@intentius/chant-lexicon-k3s 0.44.3

package/dist/types/index.d.ts

@@ -0,0 +1,370 @@
+// Code generated by chant k3s generate. DO NOT EDIT.
+
+// --- k3s Entity classes ---
+
+export declare class Agent {
+  constructor(props: {
+    /** (cluster) Server to connect to */
+    server: string;
+    /** (logging) Log to standard error as well as file (if set) */
+    alsologtostderr?: boolean;
+    /** (listener)  bind address (default: 0.0.0.0) */
+    "bind-address"?: string;
+    /** (agent/runtime) Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path */
+    "container-runtime-endpoint"?: string;
+    /** (agent/data) Folder to hold state */
+    "data-dir"?: string;
+    /** (logging) Turn on debug logs */
+    debug?: boolean;
+    /** (agent/runtime) Set the default runtime in containerd */
+    "default-runtime"?: string;
+    /** (agent/networking) (experimental) Disable the agent's client-side load-balancer and connect directly to the configured server address */
+    "disable-apiserver-lb"?: boolean;
+    /** (agent/containerd) Disables containerd's fallback default registry endpoint when a mirror is configured for that registry */
+    "disable-default-registry-endpoint"?: boolean;
+    /** (agent/runtime) (experimental) Use cri-dockerd instead of containerd */
+    docker?: boolean;
+    /** (experimental) Enable pprof endpoint on supervisor port */
+    "enable-pprof"?: boolean;
+    /** (agent/networking) Override default flannel cni config file */
+    "flannel-cni-conf"?: string;
+    /** (agent/networking) Override default flannel config file */
+    "flannel-conf"?: string;
+    /** (agent/networking) Override default flannel interface */
+    "flannel-iface"?: string;
+    /** (agent/node) The path to the directory where credential provider plugin binaries are located (default: /var/lib/rancher/credentialprovider/bin) */
+    "image-credential-provider-bin-dir"?: string;
+    /** (agent/node) The path to the credential provider plugin config file (default: /var/lib/rancher/credentialprovider/config.yaml) */
+    "image-credential-provider-config"?: string;
+    /** (agent/runtime) Disable embedded containerd image service and use remote image service socket at the given path. If not specified, defaults to --container-runtime-endpoint. */
+    "image-service-endpoint"?: string;
+    /** (agent/flags) Customized flag for kube-proxy process */
+    "kube-proxy-arg"?: string | string[];
+    /** (agent/flags) Customized flag for kubelet process */
+    "kubelet-arg"?: string | string[];
+    /** (agent/node) Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444) */
+    "lb-server-port"?: number;
+    /** (logging) Log to file */
+    log?: string;
+    /** (agent/networking) external DNS addresses to advertise for node */
+    "node-external-dns"?: string | string[];
+    /** (agent/networking) IPv4/IPv6 external IP addresses to advertise for node */
+    "node-external-ip"?: string | string[];
+    /** (agent/networking) internal DNS addresses to advertise for node */
+    "node-internal-dns"?: string | string[];
+    /** (agent/networking) IPv4/IPv6 addresses to advertise for node */
+    "node-ip"?: string | string[];
+    /** (agent/node) Registering and starting kubelet with set of labels */
+    "node-label"?: string | string[];
+    /** (agent/node) Node name */
+    "node-name"?: string;
+    /** (agent/node) Registering kubelet with set of taints */
+    "node-taint"?: string | string[];
+    /** (agent/containerd) Allows non-root pods to access devices by setting device_ownership_from_security_context=true in the containerd CRI config */
+    "nonroot-devices"?: boolean;
+    /** (agent/runtime) Customized pause image for containerd or docker sandbox (default: rancher/mirrored-pause:3.10.2) */
+    "pause-image"?: string;
+    /** (experimental) Prefer bundled userspace binaries over host binaries */
