@intentius/chant-lexicon-k8s 0.30.0 → 0.32.0

package/dist/kube/project.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Best-effort chant-project context for `chant kube` (chant #1079).
+ *
+ * `get`'s chant-verdict column and `source` both need to answer "does a
+ * declared entity in this project's source name this live object" — which
+ * needs the project built (chant.config.ts read, source discovered and
+ * resolved). `chant kube` is also usable against a bare cluster with no
+ * chant project in sight (a checkout of someone else's manifests, a
+ * throwaway directory) — the acceptance criterion is that reads still work
+ * there and only the chant-specific parts degrade, quietly, to
+ * "unavailable" rather than erroring. Every failure mode here — no
+ * `chant.config.ts`, a project with build errors, an unreadable directory —
+ * collapses to `undefined` for exactly that reason.
+ *
+ * Deliberately does not import anything client-shaped: this runs before a
+ * cluster is ever reached (`source`/`get` need it to compute a verdict for
+ * objects the client already read), and matching is pure once given a live
+ * object's coordinates.
+ */
+import { type ChantConfig } from "@intentius/chant/config";
+import { type EntityProvenance } from "@intentius/chant/provenance";
+import type { Declarable } from "@intentius/chant/declarable";
+export interface KubeProjectContext {
+    cwd: string;
+    config: ChantConfig;
+    entities: Map<string, Declarable>;
+}
+/**
+ * Build the project rooted at `cwd` (or its configured `sourceDir`) with the
+ * k8s serializer, so `entities` carries resolved props (composites expanded,
+ * AttrRefs resolved) and build provenance (chant #1064's entity-level
+ * `sourceFile`/`composite`, stamped during discovery). Returns undefined —
+ * never throws — for anything that stops the project from resolving: no
+ * `chant.config.ts` here or above, a build with errors, an inaccessible
+ * directory. This IS the "outside a chant project" signal every caller
+ * checks for.
+ */
+export declare function loadKubeProjectContext(cwd?: string): Promise<KubeProjectContext | undefined>;
+export interface DeclaredMatch {
+    entityName: string;
+    entity: Declarable;
+    props: Record<string, unknown> | undefined;
+}
+/**
+ * Reverse-map a live object's coordinates (apiVersion/kind/name/namespace) to
+ * the declared k8s entity that names it, if this project declares one.
+ * `operationFor` is the same generated operation surface `describeResources`
+ * addresses entities with, so a match here is addressed exactly the way the
+ * live read that produced the object was — no separate naming convention.
+ */
+export declare function findDeclaredMatch(entities: Map<string, Declarable>, ref: {
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+}): DeclaredMatch | undefined;
+/** Provenance for a matched entity, relative to the project root when possible. */
+export declare function relativeProvenance(ctx: KubeProjectContext, entity: Declarable): EntityProvenance | undefined;
+//# sourceMappingURL=project.d.ts.map

package/dist/kube/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../src/kube/project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAI9D,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,GAAG,GAAE,MAAsB,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAkBjH;AAMD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1E,aAAa,GAAG,SAAS,CAY3B;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAM5G"}

