@intentius/chant-lexicon-k8s 0.41.13 → 0.41.15

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "9ba4951b328537999953cb55679d420add94305817fab50d31b487841236689f",
+    "manifest.json": "de51ffb566f7b4346cfb33021dbca84d7e7d7a3d0c096640dbe1d38f831187ee",
     "meta.json": "c0b141b882c51483c1d1aead748a0eb171aceca7432edd2a0404b062bf6d7831",
     "types/index.d.ts": "3be2af7494aca94adfa16269cb9c4e7a155529872207a3d70b0c4d39914f9eec",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "3ad81fead558e4d2546ec00f031acaaa0fb4c1800794a5147b2cd0b20d9ef4ed"
+  "composite": "2a0b689bdb3e0a2d672e703b751bf91685ee52070385d52fb03c997cc06afb36"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.41.13",
+  "version": "0.41.15",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/op/activities/index.d.ts

@@ -6,9 +6,12 @@
  *     #1075, prune chant-owned objects it no longer declares; `applyManifest`
  *     is the same work with a report of what it did, which is what the
  *     Temporal lexicon's `nativeApply` dispatcher calls for a kubectl target)
- *   - k3dUp / k3dDown — boot/tear down a local k3d cluster
  *   - waitForArgoSync — block until an Argo CD Application is Healthy && Synced
  *
+ * k3dUp / k3dDown moved again, to the k3d lexicon (chant #1410) — a lexicon
+ * owns its own product's activities, and k3d is its own product now. Projects
+ * using them list `k3d` in `lexicons`; loadActivities(["k3d"]) provides them.
+ *
  * The step builders (kubectlApply, k3dUp, k3dDown) stay in core, re-exported from
  * the temporal Op-authoring barrel like the other core builders. Each activity is
  * dependency-light — it shells out to a CLI and does not import the k8s declarable
@@ -16,8 +19,6 @@
  */
 export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl.js";
 export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl.js";
-export { k3dUp, k3dDown, k3dUpCommand, k3dDownCommand, k3dExistsCommand } from "./k3d.js";
-export type { K3dUpArgs, K3dDownArgs } from "./k3d.js";
 export { waitForArgoSync, defaultArgoStatusFetcher, ArgoSyncFailedError } from "./argo.js";
 export type { WaitForArgoSyncArgs, ArgoAppStatus, ArgoStatusFetcher } from "./argo.js";
 export { waitForReady, defaultResourceFetcher, apiResourceFetcher, ReadinessFailedError, readinessFor, isReady, firstTerminal, DEFAULT_READINESS, READINESS_OVERRIDES, } from "./wait-for-ready.js";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEpG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.41.13",
+  "version": "0.41.15",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.41.13",
+    "@intentius/chant": "^0.41.15",
     "typescript": "^5.9.3"
   }
 }

package/src/lint/post-synth/post-synth.test.ts

@@ -667,6 +667,45 @@ describe("WK8204: runAsNonRoot", () => {
     expect(diags.length).toBe(0);
   });
 
+  // #1482 — the manifest arrives as real YAML, and the initContainer's args is
+  // a block scalar. The parser bug turned `- |` into the string "|" and hoisted
+  // every key after it (securityContext, the containers list itself) to the
+  // document root, so this check warned on a compliant initContainer and never
+  // saw the app container at all.
+  test("initContainer with a block-scalar arg keeps its securityContext, and the app container is still checked (#1482)", () => {
+    const yaml = [
+      "apiVersion: apps/v1",
+      "kind: Deployment",
+      "metadata:",
+      "  name: app",
+      "spec:",
+      "  template:",
+      "    spec:",
+      "      initContainers:",
+      "        - name: wait",
+      "          image: pg:16",
+      "          args:",
+      "            - |",
+      "              set -eu",
+      "              echo ready",
+      "          securityContext:",
+      "            runAsNonRoot: true",
+      "            runAsUser: 1001",
+      "      containers:",
+      "        - name: app",
+      "          image: app:1.0",
+      "          securityContext: {}",
+      "",
+    ].join("\n");
+    const ctx = makeCtx(yaml);
+    const diags = wk8204.check(ctx);
+    // The compliant initContainer produces nothing; the bare app container is
+    // the one — and the only one — that warns.
+    expect(diags.length).toBe(1);
+    expect(diags[0].message).toContain('"app"');
+    expect(diags[0].message).not.toContain("wait");
+  });
+
   test("pod-level runAsUser satisfies container-level runAsNonRoot", () => {
     const ctx = makeCtx(JSON.stringify({
       apiVersion: "apps/v1",

package/src/op/activities/index.ts

@@ -6,9 +6,12 @@
  *     #1075, prune chant-owned objects it no longer declares; `applyManifest`
  *     is the same work with a report of what it did, which is what the
  *     Temporal lexicon's `nativeApply` dispatcher calls for a kubectl target)
- *   - k3dUp / k3dDown — boot/tear down a local k3d cluster
  *   - waitForArgoSync — block until an Argo CD Application is Healthy && Synced
  *
+ * k3dUp / k3dDown moved again, to the k3d lexicon (chant #1410) — a lexicon
+ * owns its own product's activities, and k3d is its own product now. Projects
+ * using them list `k3d` in `lexicons`; loadActivities(["k3d"]) provides them.
+ *
  * The step builders (kubectlApply, k3dUp, k3dDown) stay in core, re-exported from
  * the temporal Op-authoring barrel like the other core builders. Each activity is
  * dependency-light — it shells out to a CLI and does not import the k8s declarable
@@ -17,9 +20,6 @@
 export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl";
 export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl";
 
