@intentius/chant-lexicon-k8s 0.124.30 → 0.124.32

package/dist/import/parser.js

@@ -0,0 +1,204 @@
+/**
+ * Kubernetes YAML parser for `chant import`.
+ *
+ * Parses Kubernetes manifests (single or multi-document YAML) into the core
+ * TemplateIR format, mapping K8s resources to the K8s::{Group}::{Kind} type
+ * convention.
+ */
+import { parseYAML, splitYAMLDocuments } from "@intentius/chant/yaml";
+import { namespaceSegmentForGroup } from "../group-namespace.js";
+import { delegateEmbedded } from "./embedded.js";
+// ── GVK to type name mapping ───────────────────────────────────────
+/**
+ * Well-known kind+apiVersion pairs mapped to K8s type names.
+ * Key format: "apiVersion/kind" (core group uses just "kind").
+ */
+const GVK_TYPE_MAP = {
+    // Core (v1)
+    "v1/Pod": "K8s::Core::Pod",
+    "v1/Service": "K8s::Core::Service",
+    "v1/ConfigMap": "K8s::Core::ConfigMap",
+    "v1/Secret": "K8s::Core::Secret",
+    "v1/Namespace": "K8s::Core::Namespace",
+    "v1/ServiceAccount": "K8s::Core::ServiceAccount",
+    "v1/PersistentVolume": "K8s::Core::PersistentVolume",
+    "v1/PersistentVolumeClaim": "K8s::Core::PersistentVolumeClaim",
+    "v1/Endpoints": "K8s::Core::Endpoints",
+    "v1/LimitRange": "K8s::Core::LimitRange",
+    "v1/ResourceQuota": "K8s::Core::ResourceQuota",
+    // Apps (apps/v1)
+    "apps/v1/Deployment": "K8s::Apps::Deployment",
+    "apps/v1/StatefulSet": "K8s::Apps::StatefulSet",
+    "apps/v1/DaemonSet": "K8s::Apps::DaemonSet",
+    "apps/v1/ReplicaSet": "K8s::Apps::ReplicaSet",
+    // Batch (batch/v1)
+    "batch/v1/Job": "K8s::Batch::Job",
+    "batch/v1/CronJob": "K8s::Batch::CronJob",
+    // Networking (networking.k8s.io/v1)
+    "networking.k8s.io/v1/Ingress": "K8s::Networking::Ingress",
+    "networking.k8s.io/v1/NetworkPolicy": "K8s::Networking::NetworkPolicy",
+    "networking.k8s.io/v1/IngressClass": "K8s::Networking::IngressClass",
+    // RBAC (rbac.authorization.k8s.io/v1)
+    "rbac.authorization.k8s.io/v1/Role": "K8s::Rbac::Role",
+    "rbac.authorization.k8s.io/v1/ClusterRole": "K8s::Rbac::ClusterRole",
+    "rbac.authorization.k8s.io/v1/RoleBinding": "K8s::Rbac::RoleBinding",
+    "rbac.authorization.k8s.io/v1/ClusterRoleBinding": "K8s::Rbac::ClusterRoleBinding",
+    // Autoscaling (autoscaling/v2)
+    "autoscaling/v2/HorizontalPodAutoscaler": "K8s::Autoscaling::HorizontalPodAutoscaler",
+    "autoscaling/v1/HorizontalPodAutoscaler": "K8s::Autoscaling::HorizontalPodAutoscaler",
+    // Policy (policy/v1)
+    "policy/v1/PodDisruptionBudget": "K8s::Policy::PodDisruptionBudget",
+    // Storage (storage.k8s.io/v1)
+    "storage.k8s.io/v1/StorageClass": "K8s::Storage::StorageClass",
+    // Certificates (certificates.k8s.io/v1)
+    "certificates.k8s.io/v1/CertificateSigningRequest": "K8s::Certificates::CertificateSigningRequest",
+    // Coordination (coordination.k8s.io/v1)
+    "coordination.k8s.io/v1/Lease": "K8s::Coordination::Lease",
+    // Discovery (discovery.k8s.io/v1)
+    "discovery.k8s.io/v1/EndpointSlice": "K8s::Discovery::EndpointSlice",
+};
+/**
+ * Resolve apiVersion + kind to a K8s type name.
