@intentius/chant-lexicon-k8s 0.31.0 → 0.32.0

package/dist/api/classify.d.ts

@@ -37,6 +37,16 @@ export type K8sReadOutcome =
 };
 /** Classify a failure from the typed client into the observation tri-state. */
 export declare function classifyApiFailure(err: unknown): K8sReadOutcome;
+/**
+ * The cluster's own discovery reports no such kind at all — distinct from a
+ * kind that exists but currently has zero live instances. `classifyApiFailure`
+ * folds both into `absent` for the declared-entity read path, where "no
+ * instance can exist" is exactly the signal a `create` needs. `chant kube get`
+ * (chant #1079) needs the finer distinction: an ad hoc `chant kube get
+ * widgets` against a kind the cluster has never heard of should say so, not
+ * print "No resources found." as if `widgets` were a real, empty kind.
+ */
+export declare function isUnknownResource(err: unknown): boolean;
 /**
  * Whether a failure kills the whole observation rather than one entity. A
  * refused binding, a missing client package and a rejected credential plugin

package/dist/api/classify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/api/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,+EAA+E;AAC/E,MAAM,MAAM,cAAc;AACxB,kFAAkF;AAChF;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE;AACpB,4DAA4D;GAC1D;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBrE,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAwC/D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAG3D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAK5D;AAED,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,QAEuE,CAAC"}
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/api/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,+EAA+E;AAC/E,MAAM,MAAM,cAAc;AACxB,kFAAkF;AAChF;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE;AACpB,4DAA4D;GAC1D;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBrE,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAwC/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAG3D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAK5D;AAED,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,QAEuE,CAAC"}

package/dist/api/owner-chain.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Resolving a live Kubernetes object's `ownerReferences` chain up to a
+ * declared, chant-observed entity (chant #1077).
+ *
+ * There is no server-side "who ultimately owns this object" query — Kubernetes'
+ * own garbage collector does not have one either; it walks the same chain one
+ * hop at a time, reading each intermediate owner. A Pod's `ownerReferences`
+ * names its ReplicaSet, which chant never declared; the ReplicaSet's own
+ * `ownerReferences` names the Deployment, which is declared. Reaching that
+ * declared entity takes reading the ReplicaSet in between.
+ *
+ * This module's only job is assembling that chain — fetching each hop through
+ * the typed client, bounded and cycle-guarded so a corrupt or adversarial
+ * chain cannot hang an observation. The bounded/cycle-safe *interpretation* of
+ * the assembled chain (declared / unowned / foreign / unknown) is core's
+ * `classifyOwnerChain` (`@intentius/chant/owner-chain`) — the issue's own
+ * division of labor: core owns the category, the lexicon supplies the chain.
+ */
+import type { K8sClient, K8sObject } from "@intentius/chant-k8s-client";
+import { type OwnerChainVerdict } from "@intentius/chant/owner-chain";
+/** The client surface this module needs — a single object read, addressed by
+ * an owner reference's own coordinates. */
+export type OwnerChainReader = Pick<K8sClient, "readIfPresent">;
+export interface ResolveOwnerChainOptions {
+    /** uid → declared chant entity name, from this observation's own resolved entities. */
+    declaredByUid: ReadonlyMap<string, string>;
+    /** Reads each intermediate owner. */
+    reader: OwnerChainReader;
+    /**
+     * Namespace the starting object lives in. Owner references are same-namespace
+     * only — a namespaced object cannot be owned by an object in another
+     * namespace, the same rule Kubernetes' own garbage collector enforces —so
+     * every hop is read in this namespace.
+     */
+    namespace: string | undefined;
+    maxDepth?: number;
+}
+/**
+ * Walk `obj`'s owner-reference chain up to a declared entity, a foreign root,
+ * or a bound (#1077). Fetches at most `maxDepth + 1` objects (the starting
+ * object plus up to `maxDepth` ancestors) — the same bound `classifyOwnerChain`
+ * enforces when interpreting the result, so nothing is fetched that the
+ * interpretation would not have used anyway.
+ */
+export declare function resolveK8sOwnerChain(obj: K8sObject, options: ResolveOwnerChainOptions): Promise<OwnerChainVerdict>;
+//# sourceMappingURL=owner-chain.d.ts.map