package/dist/kube/render.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Output rendering for `chant kube get`/`describe` (chant #1079).
+ *
+ * kubectl's own `-o` vocabulary, minus the one form the issue says to drop
+ * openly rather than half-implement: `-o go-template[-file]` is Go template
+ * syntax, and chant does not carry a Go template engine — {@link parseOutput}
+ * refuses it by name rather than pretending a partial implementation covers
+ * it. `-o jsonpath` and `-o custom-columns` are "tractable" per the issue's
+ * own notes, and are implemented here as a deliberately small subset: dot
+ * paths, bracket indices, and a `[*]` wildcard — the paths kubectl one-liners
+ * actually use — not the full jsonpath grammar (filters, `range`/`end`
+ * templates). `-o chant` is chant's own addition: a live object rendered as
+ * the typed source that would declare it, reusing `./import/live-export.ts`
+ * and the lexicon's own `K8sGenerator` — the same machinery `chant import`
+ * uses, so every read is an adoption path, per the issue's framing.
+ */
+import type { K8sObject } from "@intentius/chant-k8s-client";
+import type { KubeVerdict } from "./verdict.js";
+export type OutputFormat = {
+    kind: "text";
+} | {
+    kind: "wide";
+} | {
+    kind: "json";
+} | {
+    kind: "yaml";
+} | {
+    kind: "name";
+} | {
+    kind: "chant";
+} | {
+    kind: "jsonpath";
+    expr: string;
+} | {
+    kind: "custom-columns";
+    spec: string;
+};
+/** Parse an `-o`/`--output` value. Throws on `go-template[-file]`. */
+export declare function parseOutput(value: string | undefined): OutputFormat;
+export interface KubeRow {
+    namespace?: string;
+    name: string;
+    kind: string;
+    status: string;
+    age?: string;
+    verdict?: KubeVerdict;
+    labels?: Record<string, string>;
+    object: K8sObject;
+}
+/** kubectl-style relative age, e.g. "45s", "12m", "3h", "5d". */
+export declare function relativeAge(creationTimestamp: string | undefined, now?: number): string;
+/** Render a fixed-width table. `columns` is header → per-row value. */
+export declare function renderTable(headers: string[], rows: string[][]): string;
+export declare function renderKubeTable(rows: KubeRow[], opts: {
+    allNamespaces: boolean;
+    wide: boolean;
+    showVerdict: boolean;
+}): string;
+export declare function renderJson(objects: readonly K8sObject[]): string;
+export declare function renderYaml(objects: readonly K8sObject[]): string;
+/** `kubectl get -o name`: `<lowercased-kind>.<group>/<name>` (`<lowercased-kind>/<name>` for the core group). */
+export declare function renderName(objects: readonly K8sObject[]): string;
+/** Render live objects as the typed chant source that would declare them. */
+export declare function renderChantSource(objects: readonly K8sObject[]): string;
+/**
+ * Evaluate a kubectl-style jsonpath template against one root value: literal
+ * text passes through, `{"..."}` is a quoted literal, `{.a.b[*].c}` extracts
+ * and space-joins matches. Multiple `{...}` blocks concatenate directly, as
+ * kubectl's own `-o jsonpath` does.
+ */
+export declare function evalJsonPath(template: string, root: unknown): string;
+/** `-o jsonpath=`: kubectl runs the whole template once per top-level object printed. */
+export declare function renderJsonPath(expr: string, objects: readonly K8sObject[]): string;
+export declare function renderCustomColumns(spec: string, objects: readonly K8sObject[]): string;
+//# sourceMappingURL=render.d.ts.map

package/dist/kube/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/kube/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAgBnE;AAID,MAAM,WAAW,OAAO;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,CAanG;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAIvE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAkB9H;AAiBD,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAEhE;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAEhE;AAED,iHAAiH;AACjH,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAShE;AAID,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAIvE;AA+CD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAkBpE;AAED,yFAAyF;AACzF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAGlF;AAmBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAKvF"}

package/dist/kube/source.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `chant kube source` (chant #1079) — resolve a live object back to the
+ * `.ts` file and composite that declared it, reusing the exact build
+ * provenance the gitlab/forgejo lexicons' own `:source` context tools already
+ * expose (`@intentius/chant/provenance`, stamped during discovery — chant
+ * #1064). That precedent is explicit that provenance here is **entity-level
+ * (file + composite), not a YAML-line source map** — chant does not carry
+ * one, for k8s or for anything else — so this verb reports the same two
+ * facts (never a fabricated line number) and says so plainly rather than
+ * silently coming up one field short of the issue's wording.
+ */
+import { type K8sConnector } from "../api/connect.js";
+import { type KubeProjectContext } from "./project.js";
+export interface SourceDeps {
+    connect?: K8sConnector;
+    loadProject?: (cwd?: string) => Promise<KubeProjectContext | undefined>;
+}
+export declare function runSource(rawArgs: string[], deps?: SourceDeps): Promise<number>;
+//# sourceMappingURL=source.d.ts.map