+ * Falls back to constructing from the apiVersion group.
+ */
+/**
+ * `<apiVersion>/<kind>` keys that map to a type another key maps to first.
+ * The build writes the first key's apiVersion for that type, so a document
+ * written against a later key (`autoscaling/v1` HorizontalPodAutoscaler)
+ * keeps its own apiVersion as a property.
+ */
+const ALIASED_GVKS = (() => {
+    const firstForType = new Set();
+    const aliased = new Set();
+    for (const [key, type] of Object.entries(GVK_TYPE_MAP)) {
+        if (firstForType.has(type))
+            aliased.add(key);
+        else
+            firstForType.add(type);
+    }
+    return aliased;
+})();
+function resolveTypeName(apiVersion, kind) {
+    // Try exact match
+    const key = `${apiVersion}/${kind}`;
+    if (GVK_TYPE_MAP[key])
+        return GVK_TYPE_MAP[key];
+    // Core group uses just kind
+    if (apiVersion === "v1") {
+        const coreKey = `v1/${kind}`;
+        if (GVK_TYPE_MAP[coreKey])
+            return GVK_TYPE_MAP[coreKey];
+    }
+    // Construct from apiVersion group
+    const group = apiVersionToGroup(apiVersion);
+    return `K8s::${group}::${kind}`;
+}
+/**
+ * Extract the namespace segment from an apiVersion string.
+ * "apps/v1" → "Apps"
+ * "v1" → "Core"
+ * "rbac.authorization.k8s.io/v1" → "Rbac"
+ * "argoproj.io/v1alpha1" → "Argo" (override)
+ *
+ * Splits the version off and hands the group to the shared rule, so an
+ * imported manifest is typed exactly as a declared one is.
+ */
+function apiVersionToGroup(apiVersion) {
+    const slashIdx = apiVersion.indexOf("/");
+    if (slashIdx === -1)
+        return "Core"; // core group (v1)
+    return namespaceSegmentForGroup(apiVersion.slice(0, slashIdx));
+}
+/**
+ * Convert a K8s object name to a camelCase logical identifier.
+ * Combines kind (lowercased first char) with the object name (PascalCased).
+ *
+ * E.g., kind="Deployment", name="my-app" → "deploymentMyApp"
+ */
+function toLogicalId(kind, name) {
+    const prefix = kind.charAt(0).toLowerCase() + kind.slice(1);
+    if (!name)
+        return prefix;
+    const pascalName = name
+        .split(/[-_.]/)
+        .map((seg) => seg.charAt(0).toUpperCase() + seg.slice(1))
+        .join("");
+    return `${prefix}${pascalName}`;
+}
+// ── Parser ──────────────────────────────────────────────────────────
+/**
+ * Kubernetes YAML parser implementation.
+ *
+ * Supports multi-document YAML (split on `---`, see `splitYAMLDocuments`). Each document is expected
+ * to be a standard Kubernetes object with apiVersion, kind, and metadata.
+ */
+export class K8sParser {
+    /**
+     * With `context.embedded` (`chant import`), content another lexicon owns
+     * is offered to it: every ConfigMap `data` value and a PrometheusRule's
+     * `spec.groups` (see ./embedded.ts). Without it, everything is kept as
+     * written.
+     */
+    parse(content, context) {
+        const resources = [];
+        const namespaces = new Set();
+        // Split into documents on `---` / `...` markers (a trailing `# comment`
+        // allowed); empty and comment-only documents are dropped (#2965).
