@intentius/chant-lexicon-k8s 0.41.12 → 0.41.14

package/dist/describe-stack-status.d.ts

@@ -14,11 +14,18 @@
  * a caller observes with, and a mismatch would read a deployed unit as absent
  * — the failure mode the tri-state exists to prevent.
  *
- * The sweep is bounded to the kinds chant's own k8s surface deploys as
- * stack-scoped objects (workloads + the service/config plumbing around them).
- * A CRD-only unit is out of this bound and reports absent rather than null —
- * a real limit, stated here rather than papered over; widening the sweep to
- * discovery-driven kinds is a follow-up, not a silent claim.
+ * The sweep starts from the kinds chant's own k8s surface deploys as
+ * stack-scoped objects (workloads + the service/config plumbing around them),
+ * then widens to what the cluster itself serves: the CRDs (a unit that
+ * deploys definitions is a real unit — kubemicrovm-ops pins them
+ * `delete: never`), and every CRD-backed kind those definitions declare. A
+ * kubemicrovm workload stack is *entirely* custom resources, and under the
+ * fixed bound it read as absent while its VMs ran (#1528) — and because a
+ * component is live only when every unit is, that one false absence painted
+ * whole components dead. The CRD list is read unfiltered, since the unit
+ * under observation rarely owns the definitions its objects instantiate;
+ * each derived kind is then read with the same stack selector, so the cost
+ * is one label-filtered list per served CRD kind.
  */
 import type { StackStatusObservation } from "@intentius/chant/lexicon";
 import { type K8sConnector } from "./api/connect.js";

package/dist/describe-stack-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-stack-status.d.ts","sourceRoot":"","sources":["../src/describe-stack-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGvE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAgCvE,wBAAsB,mBAAmB,CACvC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAC/C,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAuCxC"}
+{"version":3,"file":"describe-stack-status.d.ts","sourceRoot":"","sources":["../src/describe-stack-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGvE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAmEvE,wBAAsB,mBAAmB,CACvC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAC/C,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAwCxC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "0f71a63f04a8cd5caef3bd561c424d4dbbf973905a82ecb10189335ce638f844",
+    "manifest.json": "ba8a86870c372520c29075795e436c0d6b75bdfcf0efa31e659d02ade4a05d65",
     "meta.json": "c0b141b882c51483c1d1aead748a0eb171aceca7432edd2a0404b062bf6d7831",
     "types/index.d.ts": "3be2af7494aca94adfa16269cb9c4e7a155529872207a3d70b0c4d39914f9eec",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "a948db9f56e3d71f3e08460320bd55fbb98aa0223e8336ca4cac1d54da0223c8"
+  "composite": "da8f0e0aec605eff3c8ca4fca6c31f3bac6f8a2e9070e7708fd97cc49daf93a6"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.41.12",
+  "version": "0.41.14",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/op/activities/index.d.ts

@@ -6,9 +6,12 @@
  *     #1075, prune chant-owned objects it no longer declares; `applyManifest`
  *     is the same work with a report of what it did, which is what the
  *     Temporal lexicon's `nativeApply` dispatcher calls for a kubectl target)
- *   - k3dUp / k3dDown — boot/tear down a local k3d cluster
  *   - waitForArgoSync — block until an Argo CD Application is Healthy && Synced
  *
+ * k3dUp / k3dDown moved again, to the k3d lexicon (chant #1410) — a lexicon
+ * owns its own product's activities, and k3d is its own product now. Projects
+ * using them list `k3d` in `lexicons`; loadActivities(["k3d"]) provides them.
+ *
  * The step builders (kubectlApply, k3dUp, k3dDown) stay in core, re-exported from
  * the temporal Op-authoring barrel like the other core builders. Each activity is
  * dependency-light — it shells out to a CLI and does not import the k8s declarable
@@ -16,8 +19,6 @@
  */
 export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl.js";
 export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl.js";
-export { k3dUp, k3dDown, k3dUpCommand, k3dDownCommand, k3dExistsCommand } from "./k3d.js";
-export type { K3dUpArgs, K3dDownArgs } from "./k3d.js";
 export { waitForArgoSync, defaultArgoStatusFetcher, ArgoSyncFailedError } from "./argo.js";
 export type { WaitForArgoSyncArgs, ArgoAppStatus, ArgoStatusFetcher } from "./argo.js";
 export { waitForReady, defaultResourceFetcher, apiResourceFetcher, ReadinessFailedError, readinessFor, isReady, firstTerminal, DEFAULT_READINESS, READINESS_OVERRIDES, } from "./wait-for-ready.js";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEpG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.41.12",
+  "version": "0.41.14",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.41.12",
+    "@intentius/chant": "^0.41.14",
     "typescript": "^5.9.3"
   }
 }

