@intentius/chant-lexicon-k8s 0.30.0 → 0.31.0

package/src/describe-resources.ts

@@ -2,79 +2,53 @@
  * Live introspection of a Kubernetes cluster — implements the
  * LexiconPlugin.describeResources() contract for the k8s lexicon.
  *
- * For each declared K8s entity, runs `kubectl get <kind> <name> [-n <ns>] -o json`
- * and maps the response to a ResourceMetadata entry keyed by the chant entity
- * name (using the props.metadata.name + props.metadata.namespace from #39's
- * entity-prop pass-through).
+ * ## What changed, and why it matters (chant #1074)
  *
- * The observation tri-state (#1089) is what the return value carries. A genuine
- * `NotFound` from the API server is an absence, and only that becomes a `create`
- * downstream. An entity type with no entry in `KUBECTL_RESOURCE` — every CRD —
- * was never looked at, and comes back `unsupported-kind`: it may well be running
- * in the cluster, and proposing to create it would be a guess. Auth failures and
- * unreachable API servers come back `no-credentials` / `no-binding` for the same
- * reason. Extending the KUBECTL_RESOURCE map converts unsupported-kind holes into
- * real reads; until then they are holes chant admits to.
+ * This used to run `kubectl get <kind> <name> -o json` once per declared
+ * entity, serially, resolved through a hardcoded twenty-entry
+ * `KUBECTL_RESOURCE` map. Every CRD and every uncommon type fell off the end
+ * of that map and came back as a hole. Coverage, concurrency and error quality
+ * were all capped by it, and `lifecycle diff --live`, `lifecycle plan` and
+ * behold's overlay inherited the cap.
  *
- * Before touching any resource, the environment is resolved to a cluster
- * identity (chant #1100) via `resolveClusterTarget` — see `./config.ts` for
- * the `k8s.profiles.<env>.context` binding shape. A declared binding is
- * passed explicitly as `--context` on every kubectl call below; an ambient
- * context that disagrees with it aborts the whole describe with a loud
- * error rather than silently reading the wrong cluster. No binding keeps
- * today's behavior (ambient context), with a visible warning.
+ * Now:
+ *
+ * - **Coverage.** An entity type becomes an API address through the generated
+ *   operation surface (`./api/operation-surface.ts`), which the same codegen
+ *   pass that emits the declarable classes writes — 184 types rather than 20,
+ *   CRDs included. The address is then confirmed against the cluster's *own*
+ *   discovery, which is what knows the plural and the scope for the version
+ *   that cluster actually serves.
+ * - **Concurrency.** Reads run through the client's bounded pool. A hundred
+ *   entities are a hundred concurrent HTTP GETs sharing one connection and one
+ *   cached credential, not a hundred serial process spawns.
+ * - **Error quality.** Failures arrive as typed errors carrying the API
+ *   server's own `code` and `reason`, so the tri-state verdict is read off a
+ *   field instead of matched against English on stderr.
+ *
+ * ## What did not change
+ *
+ * The observation tri-state (chant #1089) and the cluster binding (chant
+ * #1100/#1155) are the same contracts they were. A genuine `NotFound` — and a
+ * kind the cluster's discovery does not serve, where no instance can exist —
+ * is an absence, and only an absence becomes a `create`. Everything else is
+ * NOT-OBSERVED with a reason. A declared `k8s.profiles.<env>.context` that
+ * disagrees with the ambient one still refuses before a single resource is
+ * touched, via the same `resolveClusterTarget` the GCP lexicon shares.
  */
 
