@intentius/chant-lexicon-k8s 0.124.31 → 0.124.33

package/dist/kube/get.js

@@ -0,0 +1,159 @@
+/**
+ * `chant kube get` (chant #1079) — kubectl's own muscle-memory verb, plus the
+ * chant verdict column the issue's acceptance criterion names.
+ *
+ * The cluster edge is the typed client (chant #1074/#1177), reached the same
+ * way every other read does: `--env` resolves and uses the cluster
+ * binding (chant #1100/#1155, revised by #1488 — the declared context is
+ * used regardless of what is ambient), `--context` is an explicit override,
+ * neither given falls back to the ambient kubeconfig context. A connect failure, an RBAC-denied read, or a kind the cluster's
+ * discovery has never heard of all render as an honest message rather than
+ * an empty table — "No resources found." is reserved for the one case that
+ * actually means it: the kind is real and there are zero live instances.
+ */
+import { formatUnobserved } from "@intentius/chant/observation";
+import { defaultK8sConnector } from "../api/connect.js";
+import { classifyApiFailure, isUnknownResource } from "../api/classify.js";
+import { statusFromObject } from "../describe-resources.js";
+import { kubeConnect } from "./connect.js";
+import { parseKubeFlags, connectOptionsFrom } from "./flags.js";
+import { loadKubeProjectContext } from "./project.js";
+import { resolveKubeTarget, matchLiveObject, isTargetError } from "./target.js";
+import { verdictFor } from "./verdict.js";
+import { parseOutput, renderKubeTable, relativeAge, renderJson, renderYaml, renderName, renderChantSource, renderJsonPath, renderCustomColumns, } from "./render.js";
+function targetLabel(target) {
+    return "apiVersion" in target.selector ? target.selector.kind : target.selector.resource;
+}
+export async function runGet(rawArgs, deps = {}) {
+    const connect = deps.connect ?? defaultK8sConnector;
+    const loadProject = deps.loadProject ?? loadKubeProjectContext;
+    let flags;
+    try {
+        flags = parseKubeFlags(rawArgs);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        return 1;
+    }
+    let output;
+    try {
+        output = parseOutput(flags.values.output);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        return 1;
+    }
+    const project = await loadProject();
+    const target = resolveKubeTarget(flags.positional, flags.values.namespace, project);
+    if (isTargetError(target)) {
+        console.error(`error: ${target.error}`);
+        return 1;
+    }
+    const connected = await kubeConnect(connectOptionsFrom(flags.values), connect);
+    if (connected.kind === "unobserved") {
+        console.error(formatUnobserved(targetLabel(target), unobservedEntity(connected)));
+        return 1;
+    }
+    const { client } = connected;
+    let info;
+    try {
+        info = await client.resolve(target.selector);
+    }
+    catch (err) {
+        const outcome = classifyApiFailure(err);
+        console.error(formatUnobserved(targetLabel(target), {
+            reason: outcome.kind === "unobserved" ? outcome.reason : "read-failed",
+            detail: outcome.kind === "unobserved" ? outcome.detail : String(err),
+        }));
+        return 1;
+    }
+    if (!info) {
+        console.error(`error: the server doesn't have a resource type "${targetLabel(target)}"`);
+        return 1;
+    }
+    const namespace = flags.flags.allNamespaces ? undefined : (target.namespace ?? client.defaultNamespace);
+    const ref = { apiVersion: info.apiVersion, kind: info.kind };
+    let objects;
+    if (target.name) {
+        try {
+            const obj = await client.readIfPresent({ ...ref, name: target.name, ...(namespace ? { namespace } : {}) });
+            if (!obj) {
+                console.error(`Error from server (NotFound): ${info.name} "${target.name}" not found`);
+                return 1;