package/src/describe-stack-status.test.ts

@@ -2,13 +2,23 @@ import { describe, test, expect } from "vitest";
 import { describeStackStatus } from "./describe-stack-status";
 import type { K8sConnector } from "./api/connect";
 
-/** A connector whose client answers list() from a canned map keyed by kind. */
-function fakeConnector(byKind: Record<string, unknown[]>, opts: { failKinds?: string[]; recordSelectors?: string[] } = {}): K8sConnector {
+/**
+ * A connector whose client answers list() from a canned map keyed by kind.
+ * Selector-bearing lists model the server having filtered to the stack's
+ * objects (`byKind` holds what matched); the selector-less list is the CRD
+ * discovery read (#1528), answered from `discovery` so a test can serve
+ * definitions without them counting as the stack's own objects.
+ */
+function fakeConnector(
+  byKind: Record<string, unknown[]>,
+  opts: { failKinds?: string[]; recordSelectors?: string[]; discovery?: Record<string, unknown[]> } = {},
+): K8sConnector {
   return (async () => ({
     client: {
       async list(selector: { kind: string }, listOpts?: { labelSelector?: string }) {
-        if (listOpts?.labelSelector && opts.recordSelectors) opts.recordSelectors.push(listOpts.labelSelector);
         if (opts.failKinds?.includes(selector.kind)) throw new Error("rbac denied");
+        if (!listOpts?.labelSelector) return opts.discovery?.[selector.kind] ?? [];
+        if (opts.recordSelectors) opts.recordSelectors.push(listOpts.labelSelector);
         return byKind[selector.kind] ?? [];
       },
     },
@@ -23,6 +33,26 @@ const readyDeployment = {
 const laggingDeployment = { ...readyDeployment, status: { replicas: 2, readyReplicas: 1 } };
 const service = { kind: "Service", metadata: { name: "cc-api" } };
 
