@intentius/chant-lexicon-k8s 0.30.0 → 0.32.0

package/dist/api/classify.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Typed API failure → the observation tri-state (chant #1089, #1074).
+ *
+ * `classifyKubectlFailure` in core does this by matching English on stderr,
+ * because that was all `kubectl` gave it. The API server has always sent a
+ * `Status` object with a numeric code and a `reason` enum; the typed client
+ * carries it through, so classification here reads fields rather than
+ * searching for substrings. The verdicts are deliberately the same ones the
+ * kubectl path produced — this replaces the evidence, not the contract.
+ *
+ * The one that reads as a surprise, and is not: **a kind the cluster does not
+ * serve is an absence, not a hole.** No instance of an unserved kind can exist
+ * there, and the usual cause is a CRD the very plan being computed has not
+ * applied yet. Calling it NOT-OBSERVED would suppress the create that is
+ * genuinely needed. That is core's existing rule (`classifyKubectlFailure`
+ * treats "the server doesn't have a resource type" as absent) and it survives
+ * the move intact.
+ *
+ * Errors are discriminated by `name`, not `instanceof`. The client is an
+ * optional dependency reached through a dynamic import, so this module must
+ * not carry a static value import of it — and `name` is set explicitly by
+ * every one of its error classes, which also makes the classification survive
+ * a duplicated copy of the package in a consumer's tree.
+ */
+import type { UnobservedReason } from "@intentius/chant/lexicon";
+/** What a failed read actually proved. Mirrors core's `KubectlReadOutcome`. */
+export type K8sReadOutcome = 
+/** The API server answered and the object is not there. Safe to plan a create. */
+{
+    kind: "absent";
+}
+/** The read proved nothing about the object's existence. */
+ | {
+    kind: "unobserved";
+    reason: UnobservedReason;
+    detail: string;
+};
+/** Classify a failure from the typed client into the observation tri-state. */
+export declare function classifyApiFailure(err: unknown): K8sReadOutcome;
+/**
+ * The cluster's own discovery reports no such kind at all — distinct from a
+ * kind that exists but currently has zero live instances. `classifyApiFailure`
+ * folds both into `absent` for the declared-entity read path, where "no
+ * instance can exist" is exactly the signal a `create` needs. `chant kube get`
+ * (chant #1079) needs the finer distinction: an ad hoc `chant kube get
+ * widgets` against a kind the cluster has never heard of should say so, not
+ * print "No resources found." as if `widgets` were a real, empty kind.
+ */
+export declare function isUnknownResource(err: unknown): boolean;
+/**
+ * Whether a failure kills the whole observation rather than one entity. A
+ * refused binding, a missing client package and a rejected credential plugin
+ * are all true of every entity, so they propagate and core marks the lot
+ * NOT-OBSERVED with one reason instead of repeating the same failure N times.
+ */
+export declare function isWholeLexiconFailure(err: unknown): boolean;
+/**
+ * A dynamic import of the optional client package that failed to resolve looks
+ * like an ordinary module error. Recognizing it lets `describeResources` report
+ * a missing dependency as a missing dependency rather than as a broken cluster.
+ */
+export declare function isMissingClientPackage(err: unknown): boolean;
+/** The message a missing client package should produce. */
+export declare const MISSING_CLIENT_DETAIL: string;
+//# sourceMappingURL=classify.d.ts.map

package/dist/api/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/api/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,+EAA+E;AAC/E,MAAM,MAAM,cAAc;AACxB,kFAAkF;AAChF;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE;AACpB,4DAA4D;GAC1D;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBrE,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAwC/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAG3D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAK5D;AAED,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,QAEuE,CAAC"}