package/dist/kube/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/kube/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAIxE,OAAO,EAA8C,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAGhG,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACzE;AAMD,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA6GzF"}

package/dist/kube/target.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Resolving `chant kube <verb> <target...>`'s positional arguments to an
+ * addressable resource (chant #1079).
+ *
+ * "Every verb resolves entity names through chant's own vocabulary where
+ * applicable ... while also accepting raw kind/name kubectl-style." Both
+ * forms share one positional shape, disambiguated by arity:
+ *
+ * - One token, and it names a declared entity in this project → chant's own
+ *   vocabulary: the entity's `metadata.name`(/`namespace`) is looked up in
+ *   its own source, not typed twice.
+ * - One or two tokens otherwise → kubectl's own shape, `<kind> [name]`; a
+ *   bare kind with no name is a list, matching `kubectl get <kind>`.
+ *
+ * `<kind>` is never parsed here beyond splitting the `.group` suffix — that
+ * job belongs to the typed client's own `resolve()` (kubectl's own
+ * plural/singular/kind/short-name precedence, `packages/k8s-client/src/client.ts`),
+ * so a raw kind string reaches the cluster exactly as `kubectl get raycluster.ray.io`
+ * would.
+ */
+import type { ResourceSelector } from "@intentius/chant-k8s-client";
+import { type DeclaredMatch, type KubeProjectContext } from "./project.js";
+export interface KubeTarget {
+    selector: ResourceSelector;
+    /** Object name. Undefined means "list every object this selector addresses". */
+    name?: string;
+    namespace?: string;
+    /** Set when resolution went through chant's own vocabulary rather than a kubectl kind string. */
+    declaredMatch?: DeclaredMatch;
+}
+export interface KubeTargetError {
+    error: string;
+}
+export declare function isTargetError(t: KubeTarget | KubeTargetError): t is KubeTargetError;
+/**
+ * Resolve `positional` (whatever's left after flags) plus an explicit
+ * `-n/--namespace`, against `project`'s declared entities when available.
+ */
+export declare function resolveKubeTarget(positional: readonly string[], namespaceFlag: string | undefined, project: KubeProjectContext | undefined): KubeTarget | KubeTargetError;
+/**
+ * After a live read resolves an object's real `apiVersion`/`kind` (a kubectl
+ * kind string like `deploy` isn't one), reverse-map it against the project
+ * for the verdict column / `source` — reusing the exact match `resolveKubeTarget`
+ * would have made had the caller spelled out the entity name.
+ */
+export declare function matchLiveObject(project: KubeProjectContext | undefined, ref: {
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+}): DeclaredMatch | undefined;
+//# sourceMappingURL=target.d.ts.map

package/dist/kube/target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.d.ts","sourceRoot":"","sources":["../../src/kube/target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAqB,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG3F,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,eAAe,GAAG,CAAC,IAAI,eAAe,CAEnF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,OAAO,EAAE,kBAAkB,GAAG,SAAS,GACtC,UAAU,GAAG,eAAe,CAwB9B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1E,aAAa,GAAG,SAAS,CAG3B"}

