@intentius/chant-lexicon-k8s 0.41.20 → 0.44.1

package/src/components/kustomize-apply.ts

@@ -14,32 +14,26 @@
  * `stack` doubles as the ownership identity and the deploy unit, exactly as
  * `kubectl-apply` — one name, both jobs.
  *
- * Renderer resolution: `kustomize build`, falling back to
+ * Renderer resolution lives in `../kustomize/render.ts` (shared with the
+ * build-root path, #1548 piece 3): `kustomize build`, falling back to
  * `kubectl kustomize` (the same renderer vendored into kubectl) when the
  * standalone binary is absent. Both run through an injectable runner so tests
- * assert the exact command without either binary installed. The 64MiB
- * maxBuffer mirrors helm-upgrade's — a big overlay renders megabytes.
+ * assert the exact command without either binary installed.
  *
  * The #1074 boundary applies as it does to kubectl-apply: nothing exported
  * from the lexicon entry point may statically import the API-client chain, so
  * the applier is reached by dynamic import inside `run()` and its argument
  * shape is a structural mirror.
  */
-import { exec } from "node:child_process";
-import { promisify } from "node:util";
-import { loadAll } from "js-yaml";
 import type { Capability, DeployContext } from "@intentius/chant/components/capability";
+import {
+  defaultKustomizeRunner,
+  renderCommand,
+  renderKustomizeDocuments,
+  type KustomizeRunner,
+} from "../kustomize/render";
 
-const execAsync = promisify(exec);
-
-/** Injectable shell runner — the helm-upgrade seam, same buffer bound. */
-export type KustomizeRunner = (command: string) => Promise<{ stdout: string }>;
-const defaultRunner: KustomizeRunner = (command) => execAsync(command, { maxBuffer: 64 * 1024 * 1024 });
-
-/** Single-quote shell escaping, as helm-upgrade quotes its argv. */
-function q(v: string): string {
-  return `'${v.replace(/'/g, "'\\''")}'`;
-}
+export { renderCommand, type KustomizeRunner };
 
 /** Structural mirrors of the activity module's shapes (see the module doc). */
 interface AppliedRef {
@@ -81,33 +75,10 @@ export interface KustomizeApplyInput {
   delete?: "never" | "owned-only";
 }
 
-/** The exact render command, standalone binary first. Pure; exported for tests. */
-export function renderCommand(dir: string, tool: "kustomize" | "kubectl" = "kustomize"): string {
-  return tool === "kustomize" ? `kustomize build ${q(dir)}` : `kubectl kustomize ${q(dir)}`;
-}
-
-/** Render the overlay, falling back to kubectl's vendored kustomize when the
- * standalone binary is missing (ENOENT/127), and parse the emitted YAML. */
-async function renderDocuments(dir: string, run: KustomizeRunner): Promise<Array<Record<string, unknown>>> {
-  let stdout: string;
-  try {
-    ({ stdout } = await run(renderCommand(dir, "kustomize")));
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    if (!/ENOENT|not found|command not found|127/.test(message)) throw err;
-    ({ stdout } = await run(renderCommand(dir, "kubectl")));
-  }
-  const documents: Array<Record<string, unknown>> = [];
-  for (const doc of loadAll(stdout)) {
-    if (doc && typeof doc === "object" && !Array.isArray(doc)) documents.push(doc as Record<string, unknown>);
-  }
-  return documents;
-}
-
 /** Factory with injectable renderer + applier, so tests assert the render
  * command and the exact applier delegation without kustomize or a cluster. */
 export function createKustomizeApplyCapability(
-  run: KustomizeRunner = defaultRunner,
+  run: KustomizeRunner = defaultKustomizeRunner,
   apply?: Applier,
 ): Capability<KustomizeApplyInput, KustomizeApplyOutcome> {
   return {
@@ -116,7 +87,7 @@ export function createKustomizeApplyCapability(
     // undo of its own — same posture as kubectl-apply.
     rollbackPolicy: "needs-opt-out",
     async run(ctx: DeployContext, input: KustomizeApplyInput): Promise<KustomizeApplyOutcome> {
-      const documents = await renderDocuments(input.dir, run);
+      const documents = await renderKustomizeDocuments(input.dir, run);
       const applier: Applier = apply ?? ((await import("../op/activities/kubectl")).applyManifest as unknown as Applier);
       return applier({
         manifest: `kustomize:${input.dir}`,