+            }
+            objects = [obj];
+        }
+        catch (err) {
+            if (isUnknownResource(err)) {
+                console.error(`error: the server doesn't have a resource type "${targetLabel(target)}"`);
+                return 1;
+            }
+            const outcome = classifyApiFailure(err);
+            console.error(formatUnobserved(`${info.kind}/${target.name}`, {
+                reason: outcome.kind === "unobserved" ? outcome.reason : "read-failed",
+                detail: outcome.kind === "unobserved" ? outcome.detail : String(err),
+            }));
+            return 1;
+        }
+    }
+    else {
+        try {
+            objects = await client.list(ref, {
+                ...(namespace ? { namespace } : {}),
+                ...(flags.values.selector ? { labelSelector: flags.values.selector } : {}),
+            });
+        }
+        catch (err) {
+            const outcome = classifyApiFailure(err);
+            console.error(formatUnobserved(info.kind, {
+                reason: outcome.kind === "unobserved" ? outcome.reason : "read-failed",
+                detail: outcome.kind === "unobserved" ? outcome.detail : String(err),
+            }));
+            return 1;
+        }
+    }
+    switch (output.kind) {
+        case "json":
+            console.log(renderJson(objects));
+            return 0;
+        case "yaml":
+            console.log(renderYaml(objects));
+            return 0;
+        case "name":
+            console.log(renderName(objects));
+            return 0;
+        case "chant":
+            console.log(renderChantSource(objects));
+            return 0;
+        case "jsonpath":
+            console.log(renderJsonPath(output.expr, objects));
+            return 0;
+        case "custom-columns":
+            console.log(renderCustomColumns(output.spec, objects));
+            return 0;
+    }
+    const allNamespaces = flags.flags.allNamespaces ?? false;
+    const rows = objects.map((obj) => {
+        const match = matchLiveObject(project, {
+            apiVersion: obj.apiVersion ?? info.apiVersion,
+            kind: obj.kind ?? info.kind,
+            name: obj.metadata?.name ?? "",
+            namespace: obj.metadata?.namespace,
+        });
+        return {
+            namespace: obj.metadata?.namespace,
+            name: obj.metadata?.name ?? "",
+            kind: info.kind,
+            status: statusFromObject(obj),
+            age: relativeAge(obj.metadata?.creationTimestamp),
+            verdict: project ? verdictFor(obj, match) : "unavailable",
+            labels: obj.metadata?.labels,
+            object: obj,
+        };
+    });
+    console.log(renderKubeTable(rows, { allNamespaces, wide: output.kind === "wide", showVerdict: true }));
+    return 0;
+}
+function unobservedEntity(connected) {
+    return { reason: connected.reason, detail: connected.detail };
+}

package/dist/kube/group.js

@@ -0,0 +1,123 @@
+/**
+ * `chant kube` — the terminal surface over the typed client (chant #1079),
+ * mounted through the command-group seam #1078 built and reserved this exact
+ * namespace for (`lexicons/k8s/src/plugin.ts`'s `commands()`).
+ *
+ * Every verb below except `version` dynamically imports its own module. That
+ * is not a style choice: `describe-resources.ts`, `api/connect.ts` and the
+ * rest of the read/write paths sit behind a dynamic import specifically so
+ * `chant build` never has to resolve `@intentius/chant-k8s-client`
+ * (chant #1074, `examples/k8s-client-boundary.test.ts`). This module IS
+ * statically reachable from `plugin.ts` — it is plain data, a list of verb
+ * names and descriptions — so every verb whose implementation touches the
+ * client must be reached from here only through `await import(...)`, exactly
+ * like `version`'s existing `await import("../spec/fetch.js")`.