package/dist/kube/testing.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Test doubles for `chant kube` (chant #1079).
+ *
+ * `./project.ts`'s real `loadKubeProjectContext` builds an actual project
+ * (`chant.config.ts` read, source discovered, serialized) — every verb takes
+ * it as an injectable dependency for exactly this reason: a unit test builds
+ * a `KubeProjectContext` by hand instead, the same way `../api/fake-cluster.ts`
+ * lets a test build a client without a socket.
+ */
+import { type Declarable } from "@intentius/chant/declarable";
+import { type EntityProvenance } from "@intentius/chant/provenance";
+import type { ChantConfig } from "@intentius/chant/config";
+import type { KubeProjectContext } from "./project.js";
+export type FakeDeclarable = Declarable & {
+    props: Record<string, unknown>;
+};
+/** A minimal `Declarable` carrying `props`, optionally stamped with build provenance. */
+export declare function fakeDeclarable(entityType: string, props: Record<string, unknown>, provenance?: EntityProvenance): FakeDeclarable;
+/** A `KubeProjectContext` built from a plain name → entity map, no disk I/O. */
+export declare function fakeProjectContext(entities: Record<string, Declarable>, config?: ChantConfig, cwd?: string): KubeProjectContext;
+//# sourceMappingURL=testing.d.ts.map

package/dist/kube/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/kube/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAE7E,yFAAyF;AACzF,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,CAAC,EAAE,gBAAgB,GAC5B,cAAc,CAUhB;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EACpC,MAAM,GAAE,WAAgB,EACxB,GAAG,SAAa,GACf,kBAAkB,CAEpB"}

package/dist/kube/top.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `chant kube top pods|nodes` (chant #1079).
+ *
+ * `metrics.k8s.io` is not part of the standard Kubernetes OpenAPI schema chant's
+ * codegen ingests — it is an aggregated API a cluster may or may not be running
+ * (metrics-server). It needs no entry in the generated operation surface either
+ * way: the typed client's kubectl-style selector (`{ resource, group }`) resolves
+ * purely off the *cluster's own* discovery, the same path `waitForReady`'s `kind`
+ * argument already uses for CRDs — so this needs no client change, only the
+ * right selector.
+ *
+ * Kubectl's own `top` sums each Pod's per-container usage into one CPU/memory
+ * figure, which needs real quantity-unit arithmetic (`250m` + `100m`, `128Mi` +
+ * `64Mi`). That normalization is not implemented here — each container's raw
+ * usage string is shown as the API reported it, unsummed. Good enough for "is
+ * anything obviously starved", not a replacement for `kubectl top --containers`.
+ */
+import { type K8sConnector } from "../api/connect.js";
+export interface TopDeps {
+    connect?: K8sConnector;
+}
+export declare function runTop(rawArgs: string[], deps?: TopDeps): Promise<number>;
+//# sourceMappingURL=top.d.ts.map

package/dist/kube/top.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"top.d.ts","sourceRoot":"","sources":["../../src/kube/top.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAMxE,MAAM,WAAW,OAAO;IACtB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAWD,wBAAsB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,OAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAiFnF"}

package/dist/kube/verdict.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The chant verdict column `chant kube get` carries on every row (chant
+ * #1079's acceptance criterion: "get annotates each row with the declared /
+ * owned / drifted / foreign-owned verdict").
+ *
+ * Four states:
+ *
+ * - `declared` — this project's source names an entity at this exact
+ *   apiVersion/kind/name(/namespace), and the live object agrees with it on
+ *   every field the source declares.
+ * - `drifted` — same match, but the live object disagrees with the source on
+ *   at least one declared field.
+ * - `owned` — no declared match, but the live object carries chant's
+ *   ownership marker (`app.kubernetes.io/managed-by=chant`) — something
+ *   chant applied that source no longer declares, or a stack/entity this
+ *   project's build didn't resolve.
+ * - `foreign-owned` — no declared match and no marker: chant does not
+ *   consider this object its own.
+ *
+ * `unavailable` is not a verdict about the object; it is what every row gets
+ * when the project context could not be loaded at all (chant #1079's
+ * "degrades gracefully outside a chant project" — `get` and `describe` still
+ * work, this column just has nothing to say).
+ *
+ * The drift check here is a fast, best-effort *declared-subset* comparison —
+ * every path the source sets must agree on the live object — not the
+ * managed-fields-precise diff `chant lifecycle diff --live --deep` computes
+ * (chant #1076). It exists for a table column that must render for dozens of
+ * rows in one `get` call; the deep, field-ownership-aware answer stays the
+ * lifecycle command's job. A live object can disagree with the source on a
+ * field a controller owns (Kubernetes rewriting `spec.replicas` under an
+ * HPA, say) and still show `drifted` here — reach for the deep diff before
+ * treating this column as a verdict rather than a hint.
+ */
+import type { K8sObject } from "@intentius/chant-k8s-client";
+import type { DeclaredMatch } from "./project.js";
+export type KubeVerdict = "declared" | "owned" | "drifted" | "foreign-owned" | "unavailable";
+/**
+ * True when every path `declared` sets is present and equal on `live`.
+ * Extra fields on `live` (server defaults, status, anything the source never
+ * mentions) are not drift — chant never declared an opinion about them.
+ */
+export declare function declaredSubsetMatches(declared: unknown, live: unknown): boolean;
+export declare function verdictFor(live: K8sObject, match: DeclaredMatch | undefined): KubeVerdict;
+//# sourceMappingURL=verdict.d.ts.map