package/dist/api/owner-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-chain.d.ts","sourceRoot":"","sources":["../../src/api/owner-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,8BAA8B,CAAC;AA2BtC;2CAC2C;AAC3C,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;AAEhE,MAAM,WAAW,wBAAwB;IACvC,uFAAuF;IACvF,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,qCAAqC;IACrC,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,iBAAiB,CAAC,CA8D5B"}

package/dist/api/sweep-types.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The kinds chant sweeps when nothing narrows the question.
+ *
+ * A *product* decision — what a bare `chant import` should pull back, and
+ * (chant #1075) which kinds an ownership-scoped prune has to look at to notice
+ * that a whole kind was removed from source. Not an addressing limit: since
+ * chant #1074 removed `KUBECTL_RESOURCE`, a `--selector type=<entity type>`
+ * import can name any of the ~180 types the generated operation surface
+ * carries, CRDs included.
+ *
+ * It lives in its own module, with no imports of its own, because both
+ * consumers reach it from different directions — `../export-resources.ts`
+ * pulls in the whole import parser, and a Temporal worker loading the apply
+ * activity should not.
+ */
+export declare const DEFAULT_IMPORT_TYPES: readonly string[];
+//# sourceMappingURL=sweep-types.d.ts.map

package/dist/api/sweep-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweep-types.d.ts","sourceRoot":"","sources":["../../src/api/sweep-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAoBjD,CAAC"}

package/dist/deep-observe-hooks.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The k8s lexicon's *static* deep-observation noise rules (#1076, epic #1073).
+ *
+ * Split out from `./deep-observe.ts` for one reason: this file must be safe
+ * to import from `plugin.ts` at module load time, because
+ * `LexiconPlugin.deepNormalizationHooks` is plain data core reads to
+ * normalize the *declared* tree — the half of the contract that runs whether
+ * or not a cluster is ever touched (`lifecycle diff` without `--live`,
+ * `chant build`, tests that only exercise normalization). `./deep-observe.ts`
+ * itself imports `@intentius/chant-k8s-client` for the live read, and chant
+ * #1074 made that package's reachability from the build path a structural
+ * property (`examples/k8s-client-boundary.test.ts`) rather than a lint rule —
+ * so nothing this file exports may pull that package in, directly or
+ * transitively. It imports nothing but the core contract's own types.
+ *
+ * What lives here is deliberately the *entityType-keyed, resource-agnostic*
+ * half of the rules: which fields the API server always populates regardless
+ * of what a manager wrote (`status`, `metadata.uid`, …), which fields
+ * Kubernetes defaults when a manifest is silent about them, and which arrays
+ * are sets addressed by a well-known identity (containers by name, ports by
+ * containerPort+protocol). None of that needs a live object in hand.
+ *
+ * What does *not* live here is the managed-fields prune — whether one
+ * specific field on one specific live object is chant-owned, foreign-owned,
+ * or contested. That is inherently per-object (it depends on *that* object's
+ * `metadata.managedFields`, which the declared tree never carries and which
+ * differs between two Deployments of the same type), so it cannot be
+ * expressed as a fixed rule keyed only by entity type and path — the shape
+ * every other hook in this file takes. `./deep-observe.ts` computes it once
+ * per resource and layers it on top of the rules below.
+ *
+ * The *entity-type-agnostic* half of these rules — which fields every
+ * Kubernetes API object carries regardless of kind, and the well-known
+ * list-map-key ordering conventions (containers/env/volumes/ports) — lives in
+ * `@intentius/chant/managed-fields` (chant #1087), because a GCP Config
+ * Connector custom resource is a Kubernetes object too and needs the exact
+ * same rules without depending on this lexicon's package. What stays here is
+ * only what's genuinely k8s-*lexicon*-specific: {@link K8S_SERVICE_DEFAULTS},
+ * keyed by chant's own k8s entityType catalog.
+ */
+import type { DeepNormalizationHooks } from "@intentius/chant/lexicon";
+/**
+ * Kubernetes-defaulted fields, per entity type, as index-erased property
+ * paths. Subtracted only where source never declared the property
+ * (`side === "live" && counterpart === "absent"`) — cdk-real-drift's default
+ * subtraction, same convention as AWS/Azure/Temporal's tables.
+ *
+ * Sparse and evidence-based rather than derived from the generated schema:
+ * the k8s OpenAPI spec this lexicon's codegen consumes
+ * (`lexicons/k8s/src/spec/parse.ts`) does not carry a `default` value for
+ * these fields the way ARM's schema sometimes does, so "per discovery" is not
+ * actually expressible today. Widening this table is additive and needs no
+ * contract change.
+ *
+ * `spec.strategy` is listed whole, not as `spec.strategy.type`, for the same
+ * reason Temporal's `TEMPORAL_SCHEDULE_DEFAULTS` lists `state` whole: pruning
+ * only the leaf would still recurse into the object, and a nested default the
+ * table does not separately name (`rollingUpdate.maxSurge`/`maxUnavailable`,
+ * both `"25%"` when `spec.strategy` is omitted entirely) would leave behind an
+ * empty `strategy: {}` — a value distinct from no `strategy` key at all, and
+ * itself a spurious "undeclared" finding. Matching the whole node first, before
+ * its children are ever visited, drops the wrapper outright when every field
+ * under it is exactly at its default.
+ */
+export declare const K8S_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
+/**
+ * The k8s lexicon's static noise rules: the generic Kubernetes object
+ * envelope (unconditional, by pattern, `@intentius/chant/managed-fields`) and
+ * Kubernetes-defaulted fields (gated on `counterpart === "absent"`), plus the
+ * array orderings the acceptance criteria name — `x-kubernetes-patch-merge-
+ * key`/`list-map-keys` conventions the generated surface does not currently
+ * carry (see the module doc), so these are the "else named-by-name
+ * conventions" the issue calls for: containers by `name`, `env` by `name`,
+ * `volumes` by `name`, container/service `ports` by `containerPort`/`port` +
+ * `protocol` — the same conventions `@intentius/chant/managed-fields`'s
+ * `k8sListMapOrderKey` implements, reused verbatim.
+ *
+ * This is the object `k8sPlugin.deepNormalizationHooks` is. It is also what
+ * `./deep-observe.ts` layers its per-resource managed-fields prune on top of,
+ * so the two normalization passes (the reader's own, and core's later
+ * re-normalization of both the declared and the already-normalized live tree
+ * — see `packages/core/src/lifecycle/deep-observe.ts`) apply the identical
+ * entityType-keyed rules either way.
+ */
+export declare const k8sDeepNormalizationHooks: DeepNormalizationHooks;
+//# sourceMappingURL=deep-observe-hooks.d.ts.map