package/dist/api/connect.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Getting from a chant environment to a live API client — chant #1074.
+ *
+ * The cluster binding (chant #1100, landed in #1155) is unchanged by the move
+ * off `kubectl`, and deliberately so: `resolveClusterTarget` in core stays the
+ * single resolver, shared with the GCP lexicon's Config Connector observation,
+ * and the refusal it throws on a bound-but-mismatched context still aborts
+ * before any resource is touched. What changes is only *how the ambient
+ * context is read*: the typed client parses the kubeconfig it is about to use
+ * rather than shelling `kubectl config current-context`, so a worker image with
+ * no `kubectl` in it can still check the binding. Same question, same three
+ * outcomes:
+ *
+ * - **Bound and ambient agrees** — the bound context is passed explicitly to
+ *   the client, never left to the ambient default.
+ * - **Bound and ambient disagrees** — `ClusterBindingMismatchError`, thrown
+ *   before the first request. Core turns the throw into NOT-OBSERVED for every
+ *   declared entity (chant #1089), which is what stops a wrong-cluster read
+ *   becoming a confident list of creates.
+ * - **Unbound** — the kubeconfig's own current-context, with the same visible
+ *   warning naming the environment and the missing binding.
+ */
+import { type ResolvedClusterTarget } from "@intentius/chant/kubectl-context";
+import type { K8sClient, K8sClientOptions } from "@intentius/chant-k8s-client";
+/**
+ * Build a client for an environment. Injectable so tests drive the real client
+ * against a fake request layer, and so `describeResources` and the Op
+ * activities share one connection story rather than each inventing one.
+ */
+export type K8sConnector = (options: ConnectOptions) => Promise<ConnectedClient>;
+export interface ConnectOptions {
+    /**
+     * chant environment being observed or applied to. Omitting it skips the
+     * config lookup and the binding check — which is what an Op activity called
+     * with no environment and no explicit context has always done: use whatever
+     * the kubeconfig selects.
+     */
+    environment?: string;
+    /** Directory whose `chant.config.ts` carries `k8s.profiles`. Defaults to cwd. */
+    cwd?: string;
+    /**
+     * An explicit context, for the Op write path whose activity contract has
+     * always taken one. Skips the config lookup and the binding check entirely.
+     */
+    context?: string;
+    /** Extra client options — the request-layer seam, concurrency. */
+    client?: Partial<K8sClientOptions>;
+}
+export interface ConnectedClient {
+    client: K8sClient;
+    target: ResolvedClusterTarget;
+}
+/**
+ * The production connector: read the project's config, resolve the binding,
+ * build a client honoring it.
+ */
+export declare const defaultK8sConnector: K8sConnector;
+//# sourceMappingURL=connect.d.ts.map

package/dist/api/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/api/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAG/E;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,YAwCjC,CAAC"}

package/dist/api/fake-cluster.d.ts

@@ -0,0 +1,55 @@
+/**
+ * A fake cluster to point the k8s lexicon at, for tests (chant #1074).
+ *
+ * It builds a **real** `@intentius/chant-k8s-client` over a literal kubeconfig
+ * with `@kubernetes/client-node`'s HTTP send replaced. So kubeconfig parsing,
+ * context selection, the credential policy, API discovery, path construction
+ * and the auth path all run for real; the only thing that does not happen is
+ * the socket. Nothing reads `~/.kube/config` or `$KUBECONFIG`, and nothing can
+ * reach a cluster the developer happens to have a context for.
+ *
+ * Shipped rather than kept in a test file because the lexicon's own tests, the
+ * cross-lexicon lifecycle suite and a consumer wiring chant into their harness
+ * all need the same thing.
+ */
+import type { K8sObject } from "@intentius/chant-k8s-client";
+import type { FakeRequestLayer, RecordedRequest } from "@intentius/chant-k8s-client/testing";
+import type { ConnectOptions, K8sConnector } from "./connect.js";
+export interface FakeClusterOptions {
+    /**
+     * Objects the cluster holds, keyed by
+     * `<apiVersion>/<Kind>/<namespace|_>/<name>`, e.g.
+     * `apps/v1/Deployment/prod/web`. Build keys with {@link objectKey}.
+     */
+    objects?: Record<string, K8sObject>;
+    /**
+     * Entity types (or `<apiVersion> <Kind>` pairs) this cluster serves. Defaults
+     * to every type in the generated operation surface, which is what makes a
+     * CRD resolvable in a test without registering anything.
+     */
+    serves?: readonly string[];
+    /** Full control: return a response for a request, or undefined to fall through. */
+    respond?: (request: RecordedRequest) => {
+        status?: number;
+        body?: unknown;
+    } | undefined;
+    /** Kubeconfig to hand the client. Defaults to a single-context one. */
+    kubeconfig?: string;
+}
+export interface FakeCluster {
+    connector: K8sConnector;
+    layer: FakeRequestLayer;
+    /** Connect options every call received, for asserting the binding path. */
+    connects: ConnectOptions[];
+}
+/** Key an object the way {@link fakeCluster} indexes them. */
+export declare function objectKey(apiVersion: string, kind: string, name: string, namespace?: string): string;
+/** Build a live object with chant's ownership marker already on it. */
+export declare function ownedObject(apiVersion: string, kind: string, name: string, namespace: string | undefined, extra?: Partial<K8sObject>): K8sObject;
+/**
+ * A cluster that answers discovery for the kinds it serves and holds the
+ * objects it was given. Anything else 404s with a real `Status` body, which is
+ * how a test drives the absent branch of the observation tri-state.
+ */
+export declare function fakeCluster(options?: FakeClusterOptions): FakeCluster;
+//# sourceMappingURL=fake-cluster.d.ts.map

