spec: import("packages/core/src").BundleSpec;
+    stats: {
+        resources: number;
+        properties: number;
+        enums: number;
+        ruleCount: number;
+        skillCount: number;
+    };
+}>;
+//# sourceMappingURL=package.d.ts.map

package/dist/codegen/package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../src/codegen/package.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;;;;;;;;;GAiBpF"}

package/dist/codegen/parse.d.ts

@@ -0,0 +1,93 @@
+/**
+ * k3s CLI flag-definition parser.
+ *
+ * The spec is the pinned Go source of pkg/cli/cmds (#1599): urfave/cli
+ * struct literals carrying Name, Usage, Value and Hidden. This parser
+ * extracts the server and agent flag lists, resolves shared flag-var
+ * references across the fetched files, and produces one entity per config
+ * document k3s consumes:
+ *
+ *   K3s::Server     — /etc/rancher/k3s/config.yaml for `k3s server`
+ *   K3s::Agent      — /etc/rancher/k3s/config.yaml for `k3s agent`
+ *   K3s::Registries — /etc/rancher/k3s/registries.yaml
+ *
+ * registries.yaml has no flag surface; its shape is hand-typed from the
+ * documented structure (docs.k3s.io/installation/private-registry) and
+ * pinned by the same release constant.
+ *
+ * ## The token boundary (#1601)
+ *
+ * `token`, `agent-token` and the deprecated `cluster-secret` are excluded
+ * from the typed surface on purpose. A literal shared secret in an emitted
+ * config.yaml is the #1365 wall; the reference forms (`token-file`,
+ * `agent-token-file`, and the K3S_TOKEN/K3S_TOKEN_FILE env vars at install
+ * time) stay. K3SC001 catches a literal that arrives through a raw prop
+ * anyway.
+ */
+import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
+export interface ParsedProperty {
+    name: string;
+    tsType: string;
+    required: boolean;
+    description?: string;
+    enum?: string[];
+    constraints: PropertyConstraints;
+}
+export interface ParsedPropertyType {
+    name: string;
+    defType: string;
+    properties: ParsedProperty[];
+}
+export interface ParsedResource {
+    typeName: string;
+    description?: string;
+    properties: ParsedProperty[];
+    attributes: Array<{
+        name: string;
+        tsType: string;
+    }>;
+    deprecatedProperties: string[];
+}
+export interface K3sParseResult {
+    resource: ParsedResource;
+    propertyTypes: ParsedPropertyType[];
+    enums: Array<{
+        name: string;
+        values: string[];
+    }>;
+    isProperty?: boolean;
+    warnings?: string[];
+}
+interface FlagDef {
+    varName?: string;
+    flagType: string;
+    name?: string;
+    usage?: string;
+    value?: string;
+    hidden: boolean;
+}
+/**
+ * Extract every `&cli.<T>Flag{...}` literal in a Go source text, keyed by
+ * the variable name it is assigned to when there is one.
+ */
+export declare function extractFlagLiterals(text: string): {
+    byVar: Map<string, FlagDef>;
+    all: FlagDef[];
+};
+/**
+ * Extract the ordered item list of a `[]cli.Flag{...}` block starting at
+ * `startIndex` (the index of the opening brace + 1). Items are either
+ * bare identifiers (shared flag vars) or inline `&cli.*Flag{...}` literals.
+ */
+export declare function extractFlagList(text: string, marker: string | RegExp): Array<string | FlagDef>;
+/**
+ * Parse the fetched spec envelope (filename → Go source) into the k3s
+ * entity results.
+ */
+export declare function parseSpecFiles(data: string | Buffer): K3sParseResult[];
+/** Extract short name: "K3s::Server" → "Server" */
+export declare function k3sShortName(typeName: string): string;
+/** Extract service name: always "K3s" — the lexicon is a single flat service. */
+export declare function k3sServiceName(_typeName: string): string;
+export {};
+//# sourceMappingURL=parse.d.ts.map