+        const documents = splitYAMLDocuments(content);
+        for (const docStr of documents) {
+            const doc = parseYAML(docStr);
+            if (!doc || typeof doc !== "object")
+                continue;
+            const resource = this.parseDocument(doc, context?.embedded);
+            if (resource) {
+                resources.push(resource);
+                // Track namespaces
+                const ns = doc.metadata;
+                if (ns?.namespace && typeof ns.namespace === "string") {
+                    namespaces.add(ns.namespace);
+                }
+            }
+        }
+        const metadata = {};
+        if (namespaces.size > 0) {
+            metadata.namespaces = [...namespaces];
+        }
+        return {
+            resources,
+            parameters: [],
+            metadata: Object.keys(metadata).length > 0 ? metadata : undefined,
+        };
+    }
+    parseDocument(doc, embedded) {
+        const apiVersion = doc.apiVersion;
+        const kind = doc.kind;
+        if (!apiVersion || !kind)
+            return null;
+        const metadata = (doc.metadata ?? {});
+        const name = metadata.name;
+        const type = resolveTypeName(apiVersion, kind);
+        const logicalId = toLogicalId(kind, name);
+        // Extract the user-configurable properties (skip apiVersion, kind)
+        const properties = {};
+        for (const [key, value] of Object.entries(doc)) {
+            if (key === "kind")
+                continue;
+            if (key === "apiVersion" && !ALIASED_GVKS.has(`${apiVersion}/${kind}`))
+                continue;
+            properties[key] = value;
+        }
+        if (embedded)
+            delegateEmbedded(type, kind, properties, embedded);
+        return {
+            logicalId,
+            type,
+            properties,
+            metadata: {
+                originalName: name,
+                apiVersion,
+                kind,
+                ...(metadata.namespace ? { namespace: metadata.namespace } : {}),
+            },
+        };
+    }
+}

package/dist/import/testdata/embedded/fixtures.js

@@ -0,0 +1,60 @@
+/**
+ * Shared by the embedded-content round trip (embedded-roundtrip.test.ts) and
+ * the type check of what it generates (embedded-types.e2e.test.ts): run
+ * `chant import` over a manifest file the way a user does, through
+ * `importCommand`, in a project inside this package so the lexicons resolve
+ * as they would for them.
+ */
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "fs";
+import { join, relative, resolve } from "path";
+import { importCommand } from "@intentius/chant/cli/commands/import";
+import { parsePrometheusYaml } from "@intentius/chant-lexicon-prometheus/import/parser";
+export const pkgDir = resolve(import.meta.dirname, "../../../..");
+export const repoRoot = resolve(pkgDir, "../..");
+export const read = (name) => readFileSync(join(import.meta.dirname, name), "utf-8");
+function walk(dir, root, out) {
+    for (const entry of readdirSync(dir)) {
+        const path = join(dir, entry);
+        if (statSync(path).isDirectory())
+            walk(path, root, out);
+        else
+            out[relative(root, path)] = readFileSync(path, "utf-8");
+    }
+}
+/**
+ * `chant import manifest.yaml --lexicon k8s` into a fresh project, or with
+ * `detect`, `chant import manifest.yaml` with the lexicon detected.
+ */
+export async function importManifest(yaml, options = {}) {
+    const dir = mkdtempSync(join(pkgDir, ".roundtrip-tmp-"));
+    writeFileSync(join(dir, "package.json"), '{ "name": "k8s-embedded-roundtrip", "private": true, "type": "module" }\n');
+    writeFileSync(join(dir, "chant.config.ts"), 'export default { lexicons: ["k8s"] };\n');
+    const srcDir = join(dir, "src");
+    mkdirSync(srcDir);
+    const templatePath = join(dir, "manifest.yaml");
+    writeFileSync(templatePath, yaml);
+    const result = await importCommand({ templatePath, output: srcDir, ...(options.detect ? {} : { lexicon: "k8s" }) });
+    const files = {};
+    walk(srcDir, srcDir, files);
+    return { result, dir, srcDir, files };
+}
+export function removeDir(dir) {
+    rmSync(dir, { recursive: true, force: true });
+}
+/**
+ * An alertmanager.yml as the prometheus importer reads it, receivers and
+ * time intervals sorted by name (the serializer sorts them): what an
+ * imported ConfigMap's `alertmanager.yml` must give back (#3031).
