@intentius/chant-lexicon-k8s 0.42.1 → 0.44.2

package/dist/meta.json

@@ -51,6 +51,13 @@
     "kind": "property",
     "lexicon": "k8s"
   },
+  "Addon": {
+    "resourceType": "K8s::K3s::Addon",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "k3s.cattle.io/v1",
+    "gvkKind": "Addon"
+  },
   "Address": {
     "resourceType": "K8s::Gateway::Gateway.addresses",
     "kind": "property",
@@ -229,6 +236,11 @@
     "kind": "property",
     "lexicon": "k8s"
   },
+  "AuthSecret": {
+    "resourceType": "K8s::K3s::HelmChart.authSecret",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
   "AutoscalerOptions": {
     "resourceType": "K8s::Ray::RayCluster.autoscalerOptions",
     "kind": "property",
@@ -1066,6 +1078,11 @@
     "kind": "property",
     "lexicon": "k8s"
   },
+  "DockerRegistrySecret": {
+    "resourceType": "K8s::K3s::HelmChart.dockerRegistrySecret",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
   "DriftDetection": {
     "resourceType": "K8s::Flux::HelmRelease.driftDetection",
     "kind": "property",
@@ -1241,6 +1258,28 @@
     "apiVersion": "flowcontrol.apiserver.k8s.io/v1",
     "gvkKind": "FlowSchemaList"
   },
+  "FluxHelmChart": {
+    "resourceType": "K8s::Flux::HelmChart",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "source.toolkit.fluxcd.io/v1",
+    "gvkKind": "HelmChart"
+  },
+  "FluxHelmChart_SourceRef": {
+    "resourceType": "K8s::Flux::HelmChart.sourceRef",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
+  "FluxHelmChart_Status": {
+    "resourceType": "K8s::Flux::HelmChart.status",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
+  "FluxHelmChart_Verify": {
+    "resourceType": "K8s::Flux::HelmChart.verify",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
   "FluxInstance": {
     "resourceType": "K8s::Flux::FluxInstance",
     "kind": "resource",
@@ -1527,25 +1566,15 @@
     "kind": "property",
     "lexicon": "k8s"
   },
-  "HelmChart": {
-    "resourceType": "K8s::Flux::HelmChart",
+  "HelmChartConfig": {
+    "resourceType": "K8s::K3s::HelmChartConfig",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "source.toolkit.fluxcd.io/v1",
-    "gvkKind": "HelmChart"
+    "apiVersion": "helm.cattle.io/v1",
+    "gvkKind": "HelmChartConfig"
   },
-  "HelmChart_SourceRef": {
-    "resourceType": "K8s::Flux::HelmChart.sourceRef",
-    "kind": "property",
-    "lexicon": "k8s"
-  },
-  "HelmChart_Status": {
-    "resourceType": "K8s::Flux::HelmChart.status",
-    "kind": "property",
-    "lexicon": "k8s"
-  },
-  "HelmChart_Verify": {
-    "resourceType": "K8s::Flux::HelmChart.verify",
+  "HelmChartConfig_ValuesSecret": {
+    "resourceType": "K8s::K3s::HelmChartConfig.valuesSecrets",
     "kind": "property",
     "lexicon": "k8s"
   },
@@ -2145,6 +2174,48 @@
     "apiVersion": "batch/v1",
     "gvkKind": "JobList"
   },
+  "K3sHelmChart": {
+    "resourceType": "K8s::K3s::HelmChart",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "helm.cattle.io/v1",
+    "gvkKind": "HelmChart"
+  },
+  "K3sHelmChart_AuthSecret": {
+    "resourceType": "K8s::K3s::HelmChart.authSecret",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
+  "K3sHelmChart_DockerRegistrySecret": {
+    "resourceType": "K8s::K3s::HelmChart.dockerRegistrySecret",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
+  "K3sHelmChart_PodSecurityContext": {
+    "resourceType": "K8s::K3s::HelmChart.podSecurityContext",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
+  "K3sHelmChart_RepoCAConfigMap": {
+    "resourceType": "K8s::K3s::HelmChart.repoCAConfigMap",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
+  "K3sHelmChart_SecurityContext": {
+    "resourceType": "K8s::K3s::HelmChart.securityContext",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
+  "K3sHelmChart_Status": {
+    "resourceType": "K8s::K3s::HelmChart.status",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
+  "K3sHelmChart_ValuesSecret": {
+    "resourceType": "K8s::K3s::HelmChart.valuesSecrets",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
   "KeyToPath": {
     "resourceType": "K8s::Core::KeyToPath",
     "kind": "property",
@@ -3416,6 +3487,11 @@
     "kind": "property",
     "lexicon": "k8s"
   },
+  "RepoCAConfigMap": {
+    "resourceType": "K8s::K3s::HelmChart.repoCAConfigMap",
+    "kind": "property",
+    "lexicon": "k8s"
+  },
   "Resource": {
     "resourceType": "K8s::Flux::Receiver.resources",
     "kind": "property",

