@intentius/chant-lexicon-k8s 0.124.31 → 0.124.32

package/dist/serializer.js

@@ -0,0 +1,578 @@
+/**
+ * Kubernetes YAML serializer.
+ *
+ * Converts Chant declarables to multi-document K8s YAML output with
+ * apiVersion, kind, metadata, and spec structure.
+ */
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { mergeResourceAttributes, RELEASE_ATTRIBUTES_VARIABLE, telemetryEnvironment } from "@intentius/chant/telemetry-attribution";
+import { podSpecOf, releaseAttributesEnv } from "./telemetry-release.js";
+import { ownershipEntries, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+import { isEffectReceipt, receiptExpectation, referenceInputPaths, } from "@intentius/chant/effect-receipt";
+import { RECEIPT_CONFIGMAP_REF, RECEIPT_DATA_KEY, RECEIPT_UNRESOLVED_VALUE_NOTE, receiptConfigMapRef, receiptNamespaceFrom, renderReceiptComment, } from "./effect-receipt-row.js";
+import { walkValue } from "@intentius/chant/serializer-walker";
+import { emitYAML } from "@intentius/chant/yaml";
+import { isDefaultLabels, isDefaultAnnotations } from "./default-labels.js";
+import { isRenderedManifestEntity } from "./manifest-entity.js";
+import { projectKindForType } from "./project-kinds.js";
+import { isEncryptedSecretFileEntity } from "./sops/entity.js";
+import { isK8sInclude } from "./include/entity.js";
+import { isRuleGroup, ruleGroupConfig } from "@intentius/chant-lexicon-prometheus";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+/**
+ * K8s resource kinds whose properties live directly on the manifest
+ * (not nested under `spec`). These types use `data`, `stringData`,
+ * or have no spec field at all.
+ */
+const SPECLESS_TYPES = new Set([
+    "ConfigMap",
+    "Secret",
+    "Namespace",
+    "ServiceAccount",
+    "ClusterRole",
+    "ClusterRoleBinding",
+    "Role",
+    "RoleBinding",
+    "StorageClass",
+    "PersistentVolume",
+    "APIService",
+]);
+let cachedGVKMap = null;
+function getGVKMap() {
+    if (cachedGVKMap)
+        return cachedGVKMap;
+    try {
+        cachedGVKMap = require("./generated/lexicon-k8s.json");
+    }
+    catch {
+        cachedGVKMap = {};
+    }
+    return cachedGVKMap;
+}
+/**
+ * Resolve entityType to apiVersion and kind.
+ */
+function resolveGVK(entityType) {
+    // A kind the project generated from its own CRDs (`chant generate`) wins
+    // over the packaged map, which knows nothing of it or an older version.
+    const projectKind = projectKindForType(entityType);
+    if (projectKind)
+        return { apiVersion: projectKind.apiVersion, kind: projectKind.kind };
+    const gvkMap = getGVKMap();
+    // Search for matching entry by resourceType
+    for (const entry of Object.values(gvkMap)) {
+        if (entry.resourceType === entityType && entry.apiVersion && entry.gvkKind) {
+            return { apiVersion: entry.apiVersion, kind: entry.gvkKind };
+        }
+    }
+    // Fallback: derive from entity type string (K8s::Group::Kind → group/v1, Kind)
+    return deriveGVKFromType(entityType);
+}
+/**
+ * Well-known K8s API group → apiVersion mappings for fallback when
+ * the generated lexicon JSON is not available.
+ */
+const API_GROUP_VERSIONS = {
+    Core: "v1",
+    Apps: "apps/v1",
+    Batch: "batch/v1",
+    Networking: "networking.k8s.io/v1",
+    Policy: "policy/v1",
+    Rbac: "rbac.authorization.k8s.io/v1",
+    Storage: "storage.k8s.io/v1",
+    Autoscaling: "autoscaling/v2",
+    Admissionregistration: "admissionregistration.k8s.io/v1",
+    GKE: "cloud.google.com/v1",
+    NetworkingGKE: "networking.gke.io/v1",
+    NetworkingGKEBeta: "networking.gke.io/v1beta1",
+    // Common Kubernetes operator CRDs
+    CertManager: "cert-manager.io/v1",
+    ExternalSecrets: "external-secrets.io/v1",
+    Monitoring: "monitoring.coreos.com/v1",
+    // KubeRay operator CRDs
+    Ray: "ray.io/v1",
+};
+function deriveGVKFromType(entityType) {
+    // Format: K8s::Group::Kind
+    const parts = entityType.split("::");
+    if (parts.length !== 3 || parts[0] !== "K8s")
+        return null;
+    const group = parts[1];
+    const kind = parts[2];
+    const apiVersion = API_GROUP_VERSIONS[group];
+    if (!apiVersion)
+        return null;
+    return { apiVersion, kind };
+}
+/**
+ * The name a resource gets when it does not declare one: the logical name,
+ * kebab-cased. Shared with the manifest builder below so a reference and the
+ * thing it references cannot derive different names (#1493).