+ */
+export function alertmanagerConfig(text) {
+    const parsed = parsePrometheusYaml(text);
+    if (parsed.kind !== "alertmanager")
+        throw new Error("not an alertmanager.yml");
+    const byName = (a, b) => a.name.localeCompare(b.name);
+    const { receivers, time_intervals, ...rest } = parsed.config;
+    return {
+        ...rest,
+        ...(receivers ? { receivers: [...receivers].sort(byName) } : {}),
+        ...(time_intervals ? { time_intervals: [...time_intervals].sort(byName) } : {}),
+    };
+}

package/dist/include/entity.js

@@ -0,0 +1,78 @@
+/**
+ * `k8sInclude`: bring a plain multi-document YAML file or pinned URL into a
+ * build as it is (#3566 item 4).
+ *
+ * Before this, the way to ship a vendored manifest bundle (an operator's
+ * install.yaml, a CRD bundle) through chant was a kustomization directory
+ * listing it as its only resource. `k8sInclude` declares the file or URL
+ * directly. Its documents become the same verbatim manifest entities a
+ * kustomize build root produces (`../manifest-entity.ts`), so they get
+ * default labels and ownership stamping, post-synth checks, and
+ * `lifecycle diff --live` like any declared resource.
+ *
+ * This module is the declaration only, with no filesystem or network access,
+ * so the factory stays pure and folds under `--sandbox`. The bytes are read
+ * at `buildRoots()`, the build's one impure seam, in `./resolve.ts`, the same
+ * split `declareSecret({ provenance: "committed-encrypted" })` uses.
+ *
+ * The declaration itself never reaches the output: the serializer skips it,
+ * and it carries no `props`, so the live read paths never ask a cluster
+ * about it.
+ */
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+/** Marks a `k8sInclude` declaration. */
+export const K8S_INCLUDE_MARKER = Symbol.for("chant.k8s.include");
+export const K8S_INCLUDE_ENTITY_TYPE = "chant:k8s:include";
+/** Annotation stamped on every included document, valued with its source. */
+export const INCLUDE_SOURCE_ANNOTATION = "chant.intentius.io/include-source";
+const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+export function isK8sInclude(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        value[K8S_INCLUDE_MARKER] === true);
+}
+/** True for an `http://` or `https://` source. */
+export function isRemoteSource(source) {
+    return /^https?:\/\//i.test(source);
+}
+/**
+ * Declare a local or pinned remote multi-document YAML to include in the
+ * build.
+ *
+ * @example
+ * ```ts
+ * import { k8sInclude } from "@intentius/chant-lexicon-k8s";
+ *
+ * export const certManager = k8sInclude({
+ *   source: "https://github.com/cert-manager/cert-manager/releases/download/v1.16.2/cert-manager.yaml",
+ *   digest: "sha256:...",
+ * });
+ *
+ * export const legacy = k8sInclude({ source: "manifests/legacy.yaml" });
+ * ```
+ */
+export function k8sInclude(props) {
+    const source = props?.source;
+    if (typeof source !== "string" || source.length === 0) {
+        throw new Error("k8sInclude: `source` must be a non-empty path or URL");
+    }
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(source) && !isRemoteSource(source)) {
+        throw new Error(`k8sInclude("${source}"): only local paths and http(s) URLs are supported`);
+    }
+    if (props.digest !== undefined && !DIGEST_RE.test(props.digest)) {
+        throw new Error(`k8sInclude("${source}"): digest ${JSON.stringify(props.digest)} is not of the form "sha256:<64 lowercase hex>"`);
+    }
+    if (isRemoteSource(source) && props.digest === undefined) {
+        throw new Error(`k8sInclude("${source}"): a URL source must be pinned with \`digest: "sha256:<hex>"\`. ` +
+            `Compute it from a copy you have reviewed, e.g. \`curl -sL <url> | shasum -a 256\`.`);
+    }
+    return {
+        lexicon: "k8s",
+        entityType: K8S_INCLUDE_ENTITY_TYPE,
+        source,
+        ...(props.digest !== undefined ? { digest: props.digest } : {}),
+        ...(props.patches !== undefined ? { patches: JSON.parse(JSON.stringify(props.patches)) } : {}),
+        [DECLARABLE_MARKER]: true,
+        [K8S_INCLUDE_MARKER]: true,
+    };
+}

package/dist/include/resolve.js

@@ -0,0 +1,170 @@
+/**
+ * Resolving `k8sInclude` declarations at `buildRoots()` (#3566 item 4).