+/** A served CRD, as the discovery read returns it — not the stack's object. */
+const microvmCrd = {
+  kind: "CustomResourceDefinition",
+  metadata: { name: "microvms.lambda.aws.amazon.com" },
+  spec: {
+    group: "lambda.aws.amazon.com",
+    names: { kind: "MicroVM" },
+    versions: [{ name: "v1alpha1", served: true, storage: true }],
+  },
+};
+const runningMicroVm = {
+  kind: "MicroVM",
+  metadata: { name: "kmv-vm", labels: { "chant.intentius.io/stack": "kmv-workload" } },
+};
+const microvmReplicaSet = {
+  kind: "MicroVMReplicaSet",
+  metadata: { name: "kmv-rs", labels: { "chant.intentius.io/stack": "kmv-workload" } },
+  status: { replicas: 2, readyReplicas: 2 },
+};
+
 describe("k8s describeStackStatus (#1495 piece 3)", () => {
   test("selects on the labels chant's serializer stamps", async () => {
     const selectors: string[] = [];
@@ -68,8 +98,72 @@ describe("k8s describeStackStatus (#1495 piece 3)", () => {
   test("every read failing is indeterminate too", async () => {
     const out = await describeStackStatus(
       { environment: "local", stack: "cc" },
-      fakeConnector({}, { failKinds: ["Deployment", "StatefulSet", "DaemonSet", "Service", "ConfigMap", "Secret", "ServiceAccount", "Namespace", "Ingress", "PodDisruptionBudget", "HorizontalPodAutoscaler", "CronJob"] }),
+      fakeConnector({}, { failKinds: ["Deployment", "StatefulSet", "DaemonSet", "Service", "ConfigMap", "Secret", "ServiceAccount", "Namespace", "Ingress", "PodDisruptionBudget", "HorizontalPodAutoscaler", "CronJob", "CustomResourceDefinition"] }),
     );
     expect(out).toBeNull();
   });
 });
+
+describe("the sweep reaches what the cluster serves, not only built-ins (#1528)", () => {
+  // A kubemicrovm estate made both gaps real: its crds unit deploys nothing
+  // but definitions, its workload unit nothing but custom resources, and
+  // under the fixed bound both read absent while the estate ran — which
+  // painted every component touching them dead in `components status --live`.
+  test("a unit that deploys the definitions themselves is present", async () => {
+    const crdWithLabel = {
+      ...microvmCrd,
+      metadata: { ...microvmCrd.metadata, labels: { "chant.intentius.io/stack": "kmv-crds" } },
+    };
+    const out = await describeStackStatus(
+      { environment: "local", stack: "kmv-crds" },
+      fakeConnector({ CustomResourceDefinition: [crdWithLabel] }),
+    );
+    expect(out).toMatchObject({ present: true });
+  });
+
+  test("a unit of custom resources is present via the kinds the CRDs declare", async () => {
+    const out = await describeStackStatus(
+      { environment: "local", stack: "kmv-workload" },
+      fakeConnector({ MicroVM: [runningMicroVm] }, { discovery: { CustomResourceDefinition: [microvmCrd] } }),
+    );
+    expect(out).toMatchObject({ present: true });
+  });
+
+  test("a custom controller reporting replica readiness asserts health like a built-in", async () => {
+    const out = await describeStackStatus(
+      { environment: "local", stack: "kmv-workload" },
+      fakeConnector(
+        { MicroVMReplicaSet: [microvmReplicaSet] },
+        {
+          discovery: {
+            CustomResourceDefinition: [
+              {
+                ...microvmCrd,
+                spec: { ...microvmCrd.spec, names: { kind: "MicroVMReplicaSet" } },
+              },
+            ],
+          },
+        },
+      ),
+    );
+    expect(out).toMatchObject({ present: true, healthy: true, status: "1/1 workloads ready" });
+  });
+
+  test("an unserved or malformed CRD derives nothing and breaks nothing", async () => {
+    const out = await describeStackStatus(
+      { environment: "local", stack: "cc" },
+      fakeConnector(
+        { Deployment: [readyDeployment] },
+        {
+          discovery: {
+            CustomResourceDefinition: [
+              { kind: "CustomResourceDefinition", metadata: { name: "half" }, spec: { group: "x.io" } },
+              { ...microvmCrd, spec: { ...microvmCrd.spec, versions: [{ name: "v1", served: false }] } },
+            ],
+          },
+        },
+      ),
+    );
+    expect(out).toMatchObject({ present: true, healthy: true });
+  });
+});

