@intentius/chant-lexicon-k8s 0.29.0 → 0.31.0

package/dist/api/classify.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Typed API failure → the observation tri-state (chant #1089, #1074).
+ *
+ * `classifyKubectlFailure` in core does this by matching English on stderr,
+ * because that was all `kubectl` gave it. The API server has always sent a
+ * `Status` object with a numeric code and a `reason` enum; the typed client
+ * carries it through, so classification here reads fields rather than
+ * searching for substrings. The verdicts are deliberately the same ones the
+ * kubectl path produced — this replaces the evidence, not the contract.
+ *
+ * The one that reads as a surprise, and is not: **a kind the cluster does not
+ * serve is an absence, not a hole.** No instance of an unserved kind can exist
+ * there, and the usual cause is a CRD the very plan being computed has not
+ * applied yet. Calling it NOT-OBSERVED would suppress the create that is
+ * genuinely needed. That is core's existing rule (`classifyKubectlFailure`
+ * treats "the server doesn't have a resource type" as absent) and it survives
+ * the move intact.
+ *
+ * Errors are discriminated by `name`, not `instanceof`. The client is an
+ * optional dependency reached through a dynamic import, so this module must
+ * not carry a static value import of it — and `name` is set explicitly by
+ * every one of its error classes, which also makes the classification survive
+ * a duplicated copy of the package in a consumer's tree.
+ */
+import type { UnobservedReason } from "@intentius/chant/lexicon";
+/** What a failed read actually proved. Mirrors core's `KubectlReadOutcome`. */
+export type K8sReadOutcome = 
+/** The API server answered and the object is not there. Safe to plan a create. */
+{
+    kind: "absent";
+}
+/** The read proved nothing about the object's existence. */
+ | {
+    kind: "unobserved";
+    reason: UnobservedReason;
+    detail: string;
+};
+/** Classify a failure from the typed client into the observation tri-state. */
+export declare function classifyApiFailure(err: unknown): K8sReadOutcome;
+/**
+ * Whether a failure kills the whole observation rather than one entity. A
+ * refused binding, a missing client package and a rejected credential plugin
+ * are all true of every entity, so they propagate and core marks the lot
+ * NOT-OBSERVED with one reason instead of repeating the same failure N times.
+ */
+export declare function isWholeLexiconFailure(err: unknown): boolean;
+/**
+ * A dynamic import of the optional client package that failed to resolve looks
+ * like an ordinary module error. Recognizing it lets `describeResources` report
+ * a missing dependency as a missing dependency rather than as a broken cluster.
+ */
+export declare function isMissingClientPackage(err: unknown): boolean;
+/** The message a missing client package should produce. */
+export declare const MISSING_CLIENT_DETAIL: string;
+//# sourceMappingURL=classify.d.ts.map

package/dist/api/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/api/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,+EAA+E;AAC/E,MAAM,MAAM,cAAc;AACxB,kFAAkF;AAChF;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE;AACpB,4DAA4D;GAC1D;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBrE,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAwC/D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAG3D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAK5D;AAED,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,QAEuE,CAAC"}

