@intentius/chant-lexicon-k8s 0.30.0 → 0.32.0

package/dist/deep-observe.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Kubernetes deep observation (#1076) — the k8s row of the deep-observe
+ * contract (#1014), and the epic's (#1073) thesis made real: chant compiled
+ * the manifest, so it knows which fields it authored; the API server records,
+ * per field, which manager last wrote it (`metadata.managedFields`, chant
+ * #1075/#1178). Intersecting those two makes Kubernetes drift *derived*
+ * rather than the hand-maintained `ignoreDifferences` list every Argo user
+ * keeps.
+ *
+ * ## Why this is not "the AWS reader, with `kubectl get` instead of Cloud
+ * Control"
+ *
+ * AWS, Azure and Temporal's rows all prune by a **static, entityType-keyed**
+ * table: an ARN always looks like an ARN, `provisioningState` is always
+ * server-populated, a namespace's retention default is always the same
+ * value. None of that needs the specific live object in hand — it is exactly
+ * what `./deep-observe-hooks.ts`'s `k8sDeepNormalizationHooks` is, and it
+ * covers Kubernetes' *equivalent* static noise (`status`,
+ * `metadata.{uid,resourceVersion,generation,creationTimestamp}`, a handful of
+ * server-defaulted pod-spec fields).
+ *
+ * managedFields is not that kind of rule. Whether `spec.replicas` is noise on
+ * *this* Deployment depends on whether *this* Deployment's
+ * `metadata.managedFields` says a controller owns it — a fact that differs
+ * between two Deployments of the same type, and that the declared tree never
+ * carries at all (chant's source has no `managedFields` key to normalize).
+ * `DeepNormalizationHooks.prune` cannot see the object it is walking, only a
+ * path and a value, so this cannot be expressed as a fixed hook the way the
+ * other three rows' entire contribution is. It has to be computed once per
+ * resource, here, and layered on top of the static rules before the tree is
+ * normalized.
+ *
+ * ## The contested-field rule, precisely
+ *
+ * For every path on the live tree, three questions, each independent:
+ *
+ * 1. **Does any chant field manager (`chant`, `chant:<stack>` — chant #1075,
+ *    matched on the family so a stack rename does not stop recognizing its
+ *    own history) own this path?** If so it is chant's business regardless of
+ *    what else is true — always diffable, never pruned by this rule.
+ * 2. **Does some *other* manager own this path, and chant does not?** That is
+ *    controller-managed noise — HPA rewriting `spec.replicas`, a mutating
+ *    webhook defaulting a field, `kubectl-client-side-apply` from a human
+ *    operator — *provided* nobody declared it (next question). Prune it.
+ * 3. **Does chant's own manifest *also* set this path?** — independent of
+ *    who currently owns it live. This is the case the issue calls out by
+ *    name: **a contested field chant declared is drift-relevant.** The
+ *    reasoning: chant's source is a statement of intent regardless of
+ *    whether a previous apply is what currently holds the field, and a
+ *    foreign write that overrides a value chant's manifest asks for is
+ *    exactly the thing `lifecycle diff --live` exists to surface — silencing
+ *    it because *something else* currently owns the field would hide the one
+ *    case where chant and the cluster disagree about a property chant is
+ *    actively declaring. So: foreign-owned *and* declared is never pruned by
+ *    this rule, whatever #2 would otherwise do.
+ *
+ * `counterpart: "unknown"` and why it does not help here: core's own
+ * counterpart tri-state (`side === "live" && counterpart === "absent"`, what
+ * {@link K8S_SERVICE_DEFAULTS} is gated on) answers "did the *declared tree*
+ * carry this path at all" — which is exactly question 3, but it is computed
+ * by *core*, from the raw declared and raw live trees, only on the **second**
+ * normalization pass (`packages/core/src/lifecycle/deep-observe.ts`'s
+ * `diffDeepObservation`). This reader's own call to
+ * {@link normalizeDeepProperties} runs first, with no `counterpartPaths`
+ * supplied — same as the other three rows — so `counterpart` is `"unknown"`
+ * for every node here, and a rule gated on `"absent"` would never fire during
+ * this read at all. That is fine for a table keyed only by entityType (AWS's
+ * service defaults are subtracted on core's later pass, not this one), but it
+ * is *not* fine for the managed-fields rule: if this reader left