+ *
+ * For each declaration in the discovered entity set: read the local file or
+ * fetch the URL, check the bytes against the pinned digest, parse the
+ * multi-document YAML, apply the declaration's patches, and wrap each
+ * document in a verbatim manifest entity stamped with the source.
+ *
+ * - Local paths resolve against the project root (the directory holding
+ *   `chant.config.*`), as `declareSecret`'s committed ciphertext and
+ *   `k8s.kustomize.roots` do.
+ * - A URL is fetched once. The bytes are cached under their digest in
+ *   `~/.chant/includes/` (override with `CHANT_INCLUDE_CACHE_ROOT`, the
+ *   counterpart of the helm lexicon's `CHANT_HELM_RENDER_ROOT`), and a build
+ *   that finds a cached copy matching the digest never touches the network.
+ *   Fetched bytes that do not match the digest fail the build and are not
+ *   cached.
+ * - Entity names are `<declaration name>/<kindName>`, qualified by
+ *   namespace and then numbered in document order on collision, the scheme
+ *   kustomize roots use. Keying on the declaration's export name rather than
+ *   the URL keeps the names stable when a pinned version is bumped, so the
+ *   live diff lines up across the upgrade.
+ * - A missing file, a failed fetch, a file with no documents, and a
+ *   document without a string `apiVersion` and `kind` each fail the build
+ *   with the path or URL in the message. Empty documents (a stray `---`)
+ *   are skipped.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { loadAll } from "js-yaml";
+import { applyRenderedPatches } from "../patch/rendered-patch.js";
+import { addRenderedEntity, renderedManifestEntity } from "../kustomize/rendered-entity.js";
+import { INCLUDE_SOURCE_ANNOTATION, isK8sInclude, isRemoteSource } from "./entity.js";
+export const defaultIncludeFetcher = async (url) => {
+    const response = await fetch(url, { redirect: "follow" });
+    if (!response.ok)
+        throw new Error(`HTTP ${response.status} ${response.statusText}`.trim());
+    return new Uint8Array(await response.arrayBuffer());
+};
+/** Where fetched include sources are cached, keyed by digest. */
+export function includeCacheRoot() {
+    return process.env.CHANT_INCLUDE_CACHE_ROOT ?? join(homedir(), ".chant", "includes");
+}
+export function sha256Digest(bytes) {
+    return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+/** `sha256:<hex>` -> `sha256-<hex>.yaml`; colons are not filesystem-safe everywhere. */
+function cachePath(root, digest) {
+    return join(root, `${digest.replace(":", "-")}.yaml`);
+}
+async function loadBytes(name, decl, opts) {
+    const read = opts.readFile ?? ((path) => readFileSync(path));
+    const label = `k8sInclude "${name}" (${decl.source})`;
+    if (!isRemoteSource(decl.source)) {
+        const absolute = resolve(opts.projectRoot, decl.source);
+        let bytes;
+        try {
+            bytes = read(absolute);
+        }
+        catch (err) {
+            throw new Error(`${label}: file not readable at ${absolute} — ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (decl.digest !== undefined) {
+            const actual = sha256Digest(bytes);
+            if (actual !== decl.digest) {
+                throw new Error(`${label}: ${absolute} does not match its pinned digest: expected ${decl.digest}, found ${actual}`);
+            }
+        }
+        return bytes;
+    }
+    // The factory refuses an unpinned URL; this guards a declaration revived
+    // from the entity wire format or built by hand.