package/src/composites/composites.test.ts

@@ -9,6 +9,7 @@ function p(member: unknown): Record<string, unknown> {
 }
 import { StatefulApp } from "./stateful-app";
 import { ArgoAppFor, ArgoAppSetForRegions, registerArgoCluster } from "./argo-app";
+import { FluxGitSource, FluxAppFor } from "./flux-app";
 import { CronWorkload } from "./cron-workload";
 import { AutoscaledService } from "./autoscaled-service";
 import { WorkerPool } from "./worker-pool";
@@ -3359,6 +3360,121 @@ describe("registerArgoCluster", () => {
   });
 });
 
+describe("FluxGitSource", () => {
+  test("returns a single GitRepository", () => {
+    const result = FluxGitSource("home-chant", { url: "https://github.com/jhgaylor/home-chant" });
+    expect(result.gitRepository).toBeDefined();
+    expect((result.gitRepository as any).entityType).toBe("K8s::Flux::GitRepository");
+  });
+
+  test("defaults: 5m interval, main branch, flux-system namespace", () => {
+    const result = FluxGitSource("home-chant", { url: "https://github.com/jhgaylor/home-chant" });
+    const meta = p(result.gitRepository).metadata as any;
+    const spec = p(result.gitRepository).spec as any;
+    expect(meta.namespace).toBe("flux-system");
+    expect(meta.labels["app.kubernetes.io/managed-by"]).toBe("chant");
+    expect(spec.interval).toBe("5m");
+    expect(spec.url).toBe("https://github.com/jhgaylor/home-chant");
+    expect(spec.ref).toEqual({ branch: "main" });
+  });
+
+  test("a tag pin wins over the branch default", () => {
+    const spec = p(FluxGitSource("app", { url: "u", tag: "v1.2.3" }).gitRepository).spec as any;
+    expect(spec.ref).toEqual({ tag: "v1.2.3" });
+  });
+
+  test("secretRef renders as a name reference", () => {
+    const spec = p(FluxGitSource("app", { url: "u", secretRef: "git-creds" }).gitRepository).spec as any;
+    expect(spec.secretRef).toEqual({ name: "git-creds" });
+  });
+});
+
+describe("FluxAppFor", () => {
+  const source = () => FluxGitSource("home-chant", { url: "https://github.com/jhgaylor/home-chant" });
+
+  test("returns a single Kustomization (the source is not duplicated)", () => {
+    const result = FluxAppFor("hello-chant", { source: source(), path: "./apps/hello-chant/k8s" });
+    expect(result.kustomization).toBeDefined();
+    expect((result.kustomization as any).entityType).toBe("K8s::Flux::Kustomization");
+    expect((result as any).gitRepository).toBeUndefined();
+  });
+
+  test("defaults: 10m interval, prune, wait, flux-system namespace", () => {
+    const result = FluxAppFor("hello-chant", { source: source(), path: "./apps/hello-chant/k8s" });
+    const meta = p(result.kustomization).metadata as any;
+    const spec = p(result.kustomization).spec as any;
+    expect(meta.name).toBe("hello-chant");
+    expect(meta.namespace).toBe("flux-system");
+    expect(spec.interval).toBe("10m");
+    expect(spec.prune).toBe(true);
+    expect(spec.wait).toBe(true);
+    expect(spec.path).toBe("./apps/hello-chant/k8s");
+  });
+
+  test("derives sourceRef from a FluxGitSource result", () => {
+    const spec = p(FluxAppFor("hello", { source: source(), path: "./k8s" }).kustomization).spec as any;