+ * `spec.replicas` in the tree waiting for core's second pass to prune it,
+ * core would be normalizing with the *static* `k8sDeepNormalizationHooks`,
+ * which has no managedFields for this object in hand either (this reader
+ * already computed its ownership sets from data it read once and does not
+ * return). So question 3 is answered **here**, directly against the declared
+ * `props` this reader was handed — not via `counterpart` — and the result is
+ * baked into what this reader returns: a foreign-owned, undeclared field is
+ * gone from the tree before it ever reaches core, and a contested one is
+ * still there for the ordinary declared-vs-live comparison to catch.
+ *
+ * ## Resolving a managedFields entry against a live array
+ *
+ * `metadata.managedFields[].fieldsV1` encodes a list item three ways —
+ * `k:{"name":"web"}` (by key), `v:"blue"` (by value), `i:3` (by index) — and
+ * chant #1178's `managed-fields.ts` renders all three to a path *string*
+ * (`.spec.containers[name="web"]`) for display. Parsing that string back
+ * would be ambiguous in general (a label key may itself contain `.`, e.g.
+ * `app.kubernetes.io/name`, indistinguishable in the rendered form from
+ * nested fields), so this reader does not parse strings at all: it walks the
+ * *structured* `fieldsV1` tree directly (`walkOwnership`, below), matching
+ * each `k:`/`v:` entry against the actual live array to find the concrete
+ * index, and against the actual declared array (by the same key or value) to
+ * answer question 3 for that element specifically — a declared container
+ * named `app` at index 0 is still "declared" if a sidecar gets injected in
+ * front of it and shifts it to live index 1.
+ *
+ * ## What is deliberately not modeled
+ *
+ * A manager's `.` entry (SSA's "I own this element's presence") on a
+ * container that also sets no scalar sub-fields (unusual — a real apply
+ * setting a container almost always sets `image`/`name` too) would not confer
+ * ownership onto a sibling field nobody's `fieldsV1` entry lists explicitly.
+ * That is the conservative direction: a path absent from every manager's
+ * fields is treated as "no ownership information", which leaves it diffable
+ * rather than silently pruned. Reported drift that turns out to be more
+ * noise than expected is a tuning problem; drift silently dropped is not.
+ *
+ * ## `buildOwnershipSets` lives in core now
+ *
+ * The ownership walk itself (`walkOwnership`, resolving a `fieldsV1` tree
+ * against the live and declared trees) has nothing k8s-*lexicon*-specific
+ * about it — it is generic Kubernetes SSA machinery. Chant #1087 (GCP's row,
+ * reusing this one, since a Config Connector CR is a Kubernetes object too)
+ * moved it to `@intentius/chant/managed-fields` rather than have gcp depend
+ * on this lexicon's package, the same reason chant #1100's
+ * `resolveClusterTarget` lives in core. This module re-exports
+ * `buildOwnershipSets`/`OwnershipSets` from there so nothing here changes for
+ * an existing importer of this file.
+ */
+import type { DeepObservationResult } from "@intentius/chant/lexicon";
+import { buildOwnershipSets, type OwnershipSets } from "@intentius/chant/managed-fields";
+import { type K8sConnector } from "./api/connect.js";
+import { k8sDeepNormalizationHooks } from "./deep-observe-hooks.js";
+export { k8sDeepNormalizationHooks, buildOwnershipSets, type OwnershipSets };
+export interface K8sDeepObserveOptions {
+    environment: string;
+    buildOutput?: string;
+    entityNames: string[];
+    entities: Map<string, {
+        entityType: string;
+        props: Record<string, unknown>;
+    }>;
+    stack?: string;
+    owned?: boolean;
+    /** Directory whose `chant.config.ts` carries the cluster binding. Defaults to cwd. */
+    cwd?: string;
+}
+/**
+ * Read the live property tree for each declared entity, pruning by
+ * `metadata.managedFields` (see the module doc). Reuses the same connector,
+ * discovery/caching client and tri-state failure classification as the thin
+ * read (`./describe-resources.ts`) — the binding check (chant #1100/#1155)
+ * still refuses before any resource is touched, and a connect failure still
+ * becomes NOT-OBSERVED for every declared entity rather than an empty result.
+ */
+export declare function observeResourcesDeepK8s(options: K8sDeepObserveOptions, connect?: K8sConnector): Promise<DeepObservationResult>;
+//# sourceMappingURL=deep-observe.d.ts.map