+    "prefer-bundled-bin"?: boolean;
+    /** (agent/runtime) Private registry configuration file */
+    "private-registry"?: string;
+    /** (agent/node) Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults. */
+    "protect-kernel-defaults"?: boolean;
+    /** (agent/networking) Kubelet resolv.conf file */
+    "resolv-conf"?: string;
+    /** (experimental) Run rootless */
+    rootless?: boolean;
+    /** (agent/node) Enable SELinux in containerd */
+    selinux?: boolean;
+    /** (agent/runtime) Override default containerd snapshotter */
+    snapshotter?: string;
+    /** (cluster) Token file to use for authentication */
+    "token-file"?: string;
+    /** (logging) Number for the log level verbosity */
+    v?: number;
+    /** (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging */
+    vmodule?: string;
+    /** (agent/networking) (experimental) Credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>] */
+    "vpn-auth"?: string;
+    /** (agent/networking) (experimental) File containing credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>] */
+    "vpn-auth-file"?: string;
+    /** (agent/node) Append id to node name */
+    "with-node-id"?: boolean;
+  });
+}
+
+export declare class Mirror {
+  constructor(props: {
+    /** Mirror endpoint URLs, tried in order */
+    endpoint?: string | string[];
+    /** Image name rewrite rules (regex to replacement) */
+    rewrite?: Record<string, string>;
+  });
+}
+
+export declare class Registries {
+  constructor(props: {
+    /** Registry endpoint to auth/TLS configuration */
+    configs?: Record<string, RegistryConfig>;
+    /** Registry name (or wildcard) to mirror configuration */
+    mirrors?: Record<string, Mirror>;
+  });
+}
+
+export declare class RegistryAuth {
+  constructor(props: {
+    /** Basic auth password. A literal here fails K3SC002 */
+    password?: string;
+    /** Bearer token. A literal here fails K3SC002 */
+    token?: string;
+    /** Basic auth username */
+    username?: string;
+  });
+}
+
+export declare class RegistryConfig {
+  constructor(props: {
+    /** Credentials for the registry */
+    auth?: RegistryAuth;
+    /** TLS settings for the registry */
+    tls?: RegistryTLS;
+  });
+}
+
+export declare class RegistryTLS {
+  constructor(props: {
+    /** CA bundle path on the node */
+    ca_file?: string;
+    /** Client certificate path on the node */
+    cert_file?: string;
+    /** Skip TLS verification. K3SS002 flags this */
+    insecure_skip_verify?: boolean;
+    /** Client key path on the node */
+    key_file?: string;
+  });
+}
+
+export declare class Server {
+  constructor(props: {
+    /** (listener) IPv4/IPv6 address that apiserver uses to advertise to members of the cluster (default: node-external-ip/node-ip) */
+    "advertise-address"?: string;
+    /** (listener) Port that apiserver uses to advertise to members of the cluster (default: https-listen-port) */
+    "advertise-port"?: number;
+    /** (cluster) File containing the agent secret */
+    "agent-token-file"?: string;
+    /** (logging) Log to standard error as well as file (if set) */
+    alsologtostderr?: boolean;
+    /** (listener)  bind address (default: 0.0.0.0) */
+    "bind-address"?: string;
+    /** (networking) IPv4/IPv6 network CIDRs to use for pod IPs (default: 10.42.0.0/16) */
+    "cluster-cidr"?: string | string[];
+    /** (networking) IPv4/IPv6 Cluster IP for coredns service. Should be in your service-cidr range (default: 10.43.0.10) */
+    "cluster-dns"?: string | string[];
+    /** (networking) Cluster Domain (default: cluster.local) */
+    "cluster-domain"?: string;
+    /** (cluster) Initialize a new cluster using embedded Etcd */
+    "cluster-init"?: boolean;
+    /** (cluster) Forget all peers and become sole member of a new cluster */
+    "cluster-reset"?: boolean;
+    /** (db) Path to snapshot file to be restored */