package/dist/api/fake-cluster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-cluster.d.ts","sourceRoot":"","sources":["../../src/api/fake-cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAE7F,OAAO,KAAK,EAAmB,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG/E,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,mFAAmF;IACnF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IACxF,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,YAAY,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpG;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,GAAE,OAAO,CAAC,SAAS,CAAM,GAC7B,SAAS,CAcX;AAwBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CA+FzE"}

package/dist/api/operation-surface.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Reading the generated operation surface — chant #1074.
+ *
+ * The table itself is written by `chant generate` (see
+ * `../codegen/generate-operations.ts`); this is the runtime side, and it is
+ * deliberately the only place in the lexicon that knows how an entity type
+ * becomes an API address.
+ *
+ * Loading mirrors the serializer's handling of `lexicon-k8s.json`: a `require`
+ * behind a try/catch, so a checkout that has not run `chant generate` yet
+ * degrades to derivation rather than failing to import. Nothing here touches
+ * the filesystem at module load (chant #1081) — the first call does, and caches.
+ */
+/** One resource's addressing information, as `chant generate` emits it. */
+export interface K8sOperationDescriptor {
+    /** chant entity type, e.g. `K8s::Apps::Deployment`. */
+    entityType: string;
+    /** `v1`, `apps/v1`, `ray.io/v1` — what goes in a manifest. */
+    apiVersion: string;
+    /** `Deployment`, `RayCluster`. */
+    kind: string;
+    /** Plural path segment the schema documents, e.g. `deployments`. */
+    plural: string;
+    scope: "Namespaced" | "Cluster";
+    /** Verbs the schema documents for the named-object path. */
+    verbs: string[];
+}
+/** The generated file's shape: entity type → descriptor. */
+export type K8sOperationTable = Record<string, K8sOperationDescriptor>;
+/**
+ * Fallback plural for a kind whose schema documented no named-object path.
+ *
+ * Kubernetes' own pluralization for resource names is the lowercased kind with
+ * English plural rules applied — the three cases `kubectl` implements. It only
+ * fires for kinds the OpenAPI paths do not cover, and the live client overrides
+ * it from the cluster's discovery regardless, so it is a placeholder rather
+ * than a second table to maintain.
+ */
+export declare function pluralizeKind(kind: string): string;
+/** The generated table, loaded once. Empty when nothing has been generated. */
+export declare function operationTable(): K8sOperationTable;
+/** Reset the memoized table. Tests only. */
+export declare function resetOperationTableForTests(): void;
+/**
+ * How to address a declared entity type over the API.
+ *
+ * Returns undefined only for a type the generated surface does not carry and
+ * whose `K8s::<Group>::<Kind>` shape yields no known group — which is the one
+ * case where chant genuinely does not know what to ask for. Every generated
+ * resource type, including every CRD baked in at generation time, is in the
+ * table; that is the difference between this and the twenty-entry map it
+ * replaces.
+ */
+export declare function operationFor(entityType: string): K8sOperationDescriptor | undefined;
+/**
+ * Last-resort derivation from the entity type's own shape, for a lexicon
+ * running without generated artifacts. It cannot invent an API group it has
+ * never seen, so an unknown group returns undefined rather than a guess that
+ * would address the wrong thing.
+ */
+export declare function deriveOperation(entityType: string): K8sOperationDescriptor | undefined;
+/** Every entity type the generated surface can address. */
+export declare function addressableEntityTypes(): string[];
+//# sourceMappingURL=operation-surface.d.ts.map

package/dist/api/operation-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-surface.d.ts","sourceRoot":"","sources":["../../src/api/operation-surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,4DAA4D;AAC5D,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKlD;AAqBD,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,iBAAiB,CAQlD;AAED,4CAA4C;AAC5C,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,CAKnF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,CAatF;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD"}