+    expect(spec.sourceRef).toEqual({ kind: "GitRepository", name: "home-chant", namespace: "flux-system" });
+  });
+
+  test("many apps share one source", () => {
+    const shared = source();
+    const a = FluxAppFor("mealie", { source: shared, path: "./apps/mealie/k8s" });
+    const b = FluxAppFor("ntfy", { source: shared, path: "./apps/ntfy/k8s" });
+    expect((p(a.kustomization).spec as any).sourceRef.name).toBe("home-chant");
+    expect((p(b.kustomization).spec as any).sourceRef.name).toBe("home-chant");
+  });
+
+  test("a string source names an existing GitRepository (flux-system)", () => {
+    const spec = p(FluxAppFor("mealie", { source: "flux-system", path: "./apps/mealie/generated" }).kustomization)
+      .spec as any;
+    expect(spec.sourceRef).toEqual({ kind: "GitRepository", name: "flux-system" });
+  });
+
+  test("an explicit ref carries a non-git source kind", () => {
+    const spec = p(
+      FluxAppFor("fountain", { source: { kind: "OCIRepository", name: "fountain" }, path: "./k8s" }).kustomization,
+    ).spec as any;
+    expect(spec.sourceRef).toEqual({ kind: "OCIRepository", name: "fountain" });
+  });
+
+  test("dependsOn is a plain name list rendered to name objects", () => {
+    const spec = p(
+      FluxAppFor("hello", {
+        source: "flux-system",
+        path: "./k8s",
+        dependsOn: ["cert-manager", "traefik"],
+      }).kustomization,
+    ).spec as any;
+    expect(spec.dependsOn).toEqual([{ name: "cert-manager" }, { name: "traefik" }]);
+  });
+
+  test("omits dependsOn when the list is empty", () => {
+    const spec = p(FluxAppFor("hello", { source: "flux-system", path: "./k8s" }).kustomization).spec as any;
+    expect(spec.dependsOn).toBeUndefined();
+  });
+
+  test("maps targetNamespace and opt-outs onto the spec", () => {
+    const spec = p(
+      FluxAppFor("cloudflared", {
+        source: "flux-system",
+        path: "./apps/cloudflared/generated",
+        targetNamespace: "cloudflared",
+        wait: false,
+        prune: false,
+        suspend: true,
+        timeout: "3m",
+        serviceAccountName: "flux-applier",
+      }).kustomization,
+    ).spec as any;
+    expect(spec.targetNamespace).toBe("cloudflared");
+    expect(spec.wait).toBe(false);
+    expect(spec.prune).toBe(false);
+    expect(spec.suspend).toBe(true);
+    expect(spec.timeout).toBe("3m");
+    expect(spec.serviceAccountName).toBe("flux-applier");
+  });
+});
+
 describe("package index re-exports (regression guard)", () => {
   test("Argo composites are reachable from the package entry", async () => {
     const pkg: any = await import("../index");
@@ -3366,4 +3482,10 @@ describe("package index re-exports (regression guard)", () => {
     expect(typeof pkg.ArgoAppSetForRegions).toBe("function");
     expect(typeof pkg.registerArgoCluster).toBe("function");
   });
+
+  test("Flux composites are reachable from the package entry", async () => {
+    const pkg: any = await import("../index");
+    expect(typeof pkg.FluxGitSource).toBe("function");
+    expect(typeof pkg.FluxAppFor).toBe("function");
+  });
 });