+    "cluster-reset-restore-path"?: string;
+    /** (agent/runtime) Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path */
+    "container-runtime-endpoint"?: string;
+    /** (data) Folder to hold state default /var/lib/rancher/ or ${HOME}/.rancher/ if not root */
+    "data-dir"?: string;
+    /** (db) TLS Certificate Authority file used to secure datastore backend communication */
+    "datastore-cafile"?: string;
+    /** (db) TLS certification file used to secure datastore backend communication */
+    "datastore-certfile"?: string;
+    /** (db) Specify etcd, NATS, MySQL, Postgres, or SQLite (default) data source name */
+    "datastore-endpoint"?: string;
+    /** (db) TLS key file used to secure datastore backend communication */
+    "datastore-keyfile"?: string;
+    /** (logging) Turn on debug logs */
+    debug?: boolean;
+    /** (storage) Default local storage path for local provisioner storage class */
+    "default-local-storage-path"?: string;
+    /** (agent/runtime) Set the default runtime in containerd */
+    "default-runtime"?: string;
+    /** (components) Do not deploy packaged components and delete any deployed components (valid values: ) */
+    disable?: string | string[];
+    /** (components) Disable  default cloud controller manager */
+    "disable-cloud-controller"?: boolean;
+    /** (agent/containerd) Disables containerd's fallback default registry endpoint when a mirror is configured for that registry */
+    "disable-default-registry-endpoint"?: boolean;
+    /** (components) Disable Helm controller */
+    "disable-helm-controller"?: boolean;
+    /** (components) Disable running kube-proxy */
+    "disable-kube-proxy"?: boolean;
+    /** (components) Disable  default network policy controller */
+    "disable-network-policy"?: boolean;
+    /** (components) Disable Kubernetes default scheduler */
+    "disable-scheduler"?: boolean;
+    /** (agent/runtime) (experimental) Use cri-dockerd instead of containerd */
+    docker?: boolean;
+    /** (networking) One of 'agent', 'cluster', 'pod', 'disabled' (default: agent) */
+    "egress-selector-mode"?: string;
+    /** (components) Enable embedded distributed container registry; requires use of embedded containerd; when enabled agents will also listen on the supervisor port */
+    "embedded-registry"?: boolean;
+    /** (experimental) Enable pprof endpoint on supervisor port */
+    "enable-pprof"?: boolean;
+    /** (flags) Customized flag for etcd process */
+    "etcd-arg"?: string | string[];
+    /** (db) Disable automatic etcd snapshots */
+    "etcd-disable-snapshots"?: boolean;
+    /** (db) Expose etcd metrics to client interface */
+    "etcd-expose-metrics"?: boolean;
+    /** (db) Enable backup to S3 */
+    "etcd-s3"?: boolean;
+    /** (db) S3 access key */
+    "etcd-s3-access-key"?: string;
+    /** (db) S3 bucket name */
+    "etcd-s3-bucket"?: string;
+    /** (db) S3 bucket lookup type, one of 'auto', 'dns', 'path'; default is 'auto' if not set */
+    "etcd-s3-bucket-lookup-type"?: string;
+    /** (db) Name of secret in the kube-system namespace used to configure S3, if etcd-s3 is enabled and no other etcd-s3 options are set */
+    "etcd-s3-config-secret"?: string;
+    /** (db) S3 endpoint url (default: s3.amazonaws.com) */
+    "etcd-s3-endpoint"?: string;
+    /** (db) S3 custom CA cert to connect to S3 endpoint */
+    "etcd-s3-endpoint-ca"?: string;
+    /** (db) S3 folder */
+    "etcd-s3-folder"?: string;
+    /** (db) Disables S3 over HTTPS */
+    "etcd-s3-insecure"?: boolean;
+    /** (db) Proxy server to use when connecting to S3, overriding any proxy-releated environment variables */
+    "etcd-s3-proxy"?: string;
+    /** (db) S3 region / bucket location (optional) (default: us-east-1) */
+    "etcd-s3-region"?: string;
+    /** (db) S3 retention limit */
+    "etcd-s3-retention"?: number;
+    /** (db) S3 secret key */