+    if (decl.digest === undefined) {
+        throw new Error(`${label}: a URL source must be pinned with a sha256 digest`);
+    }
+    const root = opts.cacheRoot ?? includeCacheRoot();
+    const cached = cachePath(root, decl.digest);
+    if (existsSync(cached)) {
+        const bytes = readFileSync(cached);
+        // A corrupt or hand-edited cache entry is refetched, never trusted.
+        if (sha256Digest(bytes) === decl.digest)
+            return bytes;
+    }
+    const fetcher = opts.fetch ?? defaultIncludeFetcher;
+    let bytes;
+    try {
+        bytes = await fetcher(decl.source);
+    }
+    catch (err) {
+        throw new Error(`${label}: fetch failed — ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const actual = sha256Digest(bytes);
+    if (actual !== decl.digest) {
+        throw new Error(`${label}: fetched bytes do not match the pinned digest: expected ${decl.digest}, fetched ${actual}. ` +
+            `The content at the URL changed, or the digest is wrong.`);
+    }
+    try {
+        mkdirSync(root, { recursive: true });
+        const tmp = `${cached}.${process.pid}.tmp`;
+        writeFileSync(tmp, bytes);
+        renameSync(tmp, cached);
+    }
+    catch {
+        // A cache write failure is not fatal: the verified bytes are in memory,
+        // and the next build fetches again.
+    }
+    return bytes;
+}
+/** Parse, validate and patch one source's documents. */
+function documentsOf(name, decl, text) {
+    const label = `k8sInclude "${name}" (${decl.source})`;
+    let parsed;
+    try {
+        parsed = loadAll(text);
+    }
+    catch (err) {
+        throw new Error(`${label} is not valid YAML: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const docs = [];
+    parsed.forEach((doc, i) => {
+        if (doc === null || doc === undefined)
+            return;
+        if (typeof doc !== "object" || Array.isArray(doc)) {
+            throw new Error(`${label}: document ${i} is not a Kubernetes object`);
+        }
+        const record = doc;
+        if (typeof record.apiVersion !== "string" || !record.apiVersion || typeof record.kind !== "string" || !record.kind) {
+            throw new Error(`${label}: document ${i} has no string apiVersion and kind`);
+        }
+        docs.push(record);
+    });
+    if (docs.length === 0)
+        throw new Error(`${label} contains no YAML documents`);
+    return applyRenderedPatches(docs, decl.patches, label);
+}
+/**
+ * Resolve every declaration into entities. Throws on the first one that
+ * does not resolve: a build that would silently drop an included bundle
+ * must not proceed.
+ */
+export async function resolveIncludes(opts) {
+    const entities = new Map();
+    for (const [name, decl] of opts.declarations) {
+        const bytes = await loadBytes(name, decl, opts);
+        const text = Buffer.from(bytes).toString("utf-8");
+        for (const doc of documentsOf(name, decl, text)) {
+            // documentsOf checked apiVersion/kind, so the wrap cannot return null.
+            addRenderedEntity(entities, name, renderedManifestEntity(doc, decl.source, INCLUDE_SOURCE_ANNOTATION));
+        }
+    }
+    return entities;
+}
+/** Every `k8sInclude` declaration in an entity map, keyed by entity name. */
+export function includeDeclarations(entities) {
+    const out = new Map();
+    for (const [name, entity] of entities) {
+        if (isK8sInclude(entity))
+            out.set(name, entity);
+    }
+    return out;
+}
+/** The `buildRoots` contribution: the documents of every `k8sInclude`. */
+export async function includeBuildRoot(ctx, overrides) {
+    const declarations = includeDeclarations(ctx.entities ?? new Map());
+    if (declarations.size === 0)
+        return { entities: new Map() };
+    return { entities: await resolveIncludes({ projectRoot: ctx.projectRoot, declarations, ...overrides }) };
+}

package/dist/index.js

@@ -0,0 +1,59 @@
+// Serializer
+export { k8sSerializer } from "./serializer.js";
+// Plugin
+export { k8sPlugin } from "./plugin.js";
+// Typed Op step-builder wrappers (chant #1288 Stage 2) — kubectlApply/
+// waitForReady/ensureSecret — are deliberately NOT re-exported here: their
+// types derive from the activities' own *Args interfaces, which name the API
+// client and therefore sit behind the #1074 dynamic-import boundary this
+// entry point must never reach, even type-only
+// (examples/k8s-client-boundary.test.ts). Import them via the subpath
+// `@intentius/chant-lexicon-k8s/op/builders`, the same way workers import
+// `@intentius/chant-lexicon-k8s/op/activities`.