+ */
+function derivedName(logicalName) {
+    return logicalName.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+/**
+ * What a cross-resource reference resolves to on this substrate (#1493).
+ *
+ * Kubernetes YAML has no deploy-time reference mechanism — no `!Ref`, no
+ * `Fn::GetAtt`. Whatever a reference is going to mean has to be resolved here,
+ * before serialization, or it means nothing at all.
+ *
+ * This used to return the *logical* name for every attribute, so
+ * `claimName: pgClaim.name` emitted `claimName: pgClaim` and the manifest
+ * named a resource that does not exist. It applied cleanly and failed on the
+ * cluster, which is the failure this whole system exists to remove. The
+ * lexicon's own plugin comment already described the intended behaviour —
+ * "resolves to metadata.name" — so this brings the code to the documentation
+ * rather than the other way round.
+ *
+ * `uid` is refused rather than resolved: a UID is assigned by the API server
+ * at admission, so no build-time value exists and any string emitted here
+ * would be a fabrication.
+ */
+function resolveK8sAttr(entity, logicalName, attr) {
+    if (attr === "uid") {
+        throw new Error(`Cannot reference "${logicalName}.uid": a Kubernetes UID is assigned by the API server at ` +
+            `admission, so it has no build-time value. Reference .name, or carry the UID at runtime ` +
+            `with fieldRef: { fieldPath: "metadata.uid" }.`);
+    }
+    const metadata = entity && isResourceDeclarable(entity) && typeof entity.props === "object" && entity.props !== null
+        ? entity.props.metadata
+        : undefined;
+    if (attr === "name") {
+        // Same fallback the manifest builder applies, so a reference to a resource
+        // that declares no name still resolves to the name it will actually get.
+        const declared = metadata?.name;
+        return typeof declared === "string" && declared.length > 0 ? declared : derivedName(logicalName);
+    }
+    if (attr === "namespace") {
+        const ns = metadata?.namespace;
+        if (typeof ns === "string" && ns.length > 0)
+            return ns;
+        throw new Error(`Cannot reference "${logicalName}.namespace": it declares no metadata.namespace, and the ` +
+            `namespace a manifest lands in is decided at apply time (kubectl -n, or the context's ` +
+            `default). Set metadata.namespace on "${logicalName}" if the reference needs to be stable.`);
+    }
+    throw new Error(`Cannot reference "${logicalName}.${attr}": the k8s lexicon resolves .name and .namespace at ` +
+        `build time, and Kubernetes YAML has no way to express any other attribute reference.`);
+}
+/** The rendered expectation: the synthesis-time value when the receipt is
+ * fully static, the placeholder note when reference inputs remain (#1703
+ * decision 5, since synthesis resolves nothing). */
+function receiptRowValue(receipt) {
+    if (receipt.flavor === "hash" && referenceInputPaths(receipt).length > 0) {
+        return RECEIPT_UNRESOLVED_VALUE_NOTE;
+    }
+    return receiptExpectation(receipt);
+}
+/**
+ * Render the effect receipts (#2074) the build withheld from the apply-bound
+ * entity set (`SerializeContext.receipts`, #1832) as ConfigMap rows: named
+ * `chant-receipt.<stack>.<env>.<effect>` from the ownership marker fields
+ * (epic decision 4), in the project's receipt namespace, with the expectation
+ * under `data.expectation`.
+ *
+ * Visibility only. The rows ride a YAML comment at the end of the manifest
+ * stream (./effect-receipt-row.ts) rather than a document, because a document
+ * is what an applier applies and the `effect()` step is a receipt's sole
+ * writer (#1832, epic #1703 decision 3).
+ *
+ * The env segment is explicit: a receipt with no resolved `ownership.env` is
+ * an error, never a guessed segment.