package/dist/api/connect.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Getting from a chant environment to a live API client — chant #1074.
+ *
+ * The cluster binding (chant #1100, landed in #1155) is unchanged by the move
+ * off `kubectl`, and deliberately so: `resolveClusterTarget` in core stays the
+ * single resolver, shared with the GCP lexicon's Config Connector observation,
+ * and the refusal it throws on a bound-but-mismatched context still aborts
+ * before any resource is touched. What changes is only *how the ambient
+ * context is read*: the typed client parses the kubeconfig it is about to use
+ * rather than shelling `kubectl config current-context`, so a worker image with
+ * no `kubectl` in it can still check the binding. Same question, same three
+ * outcomes:
+ *
+ * - **Bound and ambient agrees** — the bound context is passed explicitly to
+ *   the client, never left to the ambient default.
+ * - **Bound and ambient disagrees** — `ClusterBindingMismatchError`, thrown
+ *   before the first request. Core turns the throw into NOT-OBSERVED for every
+ *   declared entity (chant #1089), which is what stops a wrong-cluster read
+ *   becoming a confident list of creates.
+ * - **Unbound** — the kubeconfig's own current-context, with the same visible
+ *   warning naming the environment and the missing binding.
+ */
+import { type ResolvedClusterTarget } from "@intentius/chant/kubectl-context";
+import type { K8sClient, K8sClientOptions } from "@intentius/chant-k8s-client";
+/**
+ * Build a client for an environment. Injectable so tests drive the real client
+ * against a fake request layer, and so `describeResources` and the Op
+ * activities share one connection story rather than each inventing one.
+ */
+export type K8sConnector = (options: ConnectOptions) => Promise<ConnectedClient>;
+export interface ConnectOptions {
+    /**
+     * chant environment being observed or applied to. Omitting it skips the
+     * config lookup and the binding check — which is what an Op activity called
+     * with no environment and no explicit context has always done: use whatever
+     * the kubeconfig selects.
+     */
+    environment?: string;
+    /** Directory whose `chant.config.ts` carries `k8s.profiles`. Defaults to cwd. */
+    cwd?: string;
+    /**
+     * An explicit context, for the Op write path whose activity contract has
+     * always taken one. Skips the config lookup and the binding check entirely.
+     */
+    context?: string;
+    /** Extra client options — the request-layer seam, concurrency. */
+    client?: Partial<K8sClientOptions>;
+}
+export interface ConnectedClient {
+    client: K8sClient;
+    target: ResolvedClusterTarget;
+}
+/**
+ * The production connector: read the project's config, resolve the binding,
+ * build a client honoring it.
+ */
+export declare const defaultK8sConnector: K8sConnector;
+//# sourceMappingURL=connect.d.ts.map

package/dist/api/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/api/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAG/E;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,YAwCjC,CAAC"}

package/dist/api/fake-cluster.d.ts

@@ -0,0 +1,55 @@
+/**
+ * A fake cluster to point the k8s lexicon at, for tests (chant #1074).
+ *
+ * It builds a **real** `@intentius/chant-k8s-client` over a literal kubeconfig
+ * with `@kubernetes/client-node`'s HTTP send replaced. So kubeconfig parsing,
+ * context selection, the credential policy, API discovery, path construction
+ * and the auth path all run for real; the only thing that does not happen is
+ * the socket. Nothing reads `~/.kube/config` or `$KUBECONFIG`, and nothing can
+ * reach a cluster the developer happens to have a context for.
+ *
+ * Shipped rather than kept in a test file because the lexicon's own tests, the
+ * cross-lexicon lifecycle suite and a consumer wiring chant into their harness
+ * all need the same thing.
+ */
+import type { K8sObject } from "@intentius/chant-k8s-client";
+import type { FakeRequestLayer, RecordedRequest } from "@intentius/chant-k8s-client/testing";
+import type { ConnectOptions, K8sConnector } from "./connect.js";
+export interface FakeClusterOptions {
+    /**
+     * Objects the cluster holds, keyed by
+     * `<apiVersion>/<Kind>/<namespace|_>/<name>`, e.g.
+     * `apps/v1/Deployment/prod/web`. Build keys with {@link objectKey}.
+     */
+    objects?: Record<string, K8sObject>;
+    /**
+     * Entity types (or `<apiVersion> <Kind>` pairs) this cluster serves. Defaults
+     * to every type in the generated operation surface, which is what makes a
+     * CRD resolvable in a test without registering anything.
+     */
+    serves?: readonly string[];
+    /** Full control: return a response for a request, or undefined to fall through. */
+    respond?: (request: RecordedRequest) => {
+        status?: number;
+        body?: unknown;
+    } | undefined;
+    /** Kubeconfig to hand the client. Defaults to a single-context one. */
+    kubeconfig?: string;
+}
+export interface FakeCluster {
+    connector: K8sConnector;
+    layer: FakeRequestLayer;
+    /** Connect options every call received, for asserting the binding path. */
+    connects: ConnectOptions[];
+}
+/** Key an object the way {@link fakeCluster} indexes them. */
+export declare function objectKey(apiVersion: string, kind: string, name: string, namespace?: string): string;
+/** Build a live object with chant's ownership marker already on it. */
+export declare function ownedObject(apiVersion: string, kind: string, name: string, namespace: string | undefined, extra?: Partial<K8sObject>): K8sObject;
+/**
+ * A cluster that answers discovery for the kinds it serves and holds the
+ * objects it was given. Anything else 404s with a real `Status` body, which is
+ * how a test drives the absent branch of the observation tri-state.
+ */
+export declare function fakeCluster(options?: FakeClusterOptions): FakeCluster;
+//# sourceMappingURL=fake-cluster.d.ts.map