+ */
+import { splitJoinedFlags, unknownFlagError } from "@intentius/chant/cli/command-group";
+async function versionHandler(ctx) {
+    const args = splitJoinedFlags(ctx.rawArgs);
+    let format = "text";
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--format" || a === "-f") {
+            format = args[++i] === "json" ? "json" : "text";
+        }
+        else if (a.startsWith("-")) {
+            throw unknownFlagError(a, `"chant kube version" only accepts --format <text|json>.`);
+        }
+    }
+    const { K8S_SCHEMA_VERSION } = await import("../spec/fetch.js");
+    if (format === "json") {
+        console.log(JSON.stringify({ schemaVersion: K8S_SCHEMA_VERSION }));
+    }
+    else {
+        console.log(K8S_SCHEMA_VERSION);
+    }
+    return 0;
+}
+/** The full `chant kube` verb group. */
+export function kubeCommandGroup() {
+    return {
+        name: "kube",
+        description: "Terminal surface over the k8s typed client — kubectl-compatible reads plus chant's own verdict, source, and gated writes",
+        commands: [
+            {
+                name: "version",
+                description: "Print the pinned Kubernetes API schema version this lexicon was generated from",
+                handler: versionHandler,
+            },
+            {
+                name: "get",
+                description: "List or read live resources — kubectl's own flags, plus a declared/owned/drifted/foreign-owned column",
+                async handler(ctx) {
+                    const { runGet } = await import("./get.js");
+                    return runGet(ctx.rawArgs);
+                },
+            },
+            {
+                name: "describe",
+                description: "Human-readable detail for one or more resources, including chant's provenance and the object's Events",
+                async handler(ctx) {
+                    const { runDescribe } = await import("./describe.js");
+                    return runDescribe(ctx.rawArgs);
+                },
+            },
+            {
+                name: "logs",
+                description: "A Pod's log (snapshot only — no --follow)",
+                async handler(ctx) {
+                    const { runLogs } = await import("./logs.js");
+                    return runLogs(ctx.rawArgs);
+                },
+            },
+            {
+                name: "events",
+                description: "List Events, oldest first, optionally filtered with --for=Kind/name",
+                async handler(ctx) {
+                    const { runEvents } = await import("./events.js");
+                    return runEvents(ctx.rawArgs);
+                },
+            },
+            {
+                name: "top",
+                description: "Pod/node resource usage from metrics.k8s.io, when the cluster runs metrics-server",
+                async handler(ctx) {
+                    const { runTop } = await import("./top.js");
+                    return runTop(ctx.rawArgs);
+                },
+            },
+            {
+                name: "wait",
+                description: "Block until a resource's readiness spec is met (registry-driven — the same one op/activities/wait-for-ready.ts uses)",
+                async handler(ctx) {
+                    const { runWait } = await import("./wait.js");
+                    return runWait(ctx.rawArgs);
+                },
+            },
+            {
+                name: "source",
+                description: "Resolve a live object back to the .ts file and composite that declared it",
+                async handler(ctx) {
+                    const { runSource } = await import("./source.js");
+                    return runSource(ctx.rawArgs);
+                },
+            },
+            {
+                name: "apply",
+                description: "Server-side apply a manifest (dry-run preview by default — pass --yes to persist); same machinery the Op activity uses",
+                async handler(ctx) {
+                    const { runApply } = await import("./apply.js");
+                    return runApply(ctx.rawArgs);
+                },
+            },
+            {
+                name: "delete",
+                description: "Delete one named resource (never a bare kind sweep; preview by default — pass --yes to delete)",
+                async handler(ctx) {
+                    const { runDelete } = await import("./delete.js");
+                    return runDelete(ctx.rawArgs);
+                },
+            },
+        ],
+    };
+}

package/dist/kube/logs.js

@@ -0,0 +1,82 @@
+/**
+ * `chant kube logs` (chant #1079) — a Pod's `/log` subresource, over the
+ * typed client's new `readLog` (`packages/k8s-client/src/client.ts`). A
+ * snapshot only: `--follow`/`-f` would need the transport seam to expose a
+ * stream rather than a completed response body, which it does not today —
+ * left out deliberately (see `readLog`'s own doc) rather than faked with a
+ * poll loop that isn't actually following anything.