package/dist/deep-observe-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAY,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGjF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcxE,CAAC;AAaF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAWvC,CAAC"}

package/dist/deep-observe.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Kubernetes deep observation (#1076) — the k8s row of the deep-observe
+ * contract (#1014), and the epic's (#1073) thesis made real: chant compiled
+ * the manifest, so it knows which fields it authored; the API server records,
+ * per field, which manager last wrote it (`metadata.managedFields`, chant
+ * #1075/#1178). Intersecting those two makes Kubernetes drift *derived*
+ * rather than the hand-maintained `ignoreDifferences` list every Argo user
+ * keeps.
+ *
+ * ## Why this is not "the AWS reader, with `kubectl get` instead of Cloud
+ * Control"
+ *
+ * AWS, Azure and Temporal's rows all prune by a **static, entityType-keyed**
+ * table: an ARN always looks like an ARN, `provisioningState` is always
+ * server-populated, a namespace's retention default is always the same
+ * value. None of that needs the specific live object in hand — it is exactly
+ * what `./deep-observe-hooks.ts`'s `k8sDeepNormalizationHooks` is, and it
+ * covers Kubernetes' *equivalent* static noise (`status`,
+ * `metadata.{uid,resourceVersion,generation,creationTimestamp}`, a handful of
+ * server-defaulted pod-spec fields).
+ *
+ * managedFields is not that kind of rule. Whether `spec.replicas` is noise on
+ * *this* Deployment depends on whether *this* Deployment's
+ * `metadata.managedFields` says a controller owns it — a fact that differs
+ * between two Deployments of the same type, and that the declared tree never
+ * carries at all (chant's source has no `managedFields` key to normalize).
+ * `DeepNormalizationHooks.prune` cannot see the object it is walking, only a
+ * path and a value, so this cannot be expressed as a fixed hook the way the
+ * other three rows' entire contribution is. It has to be computed once per
+ * resource, here, and layered on top of the static rules before the tree is
+ * normalized.
+ *
+ * ## The contested-field rule, precisely
+ *
+ * For every path on the live tree, three questions, each independent:
+ *
+ * 1. **Does any chant field manager (`chant`, `chant:<stack>` — chant #1075,
+ *    matched on the family so a stack rename does not stop recognizing its
+ *    own history) own this path?** If so it is chant's business regardless of
+ *    what else is true — always diffable, never pruned by this rule.
+ * 2. **Does some *other* manager own this path, and chant does not?** That is
+ *    controller-managed noise — HPA rewriting `spec.replicas`, a mutating
+ *    webhook defaulting a field, `kubectl-client-side-apply` from a human
+ *    operator — *provided* nobody declared it (next question). Prune it.
+ * 3. **Does chant's own manifest *also* set this path?** — independent of
+ *    who currently owns it live. This is the case the issue calls out by
+ *    name: **a contested field chant declared is drift-relevant.** The
+ *    reasoning: chant's source is a statement of intent regardless of
+ *    whether a previous apply is what currently holds the field, and a
+ *    foreign write that overrides a value chant's manifest asks for is
+ *    exactly the thing `lifecycle diff --live` exists to surface — silencing
+ *    it because *something else* currently owns the field would hide the one
+ *    case where chant and the cluster disagree about a property chant is
+ *    actively declaring. So: foreign-owned *and* declared is never pruned by
+ *    this rule, whatever #2 would otherwise do.
+ *
+ * `counterpart: "unknown"` and why it does not help here: core's own
+ * counterpart tri-state (`side === "live" && counterpart === "absent"`, what
+ * {@link K8S_SERVICE_DEFAULTS} is gated on) answers "did the *declared tree*
+ * carry this path at all" — which is exactly question 3, but it is computed
+ * by *core*, from the raw declared and raw live trees, only on the **second**
+ * normalization pass (`packages/core/src/lifecycle/deep-observe.ts`'s
+ * `diffDeepObservation`). This reader's own call to
+ * {@link normalizeDeepProperties} runs first, with no `counterpartPaths`
+ * supplied — same as the other three rows — so `counterpart` is `"unknown"`
+ * for every node here, and a rule gated on `"absent"` would never fire during
+ * this read at all. That is fine for a table keyed only by entityType (AWS's