package/dist/api/fake-cluster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-cluster.d.ts","sourceRoot":"","sources":["../../src/api/fake-cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAE7F,OAAO,KAAK,EAAmB,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG/E,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,mFAAmF;IACnF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IACxF,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,YAAY,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpG;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,GAAE,OAAO,CAAC,SAAS,CAAM,GAC7B,SAAS,CAcX;AAwBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CA+FzE"}

package/dist/api/operation-surface.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Reading the generated operation surface — chant #1074.
+ *
+ * The table itself is written by `chant generate` (see
+ * `../codegen/generate-operations.ts`); this is the runtime side, and it is
+ * deliberately the only place in the lexicon that knows how an entity type
+ * becomes an API address.
+ *
+ * Loading mirrors the serializer's handling of `lexicon-k8s.json`: a `require`
+ * behind a try/catch, so a checkout that has not run `chant generate` yet
+ * degrades to derivation rather than failing to import. Nothing here touches
+ * the filesystem at module load (chant #1081) — the first call does, and caches.
+ */
+/** One resource's addressing information, as `chant generate` emits it. */
+export interface K8sOperationDescriptor {
+    /** chant entity type, e.g. `K8s::Apps::Deployment`. */
+    entityType: string;
+    /** `v1`, `apps/v1`, `ray.io/v1` — what goes in a manifest. */
+    apiVersion: string;
+    /** `Deployment`, `RayCluster`. */
+    kind: string;
+    /** Plural path segment the schema documents, e.g. `deployments`. */
+    plural: string;
+    scope: "Namespaced" | "Cluster";
+    /** Verbs the schema documents for the named-object path. */
+    verbs: string[];
+}
+/** The generated file's shape: entity type → descriptor. */
+export type K8sOperationTable = Record<string, K8sOperationDescriptor>;
+/**
+ * Fallback plural for a kind whose schema documented no named-object path.
+ *
+ * Kubernetes' own pluralization for resource names is the lowercased kind with
+ * English plural rules applied — the three cases `kubectl` implements. It only
+ * fires for kinds the OpenAPI paths do not cover, and the live client overrides
+ * it from the cluster's discovery regardless, so it is a placeholder rather
+ * than a second table to maintain.
+ */
+export declare function pluralizeKind(kind: string): string;
+/** The generated table, loaded once. Empty when nothing has been generated. */
+export declare function operationTable(): K8sOperationTable;
+/** Reset the memoized table. Tests only. */
+export declare function resetOperationTableForTests(): void;
+/**
+ * How to address a declared entity type over the API.
+ *
+ * Returns undefined only for a type the generated surface does not carry and
+ * whose `K8s::<Group>::<Kind>` shape yields no known group — which is the one
+ * case where chant genuinely does not know what to ask for. Every generated
+ * resource type, including every CRD baked in at generation time, is in the
+ * table; that is the difference between this and the twenty-entry map it
+ * replaces.
+ */
+export declare function operationFor(entityType: string): K8sOperationDescriptor | undefined;
+/**
+ * Last-resort derivation from the entity type's own shape, for a lexicon
+ * running without generated artifacts. It cannot invent an API group it has
+ * never seen, so an unknown group returns undefined rather than a guess that
+ * would address the wrong thing.
+ */
+export declare function deriveOperation(entityType: string): K8sOperationDescriptor | undefined;
+/** Every entity type the generated surface can address. */
+export declare function addressableEntityTypes(): string[];
+//# sourceMappingURL=operation-surface.d.ts.map

package/dist/api/operation-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-surface.d.ts","sourceRoot":"","sources":["../../src/api/operation-surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,4DAA4D;AAC5D,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKlD;AAqBD,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,iBAAiB,CAQlD;AAED,4CAA4C;AAC5C,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,CAKnF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,CAatF;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD"}