-export { k3dUp, k3dDown, k3dUpCommand, k3dDownCommand, k3dExistsCommand } from "./k3d";
-export type { K3dUpArgs, K3dDownArgs } from "./k3d";
-
 export { waitForArgoSync, defaultArgoStatusFetcher, ArgoSyncFailedError } from "./argo";
 export type { WaitForArgoSyncArgs, ArgoAppStatus, ArgoStatusFetcher } from "./argo";
 

package/dist/op/activities/k3d.d.ts

@@ -1,44 +0,0 @@
-export interface K3dUpArgs {
-    /** Cluster name (`k3d cluster create <name>`). */
-    name: string;
-    /** Number of server (control-plane) nodes. */
-    servers?: number;
-    /** Number of agent (worker) nodes. */
-    agents?: number;
-    /** k3s image, e.g. `rancher/k3s:v1.31.4-k3s1`. */
-    image?: string;
-    /** Port mappings, e.g. `["8080:80@loadbalancer"]`. */
-    ports?: string[];
-    /** Create a managed local registry with this name (`--registry-create`). */
-    registryCreate?: string;
-    /** Path to a k3d config file (`--config`). */
-    configFile?: string;
-    /** Readiness timeout for `--wait`. Default: `120s`. */
-    timeout?: string;
-}
-export interface K3dDownArgs {
-    /** Cluster name to delete. */
-    name: string;
-}
-/** `k3d cluster list <name> --no-headers` — non-empty stdout means the cluster exists. */
-export declare function k3dExistsCommand(name: string): string;
-/**
- * Build the `k3d cluster create` command. k3d merges the new cluster into the
- * default kubeconfig and switches context by default, so no extra flags are
- * needed for the manifests to be `kubectl apply`-able afterward.
- */
-export declare function k3dUpCommand(args: K3dUpArgs): string;
-/** Build the `k3d cluster delete` command. */
-export declare function k3dDownCommand(args: K3dDownArgs): string;
-/**
- * Create a local k3d cluster (vanilla Kubernetes in Docker). Idempotent: if a
- * cluster of the same name already exists it is left as-is. Uses longInfra
- * profile — 20m timeout, heartbeat every 15s (creation may pull the k3s image).
- */
-export declare function k3dUp(args: K3dUpArgs, signal?: AbortSignal): Promise<void>;
-/**
- * Delete a local k3d cluster. Uses fastIdempotent profile — 5m timeout.
- * `k3d cluster delete` is a no-op success when the cluster is already gone.
- */
-export declare function k3dDown(args: K3dDownArgs, signal?: AbortSignal): Promise<void>;
-//# sourceMappingURL=k3d.d.ts.map

package/dist/op/activities/k3d.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"k3d.d.ts","sourceRoot":"","sources":["../../../src/op/activities/k3d.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,SAAS;IACxB,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAWpD;AAED,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAExD;AAED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhF;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIpF"}

package/src/op/activities/k3d.test.ts

@@ -1,68 +0,0 @@
-import { describe, test, expect } from "vitest";
-import { k3dUpCommand, k3dDownCommand, k3dExistsCommand } from "./k3d";
-
-describe("k3dUpCommand (#704)", () => {
-  test("minimal — name only, defaults to --wait with a 120s timeout", () => {
-    const cmd = k3dUpCommand({ name: "chant-local" });
-    expect(cmd).toBe("k3d cluster create chant-local --wait --timeout 120s");
-  });
-
-  test("servers/agents/image flags", () => {
-    const cmd = k3dUpCommand({
-      name: "dev",
-      servers: 1,
-      agents: 2,
-      image: "rancher/k3s:v1.31.4-k3s1",
-    });
-    expect(cmd).toContain("--servers 1");
-    expect(cmd).toContain("--agents 2");
-    expect(cmd).toContain("--image rancher/k3s:v1.31.4-k3s1");
-  });
-
-  test("each port becomes a quoted -p flag", () => {
-    const cmd = k3dUpCommand({
-      name: "dev",
-      ports: ["8080:80@loadbalancer", "8443:443@loadbalancer"],
-    });
-    expect(cmd).toContain('-p "8080:80@loadbalancer"');
-    expect(cmd).toContain('-p "8443:443@loadbalancer"');
-  });
-
-  test("registry and config file", () => {
-    const cmd = k3dUpCommand({
-      name: "dev",
-      registryCreate: "chant-registry",
-      configFile: "k3d.yaml",
-    });
-    expect(cmd).toContain("--registry-create chant-registry");
-    expect(cmd).toContain("--config k3d.yaml");
-  });
-
-  test("custom timeout overrides the default", () => {
-    const cmd = k3dUpCommand({ name: "dev", timeout: "300s" });
-    expect(cmd).toContain("--timeout 300s");
-    expect(cmd).not.toContain("120s");
-  });
-
-  test("zero servers is emitted (not dropped as falsy)", () => {
-    // servers: 0 is unusual but must round-trip — guarded by `!== undefined`.
-    const cmd = k3dUpCommand({ name: "dev", servers: 0 });
-    expect(cmd).toContain("--servers 0");
-  });
-});
-
-describe("k3dDownCommand (#704)", () => {
-  test("deletes the named cluster", () => {
-    expect(k3dDownCommand({ name: "chant-local" })).toBe(
-      "k3d cluster delete chant-local",
-    );
-  });
-});
-
-describe("k3dExistsCommand (#704)", () => {
-  test("lists a single cluster with no headers for an emptiness check", () => {
-    expect(k3dExistsCommand("chant-local")).toBe(
-      "k3d cluster list chant-local --no-headers",
-    );
-  });
-});