+// The capability plugin core's loader discovers on this package (#1495 piece 2)
+// — the kubectl-apply leaf a component composes, the way aws contributes
+// cfn-deploy.
+export { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./components/capability-plugin.js";
+export { kubectlApplyCapability, createKubectlApplyCapability } from "./components/kubectl-apply.js";
+export { kustomizeApplyCapability, createKustomizeApplyCapability } from "./components/kustomize-apply.js";
+// Default labels & annotations
+export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels.js";
+export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels.js";
+// Variables / label constants
+export { K8sLabels, K8sAnnotations } from "./variables.js";
+// Effect receipts (#2074, epic #1703): the k8s materialization row, meaning the
+// factory a project declares (core's shape under the k8s lexicon, carrying
+// the marker) and the name/label constants. The ConfigMap-backed store itself
+// lives at the `/receipt-store` subpath, off the build path (#1074).
+export { EffectReceipt, receiptConfigMapName, receiptConfigMapRef, receiptNamespaceFrom, isEffectReceiptObject, K8S_EFFECT_RECEIPT_ENTITY_TYPE, EFFECT_RECEIPTS_COMMENT_MARKER, RECEIPT_NAME_PREFIX, RECEIPT_DATA_KEY, RECEIPT_LABEL_KEY, RECEIPT_DEFAULT_NAMESPACE, RECEIPT_UNRESOLVED_VALUE_NOTE, parseReceiptComment, renderReceiptComment, } from "./effect-receipt-row.js";
+// Generated-once secret marker (#1830) — constants only; the store adapter
+// itself lives at the `/secret-store` subpath, off the build path (#1074).
+export { GENERATED_ONCE_LABEL_KEY, GENERATED_ONCE_LABEL_VALUE, isGeneratedOnce } from "./secret-labels.js";
+// MicroTime helpers — see micro-time.ts for why this exists.
+export { microTime, isMicroTimeFormatted } from "./micro-time.js";
+// Verbatim manifest escape hatch — a kind with no generated class, and what
+// `chant carve emit` writes for a Terraform kubernetes_manifest (#999).
+export { k8sManifest } from "./manifest-entity.js";
+// Plain YAML included as it is, local or pinned URL (#3566). The factory is
+// pure; the bytes are read at buildRoots() (./include/resolve.ts).
+export { k8sInclude, isK8sInclude, INCLUDE_SOURCE_ANNOTATION } from "./include/entity.js";
+// Patches on rendered documents: k8sInclude, kustomize roots, HelmRender (#3566).