package/src/describe-stack-status.ts

@@ -14,11 +14,18 @@
  * a caller observes with, and a mismatch would read a deployed unit as absent
  * — the failure mode the tri-state exists to prevent.
  *
- * The sweep is bounded to the kinds chant's own k8s surface deploys as
- * stack-scoped objects (workloads + the service/config plumbing around them).
- * A CRD-only unit is out of this bound and reports absent rather than null —
- * a real limit, stated here rather than papered over; widening the sweep to
- * discovery-driven kinds is a follow-up, not a silent claim.
+ * The sweep starts from the kinds chant's own k8s surface deploys as
+ * stack-scoped objects (workloads + the service/config plumbing around them),
+ * then widens to what the cluster itself serves: the CRDs (a unit that
+ * deploys definitions is a real unit — kubemicrovm-ops pins them
+ * `delete: never`), and every CRD-backed kind those definitions declare. A
+ * kubemicrovm workload stack is *entirely* custom resources, and under the
+ * fixed bound it read as absent while its VMs ran (#1528) — and because a
+ * component is live only when every unit is, that one false absence painted
+ * whole components dead. The CRD list is read unfiltered, since the unit
+ * under observation rarely owns the definitions its objects instantiate;
+ * each derived kind is then read with the same stack selector, so the cost
+ * is one label-filtered list per served CRD kind.
  */
 import type { StackStatusObservation } from "@intentius/chant/lexicon";
 import { LABEL_OWNERSHIP_KEYS, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
@@ -39,8 +46,43 @@ const SWEEP_KINDS: ReadonlyArray<{ apiVersion: string; kind: string }> = [
   { apiVersion: "policy/v1", kind: "PodDisruptionBudget" },
   { apiVersion: "autoscaling/v2", kind: "HorizontalPodAutoscaler" },
   { apiVersion: "batch/v1", kind: "CronJob" },
+  // The definitions themselves: a crds unit deploys these and nothing else.
+  { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition" },
 ];
 
+/**
+ * Every kind the cluster's CRDs declare, one served version each (storage
+ * preferred). Read unfiltered — see the module doc. Failure to read the CRD
+ * list narrows the sweep back to the fixed bound rather than failing it.
+ */
+async function crdBackedKinds(client: {
+  list(target: { apiVersion: string; kind: string }, opts?: object): Promise<K8sObject[]>;
+}): Promise<Array<{ apiVersion: string; kind: string }>> {
+  let crds: K8sObject[];
+  try {
+    crds = await client.list({ apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition" });
+  } catch {
+    return [];
+  }
+  const kinds: Array<{ apiVersion: string; kind: string }> = [];
+  for (const crd of crds) {
+    const spec = (crd as {
+      spec?: {
+        group?: string;
+        names?: { kind?: string };
+        versions?: Array<{ name: string; served?: boolean; storage?: boolean }>;
+      };
+    }).spec;
+    const group = spec?.group;
+    const kind = spec?.names?.kind;
+    const versions = spec?.versions ?? [];
+    const version = versions.find((v) => v.storage && v.served) ?? versions.find((v) => v.served);
+    if (!group || !kind || !version) continue;
+    kinds.push({ apiVersion: `${group}/${version.name}`, kind });
+  }
+  return kinds;
+}
+
 /** A workload is healthy when its controller reports every replica ready; a
  * kind with no readiness story (a ConfigMap, a Service) asserts nothing. */
 function objectHealthy(obj: K8sObject): boolean | undefined {
@@ -74,7 +116,8 @@ export async function describeStackStatus(
 
   const matched: K8sObject[] = [];
   let anyRead = false;
-  for (const target of SWEEP_KINDS) {
+  const targets = [...SWEEP_KINDS, ...(await crdBackedKinds(client))];
+  for (const target of targets) {
     try {
       const items = await client.list(target, { labelSelector: selector });
       anyRead = true;

package/src/lint/post-synth/post-synth.test.ts

@@ -667,6 +667,45 @@ describe("WK8204: runAsNonRoot", () => {
     expect(diags.length).toBe(0);
   });
 