package/dist/codegen/generate-operations.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The generated operation surface — chant #1074.
+ *
+ * `describeResources` used to reach the cluster through a hand-written
+ * `entityType → kubectl resource` map with twenty entries in it. Every one of
+ * the other ~180 generated resource types, and every CRD, fell off the end of
+ * it. The map was hand-maintained precisely because nothing derived it, and
+ * nothing derived it because the codegen pass that produces the types never
+ * emitted the addressing half.
+ *
+ * It does now. This artifact is written by the same `generate()` run that
+ * writes `lexicon-k8s.json` and `index.d.ts`, out of the same parsed results,
+ * so a resource that has a declarable class necessarily has an operation entry
+ * with the same apiVersion and kind. `operation-surface.test.ts` asserts that
+ * correspondence rather than trusting it.
+ *
+ * What it is not: an authority on what a given cluster serves. `plural` and
+ * `scope` are what the schema says; the live client confirms both against the
+ * cluster's own discovery before addressing anything, because a cluster can
+ * serve a different version of a CRD than the one chant generated from.
+ */
+import type { K8sParseResult } from "../spec/parse.js";
+import { type K8sOperationDescriptor, type K8sOperationTable } from "../api/operation-surface.js";
+export type { K8sOperationDescriptor, K8sOperationTable };
+/** Build the operation table from the same parsed results the types come from. */
+export declare function buildOperationTable(results: K8sParseResult[]): K8sOperationTable;
+/** Serialize the table, key-sorted so regeneration produces a stable diff. */
+export declare function generateOperationsJSON(results: K8sParseResult[]): string;
+//# sourceMappingURL=generate-operations.d.ts.map

package/dist/codegen/generate-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-operations.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAiB,KAAK,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE9G,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,CAAC;AAE1D,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,iBAAiB,CAkBhF;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAKxE"}

package/dist/codegen/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EAEpB,MAAM,mCAAmC,CAAC;AAc3C,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmErF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAUjF"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EAEpB,MAAM,mCAAmC,CAAC;AAe3C,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,cAAc,CAAC,CA0ErF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAWjF"}

package/dist/config.d.ts

@@ -58,5 +58,22 @@ export interface K8sClusterProfile {
 export interface K8sChantConfig {
     /** Named environment → cluster bindings, keyed by environment name. */
     profiles?: Record<string, K8sClusterProfile>;
+    /**
+     * Exec credential-plugin commands chant may execute (chant #1074).
+     *
+     * On EKS, AKS and GKE, kubeconfig authentication is a subprocess:
+     * `aws eks get-token`, `kubelogin`, `gke-gcloud-auth-plugin`. Those three
+     * plus `kubectl` are allowed by default. Anything else the kubeconfig names
+     * is refused, because an exec plugin is an arbitrary binary named in a file
+     * chant did not write. Setting this **replaces** the default list.
+     *
+     * ```ts
+     * k8s: {
+     *   profiles: { prod: { context: "prod-eks" } },
+     *   execCredentialPlugins: ["aws", "my-org-oidc-helper"],
+     * } satisfies K8sChantConfig
+     * ```
+     */
+    execCredentialPlugins?: string[];
 }
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC9C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC"}

package/dist/crd/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/crd/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AA4CvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CA4C5D"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/crd/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AA4CvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAoD5D"}

package/dist/crd/types.d.ts

@@ -32,6 +32,13 @@ export interface CRDSource {
 export interface CRDSpec {
     /** API group (e.g. "cert-manager.io") */
     group: string;
+    /**
+     * Whether instances are namespaced. Declared by the CRD itself, so it is the
+     * authoritative source for a custom resource's scope — the equivalent of what
+     * the OpenAPI `paths` say for built-in kinds (chant #1074). Defaults to
+     * `Namespaced`, matching the API server's own default.
+     */
+    scope?: "Namespaced" | "Cluster";
     /** Name variants for the CRD */
     names: {
         kind: string;