+    "etcd-s3-secret-key"?: string;
+    /** (db) S3 session token */
+    "etcd-s3-session-token"?: string;
+    /** (db) Disables S3 SSL certificate validation */
+    "etcd-s3-skip-ssl-verify"?: boolean;
+    /** (db) S3 timeout */
+    "etcd-s3-timeout"?: string;
+    /** (db) Compress etcd snapshot */
+    "etcd-snapshot-compress"?: boolean;
+    /** (db) Directory to save db snapshots. (default: ${data-dir}/server/db/snapshots) */
+    "etcd-snapshot-dir"?: string;
+    /** (db) Set the base name of etcd snapshots, appended with UNIX timestamp (default: etcd-snapshot) */
+    "etcd-snapshot-name"?: string;
+    /** (db) Snapshot reconcile interval */
+    "etcd-snapshot-reconcile-interval"?: string;
+    /** (db) Number of snapshots to retain */
+    "etcd-snapshot-retention"?: number;
+    /** (db) Snapshot interval time in cron spec. eg. every 5 hours '0 *\/5 * * *' (default: 0 *\/12 * * *) */
+    "etcd-snapshot-schedule-cron"?: string;
+    /** (networking) Backend (valid values: 'none', 'vxlan', 'host-gw', 'wireguard-native' (default: vxlan) */
+    "flannel-backend"?: string;
+    /** (agent/networking) Override default flannel cni config file */
+    "flannel-cni-conf"?: string;
+    /** (agent/networking) Override default flannel config file */
+    "flannel-conf"?: string;
+    /** (networking) Use node external IP addresses for Flannel traffic */
+    "flannel-external-ip"?: boolean;
+    /** (agent/networking) Override default flannel interface */
+    "flannel-iface"?: string;
+    /** (networking) Enable IPv6 masquerading for pod */
+    "flannel-ipv6-masq"?: boolean;
+    /** (flags) Customized flag for helm-controller process */
+    "helm-controller-arg"?: string | string[];
+    /** (listener) HTTPS listen port (default: 6443) */
+    "https-listen-port"?: number;
+    /** (agent/node) The path to the directory where credential provider plugin binaries are located (default: /var/lib/rancher/credentialprovider/bin) */
+    "image-credential-provider-bin-dir"?: string;
+    /** (agent/node) The path to the credential provider plugin config file (default: /var/lib/rancher/credentialprovider/config.yaml) */
+    "image-credential-provider-config"?: string;
+    /** (agent/runtime) Disable embedded containerd image service and use remote image service socket at the given path. If not specified, defaults to --container-runtime-endpoint. */
+    "image-service-endpoint"?: string;
+    /** (flags) Customized flag for kube-apiserver process */
+    "kube-apiserver-arg"?: string | string[];
+    /** (flags) Customized flag for kube-cloud-controller-manager process */
+    "kube-cloud-controller-manager-arg"?: string | string[];
+    /** (flags) Customized flag for kube-controller-manager process */
+    "kube-controller-manager-arg"?: string | string[];
+    /** (agent/flags) Customized flag for kube-proxy process */
+    "kube-proxy-arg"?: string | string[];
+    /** (flags) Customized flag for kube-scheduler process */
+    "kube-scheduler-arg"?: string | string[];
+    /** (agent/flags) Customized flag for kubelet process */
+    "kubelet-arg"?: string | string[];
+    /** (agent/node) Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444) */
+    "lb-server-port"?: number;
+    /** (logging) Log to file */
+    log?: string;
+    /** (agent/networking) external DNS addresses to advertise for node */
+    "node-external-dns"?: string | string[];
+    /** (agent/networking) IPv4/IPv6 external IP addresses to advertise for node */
+    "node-external-ip"?: string | string[];
+    /** (agent/networking) internal DNS addresses to advertise for node */
+    "node-internal-dns"?: string | string[];
+    /** (agent/networking) IPv4/IPv6 addresses to advertise for node */
+    "node-ip"?: string | string[];
+    /** (agent/node) Registering and starting kubelet with set of labels */
+    "node-label"?: string | string[];