+ */
+import { formatUnobserved } from "@intentius/chant/observation";
+import { defaultK8sConnector } from "../api/connect.js";
+import { classifyApiFailure } from "../api/classify.js";
+import { operationFor } from "../api/operation-surface.js";
+import { kubeConnect } from "./connect.js";
+import { parseKubeFlags, connectOptionsFrom, parseDurationSeconds } from "./flags.js";
+import { loadKubeProjectContext } from "./project.js";
+export async function runLogs(rawArgs, deps = {}) {
+    const connect = deps.connect ?? defaultK8sConnector;
+    const loadProject = deps.loadProject ?? loadKubeProjectContext;
+    let flags;
+    try {
+        flags = parseKubeFlags(rawArgs, {
+            value: { "-c": "container", "--container": "container", "--tail": "tail", "--since": "since" },
+            boolean: { "-p": "previous", "--previous": "previous", "--timestamps": "timestamps" },
+        });
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        return 1;
+    }
+    const podArg = flags.positional[0];
+    if (!podArg) {
+        console.error("error: a pod name (or a declared entity name) is required — e.g. `chant kube logs web-6c8f`");
+        return 1;
+    }
+    const project = await loadProject();
+    let podName = podArg;
+    let namespace = flags.values.namespace;
+    const entity = project?.entities.get(podArg);
+    if (entity && entity.lexicon === "k8s") {
+        const operation = operationFor(entity.entityType);
+        if (operation && operation.kind !== "Pod") {
+            console.error(`error: "${podArg}" declares a ${operation.kind}, not a Pod — chant kube logs only reads Pod logs`);
+            return 1;
+        }
+        if (operation?.kind === "Pod") {
+            const props = "props" in entity ? entity.props : undefined;
+            const metadata = props?.metadata;
+            if (metadata?.name) {
+                podName = metadata.name;
+                namespace = namespace ?? metadata.namespace;
+            }
+        }
+    }
+    const connected = await kubeConnect(connectOptionsFrom(flags.values), connect);
+    if (connected.kind === "unobserved") {
+        console.error(formatUnobserved(`pod/${podName}`, { reason: connected.reason, detail: connected.detail }));
+        return 1;
+    }
+    const { client } = connected;
+    const tailLines = flags.values.tail !== undefined ? Number(flags.values.tail) : undefined;
+    const sinceSeconds = flags.values.since !== undefined ? parseDurationSeconds(flags.values.since) : undefined;
+    try {
+        const text = await client.readLog({ apiVersion: "v1", kind: "Pod", name: podName, namespace: namespace ?? client.defaultNamespace }, {
+            ...(flags.values.container ? { container: flags.values.container } : {}),
+            ...(tailLines !== undefined ? { tailLines } : {}),
+            ...(sinceSeconds !== undefined ? { sinceSeconds } : {}),
+            previous: flags.flags.previous ?? false,
+            timestamps: flags.flags.timestamps ?? false,
+        });
+        process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
+        return 0;
+    }
+    catch (err) {
+        const outcome = classifyApiFailure(err);
+        if (outcome.kind === "absent") {
+            console.error(`Error from server (NotFound): pods "${podName}" not found`);
+            return 1;
+        }
+        console.error(formatUnobserved(`pod/${podName}`, { reason: outcome.reason, detail: outcome.detail }));
+        return 1;
+    }
+}

package/dist/kube/project.js

@@ -0,0 +1,94 @@
+/**
+ * Best-effort chant-project context for `chant kube` (chant #1079).
+ *
+ * `get`'s chant-verdict column and `source` both need to answer "does a
+ * declared entity in this project's source name this live object" — which
+ * needs the project built (chant.config.ts read, source discovered and
+ * resolved). `chant kube` is also usable against a bare cluster with no
+ * chant project in sight (a checkout of someone else's manifests, a
+ * throwaway directory) — the acceptance criterion is that reads still work
+ * there and only the chant-specific parts degrade, quietly, to
+ * "unavailable" rather than erroring. Every failure mode here — no
+ * `chant.config.ts`, a project with build errors, an unreadable directory —
+ * collapses to `undefined` for exactly that reason.
+ *
+ * Deliberately does not import anything client-shaped: this runs before a
+ * cluster is ever reached (`source`/`get` need it to compute a verdict for
+ * objects the client already read), and matching is pure once given a live
+ * object's coordinates.