package/dist/deep-observe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqHG;AAGH,OAAO,KAAK,EAEV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAoB,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC3G,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AASjE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAuBD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CA0GhC"}

package/dist/describe-resources.d.ts

@@ -2,35 +2,64 @@
  * Live introspection of a Kubernetes cluster — implements the
  * LexiconPlugin.describeResources() contract for the k8s lexicon.
  *
- * For each declared K8s entity, runs `kubectl get <kind> <name> [-n <ns>] -o json`
- * and maps the response to a ResourceMetadata entry keyed by the chant entity
- * name (using the props.metadata.name + props.metadata.namespace from #39's
- * entity-prop pass-through).
- *
- * The observation tri-state (#1089) is what the return value carries. A genuine
- * `NotFound` from the API server is an absence, and only that becomes a `create`
- * downstream. An entity type with no entry in `KUBECTL_RESOURCE` — every CRD —
- * was never looked at, and comes back `unsupported-kind`: it may well be running
- * in the cluster, and proposing to create it would be a guess. Auth failures and
- * unreachable API servers come back `no-credentials` / `no-binding` for the same
- * reason. Extending the KUBECTL_RESOURCE map converts unsupported-kind holes into
- * real reads; until then they are holes chant admits to.
- *
- * Before touching any resource, the environment is resolved to a cluster
- * identity (chant #1100) via `resolveClusterTarget` — see `./config.ts` for
- * the `k8s.profiles.<env>.context` binding shape. A declared binding is
- * passed explicitly as `--context` on every kubectl call below; an ambient
- * context that disagrees with it aborts the whole describe with a loud
- * error rather than silently reading the wrong cluster. No binding keeps
- * today's behavior (ambient context), with a visible warning.
+ * ## What changed, and why it matters (chant #1074)
+ *
+ * This used to run `kubectl get <kind> <name> -o json` once per declared
+ * entity, serially, resolved through a hardcoded twenty-entry
+ * `KUBECTL_RESOURCE` map. Every CRD and every uncommon type fell off the end
+ * of that map and came back as a hole. Coverage, concurrency and error quality
+ * were all capped by it, and `lifecycle diff --live`, `lifecycle plan` and
+ * behold's overlay inherited the cap.
+ *
+ * Now:
+ *
+ * - **Coverage.** An entity type becomes an API address through the generated
+ *   operation surface (`./api/operation-surface.ts`), which the same codegen
+ *   pass that emits the declarable classes writes — 184 types rather than 20,
+ *   CRDs included. The address is then confirmed against the cluster's *own*
+ *   discovery, which is what knows the plural and the scope for the version
+ *   that cluster actually serves.
+ * - **Concurrency.** Reads run through the client's bounded pool. A hundred
+ *   entities are a hundred concurrent HTTP GETs sharing one connection and one
+ *   cached credential, not a hundred serial process spawns.
+ * - **Error quality.** Failures arrive as typed errors carrying the API
+ *   server's own `code` and `reason`, so the tri-state verdict is read off a
+ *   field instead of matched against English on stderr.
+ *
+ * ## What did not change
+ *
+ * The observation tri-state (chant #1089) and the cluster binding (chant
+ * #1100/#1155) are the same contracts they were. A genuine `NotFound` — and a
+ * kind the cluster's discovery does not serve, where no instance can exist —
+ * is an absence, and only an absence becomes a `create`. Everything else is
+ * NOT-OBSERVED with a reason. A declared `k8s.profiles.<env>.context` that
+ * disagrees with the ambient one still refuses before a single resource is
+ * touched, via the same `resolveClusterTarget` the GCP lexicon shares.
+ *
+ * ## Runtime children (chant #1077)
+ *
+ * A Pod a declared Deployment's controller created is live and undeclared —
+ * exactly the shape `lifecycle diff --live` has always classified `orphan`.
+ * On Kubernetes that is wrong: it is expected runtime, not drift, and will be
+ * recreated the moment it is deleted. After the declared-entity reads above
+ * resolve, this scans Pods in the namespaces they actually live in and walks
+ * each one's `ownerReferences` chain (`./api/owner-chain.ts`) against the
+ * entities this very call resolved. A chain reaching one of them is reported
+ * with `ownerChain: { root: "declared", ... }`; core's diff/change-set engine
+ * reads that as `runtime` instead of `orphan`. Deliberately scoped to Pods —
+ * the concrete case the issue and its acceptance criteria name — and to the
+ * namespaces this observation already touched, not a cluster-wide sweep;
+ * widening to other controller-spawned kinds is the same walk repeated.
  */
 import type { ObservationResult } from "@intentius/chant/lexicon";
+import type { K8sObject } from "@intentius/chant-k8s-client";
+import { type K8sConnector } from "./api/connect.js";
 /**
- * Map chant entity types to `kubectl get` resource names. Add entries here
- * as new types are needed.
+ * Collapse a live object to one status word. Unchanged from the kubectl path
+ * — the shape of the response is the same JSON either way.
  */
-export declare const KUBECTL_RESOURCE: Record<string, string>;
-export declare function describeResources(options: {
+export declare function statusFromObject(obj: K8sObject): string;
+export interface DescribeResourcesOptions {
     environment: string;
     buildOutput: string;
     entityNames: string[];
@@ -39,5 +68,8 @@ export declare function describeResources(options: {
         props: Record<string, unknown>;
     }>;
     owned?: boolean;
-}): Promise<ObservationResult>;
+    /** Directory whose `chant.config.ts` carries the cluster binding. Defaults to cwd. */
+    cwd?: string;
+}
+export declare function describeResources(options: DescribeResourcesOptions, connect?: K8sConnector): Promise<ObservationResult>;
 //# sourceMappingURL=describe-resources.d.ts.map