+ * service defaults are subtracted on core's later pass, not this one), but it
+ * is *not* fine for the managed-fields rule: if this reader left
+ * `spec.replicas` in the tree waiting for core's second pass to prune it,
+ * core would be normalizing with the *static* `k8sDeepNormalizationHooks`,
+ * which has no managedFields for this object in hand either (this reader
+ * already computed its ownership sets from data it read once and does not
+ * return). So question 3 is answered **here**, directly against the declared
+ * `props` this reader was handed — not via `counterpart` — and the result is
+ * baked into what this reader returns: a foreign-owned, undeclared field is
+ * gone from the tree before it ever reaches core, and a contested one is
+ * still there for the ordinary declared-vs-live comparison to catch.
+ *
+ * ## Resolving a managedFields entry against a live array
+ *
+ * `metadata.managedFields[].fieldsV1` encodes a list item three ways —
+ * `k:{"name":"web"}` (by key), `v:"blue"` (by value), `i:3` (by index) — and
+ * chant #1178's `managed-fields.ts` renders all three to a path *string*
+ * (`.spec.containers[name="web"]`) for display. Parsing that string back
+ * would be ambiguous in general (a label key may itself contain `.`, e.g.
+ * `app.kubernetes.io/name`, indistinguishable in the rendered form from
+ * nested fields), so this reader does not parse strings at all: it walks the
+ * *structured* `fieldsV1` tree directly (`walkOwnership`, below), matching
+ * each `k:`/`v:` entry against the actual live array to find the concrete
+ * index, and against the actual declared array (by the same key or value) to
+ * answer question 3 for that element specifically — a declared container
+ * named `app` at index 0 is still "declared" if a sidecar gets injected in
+ * front of it and shifts it to live index 1.
+ *
+ * ## What is deliberately not modeled
+ *
+ * A manager's `.` entry (SSA's "I own this element's presence") on a
+ * container that also sets no scalar sub-fields (unusual — a real apply
+ * setting a container almost always sets `image`/`name` too) would not confer
+ * ownership onto a sibling field nobody's `fieldsV1` entry lists explicitly.
+ * That is the conservative direction: a path absent from every manager's
+ * fields is treated as "no ownership information", which leaves it diffable
+ * rather than silently pruned. Reported drift that turns out to be more
+ * noise than expected is a tuning problem; drift silently dropped is not.
+ *
+ * ## `buildOwnershipSets` lives in core now
+ *
+ * The ownership walk itself (`walkOwnership`, resolving a `fieldsV1` tree
+ * against the live and declared trees) has nothing k8s-*lexicon*-specific
+ * about it — it is generic Kubernetes SSA machinery. Chant #1087 (GCP's row,
+ * reusing this one, since a Config Connector CR is a Kubernetes object too)
+ * moved it to `@intentius/chant/managed-fields` rather than have gcp depend
+ * on this lexicon's package, the same reason chant #1100's
+ * `resolveClusterTarget` lives in core. This module re-exports
+ * `buildOwnershipSets`/`OwnershipSets` from there so nothing here changes for
+ * an existing importer of this file.
+ */
+import type { DeepObservationResult } from "@intentius/chant/lexicon";
+import { buildOwnershipSets, type OwnershipSets } from "@intentius/chant/managed-fields";
+import { type K8sConnector } from "./api/connect.js";
+import { k8sDeepNormalizationHooks } from "./deep-observe-hooks.js";
+export { k8sDeepNormalizationHooks, buildOwnershipSets, type OwnershipSets };
+export interface K8sDeepObserveOptions {
+    environment: string;
+    buildOutput?: string;
+    entityNames: string[];
+    entities: Map<string, {
+        entityType: string;
+        props: Record<string, unknown>;
+    }>;
+    stack?: string;
+    owned?: boolean;
+    /** Directory whose `chant.config.ts` carries the cluster binding. Defaults to cwd. */
+    cwd?: string;
+}
+/**
+ * Read the live property tree for each declared entity, pruning by
+ * `metadata.managedFields` (see the module doc). Reuses the same connector,
+ * discovery/caching client and tri-state failure classification as the thin
+ * read (`./describe-resources.ts`) — the binding check (chant #1100/#1155)
+ * still refuses before any resource is touched, and a connect failure still
+ * becomes NOT-OBSERVED for every declared entity rather than an empty result.
+ */
+export declare function observeResourcesDeepK8s(options: K8sDeepObserveOptions, connect?: K8sConnector): Promise<DeepObservationResult>;
+//# sourceMappingURL=deep-observe.d.ts.map