package/dist/crd/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/crd/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IACjC,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,sCAAsC;IACtC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,0BAA0B,CAAC;IACjC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACnD,IAAI,EAAE,OAAO,CAAC;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/crd/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IACjC,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACjC,gCAAgC;IAChC,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,sCAAsC;IACtC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,0BAA0B,CAAC;IACjC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACnD,IAAI,EAAE,OAAO,CAAC;CACf"}

package/dist/describe-resources.d.ts

@@ -2,35 +2,49 @@
  * Live introspection of a Kubernetes cluster — implements the
  * LexiconPlugin.describeResources() contract for the k8s lexicon.
  *
- * For each declared K8s entity, runs `kubectl get <kind> <name> [-n <ns>] -o json`
- * and maps the response to a ResourceMetadata entry keyed by the chant entity
- * name (using the props.metadata.name + props.metadata.namespace from #39's
- * entity-prop pass-through).
+ * ## What changed, and why it matters (chant #1074)
  *
- * The observation tri-state (#1089) is what the return value carries. A genuine
- * `NotFound` from the API server is an absence, and only that becomes a `create`
- * downstream. An entity type with no entry in `KUBECTL_RESOURCE` — every CRD —
- * was never looked at, and comes back `unsupported-kind`: it may well be running
- * in the cluster, and proposing to create it would be a guess. Auth failures and
- * unreachable API servers come back `no-credentials` / `no-binding` for the same
- * reason. Extending the KUBECTL_RESOURCE map converts unsupported-kind holes into
- * real reads; until then they are holes chant admits to.
+ * This used to run `kubectl get <kind> <name> -o json` once per declared
+ * entity, serially, resolved through a hardcoded twenty-entry
+ * `KUBECTL_RESOURCE` map. Every CRD and every uncommon type fell off the end
+ * of that map and came back as a hole. Coverage, concurrency and error quality
+ * were all capped by it, and `lifecycle diff --live`, `lifecycle plan` and
+ * behold's overlay inherited the cap.
  *
- * Before touching any resource, the environment is resolved to a cluster
- * identity (chant #1100) via `resolveClusterTarget` — see `./config.ts` for
- * the `k8s.profiles.<env>.context` binding shape. A declared binding is
- * passed explicitly as `--context` on every kubectl call below; an ambient
- * context that disagrees with it aborts the whole describe with a loud
- * error rather than silently reading the wrong cluster. No binding keeps
- * today's behavior (ambient context), with a visible warning.
+ * Now:
+ *
+ * - **Coverage.** An entity type becomes an API address through the generated
+ *   operation surface (`./api/operation-surface.ts`), which the same codegen
+ *   pass that emits the declarable classes writes — 184 types rather than 20,
+ *   CRDs included. The address is then confirmed against the cluster's *own*
+ *   discovery, which is what knows the plural and the scope for the version
+ *   that cluster actually serves.
+ * - **Concurrency.** Reads run through the client's bounded pool. A hundred
+ *   entities are a hundred concurrent HTTP GETs sharing one connection and one
+ *   cached credential, not a hundred serial process spawns.
+ * - **Error quality.** Failures arrive as typed errors carrying the API
+ *   server's own `code` and `reason`, so the tri-state verdict is read off a
+ *   field instead of matched against English on stderr.
+ *
+ * ## What did not change
+ *
+ * The observation tri-state (chant #1089) and the cluster binding (chant
+ * #1100/#1155) are the same contracts they were. A genuine `NotFound` — and a
+ * kind the cluster's discovery does not serve, where no instance can exist —
+ * is an absence, and only an absence becomes a `create`. Everything else is
+ * NOT-OBSERVED with a reason. A declared `k8s.profiles.<env>.context` that
+ * disagrees with the ambient one still refuses before a single resource is
+ * touched, via the same `resolveClusterTarget` the GCP lexicon shares.
  */
 import type { ObservationResult } from "@intentius/chant/lexicon";
+import type { K8sObject } from "@intentius/chant-k8s-client";
+import { type K8sConnector } from "./api/connect.js";
 /**
- * Map chant entity types to `kubectl get` resource names. Add entries here
- * as new types are needed.
+ * Collapse a live object to one status word. Unchanged from the kubectl path
+ * — the shape of the response is the same JSON either way.
  */
-export declare const KUBECTL_RESOURCE: Record<string, string>;
-export declare function describeResources(options: {
+export declare function statusFromObject(obj: K8sObject): string;
+export interface DescribeResourcesOptions {
     environment: string;
     buildOutput: string;
     entityNames: string[];
@@ -39,5 +53,8 @@ export declare function describeResources(options: {
         props: Record<string, unknown>;
     }>;
     owned?: boolean;
-}): Promise<ObservationResult>;
+    /** Directory whose `chant.config.ts` carries the cluster binding. Defaults to cwd. */
+    cwd?: string;
+}
+export declare function describeResources(options: DescribeResourcesOptions, connect?: K8sConnector): Promise<ObservationResult>;
 //# sourceMappingURL=describe-resources.d.ts.map