-import { exec } from "node:child_process";
-import { promisify } from "node:util";
 import type { ObservationResult, ResourceMetadata, UnobservedEntity } from "@intentius/chant/lexicon";
-import { observation } from "@intentius/chant/observation";
+import { observation, unobservedAll } from "@intentius/chant/observation";
 import { hasOwnershipMarker, classifyOwnership, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
-import { loadChantConfig } from "@intentius/chant/config";
-import { resolveClusterTarget, classifyKubectlFailure } from "@intentius/chant/kubectl-context";
-
-const execAsync = promisify(exec);
-
-/**
- * Map chant entity types to `kubectl get` resource names. Add entries here
- * as new types are needed.
- */
-export const KUBECTL_RESOURCE: Record<string, string> = {
-  "K8s::Apps::Deployment": "deployment.apps",
-  "K8s::Apps::StatefulSet": "statefulset.apps",
-  "K8s::Apps::DaemonSet": "daemonset.apps",
-  "K8s::Apps::ReplicaSet": "replicaset.apps",
-  "K8s::Core::Service": "service",
-  "K8s::Core::ConfigMap": "configmap",
-  "K8s::Core::Secret": "secret",
-  "K8s::Core::Namespace": "namespace",
-  "K8s::Core::Pod": "pod",
-  "K8s::Core::PersistentVolumeClaim": "persistentvolumeclaim",
-  "K8s::Core::ServiceAccount": "serviceaccount",
-  "K8s::Batch::Job": "job.batch",
-  "K8s::Batch::CronJob": "cronjob.batch",
-  "K8s::Networking::Ingress": "ingress.networking.k8s.io",
-  "K8s::Networking::NetworkPolicy": "networkpolicy.networking.k8s.io",
-  "K8s::Rbac::Role": "role.rbac.authorization.k8s.io",
-  "K8s::Rbac::RoleBinding": "rolebinding.rbac.authorization.k8s.io",
-  "K8s::Rbac::ClusterRole": "clusterrole.rbac.authorization.k8s.io",
-  "K8s::Rbac::ClusterRoleBinding": "clusterrolebinding.rbac.authorization.k8s.io",
-};
-
-interface KubectlResponse {
-  metadata?: {
-    name?: string;
-    namespace?: string;
-    uid?: string;
-    creationTimestamp?: string;
-    labels?: Record<string, string>;
-    resourceVersion?: string;
-  };
-  status?: {
-    phase?: string;
-    [k: string]: unknown;
-  };
-}
+import type { K8sObject } from "@intentius/chant-k8s-client";
+import { defaultK8sConnector, type K8sConnector } from "./api/connect";
+import {
+  classifyApiFailure,
+  isMissingClientPackage,
+  isWholeLexiconFailure,
+  MISSING_CLIENT_DETAIL,
+} from "./api/classify";
+import { operationFor } from "./api/operation-surface";
 
 function pruneUndefined<T extends Record<string, unknown>>(obj: T): Record<string, unknown> {
   const out: Record<string, unknown> = {};
@@ -84,51 +58,98 @@ function pruneUndefined<T extends Record<string, unknown>>(obj: T): Record<strin
   return out;
 }
 
-function statusFromKubectl(obj: KubectlResponse): string {
-  // Different K8s resource types report status differently. Fall back to
-  // "PRESENT" if we can't extract a meaningful field.
-  const phase = obj.status?.phase;
+/**
+ * Collapse a live object to one status word. Unchanged from the kubectl path
+ * — the shape of the response is the same JSON either way.
+ */
+export function statusFromObject(obj: K8sObject): string {
+  const status = obj.status;
+  const phase = status?.phase;
   if (typeof phase === "string") return phase;
-  // Deployment/StatefulSet — readyReplicas == replicas → READY
-  const status = obj.status as Record<string, unknown> | undefined;
   if (status && typeof status.readyReplicas === "number" && typeof status.replicas === "number") {
-    return status.readyReplicas === status.replicas ? "READY" : `PROGRESSING(${status.readyReplicas}/${status.replicas})`;
+    return status.readyReplicas === status.replicas
+      ? "READY"
+      : `PROGRESSING(${status.readyReplicas}/${status.replicas})`;
   }
   return "PRESENT";
 }
 
-export async function describeResources(options: {
+interface Declared {
+  entityName: string;
+  entityType: string;
+  props: Record<string, unknown>;
+}
+
+export interface DescribeResourcesOptions {
   environment: string;
   buildOutput: string;
   entityNames: string[];
   entities: Map<string, { entityType: string; props: Record<string, unknown> }>;
   owned?: boolean;
-}): Promise<ObservationResult> {
-  const result: Record<string, ResourceMetadata> = {};
+  /** Directory whose `chant.config.ts` carries the cluster binding. Defaults to cwd. */
+  cwd?: string;
+}
+
+export async function describeResources(
+  options: DescribeResourcesOptions,
+  connect: K8sConnector = defaultK8sConnector,
+): Promise<ObservationResult> {
+  const resources: Record<string, ResourceMetadata> = {};
   const unobserved: Record<string, UnobservedEntity> = {};
-  const skippedTypes = new Set<string>();
 