package/dist/kube/verdict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../../src/kube/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,aAAa,CAAC;AAM7F;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAU/E;AAWD,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,GAAG,SAAS,GAAG,WAAW,CAKzF"}

package/dist/kube/wait.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `chant kube wait` (chant #1079) — the issue names this one explicitly:
+ * "`wait` should use the existing readiness-spec registry in
+ * `op/activities/wait-for-ready.ts`, which already handles the Argo case
+ * where health and sync replace a `Ready` condition — something `kubectl
+ * wait --for` cannot express without jsonpath gymnastics." This verb is a
+ * thin CLI shell around that exact registry (`readinessFor`/`isReady`/
+ * `firstTerminal`/`waitForReady`) — not a second implementation of it.
+ *
+ * `--for=condition=<Type>[=<Status>]` overrides the registry with a single
+ * condition check, matching kubectl's own flag. `--for=delete` polls for
+ * absence instead. Neither given falls back to the registry: the generic
+ * `Ready` condition, or a resource-specific override (Argo's `Application`
+ * today).
+ */
+import { type K8sConnector } from "../api/connect.js";
+import { type KubeProjectContext } from "./project.js";
+export interface WaitDeps {
+    connect?: K8sConnector;
+    loadProject?: (cwd?: string) => Promise<KubeProjectContext | undefined>;
+}
+export declare function runWait(rawArgs: string[], deps?: WaitDeps): Promise<number>;
+//# sourceMappingURL=wait.d.ts.map

package/dist/kube/wait.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait.d.ts","sourceRoot":"","sources":["../../src/kube/wait.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAWxE,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG5E,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACzE;AAkBD,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA6FrF"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/op/activities/index.d.ts