+  // #1482 — the manifest arrives as real YAML, and the initContainer's args is
+  // a block scalar. The parser bug turned `- |` into the string "|" and hoisted
+  // every key after it (securityContext, the containers list itself) to the
+  // document root, so this check warned on a compliant initContainer and never
+  // saw the app container at all.
+  test("initContainer with a block-scalar arg keeps its securityContext, and the app container is still checked (#1482)", () => {
+    const yaml = [
+      "apiVersion: apps/v1",
+      "kind: Deployment",
+      "metadata:",
+      "  name: app",
+      "spec:",
+      "  template:",
+      "    spec:",
+      "      initContainers:",
+      "        - name: wait",
+      "          image: pg:16",
+      "          args:",
+      "            - |",
+      "              set -eu",
+      "              echo ready",
+      "          securityContext:",
+      "            runAsNonRoot: true",
+      "            runAsUser: 1001",
+      "      containers:",
+      "        - name: app",
+      "          image: app:1.0",
+      "          securityContext: {}",
+      "",
+    ].join("\n");
+    const ctx = makeCtx(yaml);
+    const diags = wk8204.check(ctx);
+    // The compliant initContainer produces nothing; the bare app container is
+    // the one — and the only one — that warns.
+    expect(diags.length).toBe(1);
+    expect(diags[0].message).toContain('"app"');
+    expect(diags[0].message).not.toContain("wait");
+  });
+
   test("pod-level runAsUser satisfies container-level runAsNonRoot", () => {
     const ctx = makeCtx(JSON.stringify({
       apiVersion: "apps/v1",

package/src/op/activities/index.ts

@@ -6,9 +6,12 @@
  *     #1075, prune chant-owned objects it no longer declares; `applyManifest`
  *     is the same work with a report of what it did, which is what the
  *     Temporal lexicon's `nativeApply` dispatcher calls for a kubectl target)
- *   - k3dUp / k3dDown — boot/tear down a local k3d cluster
  *   - waitForArgoSync — block until an Argo CD Application is Healthy && Synced
  *
+ * k3dUp / k3dDown moved again, to the k3d lexicon (chant #1410) — a lexicon
+ * owns its own product's activities, and k3d is its own product now. Projects
+ * using them list `k3d` in `lexicons`; loadActivities(["k3d"]) provides them.
+ *
  * The step builders (kubectlApply, k3dUp, k3dDown) stay in core, re-exported from
  * the temporal Op-authoring barrel like the other core builders. Each activity is
  * dependency-light — it shells out to a CLI and does not import the k8s declarable
@@ -17,9 +20,6 @@
 export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl";
 export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl";
 
-export { k3dUp, k3dDown, k3dUpCommand, k3dDownCommand, k3dExistsCommand } from "./k3d";
-export type { K3dUpArgs, K3dDownArgs } from "./k3d";
-
 export { waitForArgoSync, defaultArgoStatusFetcher, ArgoSyncFailedError } from "./argo";
 export type { WaitForArgoSyncArgs, ArgoAppStatus, ArgoStatusFetcher } from "./argo";
 

package/dist/op/activities/k3d.d.ts

@@ -1,44 +0,0 @@
-export interface K3dUpArgs {
-    /** Cluster name (`k3d cluster create <name>`). */
-    name: string;
-    /** Number of server (control-plane) nodes. */
-    servers?: number;
-    /** Number of agent (worker) nodes. */
-    agents?: number;
-    /** k3s image, e.g. `rancher/k3s:v1.31.4-k3s1`. */
-    image?: string;
-    /** Port mappings, e.g. `["8080:80@loadbalancer"]`. */
-    ports?: string[];
-    /** Create a managed local registry with this name (`--registry-create`). */
-    registryCreate?: string;
-    /** Path to a k3d config file (`--config`). */
-    configFile?: string;
-    /** Readiness timeout for `--wait`. Default: `120s`. */
-    timeout?: string;
-}
-export interface K3dDownArgs {
-    /** Cluster name to delete. */
-    name: string;
-}
-/** `k3d cluster list <name> --no-headers` — non-empty stdout means the cluster exists. */
-export declare function k3dExistsCommand(name: string): string;
-/**
- * Build the `k3d cluster create` command. k3d merges the new cluster into the
- * default kubeconfig and switches context by default, so no extra flags are
- * needed for the manifests to be `kubectl apply`-able afterward.
- */
-export declare function k3dUpCommand(args: K3dUpArgs): string;
-/** Build the `k3d cluster delete` command. */
-export declare function k3dDownCommand(args: K3dDownArgs): string;
-/**
- * Create a local k3d cluster (vanilla Kubernetes in Docker). Idempotent: if a
- * cluster of the same name already exists it is left as-is. Uses longInfra
- * profile — 20m timeout, heartbeat every 15s (creation may pull the k3s image).
- */
-export declare function k3dUp(args: K3dUpArgs, signal?: AbortSignal): Promise<void>;
-/**
- * Delete a local k3d cluster. Uses fastIdempotent profile — 5m timeout.
- * `k3d cluster delete` is a no-op success when the cluster is already gone.
- */
-export declare function k3dDown(args: K3dDownArgs, signal?: AbortSignal): Promise<void>;
-//# sourceMappingURL=k3d.d.ts.map