-  // Resolve the cluster identity for this environment before touching any
-  // resource — a declared-but-mismatched binding throws here, aborting the
-  // whole describe rather than letting a per-entity try/catch below absorb
-  // it as an ordinary "not found".
-  const { config } = await loadChantConfig(process.cwd());
-  const target = await resolveClusterTarget(config as Record<string, unknown>, options.environment, "k8s");
-  const ctxArg = target.context ? ["--context", target.context] : [];
+  const declared: Declared[] = [...options.entities].map(([entityName, entity]) => ({
+    entityName,
+    entityType: entity.entityType,
+    props: entity.props,
+  }));
+
+  // Connect first. The binding check lives here, so a bound-but-mismatched
+  // context throws before any resource is read — core turns that into
+  // NOT-OBSERVED for every declared entity rather than an empty result.
+  let client;
+  try {
+    ({ client } = await connect({ environment: options.environment, cwd: options.cwd }));
+  } catch (err) {
+    if (isMissingClientPackage(err)) {
+      return observation(
+        {},
+        unobservedAll(
+          declared.map((d) => d.entityName),
+          "read-failed",
+          MISSING_CLIENT_DETAIL,
+          options.entities,
+        ),
+      );
+    }
+    if (isWholeLexiconFailure(err)) {
+      const outcome = classifyApiFailure(err);
+      return observation(
+        {},
+        unobservedAll(
+          declared.map((d) => d.entityName),
+          outcome.kind === "unobserved" ? outcome.reason : "read-failed",
+          outcome.kind === "unobserved" ? outcome.detail : undefined,
+          options.entities,
+        ),
+      );
+    }
+    // A cluster-binding mismatch (chant #1100) belongs here: it is a loud
+    // refusal, and core's whole-lexicon handling is what turns it into an
+    // honest hole per entity.
+    throw err;
+  }
 
-  for (const [entityName, { entityType, props }] of options.entities) {
-    const kubectlResource = KUBECTL_RESOURCE[entityType];
-    if (!kubectlResource) {
-      // No reader for this kind (every CRD). The object may exist; chant has no
-      // way to ask. Reporting it as unobserved is what stops `lifecycle plan`
-      // proposing to create a CRD that is already in the cluster (#1089).
-      skippedTypes.add(entityType);
+  await client.concurrently(declared, async ({ entityName, entityType, props }) => {
+    const operation = operationFor(entityType);
+    if (!operation) {
+      // chant knows no API address for this type at all — not even its group.
+      // The object may well exist, so this is a hole, never an absence.
       unobserved[entityName] = {
         type: entityType,
         reason: "unsupported-kind",
-        detail: `no kubectl mapping for ${entityType} — extend KUBECTL_RESOURCE to observe it`,
+        detail: `no generated operation surface for ${entityType} — run \`chant generate\` in the k8s lexicon, or declare the CRD as a codegen source`,
       };
-      continue;
+      return;
     }
 
     const metadata = props.metadata as { name?: string; namespace?: string } | undefined;
@@ -140,18 +161,20 @@ export async function describeResources(options: {
         reason: "read-failed",
         detail: "declared entity has no metadata.name to query by",
       };
-      continue;
+      return;
     }
 
-    const nsArg = metadata.namespace ? ["-n", metadata.namespace] : [];
-    const cmd = ["kubectl", "get", kubectlResource, name, ...nsArg, ...ctxArg, "-o", "json"].join(" ");
-
     try {
-      const { stdout } = await execAsync(cmd);
-      const obj: KubectlResponse = JSON.parse(stdout);
+      const obj = await client.read({
+        apiVersion: operation.apiVersion,
+        kind: operation.kind,
+        name,
+        ...(metadata?.namespace ? { namespace: metadata.namespace } : {}),
+      });
+
       // owned filter: withhold resources not carrying chant's marker label.
-      // Withheld is not absent (#1089) — this object exists, it just isn't
-      // chant's, and dropping it silently is how `--owned` used to turn a
+      // Withheld is not absent (chant #1089) — this object exists, it just
+      // isn't chant's, and dropping it silently is how `--owned` used to turn a
       // declared-but-foreign resource into a proposed `create`.
       if (options.owned && !hasOwnershipMarker(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS)) {
         unobserved[entityName] = {
@@ -159,12 +182,13 @@ export async function describeResources(options: {
           reason: "filtered",
           detail: "live object carries no chant ownership marker and --owned was requested",
         };
-        continue;
+        return;
       }
-      result[entityName] = {
+
+      resources[entityName] = {
         type: entityType,
         physicalId: obj.metadata?.uid,
-        status: statusFromKubectl(obj),
+        status: statusFromObject(obj),
         lastUpdated: obj.metadata?.creationTimestamp,
         ownership: classifyOwnership(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS),
         attributes: pruneUndefined({
@@ -174,22 +198,14 @@ export async function describeResources(options: {
         }),
       };
     } catch (err) {
-      // Only a real NotFound leaves the entity out (an absence the diff may
-      // read as missing and the plan as create). Auth, connectivity, and every
-      // other failure prove nothing about existence and are reported as such.
-      const outcome = classifyKubectlFailure(err);
+      const outcome = classifyApiFailure(err);
       if (outcome.kind === "unobserved") {
         unobserved[entityName] = { type: entityType, reason: outcome.reason, detail: outcome.detail };
       }
+      // `absent` deliberately records nothing: in neither map is how the
+      // contract spells "asked, and it is not there".
     }
-  }
-
-  if (skippedTypes.size > 0) {
-    // eslint-disable-next-line no-console
-    console.warn(
-      `[k8s] no kubectl mapping for ${skippedTypes.size} entity type(s): ${[...skippedTypes].join(", ")} — reported as unobserved (not absent), so no create is proposed for them`,
-    );
-  }
+  });
 