package/dist/codegen/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/codegen/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAIhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACjD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAID,UAAU,OAAO;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAaD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,GAAG,EAAE,OAAO,EAAE,CAAA;CAAE,CAkBjG;AAsDD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAuB9F;AAkID;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,cAAc,EAAE,CAkDtE;AAID,mDAAmD;AACnD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExD"}

package/dist/generated/index.d.ts

@@ -0,0 +1,8 @@
+export declare const Agent: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const Registries: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const Server: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const Mirror: new (props: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, unknown>;
+export declare const RegistryAuth: new (props: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, unknown>;
+export declare const RegistryConfig: new (props: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, unknown>;
+export declare const RegistryTLS: new (props: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, unknown>;
+//# sourceMappingURL=index.d.ts.map

package/dist/generated/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generated/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,KAAK,+IAA0C,CAAC;AAC7D,eAAO,MAAM,UAAU,+IAA+C,CAAC;AACvE,eAAO,MAAM,MAAM,+IAA2C,CAAC;AAE/D,eAAO,MAAM,MAAM,0GAAuC,CAAC;AAC3D,eAAO,MAAM,YAAY,0GAA6C,CAAC;AACvE,eAAO,MAAM,cAAc,0GAA+C,CAAC;AAC3E,eAAO,MAAM,WAAW,0GAA4C,CAAC"}

package/dist/generated/runtime.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";
+//# sourceMappingURL=runtime.d.ts.map

package/dist/generated/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/generated/runtime.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { k3sPlugin } from "./plugin.js";
+export { k3sSerializer } from "./serializer.js";
+export * from "./generated/index.js";
+export { K3S_VERSION, K3S_IMAGE_TAG } from "./spec/fetch.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/integrity.json

@@ -0,0 +1,10 @@
+{
+  "algorithm": "sha256",
+  "artifacts": {
+    "manifest.json": "5208bf3cb7308fcf74bcfae5cd70e1e4c73b0b567e71ac0f593246f1d72eaef2",
+    "meta.json": "5988c37e9e93d52828d34fa043b0804fec7eb833153d387a9711333bcdff4bff",
+    "types/index.d.ts": "98f3f3175d38aa2979c57577512c554eafed49b9125967c8617c137c01358e26",
+    "skills/chant-k3s.md": "05b322cae62541204bc737ae5e8aacdb689e0ebcc0b551844c907573ea62b945"
+  },
+  "composite": "ccdbd6b6b747df56c8d6c9db11cd2ee6ee5ddff042b9e8438a88a1f667a98db6"
+}

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The k3s lexicon's chant audit catalog — metadata for its post-synth
+ * checks, contributed via k3sPlugin.auditCatalog() (#687, #1346). Every
+ * post-synth check has an entry, or the check contributes nothing to
+ * `chant audit`, silently.
+ *
+ * All five checks read the chant model (`ctx.entities`) rather than the
+ * emitted YAML — an emitted config.yaml carries no marker naming its own
+ * role — so every entry is constructed directly with `yamlBased: false`.
+ */
+import type { RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const k3sAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAW/D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA+BpD,CAAC"}

package/dist/lint/post-synth/index.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const postSynthChecks: PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/post-synth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAOvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAM3C,CAAC"}

package/dist/lint/post-synth/k3s-helpers.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Shared helpers for the k3s post-synth checks.
+ *
+ * These checks read the chant model (`ctx.entities`), not the emitted
+ * YAML: an emitted config.yaml carries no marker naming its own role, so
+ * the entity type is the only honest way to know a document is a server
+ * config, an agent config, or a registries file. The audit catalog marks
+ * every entity-based check `yamlBased: false` accordingly.
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+export interface K3sEntity {
+    name: string;
+    entityType: string;
+    props: Record<string, unknown>;
+}
+/** Every declared k3s entity of one type, with its props. */
+export declare function entitiesOfType(ctx: PostSynthContext, entityType: string): K3sEntity[];
+export declare function configEntities(ctx: PostSynthContext): K3sEntity[];
+//# sourceMappingURL=k3s-helpers.d.ts.map

