@intentius/chant-lexicon-k3s 0.56.0 → 0.58.0

package/dist/integrity.json

@@ -4,7 +4,7 @@
     "manifest.json": "5208bf3cb7308fcf74bcfae5cd70e1e4c73b0b567e71ac0f593246f1d72eaef2",
     "meta.json": "5988c37e9e93d52828d34fa043b0804fec7eb833153d387a9711333bcdff4bff",
     "types/index.d.ts": "98f3f3175d38aa2979c57577512c554eafed49b9125967c8617c137c01358e26",
-    "skills/chant-k3s.md": "647bd3e1c6f75b1695150b895273edff6e25fe5851ce85dd3a213280fb6a0e75"
+    "skills/chant-k3s.md": "5ea0ac56f5584913f7df3bbfa591522a470772854df58a1830ec280d44bbd77c"
   },
-  "composite": "c5aa14712fce0c3baf881168a643b0af27bdd787ad431c959e07ada098c73bbd"
+  "composite": "820d397809f6e20871fb7b8afc90f3a34a7112e7fcd530d45d01b24e41f31b77"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAW/D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA2CpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAa/D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA2CpD,CAAC"}

package/dist/lint/audit-lineage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+export declare const k3sAuditLineage: Record<string, Lineage[]>;
+//# sourceMappingURL=audit-lineage.d.ts.map

package/dist/lint/audit-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAIrD,CAAC"}

package/dist/op/activities/index.d.ts

@@ -11,11 +11,12 @@
  * as a value — only `tokenFile`, a path — see the token-boundary note on
  * {@link k3sInstall} in ./k3s.
  *
- * The step builders (k3sInstall, k3sUninstall) live in core, re-exported from
- * the temporal Op-authoring barrel like k3dUp/k3dDown. The activities here are
+ * The step builders (k3sInstall, k3sUninstall) live in core and reach authors
+ * through `@intentius/chant/op` like k3dUp/k3dDown. The activities here are
  * dependency-light — they shell out to the k3s installer/uninstall scripts and
- * only pull in the lexicon's version pin, not its declarable surface — so a
- * Temporal worker loads them cheaply.
+ * only pull in the lexicon's version pin, not its declarable surface — so
+ * `loadActivities` (`packages/core/src/op/activity-registry.ts`), which imports
+ * this module at run time, pulls in nothing expensive.
  */
 export { k3sInstall, k3sUninstall, k3sInstallCommand, k3sInstallEnv, k3sUninstallCommand, k3sUninstallScript, k3sVersionCommand, parseK3sVersion, } from "./k3s.js";
 export type { K3sRole, K3sInstallArgs, K3sUninstallArgs, K3sInstallResult } from "./k3s.js";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAChB,MAAM,OAAO,CAAC;AACf,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAChB,MAAM,OAAO,CAAC;AACf,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC"}

package/dist/op/activities/k3s.d.ts

@@ -79,9 +79,9 @@ export declare function k3sUninstallCommand(args: K3sUninstallArgs): string;
 /**
  * Run the pinned k3s installer against a reachable host. Idempotent on an
  * already-installed matching version: if `k3s --version` already reports the
- * target version, the install is skipped. Uses longInfra profile — 20m
- * timeout, heartbeat every 15s (the installer downloads and starts the
- * k3s binary).
+ * target version, the install is skipped. Uses the longInfra profile: a 20m
+ * timeout, wide enough for the installer to download and start the k3s binary,
+ * and three attempts backing off from 30s.
  *
  * Bounded exactly as `k3dUp`/`k3dDown` were (chant#1410, epic #1598): this
  * drives the case where the host is reachable from where the Op runs. It

package/dist/op/activities/k3s.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"k3s.d.ts","sourceRoot":"","sources":["../../../src/op/activities/k3s.ts"],"names":[],"mappings":"AAOA,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzC,MAAM,WAAW,cAAc;IAC7B,kFAAkF;IAClF,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,wGAAwG;IACxG,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAElE;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAE9D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI1E;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAExD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAGlE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,cAAc,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAiC3B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9F"}
+{"version":3,"file":"k3s.d.ts","sourceRoot":"","sources":["../../../src/op/activities/k3s.ts"],"names":[],"mappings":"AAMA,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzC,MAAM,WAAW,cAAc;IAC7B,kFAAkF;IAClF,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,wGAAwG;IACxG,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAElE;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAE9D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI1E;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAExD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAGlE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,cAAc,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAyB3B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9F"}