+ */
+import { resolve, relative, isAbsolute } from "node:path";
+import { build } from "@intentius/chant/build";
+import { loadChantConfig } from "@intentius/chant/config";
+import { getProvenance } from "@intentius/chant/provenance";
+import { k8sSerializer } from "../serializer.js";
+import { operationFor } from "../api/operation-surface.js";
+/**
+ * Build the project rooted at `cwd` (or its configured `sourceDir`) with the
+ * k8s serializer, so `entities` carries resolved props (composites expanded,
+ * AttrRefs resolved) and build provenance (chant #1064's entity-level
+ * `sourceFile`/`composite`, stamped during discovery). Returns undefined —
+ * never throws — for anything that stops the project from resolving: no
+ * `chant.config.ts` here or above, a build with errors, an inaccessible
+ * directory. This IS the "outside a chant project" signal every caller
+ * checks for.
+ */
+export async function loadKubeProjectContext(cwd = process.cwd()) {
+    try {
+        const { config, configPath } = await loadChantConfig(cwd);
+        // `loadChantConfig` does not throw when neither `chant.config.ts` nor
+        // `chant.config.json` exists at `cwd` — it returns the default empty
+        // config instead (`configPath` absent). Building anyway would treat an
+        // arbitrary directory (a bare cluster checkout, chant's own monorepo
+        // root run from the wrong cwd) as a chant project rooted right there —
+        // exactly the "outside a chant project" case this function exists to
+        // detect, not paper over.
+        if (!configPath)
+            return undefined;
+        const root = resolve(cwd, config.sourceDir ?? ".");
+        const result = await build(root, [k8sSerializer]);
+        if (result.errors.length > 0)
+            return undefined;
+        return { cwd, config, entities: result.entities };
+    }
+    catch {
+        return undefined;
+    }
+}
+function propsOf(entity) {
+    return "props" in entity ? entity.props : undefined;
+}
+/**
+ * Reverse-map a live object's coordinates (apiVersion/kind/name/namespace) to
+ * the declared k8s entity that names it, if this project declares one.
+ * `operationFor` is the same generated operation surface `describeResources`
+ * addresses entities with, so a match here is addressed exactly the way the
+ * live read that produced the object was — no separate naming convention.
+ */
+export function findDeclaredMatch(entities, ref) {
+    for (const [entityName, entity] of entities) {
+        if (entity.lexicon !== "k8s")
+            continue;
+        const operation = operationFor(entity.entityType);
+        if (!operation || operation.apiVersion !== ref.apiVersion || operation.kind !== ref.kind)
+            continue;
+        const props = propsOf(entity);
+        const metadata = props?.metadata;
+        if (metadata?.name !== ref.name)
+            continue;
+        if ((metadata?.namespace ?? undefined) !== (ref.namespace ?? undefined))
+            continue;
+        return { entityName, entity, props };
+    }
+    return undefined;
+}
+/** Provenance for a matched entity, relative to the project root when possible. */
+export function relativeProvenance(ctx, entity) {
+    const prov = getProvenance(entity);
+    if (!prov)
+        return undefined;
+    if (!prov.sourceFile || !isAbsolute(prov.sourceFile))
+        return prov;
+    const rel = relative(ctx.cwd, prov.sourceFile);
+    return { ...prov, sourceFile: rel.startsWith("..") ? prov.sourceFile : rel };
+}

package/dist/kube/render.js

@@ -0,0 +1,227 @@
+/**
+ * Output rendering for `chant kube get`/`describe` (chant #1079).
+ *
+ * kubectl's own `-o` vocabulary, minus the one form the issue says to drop
+ * openly rather than half-implement: `-o go-template[-file]` is Go template
+ * syntax, and chant does not carry a Go template engine — {@link parseOutput}
+ * refuses it by name rather than pretending a partial implementation covers
+ * it. `-o jsonpath` and `-o custom-columns` are "tractable" per the issue's
+ * own notes, and are implemented here as a deliberately small subset: dot
+ * paths, bracket indices, and a `[*]` wildcard — the paths kubectl one-liners
+ * actually use — not the full jsonpath grammar (filters, `range`/`end`
+ * templates). `-o chant` is chant's own addition: a live object rendered as
+ * the typed source that would declare it, reusing `./import/live-export.ts`
+ * and the lexicon's own `K8sGenerator` — the same machinery `chant import`
+ * uses, so every read is an adoption path, per the issue's framing.