package/dist/api/owner-chain.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Resolving a live Kubernetes object's `ownerReferences` chain up to a
+ * declared, chant-observed entity (chant #1077).
+ *
+ * There is no server-side "who ultimately owns this object" query — Kubernetes'
+ * own garbage collector does not have one either; it walks the same chain one
+ * hop at a time, reading each intermediate owner. A Pod's `ownerReferences`
+ * names its ReplicaSet, which chant never declared; the ReplicaSet's own
+ * `ownerReferences` names the Deployment, which is declared. Reaching that
+ * declared entity takes reading the ReplicaSet in between.
+ *
+ * This module's only job is assembling that chain — fetching each hop through
+ * the typed client, bounded and cycle-guarded so a corrupt or adversarial
+ * chain cannot hang an observation. The bounded/cycle-safe *interpretation* of
+ * the assembled chain (declared / unowned / foreign / unknown) is core's
+ * `classifyOwnerChain` (`@intentius/chant/owner-chain`) — the issue's own
+ * division of labor: core owns the category, the lexicon supplies the chain.
+ */
+import type { K8sClient, K8sObject } from "@intentius/chant-k8s-client";
+import { type OwnerChainVerdict } from "@intentius/chant/owner-chain";
+/** The client surface this module needs — a single object read, addressed by
+ * an owner reference's own coordinates. */
+export type OwnerChainReader = Pick<K8sClient, "readIfPresent">;
+export interface ResolveOwnerChainOptions {
+    /** uid → declared chant entity name, from this observation's own resolved entities. */
+    declaredByUid: ReadonlyMap<string, string>;
+    /** Reads each intermediate owner. */
+    reader: OwnerChainReader;
+    /**
+     * Namespace the starting object lives in. Owner references are same-namespace
+     * only — a namespaced object cannot be owned by an object in another
+     * namespace, the same rule Kubernetes' own garbage collector enforces —so
+     * every hop is read in this namespace.
+     */
+    namespace: string | undefined;
+    maxDepth?: number;
+}
+/**
+ * Walk `obj`'s owner-reference chain up to a declared entity, a foreign root,
+ * or a bound (#1077). Fetches at most `maxDepth + 1` objects (the starting
+ * object plus up to `maxDepth` ancestors) — the same bound `classifyOwnerChain`
+ * enforces when interpreting the result, so nothing is fetched that the
+ * interpretation would not have used anyway.
+ */
+export declare function resolveK8sOwnerChain(obj: K8sObject, options: ResolveOwnerChainOptions): Promise<OwnerChainVerdict>;
+//# sourceMappingURL=owner-chain.d.ts.map

package/dist/api/owner-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-chain.d.ts","sourceRoot":"","sources":["../../src/api/owner-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,8BAA8B,CAAC;AA2BtC;2CAC2C;AAC3C,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;AAEhE,MAAM,WAAW,wBAAwB;IACvC,uFAAuF;IACvF,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,qCAAqC;IACrC,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,iBAAiB,CAAC,CA8D5B"}

package/dist/api/sweep-types.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The kinds chant sweeps when nothing narrows the question.
+ *
+ * A *product* decision — what a bare `chant import` should pull back, and
+ * (chant #1075) which kinds an ownership-scoped prune has to look at to notice
+ * that a whole kind was removed from source. Not an addressing limit: since
+ * chant #1074 removed `KUBECTL_RESOURCE`, a `--selector type=<entity type>`
+ * import can name any of the ~180 types the generated operation surface
+ * carries, CRDs included.
+ *
+ * It lives in its own module, with no imports of its own, because both
+ * consumers reach it from different directions — `../export-resources.ts`
+ * pulls in the whole import parser, and a Temporal worker loading the apply
+ * activity should not.
+ */
+export declare const DEFAULT_IMPORT_TYPES: readonly string[];
+//# sourceMappingURL=sweep-types.d.ts.map

package/dist/api/sweep-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweep-types.d.ts","sourceRoot":"","sources":["../../src/api/sweep-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAoBjD,CAAC"}