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAQtG;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAoBnD,CAAC;AAsCF,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyF7B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAGtG,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAkBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAUvD;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAqH5B"}

package/dist/export-resources.d.ts

@@ -1,8 +1,38 @@
+/**
+ * Live export for the Kubernetes lexicon — implements
+ * LexiconPlugin.exportResources() so `chant import --from <cluster-env>`
+ * regenerates live objects as chant TypeScript.
+ *
+ * Reads live objects through the typed API client (chant #1074, previously
+ * `kubectl get <kinds> -A -o json`), strips server-managed noise to reach the
+ * declared shape (kept under `verbatim`), and maps to the import IR via the
+ * shared K8sParser. All I/O lives here; the cleaning and IR-building logic is
+ * pure in `./import/live-export`.
+ *
+ * The list below is a *product* decision — what a bare `chant import` should
+ * sweep when the caller names no type — not an addressing limit. It used to be
+ * both, because `KUBECTL_RESOURCE` was simultaneously the sweep set and the
+ * only way the lexicon knew how to address anything (chant #1074 removed the
+ * second job). A `--selector type=<entity type>` import can now name any of the
+ * ~180 types the generated operation surface carries, CRDs included.
+ */
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+import { type K8sConnector } from "./api/connect.js";
+import { DEFAULT_IMPORT_TYPES } from "./api/sweep-types.js";
+/**
+ * Entity types a bare `chant import --from <cluster>` sweeps: the workload,
+ * config, networking and RBAC kinds people actually author. Everything else is
+ * reachable by naming it with `--selector type=...`. Defined in
+ * `./api/sweep-types.ts` and re-exported here, its original home — chant
+ * #1075's ownership-scoped prune needs the same list without pulling the
+ * import parser into a Temporal worker.
+ */
+export { DEFAULT_IMPORT_TYPES };
 export declare function exportResources(options: {
     environment: string;
     selector?: ResourceSelector;
     owned?: boolean;
     verbatim?: boolean;
-}): Promise<ExportedTemplate>;
+    cwd?: string;
+}, connect?: K8sConnector): Promise<ExportedTemplate>;
 //# sourceMappingURL=export-resources.d.ts.map