package/dist/op/activities/k3d.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"k3d.d.ts","sourceRoot":"","sources":["../../../src/op/activities/k3d.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,SAAS;IACxB,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAWpD;AAED,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAExD;AAED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhF;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIpF"}

package/src/op/activities/k3d.test.ts

@@ -1,68 +0,0 @@
-import { describe, test, expect } from "vitest";
-import { k3dUpCommand, k3dDownCommand, k3dExistsCommand } from "./k3d";
-
-describe("k3dUpCommand (#704)", () => {
-  test("minimal — name only, defaults to --wait with a 120s timeout", () => {
-    const cmd = k3dUpCommand({ name: "chant-local" });
-    expect(cmd).toBe("k3d cluster create chant-local --wait --timeout 120s");
-  });
-
-  test("servers/agents/image flags", () => {
-    const cmd = k3dUpCommand({
-      name: "dev",
-      servers: 1,
-      agents: 2,
-      image: "rancher/k3s:v1.31.4-k3s1",
-    });
-    expect(cmd).toContain("--servers 1");
-    expect(cmd).toContain("--agents 2");
-    expect(cmd).toContain("--image rancher/k3s:v1.31.4-k3s1");
-  });
-
-  test("each port becomes a quoted -p flag", () => {
-    const cmd = k3dUpCommand({
-      name: "dev",
-      ports: ["8080:80@loadbalancer", "8443:443@loadbalancer"],
-    });
-    expect(cmd).toContain('-p "8080:80@loadbalancer"');
-    expect(cmd).toContain('-p "8443:443@loadbalancer"');
-  });
-
-  test("registry and config file", () => {
-    const cmd = k3dUpCommand({
-      name: "dev",
-      registryCreate: "chant-registry",
-      configFile: "k3d.yaml",
-    });
-    expect(cmd).toContain("--registry-create chant-registry");
-    expect(cmd).toContain("--config k3d.yaml");
-  });
-
-  test("custom timeout overrides the default", () => {
-    const cmd = k3dUpCommand({ name: "dev", timeout: "300s" });
-    expect(cmd).toContain("--timeout 300s");
-    expect(cmd).not.toContain("120s");
-  });
-
-  test("zero servers is emitted (not dropped as falsy)", () => {
-    // servers: 0 is unusual but must round-trip — guarded by `!== undefined`.
-    const cmd = k3dUpCommand({ name: "dev", servers: 0 });
-    expect(cmd).toContain("--servers 0");
-  });
-});
-
-describe("k3dDownCommand (#704)", () => {
-  test("deletes the named cluster", () => {
-    expect(k3dDownCommand({ name: "chant-local" })).toBe(
-      "k3d cluster delete chant-local",
-    );
-  });
-});
-
-describe("k3dExistsCommand (#704)", () => {
-  test("lists a single cluster with no headers for an emptiness check", () => {
-    expect(k3dExistsCommand("chant-local")).toBe(
-      "k3d cluster list chant-local --no-headers",
-    );
-  });
-});