+    /** (agent/node) Node name */
+    "node-name"?: string;
+    /** (agent/node) Registering kubelet with set of taints */
+    "node-taint"?: string | string[];
+    /** (agent/containerd) Allows non-root pods to access devices by setting device_ownership_from_security_context=true in the containerd CRI config */
+    "nonroot-devices"?: boolean;
+    /** (agent/runtime) Customized pause image for containerd or docker sandbox (default: rancher/mirrored-pause:3.10.2) */
+    "pause-image"?: string;
+    /** (experimental) Prefer bundled userspace binaries over host binaries */
+    "prefer-bundled-bin"?: boolean;
+    /** (agent/runtime) Private registry configuration file */
+    "private-registry"?: string;
+    /** (agent/node) Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults. */
+    "protect-kernel-defaults"?: boolean;
+    /** (agent/networking) Kubelet resolv.conf file */
+    "resolv-conf"?: string;
+    /** (experimental) Run rootless */
+    rootless?: boolean;
+    /** Enable secret encryption at rest */
+    "secrets-encryption"?: boolean;
+    /** (experimental) Secret encryption provider (valid values: 'aescbc', 'secretbox') (default: aescbc) */
+    "secrets-encryption-provider"?: string;
+    /** (agent/node) Enable SELinux in containerd */
+    selinux?: boolean;
+    /** (cluster) Server to connect to, used to join a cluster */
+    server?: string;
+    /** (networking) IPv4/IPv6 network CIDRs to use for service IPs (default: 10.43.0.0/16) */
+    "service-cidr"?: string | string[];
+    /** (networking) Port range to reserve for services with NodePort visibility (default: 30000-32767) */
+    "service-node-port-range"?: string;
+    /** (networking) Namespace of the pods for the servicelb component (default: kube-system) */
+    "servicelb-namespace"?: string;
+    /** (agent/runtime) Override default containerd snapshotter */
+    snapshotter?: string;
+    /** (experimental/components) Enable serving  internal metrics on the supervisor port; when enabled agents will also listen on the supervisor port */
+    "supervisor-metrics"?: boolean;
+    /** (agent/runtime) Private registry to be used for all system images */
+    "system-default-registry"?: string;
+    /** (listener) Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert */
+    "tls-san"?: string | string[];
+    /** (listener) Protect the server TLS cert by refusing to add Subject Alternative Names not associated with the kubernetes apiserver service, server nodes, or values of the tls-san option (default: true) (default: true) */
+    "tls-san-security"?: boolean;
+    /** (cluster) File containing the token */
+    "token-file"?: string;
+    /** (logging) Number for the log level verbosity */
+    v?: number;
+    /** (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging */
+    vmodule?: string;
+    /** (agent/networking) (experimental) Credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>] */
+    "vpn-auth"?: string;
+    /** (agent/networking) (experimental) File containing credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>] */
+    "vpn-auth-file"?: string;
+    /** (agent/node) Append id to node name */
+    "with-node-id"?: boolean;
+    /** (client) Write kubeconfig for admin client to this file */
+    "write-kubeconfig"?: string;
+    /** (client) Write kubeconfig with this group */
+    "write-kubeconfig-group"?: string;
+    /** (client) Write kubeconfig with this mode */
+    "write-kubeconfig-mode"?: string;
+  });
+}

package/dist/validate-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=validate-cli.d.ts.map

package/dist/validate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-cli.d.ts","sourceRoot":"","sources":["../src/validate-cli.ts"],"names":[],"mappings":""}

package/dist/validate.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Validate generated lexicon-k3s artifacts.