package/dist/deep-observe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqHG;AAGH,OAAO,KAAK,EAEV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAoB,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC3G,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AASjE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAuBD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CA0GhC"}

package/dist/describe-resources.d.ts

@@ -35,6 +35,21 @@
  * NOT-OBSERVED with a reason. A declared `k8s.profiles.<env>.context` that
  * disagrees with the ambient one still refuses before a single resource is
  * touched, via the same `resolveClusterTarget` the GCP lexicon shares.
+ *
+ * ## Runtime children (chant #1077)
+ *
+ * A Pod a declared Deployment's controller created is live and undeclared —
+ * exactly the shape `lifecycle diff --live` has always classified `orphan`.
+ * On Kubernetes that is wrong: it is expected runtime, not drift, and will be
+ * recreated the moment it is deleted. After the declared-entity reads above
+ * resolve, this scans Pods in the namespaces they actually live in and walks
+ * each one's `ownerReferences` chain (`./api/owner-chain.ts`) against the
+ * entities this very call resolved. A chain reaching one of them is reported
+ * with `ownerChain: { root: "declared", ... }`; core's diff/change-set engine
+ * reads that as `runtime` instead of `orphan`. Deliberately scoped to Pods —
+ * the concrete case the issue and its acceptance criteria name — and to the
+ * namespaces this observation already touched, not a cluster-wide sweep;
+ * widening to other controller-spawned kinds is the same walk repeated.
  */
 import type { ObservationResult } from "@intentius/chant/lexicon";
 import type { K8sObject } from "@intentius/chant-k8s-client";