package/dist/okf/index.md

@@ -4,6 +4,7 @@ okf_version: '0.2'
 
 # Resource types
 
+* [Addon](/types/Addon.md) - K8s::K3s::Addon
 * [Alert](/types/Alert.md) - K8s::Flux::Alert
 * [APIGroup](/types/APIGroup.md) - K8s::Core::APIGroup
 * [APIGroupList](/types/APIGroupList.md) - K8s::Core::APIGroupList
@@ -68,13 +69,14 @@ okf_version: '0.2'
 * [Eviction](/types/Eviction.md) - K8s::Policy::Eviction
 * [FlowSchema](/types/FlowSchema.md) - K8s::Flowcontrol::FlowSchema
 * [FlowSchemaList](/types/FlowSchemaList.md) - K8s::Flowcontrol::FlowSchemaList
+* [FluxHelmChart](/types/FluxHelmChart.md) - K8s::Flux::HelmChart
 * [FluxInstance](/types/FluxInstance.md) - K8s::Flux::FluxInstance
 * [FluxReport](/types/FluxReport.md) - K8s::Flux::FluxReport
 * [Gateway](/types/Gateway.md) - K8s::Gateway::Gateway
 * [GatewayClass](/types/GatewayClass.md) - K8s::Gateway::GatewayClass
 * [GitRepository](/types/GitRepository.md) - K8s::Flux::GitRepository
 * [GRPCRoute](/types/GRPCRoute.md) - K8s::Gateway::GRPCRoute
-* [HelmChart](/types/HelmChart.md) - K8s::Flux::HelmChart
+* [HelmChartConfig](/types/HelmChartConfig.md) - K8s::K3s::HelmChartConfig
 * [HelmRelease](/types/HelmRelease.md) - K8s::Flux::HelmRelease
 * [HelmRepository](/types/HelmRepository.md) - K8s::Flux::HelmRepository
 * [HorizontalPodAutoscaler](/types/HorizontalPodAutoscaler.md) - K8s::Autoscaling::HorizontalPodAutoscaler
@@ -97,6 +99,7 @@ okf_version: '0.2'
 * [IPAddressList](/types/IPAddressList.md) - K8s::Networking::IPAddressList
 * [Issuer](/types/Issuer.md) - K8s::CertManager::Issuer
 * [JobList](/types/JobList.md) - K8s::Batch::JobList
+* [K3sHelmChart](/types/K3sHelmChart.md) - K8s::K3s::HelmChart
 * [Kustomization](/types/Kustomization.md) - K8s::Flux::Kustomization
 * [Lease](/types/Lease.md) - K8s::Coordination::Lease
 * [LeaseCandidate](/types/LeaseCandidate.md) - K8s::Coordination::LeaseCandidate
@@ -219,6 +222,9 @@ okf_version: '0.2'
 * [ARGO003](/rules/ARGO003.md) - Application.spec.destination must reference a registered cluster or the in-cluster target
 * [ARGO004](/rules/ARGO004.md) - ApplicationSet template must scope to a single AppProject
 * [ARGO005](/rules/ARGO005.md) - Application source.path should resolve to an existing directory under the build root
+* [FLUX001](/rules/FLUX001.md) - GitRepository must pin spec.ref
+* [FLUX002](/rules/FLUX002.md) - Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)
+* [FLUX003](/rules/FLUX003.md) - Kustomization.spec.dependsOn entries should name Kustomizations declared in the build
 * [WK8001](/rules/WK8001.md) - Hardcoded Namespace
 * [WK8002](/rules/WK8002.md) - Latest Image Tag
 * [WK8003](/rules/WK8003.md) - Missing Resource Limits