package/dist/codegen/generate-operations.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The generated operation surface — chant #1074.
+ *
+ * `describeResources` used to reach the cluster through a hand-written
+ * `entityType → kubectl resource` map with twenty entries in it. Every one of
+ * the other ~180 generated resource types, and every CRD, fell off the end of
+ * it. The map was hand-maintained precisely because nothing derived it, and
+ * nothing derived it because the codegen pass that produces the types never
+ * emitted the addressing half.
+ *
+ * It does now. This artifact is written by the same `generate()` run that
+ * writes `lexicon-k8s.json` and `index.d.ts`, out of the same parsed results,
+ * so a resource that has a declarable class necessarily has an operation entry
+ * with the same apiVersion and kind. `operation-surface.test.ts` asserts that
+ * correspondence rather than trusting it.
+ *
+ * What it is not: an authority on what a given cluster serves. `plural` and
+ * `scope` are what the schema says; the live client confirms both against the
+ * cluster's own discovery before addressing anything, because a cluster can
+ * serve a different version of a CRD than the one chant generated from.
+ */
+import type { K8sParseResult } from "../spec/parse.js";
+import { type K8sOperationDescriptor, type K8sOperationTable } from "../api/operation-surface.js";
+export type { K8sOperationDescriptor, K8sOperationTable };
+/** Build the operation table from the same parsed results the types come from. */
+export declare function buildOperationTable(results: K8sParseResult[]): K8sOperationTable;
+/** Serialize the table, key-sorted so regeneration produces a stable diff. */
+export declare function generateOperationsJSON(results: K8sParseResult[]): string;
+//# sourceMappingURL=generate-operations.d.ts.map

package/dist/codegen/generate-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-operations.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAiB,KAAK,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE9G,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,CAAC;AAE1D,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,iBAAiB,CAkBhF;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAKxE"}

package/dist/codegen/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EAEpB,MAAM,mCAAmC,CAAC;AAc3C,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmErF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAUjF"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EAEpB,MAAM,mCAAmC,CAAC;AAe3C,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,cAAc,CAAC,CA0ErF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAWjF"}

package/dist/config.d.ts

@@ -58,5 +58,22 @@ export interface K8sClusterProfile {
 export interface K8sChantConfig {
     /** Named environment → cluster bindings, keyed by environment name. */
     profiles?: Record<string, K8sClusterProfile>;
+    /**
+     * Exec credential-plugin commands chant may execute (chant #1074).
+     *
+     * On EKS, AKS and GKE, kubeconfig authentication is a subprocess:
+     * `aws eks get-token`, `kubelogin`, `gke-gcloud-auth-plugin`. Those three
+     * plus `kubectl` are allowed by default. Anything else the kubeconfig names
+     * is refused, because an exec plugin is an arbitrary binary named in a file
+     * chant did not write. Setting this **replaces** the default list.
+     *
+     * ```ts
+     * k8s: {
+     *   profiles: { prod: { context: "prod-eks" } },
+     *   execCredentialPlugins: ["aws", "my-org-oidc-helper"],
+     * } satisfies K8sChantConfig
+     * ```
+     */
+    execCredentialPlugins?: string[];
 }
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC9C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC"}

package/dist/crd/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/crd/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AA4CvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CA4C5D"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/crd/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AA4CvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAoD5D"}

package/dist/crd/types.d.ts

@@ -32,6 +32,13 @@ export interface CRDSource {
 export interface CRDSpec {
     /** API group (e.g. "cert-manager.io") */
     group: string;
+    /**
+     * Whether instances are namespaced. Declared by the CRD itself, so it is the
+     * authoritative source for a custom resource's scope — the equivalent of what
+     * the OpenAPI `paths` say for built-in kinds (chant #1074). Defaults to
+     * `Namespaced`, matching the API server's own default.
+     */
+    scope?: "Namespaced" | "Cluster";
     /** Name variants for the CRD */
     names: {
         kind: string;

package/dist/crd/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/crd/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IACjC,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,sCAAsC;IACtC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,0BAA0B,CAAC;IACjC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACnD,IAAI,EAAE,OAAO,CAAC;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/crd/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IACjC,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACjC,gCAAgC;IAChC,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,sCAAsC;IACtC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,0BAA0B,CAAC;IACjC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACnD,IAAI,EAAE,OAAO,CAAC;CACf"}