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAGtG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAiBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAUvD;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAmH5B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAGtG,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAkBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAUvD;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAqH5B"}

package/dist/export-resources.d.ts

@@ -18,12 +18,16 @@
  */
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
 import { type K8sConnector } from "./api/connect.js";
+import { DEFAULT_IMPORT_TYPES } from "./api/sweep-types.js";
 /**
  * Entity types a bare `chant import --from <cluster>` sweeps: the workload,
  * config, networking and RBAC kinds people actually author. Everything else is
- * reachable by naming it with `--selector type=...`.
+ * reachable by naming it with `--selector type=...`. Defined in
+ * `./api/sweep-types.ts` and re-exported here, its original home — chant
+ * #1075's ownership-scoped prune needs the same list without pulling the
+ * import parser into a Temporal worker.
  */
-export declare const DEFAULT_IMPORT_TYPES: readonly string[];
+export { DEFAULT_IMPORT_TYPES };
 export declare function exportResources(options: {
     environment: string;
     selector?: ResourceSelector;

package/dist/export-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAIvE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAoBjD,CAAC;AAEF,wBAAsB,eAAe,CACnC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,EACD,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,gBAAgB,CAAC,CA4B3B"}
+{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAGvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,wBAAsB,eAAe,CACnC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,EACD,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,gBAAgB,CAAC,CA4B3B"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "be792b33ca067c06a359ee06d250f08fc9ae3401507ee275c18568cfc5e55483",
+    "manifest.json": "115699ca99d75d4b540b73fc2bbae4ca9b2c10a58e2229d24f72571b9daee693",
     "meta.json": "6d112006daa7196eb28619ac5a3893b709dc2b845edbd537db7d7b471e8dc104",
     "types/index.d.ts": "7b873148146a5512c22baabfde6cfcc3248c24c2c7578f68a19544af5dc675f6",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "3620d7f17ce6375203ab8de306d37be7d96b1e5658c883acbf908307d52d2703"
+  "composite": "57c3eed6bb041d08264adcedaa5e166e624257e15c6d8121053cc945e7d212f3"
 }

package/dist/kube/apply.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `chant kube apply` (chant #1079) — "writes are not cloned": this calls
+ * `applyManifest` (`../op/activities/kubectl.ts`) directly, the exact
+ * function the k8s Op activity registers under `kubectlApply` — server-side
+ * apply, chant's field-manager identity, the same `FieldManagerConflictError`
+ * surface (chant #1075/#1178) — never a second implementation of `kubectl
+ * apply`. An explicit manifest path is mandatory; there is no bare-sweep form.
+ *
+ * The one thing this verb adds on top of the activity is a confirmation
+ * gate, matching the issue's "route through plan, gate, and ownership": a
+ * bare `chant kube apply -f x.yaml` performs a server-side dry run — every
+ * document validated and previewed, nothing persisted — and says so; only
+ * `--yes` performs the real, persisting apply. That is a deliberate
+ * divergence from `kubectl apply`, which persists by default; a terminal
+ * command that can rewrite a live Deployment is worth one extra keystroke of
+ * intent.
+ */
+import { type K8sConnector } from "../api/connect.js";
+import { type KubectlApplyArgs, type ApplyManifestResult } from "../op/activities/kubectl.js";
+export type ApplyFn = (args: KubectlApplyArgs, signal?: AbortSignal, connect?: K8sConnector) => Promise<ApplyManifestResult>;
+export interface ApplyDeps {
+    connect?: K8sConnector;
+    apply?: ApplyFn;
+}
+export declare function runApply(rawArgs: string[], deps?: ApplyDeps): Promise<number>;
+//# sourceMappingURL=apply.d.ts.map

package/dist/kube/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/kube/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAiB,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG1G,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE7H,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoEvF"}