@@ -2,7 +2,10 @@
  * k8s Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `k8s` lexicon. Relocated from the temporal lexicon
  * (#809) so Kubernetes-facing imperative activities live with their product:
- *   - kubectlApply — `kubectl apply` a rendered manifest
+ *   - kubectlApply — server-side apply a rendered manifest (and, since chant
+ *     #1075, prune chant-owned objects it no longer declares; `applyManifest`
+ *     is the same work with a report of what it did, which is what the
+ *     Temporal lexicon's `nativeApply` dispatcher calls for a kubectl target)
  *   - k3dUp / k3dDown — boot/tear down a local k3d cluster
  *   - waitForArgoSync — block until an Argo CD Application is Healthy && Synced
  *
@@ -11,13 +14,13 @@
  * dependency-light — it shells out to a CLI and does not import the k8s declarable
  * surface — so a Temporal worker loads it cheaply.
  */
-export { kubectlApply } from "./kubectl.js";
-export type { KubectlApplyArgs } from "./kubectl.js";
+export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl.js";
+export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl.js";
 export { k3dUp, k3dDown, k3dUpCommand, k3dDownCommand, k3dExistsCommand } from "./k3d.js";
 export type { K3dUpArgs, K3dDownArgs } from "./k3d.js";
 export { waitForArgoSync, defaultArgoStatusFetcher, ArgoSyncFailedError } from "./argo.js";
 export type { WaitForArgoSyncArgs, ArgoAppStatus, ArgoStatusFetcher } from "./argo.js";
-export { waitForReady, defaultResourceFetcher, ReadinessFailedError, readinessFor, isReady, firstTerminal, DEFAULT_READINESS, READINESS_OVERRIDES, } from "./wait-for-ready.js";
+export { waitForReady, defaultResourceFetcher, apiResourceFetcher, ReadinessFailedError, readinessFor, isReady, firstTerminal, DEFAULT_READINESS, READINESS_OVERRIDES, } from "./wait-for-ready.js";
 export type { WaitForReadyArgs, ResourceFetcher, ReadinessSpec, ReadinessMatch, ConditionMatch, PathMatch, } from "./wait-for-ready.js";
 export { resolveClusterTarget, ClusterBindingMismatchError } from "@intentius/chant/kubectl-context";
 export type { ResolvedClusterTarget, K8sClusterProfile, K8sConfigShape } from "@intentius/chant/kubectl-context";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEpG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/op/activities/kubectl.d.ts