-  return observation(result, unobserved);
+  return observation(resources, unobserved);
 }

package/src/export-resources-io.test.ts

@@ -1,27 +1,17 @@
-import { describe, test, expect, vi, beforeEach } from "vitest";
-
-// Synchronous delivery (value, or Error for skipped kinds) avoids dangling
-// unhandled rejections when a kind is missing / RBAC-denied.
-const execMock = vi.fn();
-vi.mock("node:child_process", async () => {
-  const actual = await vi.importActual<typeof import("node:child_process")>("node:child_process");
-  return {
-    ...actual,
-    exec: (
-      cmd: string,
-      cb: (err: Error | null, out: { stdout: string; stderr: string }) => void,
-    ) => {
-      const r = execMock(cmd);
-      queueMicrotask(() =>
-        r instanceof Error
-          ? cb(r, { stdout: "", stderr: "" })
-          : cb(null, r as { stdout: string; stderr: string }),
-      );
-    },
-  };
-});
-
-const { exportResources } = await import("./export-resources");
+/**
+ * `exportResources` I/O glue (#160), over the typed API client (chant #1074).
+ *
+ * `KUBECTL_RESOURCE` used to be two things at once: the set of kinds a bare
+ * `chant import` sweeps, and the only way the lexicon knew how to address
+ * anything. #1074 removed the second job — addressing now comes from the
+ * generated operation surface plus the cluster's discovery — so what is left
+ * here is the product decision about what a default import covers, and a
+ * `--selector type=` import can now name any generated type, CRDs included.
+ */
+import { describe, test, expect } from "vitest";
+import { exportResources, DEFAULT_IMPORT_TYPES } from "./export-resources";
+import { fakeCluster, objectKey } from "./api/fake-cluster";
+import { statusBody } from "@intentius/chant-k8s-client/testing";
 
 const liveDeployment = {
   apiVersion: "apps/v1",
@@ -30,43 +20,78 @@ const liveDeployment = {
   spec: { replicas: 3, selector: { matchLabels: { app: "web" } } },
 };
 
-const emptyList = { stdout: JSON.stringify({ items: [] }), stderr: "" };
+const liveRayCluster = {
+  apiVersion: "ray.io/v1",
+  kind: "RayCluster",
+  metadata: { name: "ml", namespace: "ray", uid: "r-1" },
+  spec: { rayVersion: "2.9.0" },
+};
 
 describe("k8s exportResources I/O glue (#160)", () => {
-  beforeEach(() => execMock.mockReset());
+  test("sweeps the default types by LIST and maps to IR", async () => {
+    const cluster = fakeCluster({
+      objects: { [objectKey("apps/v1", "Deployment", "web", "default")]: liveDeployment },
+    });
+
+    const ir = await exportResources({ environment: "prod" }, cluster.connector);
 
-  test("sweeps known kinds via `kubectl get <kind> -A -o json` and maps to IR", async () => {
-    execMock.mockImplementation((cmd?: string) =>
-      cmd?.includes("get deployment.apps")
-        ? { stdout: JSON.stringify({ items: [liveDeployment] }), stderr: "" }
-        : emptyList,
-    );
-    const ir = await exportResources({ environment: "prod" });
-    const cmds = execMock.mock.calls.map((c) => c[0] as string).filter(Boolean);
-    expect(cmds.every((c) => c.startsWith("kubectl get ") && c.endsWith("-A -o json"))).toBe(true);
-    expect(cmds).toContain("kubectl get deployment.apps -A -o json");
     expect(ir.resources.map((r) => r.type)).toContain("K8s::Apps::Deployment");
+    // Cluster-wide collection paths, which is what `kubectl get -A` was doing.
+    expect(cluster.layer.paths()).toContain("/apis/apps/v1/deployments");
+    expect(cluster.layer.paths()).toContain("/api/v1/services");
+    expect(cluster.layer.paths().some((p) => p.includes("/namespaces/"))).toBe(false);
   });
 