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAQtG;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAoBnD,CAAC;AAsCF,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyF7B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAGtG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAiBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAUvD;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAmH5B"}

package/dist/export-resources.d.ts

@@ -1,8 +1,34 @@
+/**
+ * Live export for the Kubernetes lexicon — implements
+ * LexiconPlugin.exportResources() so `chant import --from <cluster-env>`
+ * regenerates live objects as chant TypeScript.
+ *
+ * Reads live objects through the typed API client (chant #1074, previously
+ * `kubectl get <kinds> -A -o json`), strips server-managed noise to reach the
+ * declared shape (kept under `verbatim`), and maps to the import IR via the
+ * shared K8sParser. All I/O lives here; the cleaning and IR-building logic is
+ * pure in `./import/live-export`.
+ *
+ * The list below is a *product* decision — what a bare `chant import` should
+ * sweep when the caller names no type — not an addressing limit. It used to be
+ * both, because `KUBECTL_RESOURCE` was simultaneously the sweep set and the
+ * only way the lexicon knew how to address anything (chant #1074 removed the
+ * second job). A `--selector type=<entity type>` import can now name any of the
+ * ~180 types the generated operation surface carries, CRDs included.
+ */
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+import { type K8sConnector } from "./api/connect.js";
+/**
+ * Entity types a bare `chant import --from <cluster>` sweeps: the workload,
+ * config, networking and RBAC kinds people actually author. Everything else is
+ * reachable by naming it with `--selector type=...`.
+ */
+export declare const DEFAULT_IMPORT_TYPES: readonly string[];
 export declare function exportResources(options: {
     environment: string;
     selector?: ResourceSelector;
     owned?: boolean;
     verbatim?: boolean;
-}): Promise<ExportedTemplate>;
+    cwd?: string;
+}, connect?: K8sConnector): Promise<ExportedTemplate>;
 //# sourceMappingURL=export-resources.d.ts.map

package/dist/export-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAUnF,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgC5B"}
+{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAIvE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAoBjD,CAAC;AAEF,wBAAsB,eAAe,CACnC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,EACD,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,gBAAgB,CAAC,CA4B3B"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "bea5120e32340b17c1c92685893306ca70028b56c4a2bf79da7ad99917a99b4f",
+    "manifest.json": "be792b33ca067c06a359ee06d250f08fc9ae3401507ee275c18568cfc5e55483",
     "meta.json": "6d112006daa7196eb28619ac5a3893b709dc2b845edbd537db7d7b471e8dc104",
     "types/index.d.ts": "7b873148146a5512c22baabfde6cfcc3248c24c2c7578f68a19544af5dc675f6",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "52fb1f56f334cf400a0544278a42f1d85d52aa9f49f55b4d845b9844e2e42aa4"
+  "composite": "3620d7f17ce6375203ab8de306d37be7d96b1e5658c883acbf908307d52d2703"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/op/activities/index.d.ts