@@ -1,4 +1,45 @@
+/**
+ * `kubectlApply` — apply a rendered manifest to a cluster.
+ *
+ * chant #1074 moved this off `kubectl apply -f`. The activity contract is
+ * unchanged (a manifest path, an optional context, `Promise<void>`, the
+ * `longInfra` profile's 15s heartbeat) because Temporal workers register it by
+ * that signature; what changed is underneath. The name is kept for the same
+ * reason.
+ *
+ * chant #1075 finished the job on two axes:
+ *
+ * - **Identity.** The field manager is no longer the bare `chant` but
+ *   `chant:<stack>`, derived from the project's `ownership.stack` — the same
+ *   identity the ownership label already carries. See
+ *   `@intentius/chant-k8s-client`'s `field-manager.ts`.
+ * - **Deletes.** `nativeApply`'s kubectl branch used to shell
+ *   `kubectl apply --prune --selector <marker>`; that branch now routes here,
+ *   so the prune had to come with it. {@link applyManifest} implements it
+ *   against the typed client, scoped to the ownership marker exactly as the
+ *   shelled prune was, and never touching an object that does not carry it.
+ *
+ * Consequences worth knowing:
+ *
+ * - **A worker image needs no `kubectl` binary.** That was the point.
+ * - **It is a server-side apply**, rather than the client-side three-way merge
+ *   `kubectl apply` performs by default. A conflict with another field manager
+ *   arrives as a `FieldManagerConflictError` naming the competing manager and
+ *   the contested paths — never as a silent overwrite, and never force-resolved
+ *   on chant's initiative.
+ * - **Documents apply in file order**, as `kubectl apply -f` does, and a
+ *   directory's files are read in sorted order.
+ */
+import { type K8sConnector } from "../../api/connect.js";
+/**
+ * How the apply treats chant-owned objects that are no longer declared. The
+ * same three values `nativeApply` has always taken; `gated` differs from
+ * `owned-only` only in that the workflow pauses for approval first, which is
+ * the composite's business, not this activity's.
+ */
+export type ApplyDeleteMode = "never" | "owned-only" | "gated";
 export interface KubectlApplyArgs {
+    /** Path to a manifest file, or a directory of them. */
     manifest: string;
     /**
      * kubectl context name. Uses the ambient context if omitted. To target the
@@ -7,10 +48,87 @@ export interface KubectlApplyArgs {
      * `./index.ts` and pass `.context` through.
      */
     context?: string;
+    /**
+     * chant environment, used to resolve `k8s.profiles.<env>.context` when no
+     * explicit `context` is given. Optional and additive: omitting both keeps
+     * the previous behavior of using whatever the kubeconfig selects.
+     */
+    environment?: string;
+    /**
+     * Field manager recorded on the applied fields. Omitted derives it from the
+     * project's `ownership.stack` (chant #1075) — `chant:<stack>`, or the bare
+     * `chant` when the project sets none.
+     */
+    fieldManager?: string;
+    /**
+     * Ownership stack, when the caller already knows it and would rather not
+     * have the project config read. Ignored if `fieldManager` is set.
+     */
+    stack?: string;
+    /**
+     * Take ownership of fields another manager owns instead of failing with a
+     * `FieldManagerConflictError`. **Never defaulted on** — see chant #1075.
+     */
+    force?: boolean;
+    /**
+     * Delete chant-owned objects that are no longer declared. Default `never`.
+     * Deletes are scoped to the ownership marker, so an object chant did not
+     * stamp is never a candidate.
+     */
+    deleteMode?: ApplyDeleteMode;
+    /**
+     * Server-side dry run — every document is validated and would-be-applied,
+     * nothing is persisted, and pruning is skipped entirely (a prune candidate
+     * list computed from a state that was never written would be misleading).
+     * Optional and additive (chant #1079): `chant kube apply`'s confirmation
+     * gate uses this to preview an apply before anything mutates the cluster;
+     * Op callers keep the previous behavior by leaving it unset.
+     */
+    dryRun?: boolean;
+    /** Project directory whose `chant.config.ts` carries `ownership`. Defaults to cwd. */
+    cwd?: string;
+}
+/** One object the apply touched. */
+export interface AppliedRef {
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
 }
+/** What {@link applyManifest} did. */
+export interface ApplyManifestResult {
+    /** The field manager every object was applied as. */
+    fieldManager: string;
+    applied: AppliedRef[];
+    /** Objects deleted because they carried chant's marker and are no longer declared. */
+    pruned: AppliedRef[];
+}
+/** Read a manifest path — one file, or every YAML/JSON file in a directory. */
+export declare function readManifestDocuments(path: string): Record<string, unknown>[];
+/**
+ * The field manager to apply as: an explicit one, else `chant:<stack>` from a
+ * caller-supplied stack, else `chant:<stack>` from the project's `ownership`
+ * config, else the bare `chant`.
+ *
+ * A project config that cannot be read falls back to the bare `chant` with a
+ * warning rather than failing the apply — an activity handed a manifest path
+ * and nothing else is a supported way to call this, and its cwd need not be a
+ * chant project at all. The warning is there because a *silent* downgrade
+ * would change which fields chant owns without saying so.
+ */
+export declare function resolveFieldManager(args: KubectlApplyArgs): Promise<string>;
+/**
+ * Apply every document in `args.manifest`, then prune when asked.
+ *
+ * Returns what it did. `kubectlApply` is the registered activity and keeps its
+ * `Promise<void>` contract; this is the function `nativeApply` calls, because a
+ * dispatcher that reports "applied 12, pruned 2" is worth more than one that
+ * reports the shell command it ran.
+ */
+export declare function applyManifest(args: KubectlApplyArgs, signal?: AbortSignal, connect?: K8sConnector): Promise<ApplyManifestResult>;
 /**
- * Run `kubectl apply -f <manifest>`.
+ * Apply every document in `args.manifest`.
  * Uses longInfra profile — 20m timeout, heartbeat every 15s.
  */
-export declare function kubectlApply(args: KubectlApplyArgs, signal?: AbortSignal): Promise<void>;
+export declare function kubectlApply(args: KubectlApplyArgs, signal?: AbortSignal, connect?: K8sConnector): Promise<void>;
 //# sourceMappingURL=kubectl.d.ts.map

package/dist/op/activities/kubectl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB9F"}
+{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAI3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAoCD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAoD9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/op/activities/wait-for-ready.d.ts