package/dist/export-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAUnF,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgC5B"}
+{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAGvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,wBAAsB,eAAe,CACnC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,EACD,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,gBAAgB,CAAC,CA4B3B"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "a14947ba11b4d27cc1387e873f31bcacec4af1e574efe03110ee9f826c74451a",
+    "manifest.json": "115699ca99d75d4b540b73fc2bbae4ca9b2c10a58e2229d24f72571b9daee693",
     "meta.json": "6d112006daa7196eb28619ac5a3893b709dc2b845edbd537db7d7b471e8dc104",
     "types/index.d.ts": "7b873148146a5512c22baabfde6cfcc3248c24c2c7578f68a19544af5dc675f6",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "76ad1e3946f333f82f54e8da4c6b1f6e3ba11c7137d7f5b2728a58e786b1341e"
+  "composite": "57c3eed6bb041d08264adcedaa5e166e624257e15c6d8121053cc945e7d212f3"
 }

package/dist/kube/apply.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `chant kube apply` (chant #1079) — "writes are not cloned": this calls
+ * `applyManifest` (`../op/activities/kubectl.ts`) directly, the exact
+ * function the k8s Op activity registers under `kubectlApply` — server-side
+ * apply, chant's field-manager identity, the same `FieldManagerConflictError`
+ * surface (chant #1075/#1178) — never a second implementation of `kubectl
+ * apply`. An explicit manifest path is mandatory; there is no bare-sweep form.
+ *
+ * The one thing this verb adds on top of the activity is a confirmation
+ * gate, matching the issue's "route through plan, gate, and ownership": a
+ * bare `chant kube apply -f x.yaml` performs a server-side dry run — every
+ * document validated and previewed, nothing persisted — and says so; only
+ * `--yes` performs the real, persisting apply. That is a deliberate
+ * divergence from `kubectl apply`, which persists by default; a terminal
+ * command that can rewrite a live Deployment is worth one extra keystroke of
+ * intent.
+ */
+import { type K8sConnector } from "../api/connect.js";
+import { type KubectlApplyArgs, type ApplyManifestResult } from "../op/activities/kubectl.js";
+export type ApplyFn = (args: KubectlApplyArgs, signal?: AbortSignal, connect?: K8sConnector) => Promise<ApplyManifestResult>;
+export interface ApplyDeps {
+    connect?: K8sConnector;
+    apply?: ApplyFn;
+}
+export declare function runApply(rawArgs: string[], deps?: ApplyDeps): Promise<number>;
+//# sourceMappingURL=apply.d.ts.map

package/dist/kube/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/kube/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAiB,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG1G,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE7H,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoEvF"}