+ */
+import { dump } from "js-yaml";
+import { buildExportFromObjects } from "../import/live-export.js";
+import { K8sGenerator } from "../import/generator.js";
+/** Parse an `-o`/`--output` value. Throws on `go-template[-file]`. */
+export function parseOutput(value) {
+    if (value === undefined || value === "" || value === "text")
+        return { kind: "text" };
+    if (value === "wide")
+        return { kind: "wide" };
+    if (value === "json")
+        return { kind: "json" };
+    if (value === "yaml")
+        return { kind: "yaml" };
+    if (value === "name")
+        return { kind: "name" };
+    if (value === "chant")
+        return { kind: "chant" };
+    if (value.startsWith("jsonpath="))
+        return { kind: "jsonpath", expr: value.slice("jsonpath=".length) };
+    if (value.startsWith("custom-columns="))
+        return { kind: "custom-columns", spec: value.slice("custom-columns=".length) };
+    if (value === "go-template" || value === "go-template-file" || value.startsWith("go-template")) {
+        throw new Error("-o go-template is not supported — chant kube does not carry a Go template engine, and a partial " +
+            "implementation would be worse than none. Use -o jsonpath=, -o custom-columns=, or -o chant instead.");
+    }
+    throw new Error(`unsupported -o value: ${value}`);
+}
+/** kubectl-style relative age, e.g. "45s", "12m", "3h", "5d". */
+export function relativeAge(creationTimestamp, now = Date.now()) {
+    if (!creationTimestamp)
+        return "<unknown>";
+    const then = Date.parse(creationTimestamp);
+    if (Number.isNaN(then))
+        return "<unknown>";
+    const seconds = Math.max(0, Math.floor((now - then) / 1000));
+    if (seconds < 60)
+        return `${seconds}s`;
+    const minutes = Math.floor(seconds / 60);
+    if (minutes < 60)
+        return `${minutes}m`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 24)
+        return `${hours}h`;
+    const days = Math.floor(hours / 24);
+    if (days < 365)
+        return `${days}d`;
+    return `${Math.floor(days / 365)}y`;
+}
+/** Render a fixed-width table. `columns` is header → per-row value. */
+export function renderTable(headers, rows) {
+    const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length)));
+    const line = (cells) => cells.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd();
+    return [line(headers), ...rows.map(line)].join("\n");
+}
+export function renderKubeTable(rows, opts) {
+    if (rows.length === 0)
+        return "No resources found.";
+    const headers = [];
+    if (opts.allNamespaces)
+        headers.push("NAMESPACE");
+    headers.push("NAME", "STATUS", "AGE");
+    if (opts.showVerdict)
+        headers.push("CHANT");
+    if (opts.wide)
+        headers.push("LABELS");
+    const cells = rows.map((r) => {
+        const row = [];
+        if (opts.allNamespaces)
+            row.push(r.namespace ?? "");
+        row.push(r.name, r.status, r.age ?? "<unknown>");
+        if (opts.showVerdict)
+            row.push(r.verdict ?? "unavailable");
+        if (opts.wide)
+            row.push(labelsText(r.labels));
+        return row;
+    });
+    return renderTable(headers, cells);
+}
+function labelsText(labels) {
+    if (!labels || Object.keys(labels).length === 0)
+        return "<none>";
+    return Object.entries(labels)
+        .map(([k, v]) => `${k}=${v}`)
+        .join(",");
+}
+// ── json / yaml / name ─────────────────────────────────────────────────────
+/** kubectl wraps >1 item in a synthetic List; a single item is printed bare. */
+function asPrintable(objects) {
+    if (objects.length === 1)
+        return objects[0];
+    return { apiVersion: "v1", kind: "List", items: objects, metadata: {} };
+}
+export function renderJson(objects) {
+    return JSON.stringify(asPrintable(objects), null, 2);
+}
+export function renderYaml(objects) {
+    return dump(asPrintable(objects));
+}
+/** `kubectl get -o name`: `<lowercased-kind>.<group>/<name>` (`<lowercased-kind>/<name>` for the core group). */
+export function renderName(objects) {
+    return objects
+        .map((o) => {
+        const [group] = (o.apiVersion ?? "").includes("/") ? [o.apiVersion.split("/")[0]] : [""];
+        const kind = (o.kind ?? "").toLowerCase();
+        const prefix = group ? `${kind}.${group}` : kind;
+        return `${prefix}/${o.metadata?.name ?? ""}`;
+    })
+        .join("\n");
+}
+// ── -o chant ────────────────────────────────────────────────────────────────
+/** Render live objects as the typed chant source that would declare them. */
+export function renderChantSource(objects) {
+    const ir = buildExportFromObjects(objects);
+    const files = new K8sGenerator().generate(ir);
+    return files.map((f) => f.content).join("\n\n");
+}
+function parsePath(path) {
+    // ".a.b[0].c[*]" → segments; a leading "." (or none) both mean "from root".