package/src/composites/flux-app.ts

@@ -0,0 +1,274 @@
+/**
+ * Flux CD composites — turn Chant build targets into Flux sources and
+ * `Kustomization`s.
+ *
+ * The k8s lexicon stays runtime-agnostic: it only emits manifests. These
+ * composites are the opt-in bridge to Flux's reconciliation layer, the
+ * `ArgoAppFor` analogue for the source-controller/kustomize-controller pair.
+ * Authoring a `GitRepository` + `Kustomization` by hand is ~40 lines of YAML
+ * per app; `FluxAppFor` collapses the pair to one call with defaults taken
+ * from real Flux estates.
+ *
+ * - FluxGitSource(name, opts) → a single K8s::Flux::GitRepository
+ * - FluxAppFor(target, opts)  → a single K8s::Flux::Kustomization
+ *
+ * The two are split deliberately: the common estate shape is one source
+ * shared by many Kustomizations. A `GitRepository` per app is the mistake
+ * this split makes hard — declare the source once, hand its result to every
+ * `FluxAppFor` that reconciles a path out of it.
+ */
+
+import { Composite, mergeDefaults } from "@intentius/chant";
+import {
+  GitRepository as GitRepositoryResource,
+  Kustomization as KustomizationResource,
+} from "../generated";
+
+// ── Shared types ─────────────────────────────────────────────────────────────
+
+/** The namespace the Flux controllers run in and watch by default. */
+const FLUX_NAMESPACE = "flux-system";
+
+/** Source kinds a Kustomization can reconcile from. */
+export type FluxSourceKind = "GitRepository" | "OCIRepository" | "Bucket";
+
+/** An explicit reference to a source declared elsewhere. */
+export interface FluxSourceRef {
+  /** Source kind (default "GitRepository"). */
+  kind?: FluxSourceKind;
+  /** Name of the source object. */
+  name: string;
+  /** Namespace of the source, when it differs from the Kustomization's. */
+  namespace?: string;
+}
+
+// ── FluxGitSource ────────────────────────────────────────────────────────────
+
+export interface FluxGitSourceOptions {
+  /** Git repository URL the source-controller fetches. */
+  url: string;
+  /** Branch to track (default "main"). Ignored when `tag` is set. */
+  branch?: string;
+  /** Tag to pin instead of a branch. */
+  tag?: string;
+  /** Fetch interval (default "5m"). */
+  interval?: string;
+  /** Name of the Secret holding git credentials, for private repos. */
+  secretRef?: string;
+  /** Namespace the GitRepository lives in (default "flux-system"). */
+  fluxNamespace?: string;
+  /** Extra labels applied to the GitRepository. */
+  labels?: Record<string, string>;
+  defaults?: { gitRepository?: Partial<Record<string, unknown>> };
+}
+
+export type FluxGitSourceResult = {
+  gitRepository: InstanceType<typeof GitRepositoryResource>;
+}
+
+const FluxGitRepository = Composite<{ name: string } & FluxGitSourceOptions, FluxGitSourceResult>(
+  (props) => {
+    const {
+      name,
+      url,
+      branch = "main",
+      tag,
+      interval = "5m",
+      secretRef,
+      fluxNamespace = FLUX_NAMESPACE,
+      labels = {},
+      defaults,
+    } = props;
+
+    const gitRepository = new GitRepositoryResource(mergeDefaults({
+      metadata: {
+        name,
+        namespace: fluxNamespace,
+        labels: {
+          "app.kubernetes.io/name": name,
+          "app.kubernetes.io/managed-by": "chant",
+          ...labels,
+        },
+      },
+      spec: {
+        interval,
+        url,
+        // An unset spec.ref falls back to `master` — always pin (FLUX001).
+        ref: tag !== undefined ? { tag } : { branch },
+        ...(secretRef !== undefined && { secretRef: { name: secretRef } }),
+      },
+    }, defaults?.gitRepository));
+
+    return { gitRepository };
+  },
+  "FluxGitRepository",
+);
+
+/**
+ * Declare a Flux `GitRepository` source in one call.
+ *
+ * Declare it once and share it: every `FluxAppFor` that reconciles a path out
+ * of the same repo should take this result as its `source`.
+ *
+ * @example
+ * ```ts
+ * import { FluxGitSource } from "@intentius/chant-lexicon-k8s";
+ *
+ * export const source = FluxGitSource("home-chant", {
+ *   url: "https://github.com/jhgaylor/home-chant",
+ *   branch: "main",
+ * });
+ * ```
+ */
+export function FluxGitSource(name: string, options: FluxGitSourceOptions): FluxGitSourceResult {
+  return FluxGitRepository({ name, ...options });
+}
+
+// ── FluxAppFor ───────────────────────────────────────────────────────────────
+
+export interface FluxAppForOptions {
+  /**
+   * The source to reconcile from — a `FluxGitSource` result, the name of an
+   * existing `GitRepository` (e.g. the bootstrap-created "flux-system"), or an
+   * explicit `{ kind, name }` reference for OCIRepository/Bucket sources.
+   */
+  source: FluxGitSourceResult | FluxSourceRef | string;