@@ -11,13 +11,13 @@
  * dependency-light — it shells out to a CLI and does not import the k8s declarable
  * surface — so a Temporal worker loads it cheaply.
  */
-export { kubectlApply } from "./kubectl.js";
+export { kubectlApply, readManifestDocuments } from "./kubectl.js";
 export type { KubectlApplyArgs } from "./kubectl.js";
 export { k3dUp, k3dDown, k3dUpCommand, k3dDownCommand, k3dExistsCommand } from "./k3d.js";
 export type { K3dUpArgs, K3dDownArgs } from "./k3d.js";
 export { waitForArgoSync, defaultArgoStatusFetcher, ArgoSyncFailedError } from "./argo.js";
 export type { WaitForArgoSyncArgs, ArgoAppStatus, ArgoStatusFetcher } from "./argo.js";
-export { waitForReady, defaultResourceFetcher, ReadinessFailedError, readinessFor, isReady, firstTerminal, DEFAULT_READINESS, READINESS_OVERRIDES, } from "./wait-for-ready.js";
+export { waitForReady, defaultResourceFetcher, apiResourceFetcher, ReadinessFailedError, readinessFor, isReady, firstTerminal, DEFAULT_READINESS, READINESS_OVERRIDES, } from "./wait-for-ready.js";
 export type { WaitForReadyArgs, ResourceFetcher, ReadinessSpec, ReadinessMatch, ConditionMatch, PathMatch, } from "./wait-for-ready.js";
 export { resolveClusterTarget, ClusterBindingMismatchError } from "@intentius/chant/kubectl-context";
 export type { ResolvedClusterTarget, K8sClusterProfile, K8sConfigShape } from "@intentius/chant/kubectl-context";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAChE,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/op/activities/kubectl.d.ts

@@ -1,4 +1,28 @@
+/**
+ * `kubectlApply` — apply a rendered manifest to a cluster.
+ *
+ * chant #1074 moved this off `kubectl apply -f`. The activity contract is
+ * unchanged (a manifest path, an optional context, `Promise<void>`, the
+ * `longInfra` profile's 15s heartbeat) because Temporal workers register it by
+ * that signature; what changed is underneath. The name is kept for the same
+ * reason.
+ *
+ * Consequences worth knowing:
+ *
+ * - **A worker image needs no `kubectl` binary.** That was the point.
+ * - **It is a server-side apply**, with `chant` as the field manager, rather
+ *   than the client-side three-way merge `kubectl apply` performs by default.
+ *   Server-side apply is the direction Kubernetes itself has taken, it removes
+ *   the `last-applied-configuration` annotation from the story, and it is what
+ *   chant #1075 builds the field-ownership and conflict surface on. A conflict
+ *   with another field manager arrives here as a typed 409 rather than a line
+ *   of stderr; #1075 is where it gets a proper presentation.
+ * - **Documents apply in file order**, as `kubectl apply -f` does, and a
+ *   directory's files are read in sorted order.
+ */
+import { type K8sConnector } from "../../api/connect.js";
 export interface KubectlApplyArgs {
+    /** Path to a manifest file, or a directory of them. */
     manifest: string;
     /**
      * kubectl context name. Uses the ambient context if omitted. To target the
@@ -7,10 +31,22 @@ export interface KubectlApplyArgs {
      * `./index.ts` and pass `.context` through.
      */
     context?: string;
+    /**
+     * chant environment, used to resolve `k8s.profiles.<env>.context` when no
+     * explicit `context` is given. Optional and additive: omitting both keeps
+     * the previous behavior of using whatever the kubeconfig selects.
+     */
+    environment?: string;
+    /** Field manager recorded on the applied objects. Default `chant`. */
+    fieldManager?: string;
+    /** Take ownership of fields another manager owns instead of failing (chant #1075). */
+    force?: boolean;
 }
+/** Read a manifest path — one file, or every YAML/JSON file in a directory. */
+export declare function readManifestDocuments(path: string): Record<string, unknown>[];
 /**
- * Run `kubectl apply -f <manifest>`.
+ * Apply every document in `args.manifest`.
  * Uses longInfra profile — 20m timeout, heartbeat every 15s.
  */
-export declare function kubectlApply(args: KubectlApplyArgs, signal?: AbortSignal): Promise<void>;
+export declare function kubectlApply(args: KubectlApplyArgs, signal?: AbortSignal, connect?: K8sConnector): Promise<void>;
 //# sourceMappingURL=kubectl.d.ts.map

package/dist/op/activities/kubectl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB9F"}
+{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CA8Bf"}