package/dist/kube/connect.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Connecting to a cluster on `chant kube`'s behalf (chant #1079), honoring
+ * the exact same environment→cluster binding every other observing path
+ * does (chant #1100/#1155): `--env` resolves `k8s.profiles.<env>.context`
+ * and refuses loudly on a mismatch, `--context` is an explicit override that
+ * skips the binding entirely, and neither given falls back to the ambient
+ * kubeconfig context — the same three modes `describeResources` and the Op
+ * activities already use, via the same `defaultK8sConnector`. Nothing here
+ * reimplements that resolution; this only turns a connect failure into the
+ * observation tri-state so a verb can render NOT-OBSERVED-with-reason
+ * instead of a stack trace.
+ */
+import type { UnobservedReason } from "@intentius/chant/observation";
+import { type ConnectOptions, type ConnectedClient, type K8sConnector } from "../api/connect.js";
+export type KubeConnectResult = ({
+    kind: "connected";
+} & ConnectedClient) | {
+    kind: "unobserved";
+    reason: UnobservedReason;
+    detail: string;
+};
+/**
+ * Connect, or classify the failure into the tri-state. A bound-but-mismatched
+ * `--env` (`ClusterBindingMismatchError`), a missing `@intentius/chant-k8s-client`
+ * install, and a refused exec-credential plugin are the "nothing left the
+ * process" failures every verb must treat identically: NOT-OBSERVED, never
+ * an empty/absent result.
+ */
+export declare function kubeConnect(options: ConnectOptions, connect?: K8sConnector): Promise<KubeConnectResult>;
+//# sourceMappingURL=connect.d.ts.map

package/dist/kube/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/kube/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAuB,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnH,MAAM,MAAM,iBAAiB,GACzB,CAAC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG,eAAe,CAAC,GACzC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAqB5B"}

package/dist/kube/delete.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `chant kube delete` (chant #1079) — routes through the typed client's own
+ * `delete()` (`packages/k8s-client/src/client.ts`), the identical typed
+ * delete `applyManifest`'s prune step already uses (chant #1075) — never a
+ * second implementation. A kind and a name are both mandatory: there is no
+ * bare `chant kube delete deployments` form, so nothing here can become a
+ * sweep by omission (the issue's "nothing destructive happens without an
+ * explicit resource argument").
+ *
+ * Two guardrails on top of the typed delete itself:
+ *
+ * - **Gate.** A bare invocation reads the object, reports what it found (and
+ *   whether chant owns it), and stops — only `--yes` performs the delete.
+ * - **Ownership, surfaced not enforced.** kubectl itself deletes anything
+ *   RBAC allows, chant-applied or not, and this keeps that: an explicit name
+ *   is already an informed decision. What's added is visibility — a
+ *   warning when the object carries no chant ownership marker, so the
+ *   operator knows they are about to delete something chant did not apply.
+ */
+import { type K8sConnector } from "../api/connect.js";
+import { type KubeProjectContext } from "./project.js";
+export interface DeleteDeps {
+    connect?: K8sConnector;
+    loadProject?: (cwd?: string) => Promise<KubeProjectContext | undefined>;
+}
+export declare function runDelete(rawArgs: string[], deps?: DeleteDeps): Promise<number>;
+//# sourceMappingURL=delete.d.ts.map

package/dist/kube/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../src/kube/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAIxE,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG5E,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACzE;AAQD,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA0GzF"}

package/dist/kube/describe.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `chant kube describe` (chant #1079) — a generic, multi-section human view:
+ * identity, chant's own verdict + provenance (when inside a project), a
+ * pretty-printed spec/status, and the object's Events (reusing `./events.ts`'s
+ * `listEvents`/`filterInvolved`, the same machinery `chant kube events`
+ * itself uses — one implementation, not two). This is not kubectl's
+ * per-kind template set (`OldReplicaSets`/`NewReplicaSet` for a Deployment,
+ * per-container detail for a Pod, and so on for every built-in kind) — a
+ * generic describe covering the fields every object carries, plus the
+ * context only chant can add.
+ */
+import { type K8sConnector } from "../api/connect.js";
+import { type KubeProjectContext } from "./project.js";
+export interface DescribeDeps {
+    connect?: K8sConnector;
+    loadProject?: (cwd?: string) => Promise<KubeProjectContext | undefined>;
+}
+export declare function runDescribe(rawArgs: string[], deps?: DescribeDeps): Promise<number>;
+//# sourceMappingURL=describe.d.ts.map

package/dist/kube/describe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../src/kube/describe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKxE,OAAO,EAA8C,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAMhG,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACzE;AA0ED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4F7F"}