package/src/op/activities/k3d.ts

@@ -1,96 +0,0 @@
-import { exec } from "node:child_process";
-import { promisify } from "node:util";
-import { safeHeartbeat } from "@intentius/chant/op";
-
-const execAsync = promisify(exec);
-
-export interface K3dUpArgs {
-  /** Cluster name (`k3d cluster create <name>`). */
-  name: string;
-  /** Number of server (control-plane) nodes. */
-  servers?: number;
-  /** Number of agent (worker) nodes. */
-  agents?: number;
-  /** k3s image, e.g. `rancher/k3s:v1.31.4-k3s1`. */
-  image?: string;
-  /** Port mappings, e.g. `["8080:80@loadbalancer"]`. */
-  ports?: string[];
-  /** Create a managed local registry with this name (`--registry-create`). */
-  registryCreate?: string;
-  /** Path to a k3d config file (`--config`). */
-  configFile?: string;
-  /** Readiness timeout for `--wait`. Default: `120s`. */
-  timeout?: string;
-}
-
-export interface K3dDownArgs {
-  /** Cluster name to delete. */
-  name: string;
-}
-
-/** `k3d cluster list <name> --no-headers` — non-empty stdout means the cluster exists. */
-export function k3dExistsCommand(name: string): string {
-  return `k3d cluster list ${name} --no-headers`;
-}
-
-/**
- * Build the `k3d cluster create` command. k3d merges the new cluster into the
- * default kubeconfig and switches context by default, so no extra flags are
- * needed for the manifests to be `kubectl apply`-able afterward.
- */
-export function k3dUpCommand(args: K3dUpArgs): string {
-  const parts = ["k3d", "cluster", "create", args.name];
-  if (args.servers !== undefined) parts.push(`--servers ${args.servers}`);
-  if (args.agents !== undefined) parts.push(`--agents ${args.agents}`);
-  if (args.image) parts.push(`--image ${args.image}`);
-  for (const p of args.ports ?? []) parts.push(`-p "${p}"`);
-  if (args.registryCreate) parts.push(`--registry-create ${args.registryCreate}`);
-  if (args.configFile) parts.push(`--config ${args.configFile}`);
-  parts.push("--wait");
-  parts.push(`--timeout ${args.timeout ?? "120s"}`);
-  return parts.join(" ");
-}
-
-/** Build the `k3d cluster delete` command. */
-export function k3dDownCommand(args: K3dDownArgs): string {
-  return `k3d cluster delete ${args.name}`;
-}
-
-/**
- * Create a local k3d cluster (vanilla Kubernetes in Docker). Idempotent: if a
- * cluster of the same name already exists it is left as-is. Uses longInfra
- * profile — 20m timeout, heartbeat every 15s (creation may pull the k3s image).
- */
-export async function k3dUp(args: K3dUpArgs, signal?: AbortSignal): Promise<void> {
-  try {
-    const { stdout } = await execAsync(k3dExistsCommand(args.name), { signal });
-    if (stdout.trim()) {
-      console.log(`k3d cluster "${args.name}" already exists — skipping create`);
-      return;
-    }
-  } catch {
-    // `cluster list` errors when the cluster is absent — fall through to create.
-  }
-
-  const heartbeatInterval = setInterval(() => {
-    safeHeartbeat({ step: "k3d cluster create", cluster: args.name });
-  }, 15_000);
-
-  try {
-    const { stdout, stderr } = await execAsync(k3dUpCommand(args), { signal });
-    if (stdout) console.log(stdout);
-    if (stderr) console.error(stderr);
-  } finally {
-    clearInterval(heartbeatInterval);
-  }
-}
-
-/**
- * Delete a local k3d cluster. Uses fastIdempotent profile — 5m timeout.
- * `k3d cluster delete` is a no-op success when the cluster is already gone.
- */
-export async function k3dDown(args: K3dDownArgs, signal?: AbortSignal): Promise<void> {
-  const { stdout, stderr } = await execAsync(k3dDownCommand(args), { signal });
-  if (stdout) console.log(stdout);
-  if (stderr) console.error(stderr);
-}