package/dist/lint/post-synth/k3s-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k3s-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/k3s-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,CAUrF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,EAAE,CAEjE"}

package/dist/lint/post-synth/k3s101.d.ts

@@ -0,0 +1,13 @@
+/**
+ * K3S101: a literal join token reached the build.
+ *
+ * The typed surface omits `token` / `agent-token` (#1601) and K3S001
+ * catches the literal at source. This is the backstop for the path both
+ * miss: a raw prop object built at runtime, spread in, or emitted by a
+ * composite. If the key is present with a non-empty string value in the
+ * entity the build serialized, the emitted config.yaml carries the
+ * cluster's join secret, and the build fails.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const k3s101: PostSynthCheck;
+//# sourceMappingURL=k3s101.d.ts.map

package/dist/lint/post-synth/k3s101.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k3s101.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/k3s101.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAiB1C,eAAO,MAAM,MAAM,EAAE,cAyBpB,CAAC"}

package/dist/lint/post-synth/k3s102.d.ts

@@ -0,0 +1,11 @@
+/**
+ * K3S102: registry credentials as literals.
+ *
+ * registries.yaml supports inline `auth.password` / `auth.token`, and a
+ * committed estate that uses them has published its registry credentials.
+ * The TLS file paths beside them are host paths — those are fine; it is
+ * the credential values that must come from somewhere else.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const k3s102: PostSynthCheck;
+//# sourceMappingURL=k3s102.d.ts.map

package/dist/lint/post-synth/k3s102.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k3s102.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/k3s102.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAG1C,eAAO,MAAM,MAAM,EAAE,cAgCpB,CAAC"}

package/dist/lint/post-synth/k3s103.d.ts

@@ -0,0 +1,11 @@
+/**
+ * K3S103: an agent that joins nothing.
+ *
+ * An agent config without `server` is a node with no cluster to join —
+ * `k3s agent` refuses to start without it (or K3S_URL in the service
+ * environment). Declaring the agent while leaving the join out of band
+ * defeats the declaration, so this asks for it in the config.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const k3s103: PostSynthCheck;
+//# sourceMappingURL=k3s103.d.ts.map

package/dist/lint/post-synth/k3s103.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k3s103.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/k3s103.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAG1C,eAAO,MAAM,MAAM,EAAE,cAqBpB,CAAC"}

package/dist/lint/post-synth/k3s104.d.ts

@@ -0,0 +1,12 @@
+/**
+ * K3S104: kubeconfig written wider than 0644.
+ *
+ * `write-kubeconfig-mode` widens /etc/rancher/k3s/k3s.yaml — the file
+ * carrying the cluster's admin credential. k3s's own default is 0600;
+ * 0644 is the documented convenience for a single-user host. Anything
+ * granting write to group/other, or beyond read to other, hands the
+ * admin kubeconfig to every local account.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const k3s104: PostSynthCheck;
+//# sourceMappingURL=k3s104.d.ts.map

package/dist/lint/post-synth/k3s104.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k3s104.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/k3s104.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAG1C,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/k3s105.d.ts

@@ -0,0 +1,11 @@
+/**
+ * K3S105: a registry mirror that skips TLS verification.
+ *
+ * `insecure_skip_verify: true` in registries.yaml turns every image pull
+ * through that registry into an unauthenticated trust decision. Legitimate
+ * for a lab pull-through cache; worth a flag anywhere, because the estate
+ * that sets it for the lab keeps it when the registry moves.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const k3s105: PostSynthCheck;
+//# sourceMappingURL=k3s105.d.ts.map

package/dist/lint/post-synth/k3s105.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k3s105.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/k3s105.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAG1C,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/rules/index.d.ts