package/dist/okf/rules/FLUX001.md

@@ -0,0 +1,17 @@
+---
+type: lint-rule
+title: FLUX001
+description: GitRepository must pin spec.ref
+id: FLUX001
+severity: warning
+category: correctness
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+GitRepository must pin spec.ref
+
+## Applies to
+
+- [GitRepository](/types/GitRepository.md)
+- [Kustomization](/types/Kustomization.md)
+- [Node](/types/Node.md)

package/dist/okf/rules/FLUX002.md

@@ -0,0 +1,19 @@
+---
+type: post-synth-check
+title: FLUX002
+description: Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)
+id: FLUX002
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)
+
+## Applies to
+
+- [Bucket](/types/Bucket.md)
+- [GitRepository](/types/GitRepository.md)
+- [Kustomization](/types/Kustomization.md)
+- [Namespace](/types/Namespace.md)
+- [OCIRepository](/types/OCIRepository.md)

package/dist/okf/rules/FLUX003.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: FLUX003
+description: Kustomization.spec.dependsOn entries should name Kustomizations declared in the build
+id: FLUX003
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Kustomization.spec.dependsOn entries should name Kustomizations declared in the build
+
+## Applies to
+
+- [Kustomization](/types/Kustomization.md)

package/dist/okf/types/Addon.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: Addon
+description: k8s resource type K8s::K3s::Addon
+name: Addon
+lexicon: k8s
+resource_type: K8s::K3s::Addon
+---
+`K8s::K3s::Addon`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): Spec provides information about the on-disk manifest backing this resource.

package/dist/okf/types/Bucket.md

@@ -12,3 +12,7 @@ resource_type: K8s::Flux::Bucket
 
 - `metadata` (`ObjectMeta`, optional): Standard object's metadata.
 - `spec` (`Record<string, unknown>`, optional): BucketSpec specifies the required configuration to produce an Artifact for an object storage bucket.
+
+## Governed by
+
+- [FLUX002](/rules/FLUX002.md): Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)

package/dist/okf/types/{HelmChart.md → FluxHelmChart.md}

@@ -1,8 +1,8 @@
 ---
 type: resource-type
-title: HelmChart
+title: FluxHelmChart
 description: k8s resource type K8s::Flux::HelmChart
-name: HelmChart
+name: FluxHelmChart
 lexicon: k8s
 resource_type: K8s::Flux::HelmChart
 ---

package/dist/okf/types/GitRepository.md

@@ -12,3 +12,8 @@ resource_type: K8s::Flux::GitRepository
 
 - `metadata` (`ObjectMeta`, optional): Standard object's metadata.
 - `spec` (`Record<string, unknown>`, optional): GitRepositorySpec specifies the required configuration to produce an Artifact for a Git repository.
+
+## Governed by
+
+- [FLUX001](/rules/FLUX001.md): GitRepository must pin spec.ref
+- [FLUX002](/rules/FLUX002.md): Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)

package/dist/okf/types/HelmChartConfig.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: HelmChartConfig
+description: k8s resource type K8s::K3s::HelmChartConfig
+name: HelmChartConfig
+lexicon: k8s
+resource_type: K8s::K3s::HelmChartConfig
+---
+`K8s::K3s::HelmChartConfig`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): HelmChartConfigSpec represents additional user-configurable details of an installed and configured Helm chart release. These fields are merged with or override the corresponding fields on the related HelmChart resource.