package/dist/kube/connect.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Connecting to a cluster on `chant kube`'s behalf (chant #1079), honoring
+ * the exact same environment→cluster binding every other observing path
+ * does (chant #1100/#1155): `--env` resolves `k8s.profiles.<env>.context`
+ * and refuses loudly on a mismatch, `--context` is an explicit override that
+ * skips the binding entirely, and neither given falls back to the ambient
+ * kubeconfig context — the same three modes `describeResources` and the Op
+ * activities already use, via the same `defaultK8sConnector`. Nothing here
+ * reimplements that resolution; this only turns a connect failure into the
+ * observation tri-state so a verb can render NOT-OBSERVED-with-reason
+ * instead of a stack trace.
+ */
+import type { UnobservedReason } from "@intentius/chant/observation";
+import { type ConnectOptions, type ConnectedClient, type K8sConnector } from "../api/connect.js";
+export type KubeConnectResult = ({
+    kind: "connected";
+} & ConnectedClient) | {
+    kind: "unobserved";
+    reason: UnobservedReason;
+    detail: string;
+};
+/**
+ * Connect, or classify the failure into the tri-state. A bound-but-mismatched
+ * `--env` (`ClusterBindingMismatchError`), a missing `@intentius/chant-k8s-client`
+ * install, and a refused exec-credential plugin are the "nothing left the
+ * process" failures every verb must treat identically: NOT-OBSERVED, never
+ * an empty/absent result.
+ */
+export declare function kubeConnect(options: ConnectOptions, connect?: K8sConnector): Promise<KubeConnectResult>;
+//# sourceMappingURL=connect.d.ts.map

package/dist/kube/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/kube/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAuB,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnH,MAAM,MAAM,iBAAiB,GACzB,CAAC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG,eAAe,CAAC,GACzC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAqB5B"}

package/dist/kube/delete.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `chant kube delete` (chant #1079) — routes through the typed client's own
+ * `delete()` (`packages/k8s-client/src/client.ts`), the identical typed
+ * delete `applyManifest`'s prune step already uses (chant #1075) — never a
+ * second implementation. A kind and a name are both mandatory: there is no
+ * bare `chant kube delete deployments` form, so nothing here can become a
+ * sweep by omission (the issue's "nothing destructive happens without an
+ * explicit resource argument").
+ *
+ * Two guardrails on top of the typed delete itself:
+ *
+ * - **Gate.** A bare invocation reads the object, reports what it found (and
+ *   whether chant owns it), and stops — only `--yes` performs the delete.
+ * - **Ownership, surfaced not enforced.** kubectl itself deletes anything
+ *   RBAC allows, chant-applied or not, and this keeps that: an explicit name
+ *   is already an informed decision. What's added is visibility — a
+ *   warning when the object carries no chant ownership marker, so the
+ *   operator knows they are about to delete something chant did not apply.
+ */
+import { type K8sConnector } from "../api/connect.js";
+import { type KubeProjectContext } from "./project.js";
+export interface DeleteDeps {
+    connect?: K8sConnector;
+    loadProject?: (cwd?: string) => Promise<KubeProjectContext | undefined>;
+}
+export declare function runDelete(rawArgs: string[], deps?: DeleteDeps): Promise<number>;
+//# sourceMappingURL=delete.d.ts.map

package/dist/kube/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../src/kube/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAIxE,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG5E,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACzE;AAQD,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA0GzF"}

package/dist/kube/describe.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `chant kube describe` (chant #1079) — a generic, multi-section human view:
+ * identity, chant's own verdict + provenance (when inside a project), a
+ * pretty-printed spec/status, and the object's Events (reusing `./events.ts`'s
+ * `listEvents`/`filterInvolved`, the same machinery `chant kube events`
+ * itself uses — one implementation, not two). This is not kubectl's
+ * per-kind template set (`OldReplicaSets`/`NewReplicaSet` for a Deployment,
+ * per-container detail for a Pod, and so on for every built-in kind) — a
+ * generic describe covering the fields every object carries, plus the
+ * context only chant can add.
+ */
+import { type K8sConnector } from "../api/connect.js";
+import { type KubeProjectContext } from "./project.js";
+export interface DescribeDeps {
+    connect?: K8sConnector;
+    loadProject?: (cwd?: string) => Promise<KubeProjectContext | undefined>;
+}
+export declare function runDescribe(rawArgs: string[], deps?: DescribeDeps): Promise<number>;
+//# sourceMappingURL=describe.d.ts.map

package/dist/kube/describe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../src/kube/describe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKxE,OAAO,EAA8C,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAMhG,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACzE;AA0ED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4F7F"}