+ *
+ * Thin wrapper around the core validation framework
+ * with k3s-specific configuration.
+ */
+import { type ValidateResult } from "@intentius/chant/codegen/validate";
+export type { ValidateCheck, ValidateResult } from "@intentius/chant/codegen/validate";
+/**
+ * Validate the generated lexicon-k3s artifacts.
+ */
+export declare function validate(opts?: {
+    basePath?: string;
+}): Promise<ValidateResult>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAElG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAkBvF;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAQpF"}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@intentius/chant-lexicon-k3s",
+  "version": "0.44.3",
+  "type": "module",
+  "files": [
+    "src/",
+    "dist/"
+  ],
+  "exports": {
+    ".": {
+      "development": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./src/index.ts"
+    },
+    "./*": {
+      "development": "./src/*.ts",
+      "types": "./dist/*.d.ts",
+      "default": "./src/*.ts"
+    },
+    "./lint/post-synth": {
+      "development": "./src/lint/post-synth/index.ts",
+      "types": "./dist/lint/post-synth/index.d.ts",
+      "default": "./src/lint/post-synth/index.ts"
+    },
+    "./manifest": "./dist/manifest.json",
+    "./meta": "./dist/meta.json",
+    "./types": "./dist/types/index.d.ts"
+  },
+  "scripts": {
+    "generate": "npx tsx src/codegen/generate-cli.ts",
+    "validate": "npx tsx src/validate-cli.ts",
+    "docs": "npx tsx src/codegen/docs-cli.ts",
+    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete",
+    "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
+    "bundle": "tsx src/package-cli.ts"
+  },
+  "devDependencies": {
+    "@intentius/chant": "*",
+    "tsc-alias": "^1.8.17",
+    "typescript": "^5.9.3",
+    "js-yaml": "^4.1.0",
+    "@types/js-yaml": "^4.0.9"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@intentius/chant": "^0.44.3",
+    "typescript": "^5.9.3"
+  },
+  "description": "k3s lexicon for chant — the k3s distro's host configuration as declarable data",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/INTENTIUS/chant#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/INTENTIUS/chant.git",
+    "directory": "lexicons/k3s"
+  },
+  "bugs": {
+    "url": "https://github.com/INTENTIUS/chant/issues"
+  },
+  "keywords": [
+    "chant",
+    "k3s",
+    "kubernetes",
+    "iac"
+  ]
+}

package/src/codegen/docs.ts

@@ -0,0 +1,25 @@
+import { docsPipeline, writeDocsSite } from "@intentius/chant/codegen/docs";
+
+/**
+ * Generate documentation site for the k3s lexicon.
+ */
+export async function generateDocs(options?: { verbose?: boolean }): Promise<void> {
+  const config = {
+    name: "k3s",
+    displayName: "K3s",
+    description: "k3s lexicon documentation",
+    distDir: "./dist",
+    outDir: "./docs",
+    // TODO: Implement service grouping for your provider
+    serviceFromType: (type: string) => type.split("::")[1] ?? type,
+    // TODO: Implement resource documentation URLs
+    resourceTypeUrl: (type: string) => `#${type}`,
+  };
+
+  const result = docsPipeline(config);
+  writeDocsSite(config, result);
+
+  if (options?.verbose) {
+    console.error("Documentation generated");
+  }
+}

package/src/codegen/generate-cli.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env tsx
+import { generate, writeGeneratedFiles } from "./generate";
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+
+const pkgDir = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+const result = await generate({ verbose: true });
+writeGeneratedFiles(result, pkgDir);

package/src/codegen/generate-lexicon.ts

@@ -0,0 +1,58 @@
+/**
+ * Lexicon JSON generator — produces lexicon-k3s.json with metadata
+ * for all k3s entities.