package/dist/deep-observe-hooks.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The k8s lexicon's *static* deep-observation noise rules (#1076, epic #1073).
+ *
+ * Split out from `./deep-observe.ts` for one reason: this file must be safe
+ * to import from `plugin.ts` at module load time, because
+ * `LexiconPlugin.deepNormalizationHooks` is plain data core reads to
+ * normalize the *declared* tree — the half of the contract that runs whether
+ * or not a cluster is ever touched (`lifecycle diff` without `--live`,
+ * `chant build`, tests that only exercise normalization). `./deep-observe.ts`
+ * itself imports `@intentius/chant-k8s-client` for the live read, and chant
+ * #1074 made that package's reachability from the build path a structural
+ * property (`examples/k8s-client-boundary.test.ts`) rather than a lint rule —
+ * so nothing this file exports may pull that package in, directly or
+ * transitively. It imports nothing but the core contract's own types.
+ *
+ * What lives here is deliberately the *entityType-keyed, resource-agnostic*
+ * half of the rules: which fields the API server always populates regardless
+ * of what a manager wrote (`status`, `metadata.uid`, …), which fields
+ * Kubernetes defaults when a manifest is silent about them, and which arrays
+ * are sets addressed by a well-known identity (containers by name, ports by
+ * containerPort+protocol). None of that needs a live object in hand.
+ *
+ * What does *not* live here is the managed-fields prune — whether one
+ * specific field on one specific live object is chant-owned, foreign-owned,
+ * or contested. That is inherently per-object (it depends on *that* object's
+ * `metadata.managedFields`, which the declared tree never carries and which
+ * differs between two Deployments of the same type), so it cannot be
+ * expressed as a fixed rule keyed only by entity type and path — the shape
+ * every other hook in this file takes. `./deep-observe.ts` computes it once
+ * per resource and layers it on top of the rules below.
+ *
+ * The *entity-type-agnostic* half of these rules — which fields every
+ * Kubernetes API object carries regardless of kind, and the well-known
+ * list-map-key ordering conventions (containers/env/volumes/ports) — lives in
+ * `@intentius/chant/managed-fields` (chant #1087), because a GCP Config
+ * Connector custom resource is a Kubernetes object too and needs the exact
+ * same rules without depending on this lexicon's package. What stays here is
+ * only what's genuinely k8s-*lexicon*-specific: {@link K8S_SERVICE_DEFAULTS},
+ * keyed by chant's own k8s entityType catalog.
+ */
+import type { DeepNormalizationHooks } from "@intentius/chant/lexicon";
+/**
+ * Kubernetes-defaulted fields, per entity type, as index-erased property
+ * paths. Subtracted only where source never declared the property
+ * (`side === "live" && counterpart === "absent"`) — cdk-real-drift's default
+ * subtraction, same convention as AWS/Azure/Temporal's tables.
+ *
+ * Sparse and evidence-based rather than derived from the generated schema:
+ * the k8s OpenAPI spec this lexicon's codegen consumes
+ * (`lexicons/k8s/src/spec/parse.ts`) does not carry a `default` value for
+ * these fields the way ARM's schema sometimes does, so "per discovery" is not
+ * actually expressible today. Widening this table is additive and needs no
+ * contract change.
+ *
+ * `spec.strategy` is listed whole, not as `spec.strategy.type`, for the same
+ * reason Temporal's `TEMPORAL_SCHEDULE_DEFAULTS` lists `state` whole: pruning
+ * only the leaf would still recurse into the object, and a nested default the
+ * table does not separately name (`rollingUpdate.maxSurge`/`maxUnavailable`,
+ * both `"25%"` when `spec.strategy` is omitted entirely) would leave behind an
+ * empty `strategy: {}` — a value distinct from no `strategy` key at all, and
+ * itself a spurious "undeclared" finding. Matching the whole node first, before
+ * its children are ever visited, drops the wrapper outright when every field
+ * under it is exactly at its default.
+ */
+export declare const K8S_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
+/**
+ * The k8s lexicon's static noise rules: the generic Kubernetes object
+ * envelope (unconditional, by pattern, `@intentius/chant/managed-fields`) and
+ * Kubernetes-defaulted fields (gated on `counterpart === "absent"`), plus the
+ * array orderings the acceptance criteria name — `x-kubernetes-patch-merge-
+ * key`/`list-map-keys` conventions the generated surface does not currently
+ * carry (see the module doc), so these are the "else named-by-name
+ * conventions" the issue calls for: containers by `name`, `env` by `name`,
+ * `volumes` by `name`, container/service `ports` by `containerPort`/`port` +
+ * `protocol` — the same conventions `@intentius/chant/managed-fields`'s
+ * `k8sListMapOrderKey` implements, reused verbatim.
+ *
+ * This is the object `k8sPlugin.deepNormalizationHooks` is. It is also what
+ * `./deep-observe.ts` layers its per-resource managed-fields prune on top of,
+ * so the two normalization passes (the reader's own, and core's later
+ * re-normalization of both the declared and the already-normalized live tree
+ * — see `packages/core/src/lifecycle/deep-observe.ts`) apply the identical
+ * entityType-keyed rules either way.
+ */
+export declare const k8sDeepNormalizationHooks: DeepNormalizationHooks;
+//# sourceMappingURL=deep-observe-hooks.d.ts.map

package/dist/deep-observe-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAY,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGjF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcxE,CAAC;AAaF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAWvC,CAAC"}