   test("a kind that errors is skipped; the rest of the sweep still maps", async () => {
-    execMock.mockImplementation((cmd?: string) => {
-      if (cmd?.includes("get secret ")) return new Error("Error from server (Forbidden)");
-      if (cmd?.includes("get deployment.apps")) {
-        return { stdout: JSON.stringify({ items: [liveDeployment] }), stderr: "" };
-      }
-      return emptyList;
+    const cluster = fakeCluster({
+      objects: { [objectKey("apps/v1", "Deployment", "web", "default")]: liveDeployment },
+      respond: (req) =>
+        req.path === "/api/v1/secrets" ? { status: 403, body: statusBody(403, "Forbidden", "rbac") } : undefined,
     });
-    const ir = await exportResources({ environment: "prod" });
+
+    const ir = await exportResources({ environment: "prod" }, cluster.connector);
     expect(ir.resources.map((r) => r.type)).toContain("K8s::Apps::Deployment");
   });
 
-  test("a type selector narrows the sweep to a single kubectl get", async () => {
-    execMock.mockImplementation(() => ({
-      stdout: JSON.stringify({ items: [liveDeployment] }),
-      stderr: "",
-    }));
-    await exportResources({ environment: "prod", selector: { type: "K8s::Apps::Deployment" } });
-    expect(execMock.mock.calls.length).toBe(1);
-    expect(execMock.mock.calls[0][0]).toBe("kubectl get deployment.apps -A -o json");
+  test("a type selector narrows the sweep to one kind", async () => {
+    const cluster = fakeCluster({
+      objects: { [objectKey("apps/v1", "Deployment", "web", "default")]: liveDeployment },
+    });
+
+    await exportResources({ environment: "prod", selector: { type: "K8s::Apps::Deployment" } }, cluster.connector);
+
+    // One discovery request plus one collection read, and nothing else.
+    expect(cluster.layer.paths()).toEqual(["/apis/apps/v1", "/apis/apps/v1/deployments"]);
+  });
+
+  test("a CRD can now be imported by name — it never could through the twenty-entry map", async () => {
+    const cluster = fakeCluster({
+      objects: { [objectKey("ray.io/v1", "RayCluster", "ml", "ray")]: liveRayCluster },
+    });
+
+    await exportResources({ environment: "prod", selector: { type: "K8s::Ray::RayCluster" } }, cluster.connector);
+    expect(cluster.layer.paths()).toContain("/apis/ray.io/v1/rayclusters");
+  });
+
+  test("an unknown selector type sweeps nothing rather than everything", async () => {
+    const cluster = fakeCluster();
+    const ir = await exportResources(
+      { environment: "prod", selector: { type: "K8s::NotAGroupChantKnows::Thing" } },
+      cluster.connector,
+    );
+    expect(ir.resources).toEqual([]);
+    expect(cluster.layer.requests).toHaveLength(0);
+  });
+
+  test("the default sweep still covers the workload, config, networking and RBAC kinds", () => {
+    for (const type of [
+      "K8s::Apps::Deployment",
+      "K8s::Core::Service",
+      "K8s::Core::ConfigMap",
+      "K8s::Networking::Ingress",
+      "K8s::Rbac::ClusterRole",
+    ]) {
+      expect(DEFAULT_IMPORT_TYPES).toContain(type);
+    }
   });
 });