@@ -0,0 +1,5 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+export { tokenLiteralRule } from "./token-literal.js";
+/** All lint rules provided by this lexicon (imported by plugin.ts's lintRules()). */
+export declare const rules: LintRule[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAG3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,qFAAqF;AACrF,eAAO,MAAM,KAAK,EAAE,QAAQ,EAAuB,CAAC"}

package/dist/lint/rules/token-literal.d.ts

@@ -0,0 +1,17 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+/**
+ * K3S001: literal join token in source.
+ *
+ * `token` / `agent-token` are the cluster's shared join secret, and a
+ * committed config declaration is exactly the file that leaks it. The
+ * typed surface deliberately carries only the reference forms
+ * (`token-file`, `agent-token-file` — #1601), but nothing stops a raw
+ * object literal from writing the key anyway; this rule does.
+ *
+ * Flags a non-empty string-literal `token` / `agent-token` (identifier or
+ * quoted) inside a `Server(...)` / `Agent(...)` construction, with or
+ * without `new`. A bare `token:` elsewhere in the file is someone else's
+ * business.
+ */
+export declare const tokenLiteralRule: LintRule;
+//# sourceMappingURL=token-literal.d.ts.map

package/dist/lint/rules/token-literal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-literal.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/token-literal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAqE9B,CAAC"}

package/dist/lsp/completions.d.ts

@@ -0,0 +1,7 @@
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+/**
+ * Provide k3s completions based on context — Server, Agent, Registries and
+ * the registry property entities, from the generated registry.
+ */
+export declare function completions(ctx: CompletionContext): CompletionItem[];
+//# sourceMappingURL=completions.d.ts.map

package/dist/lsp/completions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAiBpF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEpE"}

package/dist/lsp/hover.d.ts

@@ -0,0 +1,6 @@
+import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
+/**
+ * Provide hover information for k3s entity types.
+ */
+export declare function hover(ctx: HoverContext): HoverInfo | undefined;
+//# sourceMappingURL=hover.d.ts.map

package/dist/lsp/hover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAiB1E;;GAEG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}

package/dist/manifest.json

@@ -0,0 +1,6 @@
+{
+  "name": "k3s",
+  "version": "0.0.1",
+  "chantVersion": ">=0.1.0",
+  "namespace": "K3s"
+}

package/dist/meta.json

@@ -0,0 +1,37 @@
+{
+  "Agent": {
+    "resourceType": "K3s::Agent",
+    "kind": "resource",
+    "lexicon": "k3s"
+  },
+  "Mirror": {
+    "resourceType": "K3s::Mirror",
+    "kind": "property",
+    "lexicon": "k3s"
+  },
+  "Registries": {
+    "resourceType": "K3s::Registries",
+    "kind": "resource",
+    "lexicon": "k3s"
+  },
+  "RegistryAuth": {
+    "resourceType": "K3s::RegistryAuth",
+    "kind": "property",
+    "lexicon": "k3s"
+  },
+  "RegistryConfig": {
+    "resourceType": "K3s::RegistryConfig",
+    "kind": "property",
+    "lexicon": "k3s"
+  },
+  "RegistryTLS": {
+    "resourceType": "K3s::RegistryTLS",
+    "kind": "property",
+    "lexicon": "k3s"
+  },
+  "Server": {
+    "resourceType": "K3s::Server",
+    "kind": "resource",
+    "lexicon": "k3s"
+  }
+}

package/dist/okf/index.md

@@ -0,0 +1,9 @@
+---
+okf_version: '0.2'
+---
+
+# Resource types
+
+* [Agent](/types/Agent.md) - K3s::Agent
+* [Registries](/types/Registries.md) - K3s::Registries
+* [Server](/types/Server.md) - K3s::Server