+  /** Path within the source holding the manifests (e.g. "./apps/api/k8s"). */
+  path: string;
+  /** Namespace the reconciled resources land in (sets spec.targetNamespace). */
+  targetNamespace?: string;
+  /** Reconcile interval (default "10m"). */
+  interval?: string;
+  /** Delete resources that disappear from the source (default true). */
+  prune?: boolean;
+  /** Wait for reconciled resources to become ready (default true). */
+  wait?: boolean;
+  /**
+   * Names of Kustomizations that must be ready first, as a plain name list
+   * (rendered to spec.dependsOn). Validated against the build by FLUX003.
+   */
+  dependsOn?: string[];
+  /** Timeout for health checks and apply operations. */
+  timeout?: string;
+  /** Pause reconciliation without deleting anything. */
+  suspend?: boolean;
+  /** ServiceAccount the kustomize-controller impersonates for this app. */
+  serviceAccountName?: string;
+  /** Namespace the Kustomization object itself lives in (default "flux-system"). */
+  fluxNamespace?: string;
+  /** Extra labels applied to the Kustomization. */
+  labels?: Record<string, string>;
+  defaults?: { kustomization?: Partial<Record<string, unknown>> };
+}
+
+export type FluxAppForResult = {
+  kustomization: InstanceType<typeof KustomizationResource>;
+}
+
+/** Resolve the `source` option to a rendered sourceRef. */
+function resolveSourceRef(
+  target: string,
+  source: FluxGitSourceResult | FluxSourceRef | string,
+): Record<string, unknown> {
+  if (typeof source === "string") {
+    return { kind: "GitRepository", name: source };
+  }
+  if ("gitRepository" in source && source.gitRepository !== undefined) {
+    const metadata = (source.gitRepository as { props?: { metadata?: { name?: unknown; namespace?: unknown } } })
+      .props?.metadata;
+    const name = metadata?.name;
+    if (typeof name !== "string" || name === "") {
+      throw new Error(
+        `FluxAppFor("${target}"): the supplied FluxGitSource result has no metadata.name to reference.`,
+      );
+    }
+    return {
+      kind: "GitRepository",
+      name,
+      ...(typeof metadata?.namespace === "string" && { namespace: metadata.namespace }),
+    };
+  }
+  const ref = source as FluxSourceRef;
+  return {
+    kind: ref.kind ?? "GitRepository",
+    name: ref.name,
+    ...(ref.namespace !== undefined && { namespace: ref.namespace }),
+  };
+}
+
+const FluxKustomization = Composite<{ target: string } & FluxAppForOptions, FluxAppForResult>(
+  (props) => {
+    const {
+      target,
+      source,
+      path,
+      targetNamespace,
+      interval = "10m",
+      prune = true,
+      wait = true,
+      dependsOn = [],
+      timeout,
+      suspend,
+      serviceAccountName,
+      fluxNamespace = FLUX_NAMESPACE,
+      labels = {},
+      defaults,
+    } = props;
+
+    const sourceRef = resolveSourceRef(target, source);
+
+    // The Kustomization's namespace also scopes the sourceRef: an in-spec
+    // sourceRef without a namespace resolves in the Kustomization's own.
+    const kustomization = new KustomizationResource(mergeDefaults({
+      metadata: {
+        name: target,
+        namespace: fluxNamespace,
+        labels: {
+          "app.kubernetes.io/name": target,
+          "app.kubernetes.io/managed-by": "chant",
+          ...labels,
+        },
+      },
+      spec: {
+        interval,
+        path,
+        prune,
+        wait,
+        sourceRef,
+        ...(targetNamespace !== undefined && { targetNamespace }),
+        ...(dependsOn.length > 0 && { dependsOn: dependsOn.map((name) => ({ name })) }),
+        ...(timeout !== undefined && { timeout }),
+        ...(suspend !== undefined && { suspend }),
+        ...(serviceAccountName !== undefined && { serviceAccountName }),
+      },
+    }, defaults?.kustomization));
+
+    return { kustomization };
+  },
+  "FluxKustomization",
+);
+
+/**
+ * Reconcile a Chant build target with Flux in one call — the `Kustomization`
+ * half of the GitRepository + Kustomization pair. The source is passed in,
+ * not created here, so many apps share one repo declaration.
+ *
+ * @example
+ * ```ts
+ * import { FluxGitSource, FluxAppFor } from "@intentius/chant-lexicon-k8s";
+ *
+ * export const source = FluxGitSource("home-chant", {
+ *   url: "https://github.com/jhgaylor/home-chant",
+ * });
+ *
+ * export const hello = FluxAppFor("hello-chant", {
+ *   source,
+ *   path: "./apps/hello-chant/k8s",
+ *   targetNamespace: "default",
+ *   dependsOn: ["cert-manager", "traefik"],
+ * });
+ * ```
+ */
+export function FluxAppFor(target: string, options: FluxAppForOptions): FluxAppForResult {
+  return FluxKustomization({ target, ...options });
+}