package/dist/okf/types/K3sHelmChart.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: K3sHelmChart
+description: k8s resource type K8s::K3s::HelmChart
+name: K3sHelmChart
+lexicon: k8s
+resource_type: K8s::K3s::HelmChart
+---
+`K8s::K3s::HelmChart`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): HelmChartSpec represents the user-configurable details for installation and upgrade of a Helm chart release.

package/dist/okf/types/Kustomization.md

@@ -12,3 +12,9 @@ resource_type: K8s::Flux::Kustomization
 
 - `metadata` (`ObjectMeta`, optional): Standard object's metadata.
 - `spec` (`Record<string, unknown>`, optional): KustomizationSpec defines the configuration to calculate the desired state from a Source using Kustomize.
+
+## Governed by
+
+- [FLUX001](/rules/FLUX001.md): GitRepository must pin spec.ref
+- [FLUX002](/rules/FLUX002.md): Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)
+- [FLUX003](/rules/FLUX003.md): Kustomization.spec.dependsOn entries should name Kustomizations declared in the build

package/dist/okf/types/Namespace.md

@@ -15,4 +15,5 @@ resource_type: K8s::Core::Namespace
 
 ## Governed by
 
+- [FLUX002](/rules/FLUX002.md): Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)
 - [WK8001](/rules/WK8001.md): Hardcoded Namespace

package/dist/okf/types/Node.md

@@ -16,6 +16,7 @@ resource_type: K8s::Core::Node
 ## Governed by
 
 - [ARGO001](/rules/ARGO001.md): Production Application must not enable automated prune
+- [FLUX001](/rules/FLUX001.md): GitRepository must pin spec.ref
 - [WK8001](/rules/WK8001.md): Hardcoded Namespace
 - [WK8002](/rules/WK8002.md): Latest Image Tag
 - [WK8003](/rules/WK8003.md): Missing Resource Limits

package/dist/okf/types/OCIRepository.md

@@ -12,3 +12,7 @@ resource_type: K8s::Flux::OCIRepository
 
 - `metadata` (`ObjectMeta`, optional): Standard object's metadata.
 - `spec` (`Record<string, unknown>`, optional): OCIRepositorySpec defines the desired state of OCIRepository
+
+## Governed by
+
+- [FLUX002](/rules/FLUX002.md): Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAwBjG,eAAO,MAAM,SAAS,EAAE,aAynBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA2BjG,eAAO,MAAM,SAAS,EAAE,aAqqBvB,CAAC"}

package/dist/rules/argo-helpers.ts

@@ -1,5 +1,7 @@
 /**
  * Shared helpers for the Argo post-synth checks (ARGO002, ARGO003, ARGO005).
+ * The generic manifest collectors (`allManifests`, `manifestsOfKind`) are
+ * shared by the Flux checks (FLUX002, FLUX003) too.
  *
  * Excluded from check auto-discovery by the "helper" filename filter.
  */