+ */
+function renderReceiptRows(receipts, ownership, namespace) {
+    const rows = {};
+    const names = [...receipts.keys()].join(", ");
+    if (!ownership?.stack) {
+        throw new Error(`k8s receipts (${names}): no ownership marker resolved. The receipt ConfigMap is named ` +
+            `chant-receipt.<stack>.<env>.<effect>, derived from the same ownership fields that ` +
+            `stamp markers (chant #1703, decision 4). Set ownership: { stack } in chant.config.ts.`);
+    }
+    if (!ownership.env) {
+        throw new Error(`k8s receipts (${names}): ownership resolved no env. The receipt name's <env> segment is ` +
+            `explicit (chant #1703, decision 4). Set ownership: { env } in chant.config.ts, or ` +
+            `build with an env-valued parameter that resolves it.`);
+    }
+    for (const [name, entity] of receipts) {
+        if (!isEffectReceipt(entity))
+            continue;
+        const ref = receiptConfigMapRef(ownership.stack, ownership.env, entity.effect, namespace);
+        rows[name] = {
+            kind: RECEIPT_CONFIGMAP_REF.kind,
+            namespace: ref.namespace,
+            name: ref.name,
+            data: { [RECEIPT_DATA_KEY]: receiptRowValue(entity) },
+        };
+    }
+    return rows;
+}
+/**
+ * K8s visitor for the generic serializer walker.
+ */
+function k8sVisitor(entityNames) {
+    // name → entity, so an AttrRef can reach the resource it points at. The
+    // walker hands the visitor a logical name, not the Declarable.
+    const byName = new Map();
+    for (const [entity, name] of entityNames)
+        byName.set(name, entity);
+    return {
+        attrRef: (name, attr) => resolveK8sAttr(byName.get(name), name, attr),
+        // A prometheus-lexicon RuleGroup (in a PrometheusRule's spec.groups) is
+        // data, not a reference: it renders as the same group the rule file
+        // holds, whether it was exported as its own entity or written inline.
+        resourceRef: (name) => {
+            const entity = byName.get(name);
+            return isRuleGroup(entity) ? ruleGroupConfig(entity) : name;
+        },
+        propertyDeclarable: (entity, walk) => {
+            if (isRuleGroup(entity))
+                return ruleGroupConfig(entity);
+            if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
+                return undefined;
+            }
+            const props = entity.props;
+            const result = {};
+            for (const [key, value] of Object.entries(props)) {
+                if (value !== undefined) {
+                    result[key] = walk(value);
+                }
+            }
+            return Object.keys(result).length > 0 ? result : undefined;
+        },
+    };
+}
+/**
+ * Convert a value to YAML-compatible form using the walker.
+ */
+function toYAMLValue(value, entityNames) {
+    return walkValue(value, entityNames, k8sVisitor(entityNames));
+}
+/**
+ * Kubernetes YAML serializer implementation.
+ */
+// ── Telemetry attribution (#2558, D22, #3059) ──────────────────────
+/** The digest of an image reference pinned with `@sha256:...`, or undefined. */
+function imageDigest(image) {
+    if (typeof image !== "string")
+        return undefined;
+    const at = image.lastIndexOf("@");
+    return at === -1 ? undefined : image.slice(at + 1);
+}
+/**
+ * Stamp `OTEL_SERVICE_NAME` and `OTEL_RESOURCE_ATTRIBUTES` into the `env` of
+ * each container of a workload. `service.name` is the workload's
+ * `metadata.name`, `chant.decl` its declaration id (`decl`), and an image
+ * pinned by digest gives `service.version`. A variable the container already
+ * sets is kept: its own `OTEL_SERVICE_NAME` wins, and its own resource
+ * attributes keep their keys while the missing ones are appended. One set
+ * through `valueFrom` is left alone. Init containers are not stamped.
+ *
+ * `OTEL_RESOURCE_ATTRIBUTES` ends with `$(CHANT_RELEASE_ATTRIBUTES)`, read
+ * from the pod annotation a release deploy sets (#3061, ws-081), so a
+ * release adds `service.version` and `vcs.ref.head.revision` without
+ * changing this output.