package/dist/kube/events.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `chant kube events` (chant #1079) — the core `v1 Event` kind is addressed
+ * exactly like any other read (`client.list`), no client extension needed.
+ * The one thing the typed client's `ListOptions` does not carry is a field
+ * selector, so `--for <kind>/<name>` (kubectl's own `kubectl events
+ * --for=kind/name` shape) filters client-side against `involvedObject` after
+ * the list comes back, rather than asking the server to. Event volume in a
+ * single namespace is small enough that this is a fine trade for not
+ * widening the client's surface for one caller.
+ */
+import type { K8sClient, K8sObject } from "@intentius/chant-k8s-client";
+import { type K8sConnector } from "../api/connect.js";
+export interface EventsDeps {
+    connect?: K8sConnector;
+}
+/** Events whose `involvedObject` names `ref`, oldest first — kubectl's own default order. */
+export declare function filterInvolved(events: readonly K8sObject[], ref: {
+    kind: string;
+    name: string;
+}): K8sObject[];
+/**
+ * List Events for `namespace` (or every namespace, when `namespace` is
+ * undefined), sorted oldest first. Shared by `runEvents` and `describe`'s own
+ * Events section, so the two verbs agree on what "the events for this object"
+ * means.
+ */
+export declare function listEvents(client: K8sClient, options?: {
+    namespace?: string;
+    labelSelector?: string;
+}): Promise<K8sObject[]>;
+/** Render an events table — reused by `describe`'s Events section. */
+export declare function renderEvents(events: readonly K8sObject[]): string;
+export declare function runEvents(rawArgs: string[], deps?: EventsDeps): Promise<number>;
+//# sourceMappingURL=events.d.ts.map

package/dist/kube/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/kube/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAMxE,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAoBD,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,EAAE,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,CAK7G;AAaD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3D,OAAO,CAAC,SAAS,EAAE,CAAC,CAMtB;AAcD,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAGjE;AASD,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAyDzF"}

package/dist/kube/flags.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Flag parsing shared by every `chant kube <verb>` (chant #1079).
+ *
+ * `CommandGroupContext.rawArgs` is unparsed argv — core has no vocabulary for
+ * a lexicon's own verbs (chant #1078) — so every verb here does its own
+ * parsing, reusing `splitJoinedFlags`/`unknownFlagError` for the same
+ * `--flag=value` splitting and rejection discipline core's own parser
+ * applies (chant #1127). This module adds the flag vocabulary every verb
+ * shares (namespace, selector, output, cluster targeting) so each verb file
+ * only has to declare what is actually its own (`--tail`, `--for`, ...).
+ */
+import type { ConnectOptions } from "../api/connect.js";
+/** A verb's own flag vocabulary, merged with the common set below. */
+export interface FlagSpec {
+    /** Value flags this verb accepts, alias → canonical key (e.g. `{ "--tail": "tail" }`). */
+    value?: Record<string, string>;
+    /** Boolean flags this verb accepts, alias → canonical key. */
+    boolean?: Record<string, string>;
+}
+export interface ParsedFlags {
+    /** Non-flag tokens, in order — the verb's own positional arguments (kind, name, ...). */
+    positional: string[];
+    /** Resolved value-flag key → the value given. */
+    values: Record<string, string>;
+    /** Resolved boolean-flag key → true (absent keys are false). */
+    flags: Record<string, boolean>;
+}
+/**
+ * Parse `rawArgs` against the common flag set plus `spec`. Throws
+ * {@link unknownFlagError}'s shape on anything starting with `-` that
+ * neither set recognizes, and on a value flag given with nothing after it.
+ */
+export declare function parseKubeFlags(rawArgs: string[], spec?: FlagSpec): ParsedFlags;
+/** Build the typed client's `ConnectOptions` from a parsed common flag set. */
+export declare function connectOptionsFrom(values: Record<string, string>): ConnectOptions;
+/** kubectl duration shorthand: "3600" (bare seconds), "1h", "90m", "45s". Shared by `logs --since` and `wait --timeout`. */
+export declare function parseDurationSeconds(value: string): number;
+/** {@link parseDurationSeconds} in milliseconds. */
+export declare function parseDurationMs(value: string): number;
+//# sourceMappingURL=flags.d.ts.map