@@ -1,3 +1,4 @@
+import { type K8sConnector } from "../../api/connect.js";
 /**
  * waitForReady — block until any operator-backed Kubernetes resource reports
  * ready, driven by a data-only **readiness spec** rather than per-CRD code.
@@ -5,9 +6,16 @@
  * Like `waitForArgoSync`, this activity is intentionally **dependency-light**:
  * its signature is primitives + a plain readiness spec, so a Temporal worker
  * loads it without importing the generated CRD declarable surface. It reads the
- * resource via `kubectl get -o json` (injectable for tests) and evaluates the
- * spec's predicates. It generalizes the bespoke `waitForArgoSync` /
- * `waitForStack` waits — see #365.
+ * resource and evaluates the spec's predicates. It generalizes the bespoke
+ * `waitForArgoSync` / `waitForStack` waits — see #365.
+ *
+ * chant #1074 moved the read from `kubectl get -o json` to the typed API
+ * client, so a worker image needs no `kubectl` binary. The signature is
+ * unchanged — `kind` is still whatever `kubectl get` accepts, because that is
+ * what every existing caller passes, and the client resolves it through the
+ * cluster's own API discovery exactly as kubectl does: plural, then singular,
+ * then kind, then short name, with anything after the first dot read as the
+ * API group.
  */
 /** Match a Kubernetes-style `status.conditions[]` entry by `type`. */
 export interface ConditionMatch {
@@ -72,6 +80,11 @@ export interface WaitForReadyArgs {
      * `.context` through.
      */
     context?: string;
+    /**
+     * chant environment, used to resolve `k8s.profiles.<env>.context` when no
+     * explicit `context` is given. Optional and additive.
+     */
+    environment?: string;
     /** API group, used to pick a readiness override when `spec` is not given. */
     group?: string;
     /** Explicit readiness spec — wins over the registry/default. */
@@ -81,6 +94,20 @@ export interface WaitForReadyArgs {
 }
 /** Pluggable resource reader — overridden in tests with a fake. */
 export type ResourceFetcher = (args: WaitForReadyArgs, signal?: AbortSignal) => Promise<Record<string, unknown>>;
+/**
+ * Read the resource through the typed API client.
+ *
+ * A client is built once per `waitForReady` call and reused for every poll, so
+ * a 20-minute wait does not re-parse the kubeconfig or re-invoke an exec
+ * credential plugin on each iteration — and neither does it re-run discovery,
+ * which the client caches per API version.
+ */
+export declare function apiResourceFetcher(connect?: K8sConnector): ResourceFetcher;
+/**
+ * The production reader. Each call builds its own fetcher, so nothing is
+ * shared between two unrelated waits; a single `waitForReady` passes one
+ * fetcher through all of its polls, which is where the caching matters.
+ */
 export declare const defaultResourceFetcher: ResourceFetcher;
 /**
  * Poll until the resource satisfies its readiness spec. Throws

package/dist/op/activities/wait-for-ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wait-for-ready.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait-for-ready.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;GAUG;AAIH,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACnC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAEhC;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAS7D,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnF;AAwCD,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAE3F;AAID,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAUtC,eAAO,MAAM,sBAAsB,EAAE,eAAiE,CAAC;AAEvG;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,eAAwC,GAChD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuBlC"}
+{"version":3,"file":"wait-for-ready.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait-for-ready.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AAIH,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACnC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAEhC;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAS7D,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnF;AAwCD,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAE3F;AAID,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,YAAkC,GAAG,eAAe,CAmC/F;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAAsE,CAAC;AAE5G;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,eAAsC,GAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuBlC"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAmBjG,eAAO,MAAM,SAAS,EAAE,aAilBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAsBjG,eAAO,MAAM,SAAS,EAAE,aA2mBvB,CAAC"}