package/src/composites/index.ts

@@ -93,3 +93,12 @@ export type {
   RegisterArgoClusterOptions,
   RegisterArgoClusterResult,
 } from "./argo-app";
+export { FluxGitSource, FluxAppFor } from "./flux-app";
+export type {
+  FluxSourceKind,
+  FluxSourceRef,
+  FluxGitSourceOptions,
+  FluxGitSourceResult,
+  FluxAppForOptions,
+  FluxAppForResult,
+} from "./flux-app";

package/src/config-augmentation.test.ts

@@ -0,0 +1,72 @@
+/**
+ * The `k8s` cluster-binding block typechecks under `satisfies ChantConfig`
+ * (#1455), and its schema rejects the typos that land a read on the wrong
+ * cluster (#1344).
+ *
+ * #1455's reproduction is the first test, verbatim: `ChantConfig` did not
+ * declare the `k8s` key the lexicon reads, so the one block that stops a live
+ * read hitting the wrong cluster was also the one block that could not
+ * typecheck — and the path of least resistance was dropping `satisfies
+ * ChantConfig`, which silently gives up checking on everything else in the
+ * file. The lexicon's module augmentation (declared in `./config.ts` and
+ * `./config-schema.ts`) is what makes it compile; this file is the forgejo
+ * lexicon's `config-augmentation.test.ts` guard, ported.
+ */
+
+import { describe, test, expect } from "vitest";
+import type { ChantConfig } from "@intentius/chant";
+import type { K8sChantConfig } from "./config";
+import { k8sConfigSchema } from "./config-schema";
+
+describe("the k8s config namespace (#1455, #1344)", () => {
+  test("the issue's reproduction typechecks as a ChantConfig", () => {
+    // The compile-time assertion is the point; the runtime one keeps vitest happy.
+    const config = {
+      lexicons: ["k8s"],
+      environments: ["local"],
+      k8s: {
+        profiles: { local: { context: "k3d-fountain-local" } },
+      } satisfies K8sChantConfig,
+    } satisfies ChantConfig;
+    expect(config.k8s.profiles.local.context).toBe("k3d-fountain-local");
+  });
+
+  test("an empty namespace is valid — every key is optional", () => {
+    expect(k8sConfigSchema.safeParse({}).success).toBe(true);
+  });
+
+  test("the schema accepts the documented shape", () => {
+    const parsed = k8sConfigSchema.safeParse({
+      profiles: { prod: { context: "prod-eks" }, staging: { context: "staging-eks" } },
+      execCredentialPlugins: ["aws", "my-org-oidc-helper"],
+    });
+    expect(parsed.success).toBe(true);
+  });
+
+  test("an unknown key at the top of the namespace is rejected, not ignored", () => {
+    // Core applies `.strict()` when validating a declared namespace
+    // (`validateLexiconConfig`), so `profile` instead of `profiles` errors
+    // rather than silently leaving every environment unbound.
+    expect(k8sConfigSchema.strict().safeParse({ profile: { local: { context: "x" } } }).success).toBe(false);
+  });
+
+  test("a typo inside a profile is rejected too — the nesting is strict", () => {
+    // `contxt` used to be accepted and ignored, which meant the ambient
+    // kubectl context won and the wrong cluster was read (#1488's setup).
+    const parsed = k8sConfigSchema.safeParse({ profiles: { prod: { contxt: "prod-eks" } } });
+    expect(parsed.success).toBe(false);
+  });
+
+  test("a wrong value type is rejected", () => {
+    expect(k8sConfigSchema.safeParse({ profiles: { prod: { context: 42 } } }).success).toBe(false);
+    expect(k8sConfigSchema.safeParse({ execCredentialPlugins: "aws" }).success).toBe(false);
+  });
+
+  test("the schema and the exported interface describe the same namespace", () => {
+    const value: K8sChantConfig = {
+      profiles: { local: { context: "k3d-fountain-local" } },
+      execCredentialPlugins: ["aws"],
+    };
+    expect(k8sConfigSchema.safeParse(value).success).toBe(true);
+  });
+});