package/dist/op/builders.d.ts

@@ -1,9 +1,11 @@
 /**
  * Typed step-builder wrappers for this lexicon's activities (chant #1288
  * Stage 2). See `lexicons/k8s/src/op/builders.ts`'s module doc for why these
- * live beside their `*Args` interfaces rather than in core or the temporal
- * barrel. `opts`'s type in each wrapper below IS the activity's own `*Args`
- * interface (via `Omit`/`WithStepRefs`) — never restated. `core`'s own
+ * live beside their `*Args` interfaces rather than in core: core cannot
+ * import a lexicon's types, so a wrapper whose `opts` IS the activity's own
+ * `*Args` interface can only sit in the lexicon that declares that
+ * interface. `opts`'s type in each wrapper below IS the activity's own
+ * `*Args` interface (via `Omit`/`WithStepRefs`) — never restated. `core`'s own
  * `k3sInstall`/`k3sUninstall` are unchanged and produce byte-identical
  * `ActivityStep` output; these are purely additive.
  */

package/dist/op/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElF,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,OAAO,EACb,MAAM,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC1D,iBAGF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,GACvB,MAAM,OAAO,EACb,OAAO,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC7D,iBAGF,CAAC"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElF,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,OAAO,EACb,MAAM,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC1D,iBAGF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,GACvB,MAAM,OAAO,EACb,OAAO,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC7D,iBAGF,CAAC"}