+ */
+function stampWorkloadTelemetry(manifest, decl, telemetry) {
+    const podSpec = podSpecOf(manifest);
+    const containers = podSpec?.containers;
+    if (!Array.isArray(containers))
+        return;
+    const service = String(manifest.metadata?.name ?? decl);
+    const releaseRef = `$(${RELEASE_ATTRIBUTES_VARIABLE})`;
+    for (const container of containers) {
+        if (!container || typeof container !== "object")
+            continue;
+        const c = container;
+        const version = imageDigest(c.image);
+        const vars = telemetryEnvironment(telemetry, { service, decl, ...(version ? { version } : {}) });
+        if (c.env !== undefined && !Array.isArray(c.env) && typeof c.env === "object" && c.env !== null) {
+            // A map, as some composites and hand-written props give it before the API's list form. A map
+            // has no order, so it cannot hold the $(VAR) reference to the release attributes.
+            const map = { ...c.env };
+            if (!("OTEL_SERVICE_NAME" in map))
+                map.OTEL_SERVICE_NAME = vars.OTEL_SERVICE_NAME;
+            const own = map.OTEL_RESOURCE_ATTRIBUTES;
+            if (own === undefined)
+                map.OTEL_RESOURCE_ATTRIBUTES = vars.OTEL_RESOURCE_ATTRIBUTES;
+            else if (typeof own === "string")
+                map.OTEL_RESOURCE_ATTRIBUTES = mergeResourceAttributes(own, vars.OTEL_RESOURCE_ATTRIBUTES);
+            c.env = map;
+            continue;
+        }
+        const env = Array.isArray(c.env) ? [...c.env] : [];
+        const at = (key) => env.findIndex((e) => e && typeof e === "object" && e.name === key);
+        if (at("OTEL_SERVICE_NAME") === -1)
+            env.push({ name: "OTEL_SERVICE_NAME", value: vars.OTEL_SERVICE_NAME });
+        let i = at("OTEL_RESOURCE_ATTRIBUTES");
+        if (i === -1) {
+            env.push({ name: "OTEL_RESOURCE_ATTRIBUTES", value: vars.OTEL_RESOURCE_ATTRIBUTES });
+            i = env.length - 1;
+        }
+        else if (typeof env[i].value === "string") {
+            env[i] = { ...env[i], value: mergeResourceAttributes(env[i].value, vars.OTEL_RESOURCE_ATTRIBUTES) };
+        }
+        // The release attributes (#3061, ws-081): a $(VAR) reference expands only to a variable defined
+        // earlier in the list, so the downward-API entry goes just before OTEL_RESOURCE_ATTRIBUTES. A
+        // container that defines the variable itself keeps its own, and gets the reference only when
+        // its definition comes first.
+        if (typeof env[i].value === "string") {
+            if (at(RELEASE_ATTRIBUTES_VARIABLE) === -1) {
+                env.splice(i, 0, releaseAttributesEnv());
+                i++;
+            }
+            const value = env[i].value;
+            if (at(RELEASE_ATTRIBUTES_VARIABLE) < i && !value.includes(releaseRef))
+                env[i] = { ...env[i], value: `${value}${releaseRef}` };
+        }
+        c.env = env;
+    }
+}
+export const k8sSerializer = {
+    name: "k8s",
+    rulePrefix: "WK8",
+    // The Argo CD and Flux checks are distinct product surfaces this lexicon
+    // covers, and their ids are published — renaming them would break every
+    // `chant-disable ARGO001` already written (#1349).
+    extraRulePrefixes: ["ARGO", "FLUX"],
+    serialize(entities, _outputs, context) {
+        // Build reverse map: entity → name
+        const entityNames = new Map();
+        for (const [name, entity] of entities) {
+            entityNames.set(entity, name);
+        }
+        // Collect default labels and annotations. Ownership markers are stamped as
+        // labels, so they seed defaultLabelEntries and flow through the same merge
+        // (explicit resource labels still win).
+        let defaultLabelEntries = context?.ownership
+            ? { ...ownershipEntries(LABEL_OWNERSHIP_KEYS, context.ownership) }
+            : {};
+        let defaultAnnotationEntries = {};
+        for (const [, entity] of entities) {
+            if (isDefaultLabels(entity)) {
+                defaultLabelEntries = { ...defaultLabelEntries, ...entity.labels };
+            }
+            if (isDefaultAnnotations(entity)) {
+                defaultAnnotationEntries = { ...defaultAnnotationEntries, ...entity.annotations };
+            }
+        }
+        const namespaceDocs = [];
+        const otherDocs = [];
+        /** Sidecar files — committed ciphertext, copied byte-for-byte. */
+        const files = {};
+        /** Basenames within `files` that must never be JSON.parse round-tripped (chant#1937). */
+        const verbatimFiles = [];
+        const warnings = [];
+        for (const [name, entity] of entities) {
+            if (isPropertyDeclarable(entity))
+                continue;
+            if (isDefaultLabels(entity) || isDefaultAnnotations(entity))
+                continue;
+            // A `k8sInclude` declaration is resolved into its documents at
+            // `buildRoots()`; the declaration itself emits nothing.
