@intentius/chant-lexicon-k8s 0.44.13 → 0.45.0

package/dist/okf/index.md

@@ -254,3 +254,5 @@ okf_version: '0.2'
 * [WK8401](/rules/WK8401.md) - shmSize must not exceed the container memory limit — pod will not schedule if it does
 * [WK8402](/rules/WK8402.md) - RayCluster should set spec.rayVersion so KubeRay selects the correct autoscaler image
 * [WK8403](/rules/WK8403.md) - spec.rayVersion should match the Ray version in the head container image tag
+* [WK8501](/rules/WK8501.md) - Custom resource spec contains a field its CRD schema does not declare
+* [WK8502](/rules/WK8502.md) - Custom resource spec field has the wrong type or a value outside its enum

package/dist/okf/rules/WK8501.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8501
+description: Custom resource spec contains a field its CRD schema does not declare
+id: WK8501
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Custom resource spec contains a field its CRD schema does not declare

package/dist/okf/rules/WK8502.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8502
+description: Custom resource spec field has the wrong type or a value outside its enum
+id: WK8502
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Custom resource spec field has the wrong type or a value outside its enum

package/dist/rules/crd-schema-helpers.ts

@@ -0,0 +1,228 @@
+/**
+ * Shared helpers for the custom-resource spec checks (WK8501, WK8502) — chant #1372.
+ *
+ * A CRD's constructor takes `spec: Record<string, unknown>`, so a misspelled
+ * or wrong-typed field type-checks, serializes, and is accepted by the API
+ * server (which prunes what the structural schema does not know) — the
+ * controller then runs with a default nobody chose. The generated lexicon JSON
+ * carries each CRD's `spec` field schema (`specSchema`); these helpers walk a
+ * synthesized manifest against it and report what the schema would reject.
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter.
+ */
+
+import { createRequire } from "module";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { CrdFieldSchema } from "../../spec/parse";
+import { getPrimaryOutput, parseK8sManifests, type K8sManifest } from "./k8s-helpers";
+
+export type { CrdFieldSchema };
+
+interface LexiconEntry {
+  kind: "resource" | "property";
+  apiVersion?: string;
+  gvkKind?: string;
+  specSchema?: CrdFieldSchema;
+}
+
+let cachedRegistry: Map<string, CrdFieldSchema> | null = null;
+
+/** Registry key: `<apiVersion>/<kind>`, the pair a manifest carries verbatim. */
+function registryKey(apiVersion: string, kind: string): string {
+  return `${apiVersion}/${kind}`;
+}
+
+/**
+ * Spec schemas of every CRD the lexicon ships, keyed by `apiVersion/kind`.
+ * Built-in kinds carry no `specSchema` and are never in the map.
+ */
+export function getCrdSchemaRegistry(): Map<string, CrdFieldSchema> {
+  if (cachedRegistry) return cachedRegistry;
+  cachedRegistry = new Map();
+  try {
+    // Built lazily so importing this module stays edge-safe: `createRequire`
+    // throws where import.meta.url is undefined (bundled Workers), and there
+    // the registry is simply empty.
+    const require = createRequire(import.meta.url);
+    const lexicon = require("../../generated/lexicon-k8s.json") as Record<string, LexiconEntry>;
+    for (const entry of Object.values(lexicon)) {
+      if (entry.kind === "resource" && entry.apiVersion && entry.gvkKind && entry.specSchema) {
+        cachedRegistry.set(registryKey(entry.apiVersion, entry.gvkKind), entry.specSchema);
+      }
+    }
+  } catch {
+    // Lexicon JSON not yet generated — empty registry, checks pass.
+  }
+  return cachedRegistry;
+}
+
+/** Test seam: replace the registry (pass `null` to reload from the lexicon JSON). */
+export function setCrdSchemaRegistry(registry: Map<string, CrdFieldSchema> | null): void {
+  cachedRegistry = registry;
+}
+
+/** The schema for a manifest's `apiVersion`/`kind`, if the lexicon ships one. */
+export function specSchemaFor(manifest: K8sManifest): CrdFieldSchema | undefined {
+  if (typeof manifest.apiVersion !== "string" || typeof manifest.kind !== "string") return undefined;
+  return getCrdSchemaRegistry().get(registryKey(manifest.apiVersion, manifest.kind));
+}
+
+/** Every manifest in the build that has a shipped spec schema, with that schema. */
+export function customResources(ctx: PostSynthContext): Array<{ manifest: K8sManifest; schema: CrdFieldSchema }> {
+  const out: Array<{ manifest: K8sManifest; schema: CrdFieldSchema }> = [];