package/dist/rules/flux-source-ref-pin.ts

@@ -0,0 +1,52 @@
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import { findResourceLiterals, getNestedObject, getNestedString, getProp, lineCol } from "./argo-ast";
+import * as ts from "typescript";
+
+/**
+ * FLUX001: GitRepository must pin spec.ref
+ *
+ * A Flux `GitRepository` with no `spec.ref` falls back to the `master` branch,
+ * which on most repos no longer exists — the source stalls with a checkout
+ * error, and every Kustomization downstream of it stalls too. Real estates pin
+ * a branch (or tag) on every source; `FluxGitSource` always emits one. Flag
+ * hand-written `GitRepository` literals whose spec carries a `url` but no
+ * `ref`.
+ *
+ * Bad:  new GitRepository({ spec: { url: "https://github.com/acme/infra" } })
+ * Good: new GitRepository({ spec: { url: "https://github.com/acme/infra", ref: { branch: "main" } } })
+ */
+
+export const fluxSourceRefPinRule: LintRule = {
+  id: "FLUX001",
+  severity: "warning",
+  category: "correctness",
+  description:
+    "Flux GitRepository must pin spec.ref (branch, tag, semver, or commit) — the unset default is the master branch",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const { sourceFile } = context;
+    const diagnostics: LintDiagnostic[] = [];
+
+    for (const { literal } of findResourceLiterals(sourceFile, new Set(["GitRepository"]))) {
+      const spec = getNestedObject(literal, ["spec"]);
+      // No spec object literal to inspect — leave it to other tooling.
+      if (!spec) continue;
+      if (getProp(spec, "ref") !== undefined) continue;
+
+      const anchor: ts.Node = spec;
+      const { line, column } = lineCol(sourceFile, anchor);
+      const name = getNestedString(literal, ["metadata", "name"]) ?? "(unnamed)";
+
+      diagnostics.push({
+        file: sourceFile.fileName,
+        line,
+        column,
+        ruleId: "FLUX001",
+        severity: "warning",
+        message: `GitRepository "${name}" has no spec.ref — Flux falls back to the master branch. Pin a branch, tag, semver range, or commit.`,
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/flux002.ts

@@ -0,0 +1,77 @@
+/**
+ * FLUX002: Kustomization.spec.sourceRef must reference a declared source
+ *
+ * A Flux `Kustomization` names its source in `spec.sourceRef` — a
+ * `GitRepository`, `OCIRepository`, or `Bucket` the source-controller fetches.
+ * If the referenced source isn't declared in the build, the
+ * kustomize-controller waits on an artifact that never arrives and the
+ * Kustomization stalls. The bootstrap-created `flux-system` GitRepository
+ * always exists on a bootstrapped cluster, so a reference to it is never
+ * flagged — the Flux analogue of ARGO002's built-in `default` project.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { allManifests, manifestsOfKind } from "./argo-helpers";
+
+/** Source kinds the kustomize-controller can reconcile from. */
+const SOURCE_KINDS = ["GitRepository", "OCIRepository", "Bucket"] as const;
+
+/** The GitRepository `flux bootstrap` creates alongside the controllers. */
+const BOOTSTRAP_SOURCE_NAME = "flux-system";
+
+export const flux002: PostSynthCheck = {
+  id: "FLUX002",
+  description: "Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const manifests = allManifests(ctx);
+
+    // Declared sources, keyed "Kind/name". Namespace is deliberately ignored:
+    // an unset sourceRef.namespace resolves in the Kustomization's own, and
+    // the common estate keeps everything in flux-system anyway.
+    const declaredSources = new Set<string>();
+    for (const kind of SOURCE_KINDS) {
+      for (const source of manifestsOfKind(manifests, kind)) {
+        const name = source.metadata?.name;
+        if (typeof name === "string") declaredSources.add(`${kind}/${name}`);
+      }
+    }
+
+    for (const kustomization of manifestsOfKind(manifests, "Kustomization")) {
+      // Flux and kustomize.config.k8s.io share the kind name; only the Flux CR
+      // carries a sourceRef-bearing spec.
+      const apiVersion = kustomization.apiVersion;
+      if (typeof apiVersion === "string" && !apiVersion.startsWith("kustomize.toolkit.fluxcd.io/")) continue;
+
+      const name = kustomization.metadata?.name ?? "Kustomization";
+      const sourceRef = kustomization.spec?.sourceRef as
+        | { kind?: unknown; name?: unknown }
+        | undefined;
+
+      if (!sourceRef || typeof sourceRef.name !== "string" || sourceRef.name === "") {
+        diagnostics.push({
+          checkId: "FLUX002",
+          severity: "error",
+          message: `Kustomization "${name}" has no spec.sourceRef.name — the kustomize-controller cannot resolve a source.`,
+          entity: name,
+          lexicon: "k8s",
+        });
+        continue;
+      }
+
+      const kind = typeof sourceRef.kind === "string" && sourceRef.kind !== "" ? sourceRef.kind : "GitRepository";
+      if (kind === "GitRepository" && sourceRef.name === BOOTSTRAP_SOURCE_NAME) continue;
+      if (declaredSources.has(`${kind}/${sourceRef.name}`)) continue;
+
+      diagnostics.push({
+        checkId: "FLUX002",
+        severity: "error",
+        message: `Kustomization "${name}" references ${kind} "${sourceRef.name}", which is not declared. Declare the source (e.g. FluxGitSource) or point sourceRef at the bootstrap flux-system repo.`,
+        entity: name,
+        lexicon: "k8s",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/flux003.ts