+ */
+
+import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
+import type { K3sParseResult } from "./parse";
+import { k3sShortName } from "./parse";
+import type { NamingStrategy } from "./naming";
+import {
+  buildRegistry,
+  serializeRegistry,
+  type RegistryResource,
+} from "@intentius/chant/codegen/generate-registry";
+
+export interface LexiconEntry {
+  resourceType: string;
+  kind: "resource" | "property";
+  lexicon: "k3s";
+  deprecatedProperties?: string[];
+  constraints?: Record<string, PropertyConstraints>;
+}
+
+/**
+ * Generate the lexicon-k3s.json content.
+ */
+export function generateLexiconJSON(results: K3sParseResult[], naming: NamingStrategy): string {
+  const registryResources: RegistryResource[] = results.map((r) => ({
+    typeName: r.resource.typeName,
+    attributes: r.resource.attributes,
+    properties: r.resource.properties,
+    propertyTypes: r.propertyTypes.map((pt) => ({ name: pt.name, specType: pt.defType })),
+  }));
+
+  const entries = buildRegistry<LexiconEntry>(registryResources, naming, {
+    shortName: k3sShortName,
+    buildEntry: (resource, _tsName, _attrs, propConstraints) => {
+      const r = results.find((res) => res.resource.typeName === resource.typeName);
+      return {
+        resourceType: resource.typeName,
+        kind: (r?.isProperty ? "property" : "resource") as "resource" | "property",
+        lexicon: "k3s" as const,
+        ...(r?.resource.deprecatedProperties?.length && {
+          deprecatedProperties: r.resource.deprecatedProperties,
+        }),
+        ...(propConstraints &&
+          Object.keys(propConstraints).length > 0 && { constraints: propConstraints }),
+      };
+    },
+    buildPropertyEntry: (resourceType, propertyType) => ({
+      resourceType: `${resourceType}.${propertyType}`,
+      kind: "property" as const,
+      lexicon: "k3s" as const,
+    }),
+  });
+
+  return serializeRegistry(entries);
+}

package/src/codegen/generate-typescript.ts

@@ -0,0 +1,63 @@
+/**
+ * TypeScript declaration file generator — produces index.d.ts with all
+ * k3s entity classes.
+ */
+
+import type { K3sParseResult } from "./parse";
+import type { NamingStrategy } from "./naming";
+import {
+  writeResourceClass,
+  type DtsProperty,
+  type DtsAttribute,
+} from "@intentius/chant/codegen/generate-typescript";
+
+interface ResourceEntry {
+  tsName: string;
+  properties: DtsProperty[];
+  attributes: DtsAttribute[];
+  remap: Map<string, string>;
+}
+
+/**
+ * Generate the complete .d.ts file content.
+ */
+export function generateTypeScriptDeclarations(
+  results: K3sParseResult[],
+  naming: NamingStrategy,
+): string {
+  const lines: string[] = [];
+  lines.push("// Code generated by chant k3s generate. DO NOT EDIT.");
+
+  const resources: ResourceEntry[] = [];
+
+  for (const r of results) {
+    const typeName = r.resource.typeName;
+    const tsName = naming.resolve(typeName);
+    if (!tsName) continue;
+
+    const dtsProps: DtsProperty[] = r.resource.properties.map((p) => ({
+      name: p.name,
+      type: p.tsType,
+      required: p.required,
+      description: p.description,
+    }));
+    const dtsAttrs: DtsAttribute[] = r.resource.attributes.map((a) => ({
+      name: a.name,
+      type: a.tsType,
+    }));
+
+    resources.push({ tsName, properties: dtsProps, attributes: dtsAttrs, remap: new Map() });
+  }
+
+  resources.sort((a, b) => a.tsName.localeCompare(b.tsName));
+
+  lines.push("");
+  lines.push("// --- k3s Entity classes ---");
+  for (const re of resources) {
+    writeResourceClass(lines, re.tsName, re.properties, re.attributes, re.remap);
+  }
+
+  lines.push("");
+
+  return lines.join("\n");
+}