package/src/op/activities/k3d.ts

@@ -1,96 +0,0 @@
-import { exec } from "node:child_process";
-import { promisify } from "node:util";
-import { safeHeartbeat } from "@intentius/chant/op";
-
-const execAsync = promisify(exec);
-
-export interface K3dUpArgs {
-  /** Cluster name (`k3d cluster create <name>`). */
-  name: string;
-  /** Number of server (control-plane) nodes. */
-  servers?: number;
-  /** Number of agent (worker) nodes. */
-  agents?: number;
-  /** k3s image, e.g. `rancher/k3s:v1.31.4-k3s1`. */
-  image?: string;
-  /** Port mappings, e.g. `["8080:80@loadbalancer"]`. */
-  ports?: string[];
-  /** Create a managed local registry with this name (`--registry-create`). */
-  registryCreate?: string;
-  /** Path to a k3d config file (`--config`). */
-  configFile?: string;
-  /** Readiness timeout for `--wait`. Default: `120s`. */
-  timeout?: string;
-}
-
-export interface K3dDownArgs {
-  /** Cluster name to delete. */
-  name: string;
-}
-
-/** `k3d cluster list <name> --no-headers` — non-empty stdout means the cluster exists. */
-export function k3dExistsCommand(name: string): string {
-  return `k3d cluster list ${name} --no-headers`;
-}
-
-/**
- * Build the `k3d cluster create` command. k3d merges the new cluster into the
- * default kubeconfig and switches context by default, so no extra flags are
- * needed for the manifests to be `kubectl apply`-able afterward.
- */
-export function k3dUpCommand(args: K3dUpArgs): string {
-  const parts = ["k3d", "cluster", "create", args.name];
-  if (args.servers !== undefined) parts.push(`--servers ${args.servers}`);
-  if (args.agents !== undefined) parts.push(`--agents ${args.agents}`);
-  if (args.image) parts.push(`--image ${args.image}`);
-  for (const p of args.ports ?? []) parts.push(`-p "${p}"`);
-  if (args.registryCreate) parts.push(`--registry-create ${args.registryCreate}`);
-  if (args.configFile) parts.push(`--config ${args.configFile}`);
-  parts.push("--wait");
-  parts.push(`--timeout ${args.timeout ?? "120s"}`);
-  return parts.join(" ");
-}
-
-/** Build the `k3d cluster delete` command. */
-export function k3dDownCommand(args: K3dDownArgs): string {
-  return `k3d cluster delete ${args.name}`;
-}
-
-/**
- * Create a local k3d cluster (vanilla Kubernetes in Docker). Idempotent: if a
- * cluster of the same name already exists it is left as-is. Uses longInfra
- * profile — 20m timeout, heartbeat every 15s (creation may pull the k3s image).
- */
-export async function k3dUp(args: K3dUpArgs, signal?: AbortSignal): Promise<void> {
-  try {
-    const { stdout } = await execAsync(k3dExistsCommand(args.name), { signal });
-    if (stdout.trim()) {
-      console.log(`k3d cluster "${args.name}" already exists — skipping create`);
-      return;
-    }
-  } catch {
-    // `cluster list` errors when the cluster is absent — fall through to create.
-  }
-
-  const heartbeatInterval = setInterval(() => {
-    safeHeartbeat({ step: "k3d cluster create", cluster: args.name });
-  }, 15_000);
-
-  try {
-    const { stdout, stderr } = await execAsync(k3dUpCommand(args), { signal });
-    if (stdout) console.log(stdout);
-    if (stderr) console.error(stderr);
-  } finally {
-    clearInterval(heartbeatInterval);
-  }
-}
-
-/**
- * Delete a local k3d cluster. Uses fastIdempotent profile — 5m timeout.
- * `k3d cluster delete` is a no-op success when the cluster is already gone.
- */
-export async function k3dDown(args: K3dDownArgs, signal?: AbortSignal): Promise<void> {
-  const { stdout, stderr } = await execAsync(k3dDownCommand(args), { signal });
-  if (stdout) console.log(stdout);
-  if (stderr) console.error(stderr);
-}