package/dist/kube/flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../../src/kube/flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,sEAAsE;AACtE,MAAM,WAAW,QAAQ;IACvB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAoBD,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,QAAa,GAAG,WAAW,CA6BlF;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,cAAc,CAMjF;AAED,4HAA4H;AAC5H,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAY1D;AAED,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD"}

package/dist/kube/get.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `chant kube get` (chant #1079) — kubectl's own muscle-memory verb, plus the
+ * chant verdict column the issue's acceptance criterion names.
+ *
+ * The cluster edge is the typed client (chant #1074/#1177), reached the same
+ * way every other read does: `--env` resolves and honors the cluster
+ * binding (chant #1100/#1155, refusing loudly on a mismatch), `--context` is
+ * an explicit override, neither given falls back to the ambient kubeconfig
+ * context. A connect failure, an RBAC-denied read, or a kind the cluster's
+ * discovery has never heard of all render as an honest message rather than
+ * an empty table — "No resources found." is reserved for the one case that
+ * actually means it: the kind is real and there are zero live instances.
+ */
+import { type K8sConnector } from "../api/connect.js";
+import { type KubeProjectContext } from "./project.js";
+export interface GetDeps {
+    connect?: K8sConnector;
+    loadProject?: (cwd?: string) => Promise<KubeProjectContext | undefined>;
+}
+export declare function runGet(rawArgs: string[], deps?: GetDeps): Promise<number>;
+//# sourceMappingURL=get.d.ts.map

package/dist/kube/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../src/kube/get.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKxE,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAgB5E,MAAM,WAAW,OAAO;IACtB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACzE;AAMD,wBAAsB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,OAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA2InF"}

package/dist/kube/group.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `chant kube` — the terminal surface over the typed client (chant #1079),
+ * mounted through the command-group seam #1078 built and reserved this exact
+ * namespace for (`lexicons/k8s/src/plugin.ts`'s `commands()`).
+ *
+ * Every verb below except `version` dynamically imports its own module. That
+ * is not a style choice: `describe-resources.ts`, `api/connect.ts` and the
+ * rest of the read/write paths sit behind a dynamic import specifically so
+ * `chant build` never has to resolve `@intentius/chant-k8s-client`
+ * (chant #1074, `examples/k8s-client-boundary.test.ts`). This module IS
+ * statically reachable from `plugin.ts` — it is plain data, a list of verb
+ * names and descriptions — so every verb whose implementation touches the
+ * client must be reached from here only through `await import(...)`, exactly
+ * like `version`'s existing `await import("../spec/fetch.js")`.
+ */
+import type { CommandGroup } from "@intentius/chant/cli/command-group";
+/** The full `chant kube` verb group. */
+export declare function kubeCommandGroup(): CommandGroup;
+//# sourceMappingURL=group.d.ts.map

package/dist/kube/group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/kube/group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,oCAAoC,CAAC;AAuB5F,wCAAwC;AACxC,wBAAgB,gBAAgB,IAAI,YAAY,CAoF/C"}

package/dist/kube/logs.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `chant kube logs` (chant #1079) — a Pod's `/log` subresource, over the
+ * typed client's new `readLog` (`packages/k8s-client/src/client.ts`). A
+ * snapshot only: `--follow`/`-f` would need the transport seam to expose a
+ * stream rather than a completed response body, which it does not today —
+ * left out deliberately (see `readLog`'s own doc) rather than faked with a
+ * poll loop that isn't actually following anything.
+ */
+import { type K8sConnector } from "../api/connect.js";
+import { type KubeProjectContext } from "./project.js";
+export interface LogsDeps {
+    connect?: K8sConnector;
+    loadProject?: (cwd?: string) => Promise<KubeProjectContext | undefined>;
+}
+export declare function runLogs(rawArgs: string[], deps?: LogsDeps): Promise<number>;
+//# sourceMappingURL=logs.d.ts.map

package/dist/kube/logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../src/kube/logs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKxE,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE5E,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACzE;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAyErF"}