package/src/config-schema.ts

@@ -23,6 +23,11 @@ export const k8sClusterProfileSchema = z.strictObject({
 export const k8sConfigSchema = z.strictObject({
   profiles: z.record(z.string(), k8sClusterProfileSchema).optional(),
   execCredentialPlugins: z.array(z.string()).optional(),
+  kustomize: z
+    .strictObject({
+      roots: z.array(z.string()).optional(),
+    })
+    .optional(),
 });
 
 declare module "@intentius/chant/config" {

package/src/config.ts

@@ -29,13 +29,15 @@
  * resolves this via `@intentius/chant/kubectl-context`'s
  * `resolveClusterTarget`:
  *
- * - A declared binding is passed explicitly as `kubectl ... --context <bound>`
- *   on every invocation, and checked against the ambient context first — a
- *   mismatch refuses loudly (naming the environment, the expected context,
- *   and the ambient one) instead of silently reading the wrong cluster.
+ * - A declared binding is passed explicitly to the typed client on every
+ *   read and write, regardless of what `kubectl` is ambiently pointed at
+ *   (#1488 — the binding is a selection, not a check). A bound context the
+ *   kubeconfig does not have fails with an error naming the context and the
+ *   `k8s.profiles.<env>.context` binding — never by falling back to ambient.
  * - No binding for the environment keeps today's behavior — the ambient
  *   context — but logs a visible note that nothing is pinned, so the
- *   fallback is never silent.
+ *   fallback is never silent. Read failures name the context that was read
+ *   and the missing binding.
  *
  * `ChantConfig` uses `.passthrough()` in its Zod schema so the `k8s` key is
  * accepted at runtime without core changes, exactly like `temporal.profiles`
@@ -83,6 +85,32 @@ export interface K8sChantConfig {
    * ```
    */
   execCredentialPlugins?: string[];
+
+  /**
+   * Kustomize settings (#1548 piece 3).
+   *
+   * `roots` names kustomization directories that are build roots: each is
+   * rendered (`kustomize build`, `kubectl kustomize` fallback) at build time
+   * and the rendered documents join the manifest set — serialized into the
+   * build output, ownership-stamped, checked by post-synth rules, and
+   * observed by `lifecycle diff --live` like any declared resource. This is
+   * how an estate that keeps its overlay tree gets a declared side without
+   * converting a single manifest to typed source.
+   *
+   * Paths are relative to the project root (the directory holding
+   * `chant.config.*`), NOT `sourceDir` — the overlay tree usually lives
+   * beside the typed source, not inside it.
+   *
+   * ```ts
+   * k8s: {
+   *   kustomize: { roots: ["overlays/prod"] },
+   * } satisfies K8sChantConfig
+   * ```
+   */
+  kustomize?: {
+    /** Kustomization directories to render into the build. */
+    roots?: string[];
+  };
 }
 
 declare module "@intentius/chant/config" {