package/src/export-resources.ts

@@ -3,56 +3,84 @@
  * LexiconPlugin.exportResources() so `chant import --from <cluster-env>`
  * regenerates live objects as chant TypeScript.
  *
- * Reads live objects with `kubectl get <kinds> -A -o json`, strips
- * server-managed noise to reach the declared shape (kept under `verbatim`),
- * and maps to the import IR via the shared K8sParser. All I/O lives here; the
- * cleaning and IR-building logic is pure in `./import/live-export`.
+ * Reads live objects through the typed API client (chant #1074, previously
+ * `kubectl get <kinds> -A -o json`), strips server-managed noise to reach the
+ * declared shape (kept under `verbatim`), and maps to the import IR via the
+ * shared K8sParser. All I/O lives here; the cleaning and IR-building logic is
+ * pure in `./import/live-export`.
+ *
+ * The list below is a *product* decision — what a bare `chant import` should
+ * sweep when the caller names no type — not an addressing limit. It used to be
+ * both, because `KUBECTL_RESOURCE` was simultaneously the sweep set and the
+ * only way the lexicon knew how to address anything (chant #1074 removed the
+ * second job). A `--selector type=<entity type>` import can now name any of the
+ * ~180 types the generated operation surface carries, CRDs included.
  */
-import { exec } from "node:child_process";
-import { promisify } from "node:util";
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
-import { KUBECTL_RESOURCE } from "./describe-resources";
+import { defaultK8sConnector, type K8sConnector } from "./api/connect";
+import { operationFor } from "./api/operation-surface";
 import { buildExportFromObjects } from "./import/live-export";
 
-const execAsync = promisify(exec);
-
-interface KubectlList {
-  items?: unknown[];
-}
+/**
+ * Entity types a bare `chant import --from <cluster>` sweeps: the workload,
+ * config, networking and RBAC kinds people actually author. Everything else is
+ * reachable by naming it with `--selector type=...`.
+ */
+export const DEFAULT_IMPORT_TYPES: readonly string[] = [
+  "K8s::Apps::Deployment",
+  "K8s::Apps::StatefulSet",
+  "K8s::Apps::DaemonSet",
+  "K8s::Apps::ReplicaSet",
+  "K8s::Core::Service",
+  "K8s::Core::ConfigMap",
+  "K8s::Core::Secret",
+  "K8s::Core::Namespace",
+  "K8s::Core::Pod",
+  "K8s::Core::PersistentVolumeClaim",
+  "K8s::Core::ServiceAccount",
+  "K8s::Batch::Job",
+  "K8s::Batch::CronJob",
+  "K8s::Networking::Ingress",
+  "K8s::Networking::NetworkPolicy",
+  "K8s::Rbac::Role",
+  "K8s::Rbac::RoleBinding",
+  "K8s::Rbac::ClusterRole",
+  "K8s::Rbac::ClusterRoleBinding",
+];
 
-export async function exportResources(options: {
-  environment: string;
-  selector?: ResourceSelector;
-  owned?: boolean;
-  verbatim?: boolean;
-}): Promise<ExportedTemplate> {
-  // Resolve which kinds to query. A type selector narrows to one kind;
-  // otherwise sweep every kind chant knows how to map.
-  const kinds = options.selector?.type
-    ? [KUBECTL_RESOURCE[options.selector.type]].filter(Boolean)
-    : Array.from(new Set(Object.values(KUBECTL_RESOURCE)));
+export async function exportResources(
+  options: {
+    environment: string;
+    selector?: ResourceSelector;
+    owned?: boolean;
+    verbatim?: boolean;
+    cwd?: string;
+  },
+  connect: K8sConnector = defaultK8sConnector,
+): Promise<ExportedTemplate> {
+  const types = options.selector?.type ? [options.selector.type] : DEFAULT_IMPORT_TYPES;
+  const operations = types.map((t) => operationFor(t)).filter((o) => o !== undefined);
 
-  if (kinds.length === 0) {
+  if (operations.length === 0) {
     return { resources: [], parameters: [] };
   }
 
+  const { client } = await connect({ environment: options.environment, cwd: options.cwd });
+
   // One List per kind keeps parsing simple and isolates a missing-kind error
-  // to that kind rather than failing the whole export.
-  const objects: unknown[] = [];
-  for (const kind of kinds) {
+  // to that kind rather than failing the whole export. They now run
+  // concurrently instead of serially.
+  const perKind = await client.concurrently(operations, async (operation) => {
     try {
-      const { stdout } = await execAsync(
-        ["kubectl", "get", kind, "-A", "-o", "json"].join(" "),
-      );
-      const list = JSON.parse(stdout) as KubectlList;
-      if (Array.isArray(list.items)) objects.push(...list.items);
+      return await client.list({ apiVersion: operation.apiVersion, kind: operation.kind });
     } catch {
-      // Kind not present in the cluster / RBAC denied — skip it, don't fail
+      // Kind not served by this cluster / RBAC denied — skip it, don't fail
       // the whole export.
+      return [];
     }
-  }
+  });
 
-  return buildExportFromObjects(objects, {
+  return buildExportFromObjects(perKind.flat(), {
     verbatim: options.verbatim,
     selector: options.selector,
     owned: options.owned,