+            if (isK8sInclude(entity))
+                continue;
+            // Committed SOPS ciphertext (epic lex00/iac-cd-bench#6) leaves as a
+            // SIDECAR and never as a document in the primary output. That is the
+            // load-bearing line: chant's appliers read the primary output, so an
+            // undecrypted Secret cannot reach a cluster through them. The bytes are
+            // copied exactly as committed — no re-emit, no label merge, no
+            // ownership stamp — because re-serializing would break the MAC the
+            // `sops` block carries over the plaintext.
+            if (isEncryptedSecretFileEntity(entity)) {
+                const existing = files[entity.filename];
+                if (existing !== undefined && existing !== entity.text) {
+                    warnings.push(`k8s: two committed-encrypted secrets emit the same sidecar filename ` +
+                        `"${entity.filename}" — the second (${entity.sourcePath}) wins`);
+                }
+                files[entity.filename] = entity.text;
+                if (!verbatimFiles.includes(entity.filename))
+                    verbatimFiles.push(entity.filename);
+                continue;
+            }
+            // A kustomize build root's document (#1548 piece 3) is render-final:
+            // the overlay decided every field, so the props ARE the manifest and
+            // the spec-inference heuristics below (built for typed declarables)
+            // must not reshape it — a doc whose top-level fields aren't `spec`
+            // (webhooks, rules on a CRD instance) would otherwise be re-nested.
+            // It still gets the exact default-label/annotation merge every
+            // discovered resource gets, which is what stamps ownership on it.
+            if (isRenderedManifestEntity(entity)) {
+                const manifest = { ...entity.props };
+                const metadata = { ...(manifest.metadata ?? {}) };
+                if (Object.keys(defaultLabelEntries).length > 0) {
+                    metadata.labels = { ...defaultLabelEntries, ...(metadata.labels ?? {}) };
+                }
+                if (Object.keys(defaultAnnotationEntries).length > 0) {
+                    metadata.annotations = {
+                        ...defaultAnnotationEntries,
+                        ...(metadata.annotations ?? {}),
+                    };
+                }
+                manifest.metadata = metadata;
+                const yamlDoc = emitK8sManifest(manifest);
+                if (manifest.kind === "Namespace") {
+                    namespaceDocs.push(yamlDoc);
+                }
+                else {
+                    otherDocs.push(yamlDoc);
+                }
+                continue;
+            }
+            const entityType = entity.entityType;
+            const gvk = resolveGVK(entityType);
+            if (!gvk)
+                continue;
+            const props = toYAMLValue(isResourceDeclarable(entity) ? entity.props : undefined, entityNames);
+            if (!props)
+                continue;
+            // Build the K8s manifest structure
+            const manifest = {
+                apiVersion: gvk.apiVersion,
+                kind: gvk.kind,
+            };
+            // Build metadata
+            const metadata = props.metadata ?? {};
+            if (!metadata.name) {
+                metadata.name = derivedName(name);
+            }
+            // Merge default labels
+            if (Object.keys(defaultLabelEntries).length > 0) {
+                const existingLabels = (metadata.labels ?? {});
+                metadata.labels = { ...defaultLabelEntries, ...existingLabels };
+            }
+            // Merge default annotations
+            if (Object.keys(defaultAnnotationEntries).length > 0) {
+                const existingAnnotations = (metadata.annotations ?? {});
+                metadata.annotations = { ...defaultAnnotationEntries, ...existingAnnotations };
+            }
+            manifest.metadata = metadata;
+            // Properties that always belong at the manifest root, never inside
+            // spec. apiVersion/kind allow consumers to override the gvk-derived
+            // defaults (the "CRD wrapper" trick used to declare arbitrary K8s
+            // resources via a generic Declarable class). rules/subjects/roleRef
+            // are the top-level fields for RBAC kinds. data/stringData are for
+            // ConfigMap/Secret. binaryData covers ConfigMap binary entries.