package/dist/okf/types/Agent.md

@@ -0,0 +1,55 @@
+---
+type: resource-type
+title: Agent
+description: k3s resource type K3s::Agent
+name: Agent
+lexicon: k3s
+resource_type: K3s::Agent
+---
+`K3s::Agent`, a resource type of the k3s lexicon.
+
+## Properties
+
+- `server` (`string`, required): (cluster) Server to connect to
+- `alsologtostderr` (`boolean`, optional): (logging) Log to standard error as well as file (if set)
+- `bind-address` (`string`, optional): (listener) bind address (default: 0.0.0.0)
+- `container-runtime-endpoint` (`string`, optional): (agent/runtime) Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path
+- `data-dir` (`string`, optional): (agent/data) Folder to hold state
+- `debug` (`boolean`, optional): (logging) Turn on debug logs
+- `default-runtime` (`string`, optional): (agent/runtime) Set the default runtime in containerd
+- `disable-apiserver-lb` (`boolean`, optional): (agent/networking) (experimental) Disable the agent's client-side load-balancer and connect directly to the configured server address
+- `disable-default-registry-endpoint` (`boolean`, optional): (agent/containerd) Disables containerd's fallback default registry endpoint when a mirror is configured for that registry
+- `docker` (`boolean`, optional): (agent/runtime) (experimental) Use cri-dockerd instead of containerd
+- `enable-pprof` (`boolean`, optional): (experimental) Enable pprof endpoint on supervisor port
+- `flannel-cni-conf` (`string`, optional): (agent/networking) Override default flannel cni config file
+- `flannel-conf` (`string`, optional): (agent/networking) Override default flannel config file
+- `flannel-iface` (`string`, optional): (agent/networking) Override default flannel interface
+- `image-credential-provider-bin-dir` (`string`, optional): (agent/node) The path to the directory where credential provider plugin binaries are located (default: /var/lib/rancher/credentialprovider/bin)
+- `image-credential-provider-config` (`string`, optional): (agent/node) The path to the credential provider plugin config file (default: /var/lib/rancher/credentialprovider/config.yaml)
+- `image-service-endpoint` (`string`, optional): (agent/runtime) Disable embedded containerd image service and use remote image service socket at the given path. If not specified, defaults to --container-runtime-endpoint.
+- `kube-proxy-arg` (`string | string[]`, optional): (agent/flags) Customized flag for kube-proxy process
+- `kubelet-arg` (`string | string[]`, optional): (agent/flags) Customized flag for kubelet process
+- `lb-server-port` (`number`, optional): (agent/node) Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444)
+- `log` (`string`, optional): (logging) Log to file
+- `node-external-dns` (`string | string[]`, optional): (agent/networking) external DNS addresses to advertise for node
+- `node-external-ip` (`string | string[]`, optional): (agent/networking) IPv4/IPv6 external IP addresses to advertise for node
+- `node-internal-dns` (`string | string[]`, optional): (agent/networking) internal DNS addresses to advertise for node
+- `node-ip` (`string | string[]`, optional): (agent/networking) IPv4/IPv6 addresses to advertise for node
+- `node-label` (`string | string[]`, optional): (agent/node) Registering and starting kubelet with set of labels
+- `node-name` (`string`, optional): (agent/node) Node name
+- `node-taint` (`string | string[]`, optional): (agent/node) Registering kubelet with set of taints
+- `nonroot-devices` (`boolean`, optional): (agent/containerd) Allows non-root pods to access devices by setting device_ownership_from_security_context=true in the containerd CRI config
+- `pause-image` (`string`, optional): (agent/runtime) Customized pause image for containerd or docker sandbox (default: rancher/mirrored-pause:3.10.2)
+- `prefer-bundled-bin` (`boolean`, optional): (experimental) Prefer bundled userspace binaries over host binaries
+- `private-registry` (`string`, optional): (agent/runtime) Private registry configuration file
+- `protect-kernel-defaults` (`boolean`, optional): (agent/node) Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults.
+- `resolv-conf` (`string`, optional): (agent/networking) Kubelet resolv.conf file
+- `rootless` (`boolean`, optional): (experimental) Run rootless
+- `selinux` (`boolean`, optional): (agent/node) Enable SELinux in containerd
+- `snapshotter` (`string`, optional): (agent/runtime) Override default containerd snapshotter
+- `token-file` (`string`, optional): (cluster) Token file to use for authentication
+- `v` (`number`, optional): (logging) Number for the log level verbosity
+- `vmodule` (`string`, optional): (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging
+- `vpn-auth` (`string`, optional): (agent/networking) (experimental) Credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>]
+- `vpn-auth-file` (`string`, optional): (agent/networking) (experimental) File containing credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>]
+- `with-node-id` (`boolean`, optional): (agent/node) Append id to node name