+export { renderedPatch, applyRenderedPatches, applyJsonPatch, applyMergePatch } from "./patch/rendered-patch.js";
+// Generated entities — export everything from generated index
+// After running `chant generate`, this re-exports all K8s resource classes
+export * from "./generated/index.js";
+// Composites
+export { WebApp, StatefulApp, CronWorkload, AutoscaledService, WorkerPool, NamespaceEnv, NodeAgent, BatchJob, SecureIngress, ConfiguredApp, SidecarApp, MonitoredService, NetworkIsolatedApp, IrsaServiceAccount, AlbIngress, EbsStorageClass, EfsStorageClass, FluentBitAgent, ExternalDnsAgent, AdotCollector, OtelCollector, OtelCollectorGateway, gatewayExporter, OTEL_COLLECTOR_ANNOTATIONS, OtelOperatorCollector, MetricsServer, WorkloadIdentityServiceAccount, GcePdStorageClass, FilestoreStorageClass, GkeGateway, ConfigConnectorContext, GceIngress, CockroachDbCluster, CockroachDbRegionStack, RayCluster, RayJob, RayService, ArgoAppFor, ArgoAppSetForRegions, registerArgoCluster, FluxGitSource, FluxAppFor, AgicIngress, AzureDiskStorageClass, AzureFileStorageClass, AzureMonitorCollector, AksWorkloadIdentityServiceAccount, GkeFluentBitAgent, GkeOtelCollector, GkeExternalDnsAgent, AksExternalDnsAgent, Model, resolveModelStorageUri, OperatorStack, deriveHostVerbClass, DEFAULT_RESOURCE_RULES, } from "./composites/index.js";
+// RBAC verb constants
+export * from "./actions/index.js";
+// Spec utilities (for tooling)
+export { fetchK8sSchema, fetchSchemas, K8S_SCHEMA_VERSION } from "./spec/fetch.js";
+export { parseK8sSwagger, k8sShortName, k8sServiceName, gvkToTypeName, gvkToApiVersion } from "./spec/parse.js";
+// Code generation pipeline
+export { generate, writeGeneratedFiles } from "./codegen/generate.js";
+export { packageLexicon } from "./codegen/package.js";
+export { parseCRD, parseCRDSpec } from "./crd/parser.js";
+export { loadCRDs, loadMultipleCRDs } from "./crd/loader.js";
+// Project-local CRD classes (`k8s.crds`, `chant generate`): the generated
+// module registers its kinds through this.
+export { registerProjectKinds } from "./project-kinds.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "35c3cfce38095b6ef87685a2b4c2f38401c33ac6473ce5353b5acbe50042d146",
+    "manifest.json": "297c642f88996e02ecc1c6a83cd2421f6d9a9aa71ea68b89b0a78ec9efef65c8",
     "meta.json": "c1831ac15083f5e0e45b29698d7b77f1c01646240fe6de5d6320753188594f69",
     "types/index.d.ts": "5c5340046d090ae9db5553039d923cf92a8b2eb57aa4dc941273ed5bcfb5bc9d",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -15,7 +15,7 @@
     "rules/argo002.ts": "d2f07daabfc7a4624d3d60ea151fd2380d43f1578dd6a17825f6f6e0ebc610ba",
     "rules/argo003.ts": "a61024fbd3db772eface6b2e4fee618a5818f12a1050faea8e358e0fdc992396",
     "rules/argo005.ts": "611ea489e005e3ead925013e636f0d7c6899fd0ce68c59a97541fc6fe4e8d25c",
-    "rules/crd-schema-helpers.ts": "06dd82481653c42a50be546e321d7fcc870ea210c079fc606a114516aaa53432",
+    "rules/crd-schema-helpers.ts": "131783fd70ccb3e829084550f6e66e5af3d436d909803b2ab60b5c06f9f32039",
     "rules/flux002.ts": "4269ce13121bc5b28c02aad06765dc85085a1c9ebcc936ae958663b85de07bc6",
     "rules/flux003.ts": "a174af9941bd2491a9bbf72039ab2fc4d4f4de388b2884ddf7123f05594d9d4e",
     "rules/k8s-helpers.ts": "868cac99b4505a8e060384a716047646da1583568ef6da471a186dc760961212",
@@ -78,5 +78,5 @@
     "skills/chant-k8s-argo.md": "24c9a85b78a2fc5c6657424baac9cc6d6caff6f47605b8146b2c0082133181cf",
     "skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
   },
-  "composite": "79727761d5ff2addfaa2458cd8b7d01850f5669d52cd3f38a4b5cc8ec6b21778"
+  "composite": "067ab31520928c9a103272ab7cac3ae17752fe1bec0c6cee9bf54653005eb187"
 }