@@ -0,0 +1,75 @@
+/**
+ * FLUX003: Kustomization.spec.dependsOn entries should name declared Kustomizations
+ *
+ * `dependsOn` is Flux's reconcile-ordering edge: the Kustomization stays
+ * pending until every named Kustomization is ready. The names are plain
+ * strings with no referential integrity — a typo, or an entry left behind
+ * after a rename, stalls the app silently. This check joins each entry
+ * against the Kustomizations the build actually declares.
+ *
+ * It is a warning, not an error: estates legitimately split infra and apps
+ * across repos, so a dependency (say `cert-manager`) may be declared by a
+ * build this one never sees. A self-referencing entry is flagged too — Flux
+ * can never satisfy it.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { allManifests, manifestsOfKind } from "./argo-helpers";
+import type { K8sManifest } from "./k8s-helpers";
+
+/** Flux Kustomizations only — the kustomize.config.k8s.io kind shares the name. */
+function fluxKustomizations(manifests: K8sManifest[]): K8sManifest[] {
+  return manifestsOfKind(manifests, "Kustomization").filter((m) => {
+    const apiVersion = m.apiVersion;
+    return typeof apiVersion !== "string" || apiVersion.startsWith("kustomize.toolkit.fluxcd.io/");
+  });
+}
+
+export const flux003: PostSynthCheck = {
+  id: "FLUX003",
+  description: "Kustomization.spec.dependsOn entries should name Kustomizations declared in the build",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const kustomizations = fluxKustomizations(allManifests(ctx));
+
+    const declared = new Set(
+      kustomizations
+        .map((k) => k.metadata?.name)
+        .filter((n): n is string => typeof n === "string"),
+    );
+
+    for (const kustomization of kustomizations) {
+      const name = kustomization.metadata?.name ?? "Kustomization";
+      const dependsOn = kustomization.spec?.dependsOn;
+      if (!Array.isArray(dependsOn)) continue;
+
+      for (const entry of dependsOn) {
+        const depName = (entry as { name?: unknown } | null)?.name;
+        if (typeof depName !== "string" || depName === "") continue;
+
+        if (depName === name) {
+          diagnostics.push({
+            checkId: "FLUX003",
+            severity: "warning",
+            message: `Kustomization "${name}" depends on itself — Flux can never satisfy the edge and the app will not reconcile.`,
+            entity: name,
+            lexicon: "k8s",
+          });
+          continue;
+        }
+
+        if (declared.has(depName)) continue;
+
+        diagnostics.push({
+          checkId: "FLUX003",
+          severity: "warning",
+          message: `Kustomization "${name}" depends on Kustomization "${depName}", which nothing in the build declares — reconciliation stalls until it exists. Fix the name, or ignore if it is declared in another repo.`,
+          entity: name,
+          lexicon: "k8s",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA6MlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA8I3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA8MlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA2K3B,CAAC"}