package/dist/kube/events.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `chant kube events` (chant #1079) — the core `v1 Event` kind is addressed
+ * exactly like any other read (`client.list`), no client extension needed.
+ * The one thing the typed client's `ListOptions` does not carry is a field
+ * selector, so `--for <kind>/<name>` (kubectl's own `kubectl events
+ * --for=kind/name` shape) filters client-side against `involvedObject` after
+ * the list comes back, rather than asking the server to. Event volume in a
+ * single namespace is small enough that this is a fine trade for not
+ * widening the client's surface for one caller.
+ */
+import type { K8sClient, K8sObject } from "@intentius/chant-k8s-client";
+import { type K8sConnector } from "../api/connect.js";
+export interface EventsDeps {
+    connect?: K8sConnector;
+}
+/** Events whose `involvedObject` names `ref`, oldest first — kubectl's own default order. */
+export declare function filterInvolved(events: readonly K8sObject[], ref: {
+    kind: string;
+    name: string;
+}): K8sObject[];
+/**
+ * List Events for `namespace` (or every namespace, when `namespace` is
+ * undefined), sorted oldest first. Shared by `runEvents` and `describe`'s own
+ * Events section, so the two verbs agree on what "the events for this object"
+ * means.
+ */
+export declare function listEvents(client: K8sClient, options?: {
+    namespace?: string;
+    labelSelector?: string;
+}): Promise<K8sObject[]>;
+/** Render an events table — reused by `describe`'s Events section. */
+export declare function renderEvents(events: readonly K8sObject[]): string;
+export declare function runEvents(rawArgs: string[], deps?: EventsDeps): Promise<number>;
+//# sourceMappingURL=events.d.ts.map

package/dist/kube/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/kube/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAMxE,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAoBD,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,EAAE,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,CAK7G;AAaD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3D,OAAO,CAAC,SAAS,EAAE,CAAC,CAMtB;AAcD,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAGjE;AASD,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAyDzF"}

package/dist/kube/flags.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Flag parsing shared by every `chant kube <verb>` (chant #1079).
+ *
+ * `CommandGroupContext.rawArgs` is unparsed argv — core has no vocabulary for
+ * a lexicon's own verbs (chant #1078) — so every verb here does its own
+ * parsing, reusing `splitJoinedFlags`/`unknownFlagError` for the same
+ * `--flag=value` splitting and rejection discipline core's own parser
+ * applies (chant #1127). This module adds the flag vocabulary every verb
+ * shares (namespace, selector, output, cluster targeting) so each verb file
+ * only has to declare what is actually its own (`--tail`, `--for`, ...).
+ */
+import type { ConnectOptions } from "../api/connect.js";
+/** A verb's own flag vocabulary, merged with the common set below. */
+export interface FlagSpec {
+    /** Value flags this verb accepts, alias → canonical key (e.g. `{ "--tail": "tail" }`). */
+    value?: Record<string, string>;
+    /** Boolean flags this verb accepts, alias → canonical key. */
+    boolean?: Record<string, string>;
+}
+export interface ParsedFlags {
+    /** Non-flag tokens, in order — the verb's own positional arguments (kind, name, ...). */
+    positional: string[];
+    /** Resolved value-flag key → the value given. */
+    values: Record<string, string>;
+    /** Resolved boolean-flag key → true (absent keys are false). */
+    flags: Record<string, boolean>;
+}
+/**
+ * Parse `rawArgs` against the common flag set plus `spec`. Throws
+ * {@link unknownFlagError}'s shape on anything starting with `-` that
+ * neither set recognizes, and on a value flag given with nothing after it.
+ */
+export declare function parseKubeFlags(rawArgs: string[], spec?: FlagSpec): ParsedFlags;
+/** Build the typed client's `ConnectOptions` from a parsed common flag set. */
+export declare function connectOptionsFrom(values: Record<string, string>): ConnectOptions;
+/** kubectl duration shorthand: "3600" (bare seconds), "1h", "90m", "45s". Shared by `logs --since` and `wait --timeout`. */
+export declare function parseDurationSeconds(value: string): number;
+/** {@link parseDurationSeconds} in milliseconds. */
+export declare function parseDurationMs(value: string): number;
+//# sourceMappingURL=flags.d.ts.map

package/dist/kube/flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../../src/kube/flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,sEAAsE;AACtE,MAAM,WAAW,QAAQ;IACvB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAoBD,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,QAAa,GAAG,WAAW,CA6BlF;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,cAAc,CAMjF;AAED,4HAA4H;AAC5H,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAY1D;AAED,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD"}