+            const TOP_LEVEL_PROPS = new Set([
+                "apiVersion",
+                "kind",
+                "rules",
+                "subjects",
+                "roleRef",
+                "data",
+                "stringData",
+                "binaryData",
+                "type",
+                "immutable",
+                "automountServiceAccountToken",
+                "secrets",
+                "imagePullSecrets",
+            ]);
+            // The remaining properties go under spec (or directly on the manifest for certain types)
+            if (SPECLESS_TYPES.has(gvk.kind)) {
+                // These types have their data directly on the manifest (data, stringData, etc.)
+                for (const [key, value] of Object.entries(props)) {
+                    if (key !== "metadata") {
+                        manifest[key] = value;
+                    }
+                }
+            }
+            else if (props.spec !== undefined) {
+                // If spec is already set, use it directly
+                manifest.spec = props.spec;
+                for (const [key, value] of Object.entries(props)) {
+                    if (key !== "metadata" && key !== "spec") {
+                        manifest[key] = value;
+                    }
+                }
+            }
+            else {
+                // Place remaining props under spec — except known top-level fields
+                // (apiVersion/kind for CRD-wrapper overrides; rules/subjects for RBAC).
+                const spec = {};
+                for (const [key, value] of Object.entries(props)) {
+                    if (key === "metadata")
+                        continue;
+                    if (TOP_LEVEL_PROPS.has(key)) {
+                        manifest[key] = value;
+                    }
+                    else {
+                        spec[key] = value;
+                    }
+                }
+                if (Object.keys(spec).length > 0) {
+                    manifest.spec = spec;
+                }
+            }
+            if (context?.telemetry)
+                stampWorkloadTelemetry(manifest, name, context.telemetry);
+            // Emit as YAML — sort Namespaces first so kubectl apply succeeds
+            const yamlDoc = emitK8sManifest(manifest);
+            if (gvk.kind === "Namespace") {
+                namespaceDocs.push(yamlDoc);
+            }
+            else {
+                otherDocs.push(yamlDoc);
+            }
+        }
+        let primary = [...namespaceDocs, ...otherDocs].join("\n---\n");
+        // Effect receipt rows (#2074): visibility only, deliberately NOT a
+        // document: appliers apply documents, and the `effect()` step is a
+        // receipt's sole writer (#1832, epic #1703 decision 3). The comment rides
+        // the same build output the observation leg is handed, which is how it
+        // learns each receipt's ConfigMap address.
+        if (context?.receipts && context.receipts.size > 0) {
+            const rows = renderReceiptRows(context.receipts, context.ownership, receiptNamespaceFrom(context.config));
+            if (Object.keys(rows).length > 0) {
+                primary = primary.length > 0 ? `${primary}\n${renderReceiptComment(rows)}\n` : `${renderReceiptComment(rows)}\n`;
+            }
+        }
+        // A bare string when there is nothing extra to write, so the common case
+        // stays byte-identical to what every existing consumer already reads.
+        if (Object.keys(files).length === 0 && warnings.length === 0)
+            return primary;
+        return {
+            primary,
+            files,
+            // Every verbatim file here is committed ciphertext, so each is also a
+            // secret: a build with no --output refuses rather than echo it (chant#3738).
+            ...(verbatimFiles.length > 0 ? { verbatimFiles, secretFiles: [...verbatimFiles] } : {}),
+            ...(warnings.length > 0 ? { warnings } : {}),
+        };
+    },
+};
+/**
+ * Emit a K8s manifest object as YAML.
+ * Preserves key ordering: apiVersion, kind, metadata, spec, then rest.
+ */
+/**
+ * Emit a key-value pair as YAML. Scalars get ` value` suffix; objects get
+ * block-style indented below the key.
+ */
+function emitKeyValue(key, value) {
+    const yamlStr = emitYAML(value, 1);
+    // If the YAML starts with a newline, it's a block value (object/array)
+    if (yamlStr.startsWith("\n")) {
+        return `${key}:${yamlStr}`;
+    }
+    return `${key}: ${yamlStr}`;
+}
+function emitK8sManifest(manifest) {
+    const orderedKeys = ["apiVersion", "kind", "metadata", "spec"];
+    const lines = [];
+    // Emit ordered keys first
+    for (const key of orderedKeys) {
+        if (manifest[key] !== undefined) {
+            lines.push(emitKeyValue(key, manifest[key]));
+        }
+    }
+    // Emit remaining keys
+    for (const [key, value] of Object.entries(manifest)) {
+        if (!orderedKeys.includes(key) && value !== undefined) {
+            lines.push(emitKeyValue(key, value));
+        }
+    }
+    return lines.join("\n") + "\n";
+}