package/dist/skills/chant-k3s.md

@@ -78,7 +78,8 @@ host the Op runs on or can reach directly — the same boundary `k3dUp`/
 Requires `"k3s"` in the project's `chant.config.ts` `lexicons`.
 
 ```typescript
-import { Op, phase, k3sInstall, k3sUninstall } from "@intentius/chant-lexicon-temporal";
+import { Op, phase } from "@intentius/chant/op";
+import { k3sInstall, k3sUninstall } from "@intentius/chant-lexicon-k3s";
 
 export default Op({
   name: "k3s-controlplane",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k3s",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "type": "module",
   "files": [
     "src/",
@@ -50,7 +50,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.56.0",
+    "@intentius/chant": "^0.58.0",
     "typescript": "^5.9.3"
   },
   "description": "k3s lexicon for chant — the k3s distro's host configuration as declarable data",

package/src/index.ts

@@ -1,8 +1,8 @@
 // Typed Op step-builder wrappers (chant #1288 Stage 2) — k3sInstall/
 // k3sUninstall with authoring-time types derived from this lexicon's own
 // *Args interfaces (see ./op/builders.ts's module doc). Opt-in:
-// `@intentius/chant-lexicon-temporal`'s same-named exports are core's
-// original untyped builders, unchanged.
+// `@intentius/chant/op`'s same-named exports are core's original untyped
+// builders, unchanged.
 export { k3sInstall, k3sUninstall } from "./op/builders";
 
 // Plugin

package/src/lint/audit-catalog.ts

@@ -9,6 +9,8 @@
  * role — so every entry is constructed directly with `yamlBased: false`.
  */
 import type { RuleMeta } from "@intentius/chant/audit/catalog";
+import { k3sAuditLineage } from "./audit-lineage";
+import { applyLineage } from "@intentius/chant/audit/catalog";
 
 function entityRule(
   id: string,
@@ -63,3 +65,6 @@ export const k3sAuditCatalog: Record<string, RuleMeta> = {
     "Remove the component's config key, or drop it from `disable`.",
   ),
 };
+
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(k3sAuditCatalog, k3sAuditLineage);

package/src/lint/audit-lineage.ts

@@ -0,0 +1,14 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+export const k3sAuditLineage: Record<string, Lineage[]> = {
+  K3S104: [
+    { tool: "kube-bench", rule: "k3s-cis-1.8 1.1.13", url: "https://raw.githubusercontent.com/aquasecurity/kube-bench/main/cfg/k3s-cis-1.8/master.yaml", relation: "overlaps" },
+  ],
+};

package/src/op/activities/index.ts

@@ -11,11 +11,12 @@
  * as a value — only `tokenFile`, a path — see the token-boundary note on
  * {@link k3sInstall} in ./k3s.
  *
- * The step builders (k3sInstall, k3sUninstall) live in core, re-exported from
- * the temporal Op-authoring barrel like k3dUp/k3dDown. The activities here are
+ * The step builders (k3sInstall, k3sUninstall) live in core and reach authors
+ * through `@intentius/chant/op` like k3dUp/k3dDown. The activities here are
  * dependency-light — they shell out to the k3s installer/uninstall scripts and
- * only pull in the lexicon's version pin, not its declarable surface — so a
- * Temporal worker loads them cheaply.
+ * only pull in the lexicon's version pin, not its declarable surface — so
+ * `loadActivities` (`packages/core/src/op/activity-registry.ts`), which imports
+ * this module at run time, pulls in nothing expensive.
  */
 export {
   k3sInstall,

package/src/op/activities/k3s.test.ts

@@ -18,7 +18,11 @@ const execCalls: Array<{ cmd: string; opts: unknown }> = [];
 let versionReply: { stdout: string; stderr: string } | Error = new Error("k3s: command not found");
 let uninstallReply: { stdout: string; stderr: string } = { stdout: "", stderr: "" };
 
-vi.mock("node:child_process", () => {
+// Partial, via `importOriginal`: `@intentius/chant/op` reaches the base
+// activities now (chant #2114), and modules on that path promisify
+// `execFile` at load. A wholesale replacement of node:child_process would
+// make them fail to import rather than fail an assertion.
+vi.mock("node:child_process", async (importOriginal) => {
   const custom = Symbol.for("nodejs.util.promisify.custom");
   const exec = ((_cmd: string, _opts: unknown, cb?: (...a: unknown[]) => void) => {
     cb?.(new Error("unmocked exec path"));
@@ -32,7 +36,7 @@ vi.mock("node:child_process", () => {
     if (cmd.startsWith("test -x")) return uninstallReply;
     return { stdout: "", stderr: "" };
   };
-  return { exec };
+  return { ...(await importOriginal<typeof import("node:child_process")>()), exec };
 });
 
 describe("k3sInstallCommand (#1601)", () => {

package/src/op/activities/k3s.ts

@@ -1,6 +1,5 @@
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
-import { safeHeartbeat } from "@intentius/chant/op";
 import { K3S_VERSION } from "../../spec/fetch";
 
 const execAsync = promisify(exec);
@@ -111,9 +110,9 @@ export function k3sUninstallCommand(args: K3sUninstallArgs): string {
 /**
  * Run the pinned k3s installer against a reachable host. Idempotent on an
  * already-installed matching version: if `k3s --version` already reports the
- * target version, the install is skipped. Uses longInfra profile — 20m
- * timeout, heartbeat every 15s (the installer downloads and starts the
- * k3s binary).
+ * target version, the install is skipped. Uses the longInfra profile: a 20m
+ * timeout, wide enough for the installer to download and start the k3s binary,
+ * and three attempts backing off from 30s.
  *
  * Bounded exactly as `k3dUp`/`k3dDown` were (chant#1410, epic #1598): this
  * drives the case where the host is reachable from where the Op runs. It
@@ -139,20 +138,12 @@ export async function k3sInstall(
     // `k3s --version` errors when k3s is absent — fall through to install.
   }
 
-  const heartbeatInterval = setInterval(() => {
-    safeHeartbeat({ step: "k3s install", role: args.role, version: target });
-  }, 15_000);
-
-  try {
-    const { stdout, stderr } = await execAsync(k3sInstallCommand(args), {
-      signal,
-      env: { ...process.env, ...k3sInstallEnv(args) },
-    });
-    if (stdout) console.log(stdout);
-    if (stderr) console.error(stderr);
-  } finally {
-    clearInterval(heartbeatInterval);
-  }
+  const { stdout, stderr } = await execAsync(k3sInstallCommand(args), {
+    signal,
+    env: { ...process.env, ...k3sInstallEnv(args) },
+  });
+  if (stdout) console.log(stdout);
+  if (stderr) console.error(stderr);
 
   return { version: target, installed: true };
 }

package/src/op/builders.ts

@@ -1,9 +1,11 @@
 /**
  * Typed step-builder wrappers for this lexicon's activities (chant #1288
  * Stage 2). See `lexicons/k8s/src/op/builders.ts`'s module doc for why these
- * live beside their `*Args` interfaces rather than in core or the temporal
- * barrel. `opts`'s type in each wrapper below IS the activity's own `*Args`
- * interface (via `Omit`/`WithStepRefs`) — never restated. `core`'s own
+ * live beside their `*Args` interfaces rather than in core: core cannot
+ * import a lexicon's types, so a wrapper whose `opts` IS the activity's own
+ * `*Args` interface can only sit in the lexicon that declares that
+ * interface. `opts`'s type in each wrapper below IS the activity's own
+ * `*Args` interface (via `Omit`/`WithStepRefs`) — never restated. `core`'s own
  * `k3sInstall`/`k3sUninstall` are unchanged and produce byte-identical
  * `ActivityStep` output; these are purely additive.
  */

package/src/skills/chant-k3s.md

@@ -78,7 +78,8 @@ host the Op runs on or can reach directly — the same boundary `k3dUp`/
 Requires `"k3s"` in the project's `chant.config.ts` `lexicons`.
 
 ```typescript
-import { Op, phase, k3sInstall, k3sUninstall } from "@intentius/chant-lexicon-temporal";
+import { Op, phase } from "@intentius/chant/op";
+import { k3sInstall, k3sUninstall } from "@intentius/chant-lexicon-k3s";
 
 export default Op({
   name: "k3s-controlplane",