+    const segments = [];
+    const re = /\.([^.[\]]+)|\[(\*|\d+)\]/g;
+    let match;
+    while ((match = re.exec(path))) {
+        if (match[1] !== undefined)
+            segments.push({ key: match[1] });
+        else if (match[2] === "*")
+            segments.push({ wildcard: true });
+        else
+            segments.push({ index: Number(match[2]) });
+    }
+    return segments;
+}
+function evalPath(root, segments) {
+    let current = [root];
+    for (const seg of segments) {
+        const next = [];
+        for (const value of current) {
+            if (value === null || value === undefined)
+                continue;
+            if ("wildcard" in seg) {
+                if (Array.isArray(value))
+                    next.push(...value);
+                else if (typeof value === "object")
+                    next.push(...Object.values(value));
+                continue;
+            }
+            if ("index" in seg) {
+                if (Array.isArray(value))
+                    next.push(value[seg.index]);
+                continue;
+            }
+            if (typeof value === "object")
+                next.push(value[seg.key]);
+        }
+        current = next;
+    }
+    return current;
+}
+function scalarText(v) {
+    if (v === undefined || v === null)
+        return "";
+    if (typeof v === "string")
+        return v;
+    return JSON.stringify(v);
+}
+/**
+ * Evaluate a kubectl-style jsonpath template against one root value: literal
+ * text passes through, `{"..."}` is a quoted literal, `{.a.b[*].c}` extracts
+ * and space-joins matches. Multiple `{...}` blocks concatenate directly, as
+ * kubectl's own `-o jsonpath` does.
+ */
+export function evalJsonPath(template, root) {
+    let out = "";
+    const re = /\{([^}]*)\}/g;
+    let lastIndex = 0;
+    let match;
+    while ((match = re.exec(template))) {
+        out += template.slice(lastIndex, match.index);
+        const inner = match[1];
+        if (inner.startsWith('"') && inner.endsWith('"')) {
+            out += inner.slice(1, -1);
+        }
+        else {
+            const segments = parsePath(inner);
+            out += evalPath(root, segments).map(scalarText).join(" ");
+        }
+        lastIndex = match.index + match[0].length;
+    }
+    out += template.slice(lastIndex);
+    return out;
+}
+/** `-o jsonpath=`: kubectl runs the whole template once per top-level object printed. */
+export function renderJsonPath(expr, objects) {
+    const root = asPrintable(objects);
+    return evalJsonPath(expr, root);
+}
+function parseCustomColumns(spec) {
+    return spec.split(",").map((entry) => {
+        const colon = entry.indexOf(":");
+        if (colon === -1)
+            throw new Error(`custom-columns entry "${entry}" is missing ":" — expected HEADER:.json.path`);
+        const header = entry.slice(0, colon);
+        const path = entry.slice(colon + 1);
+        return { header, path: parsePath(path.startsWith(".") ? path : `.${path}`) };
+    });
+}
+export function renderCustomColumns(spec, objects) {
+    const columns = parseCustomColumns(spec);
+    const headers = columns.map((c) => c.header);
+    const rows = objects.map((o) => columns.map((c) => evalPath(o, c.path).map(scalarText).join(",") || "<none>"));
+    return renderTable(headers, rows);
+}