+  for (const [, output] of ctx.outputs) {
+    for (const manifest of parseK8sManifests(getPrimaryOutput(output))) {
+      const schema = specSchemaFor(manifest);
+      if (schema) out.push({ manifest, schema });
+    }
+  }
+  return out;
+}
+
+export interface SpecFinding {
+  kind: "unknown-field" | "type-mismatch";
+  /** Dotted path under `spec`, e.g. `spec.source.s3bucket`. Array elements use `[i]`. */
+  path: string;
+  message: string;
+}
+
+/**
+ * Walk `value` against `schema` and report every field the schema does not
+ * list (unless the enclosing object is `open`) and every scalar whose type or
+ * enum membership the schema rejects. Untyped nodes pass anything.
+ */
+export function validateSpec(value: unknown, schema: CrdFieldSchema, path = "spec"): SpecFinding[] {
+  const findings: SpecFinding[] = [];
+  walk(value, schema, path, findings);
+  return findings;
+}
+
+function walk(value: unknown, schema: CrdFieldSchema, path: string, out: SpecFinding[]): void {
+  if (value === null || value === undefined) return;
+
+  // int-or-string and other deliberately untyped nodes accept anything.
+  if (!schema.type) return;
+
+  switch (schema.type) {
+    case "object": {
+      if (typeof value !== "object" || Array.isArray(value)) {
+        out.push(mismatch(path, "an object", value));
+        return;
+      }
+      const obj = value as Record<string, unknown>;
+      for (const [name, child] of Object.entries(obj)) {
+        const childSchema = schema.fields?.[name];
+        if (childSchema) {
+          walk(child, childSchema, `${path}.${name}`, out);
+          continue;
+        }
+        if (schema.open) continue;
+        const known = Object.keys(schema.fields ?? {});
+        const suggestion = suggestField(name, known);
+        const hint = suggestion ? ` (did you mean "${suggestion}"?)` : "";
+        out.push({
+          kind: "unknown-field",
+          path: `${path}.${name}`,
+          message: `unknown field "${path}.${name}"${hint}`,
+        });
+      }
+      return;
+    }
+    case "array": {
+      if (!Array.isArray(value)) {
+        out.push(mismatch(path, "an array", value));
+        return;
+      }
+      if (schema.items) {
+        value.forEach((item, i) => walk(item, schema.items!, `${path}[${i}]`, out));
+      }
+      return;
+    }
+    case "string": {
+      if (typeof value !== "string") {
+        // `x-kubernetes-int-or-string` never reaches here (untyped); a plain
+        // string field given a number is a real mismatch the server coerces
+        // or rejects depending on version, so say so.
+        out.push(mismatch(path, "a string", value));
+        return;
+      }
+      checkEnum(value, schema, path, out);
+      return;
+    }
+    case "integer":
+    case "number": {
+      if (typeof value !== "number" || (schema.type === "integer" && !Number.isInteger(value))) {
+        out.push(mismatch(path, schema.type === "integer" ? "an integer" : "a number", value));
+        return;
+      }
+      checkEnum(value, schema, path, out);
+      return;
+    }
+    case "boolean": {
+      if (typeof value !== "boolean") out.push(mismatch(path, "a boolean", value));
+      return;
+    }
+  }
+}
+
+function checkEnum(value: string | number, schema: CrdFieldSchema, path: string, out: SpecFinding[]): void {
+  if (!schema.enum || schema.enum.length === 0) return;
+  if (schema.enum.includes(String(value))) return;
+  out.push({
+    kind: "type-mismatch",
+    path,
+    message: `"${path}" must be one of ${schema.enum.map((v) => `"${v}"`).join(", ")}, got ${describe(value)}`,
+  });
+}
+
+function mismatch(path: string, expected: string, value: unknown): SpecFinding {
+  return {
+    kind: "type-mismatch",
+    path,
+    message: `"${path}" expects ${expected}, got ${describe(value)}`,
+  };
+}
+
+function describe(value: unknown): string {
+  if (typeof value === "string") return `string "${value}"`;
+  if (typeof value === "number" || typeof value === "boolean") return `${typeof value} ${String(value)}`;
+  if (Array.isArray(value)) return "an array";
+  if (value !== null && typeof value === "object") return "an object";
+  return String(value);
+}
+
+/** Levenshtein distance between two strings. */
+export function levenshtein(a: string, b: string): number {
+  const m = a.length;
+  const n = b.length;
+  const dp: number[][] = Array.from({ length: m + 1 }, () => Array<number>(n + 1).fill(0));
+  for (let i = 0; i <= m; i++) dp[i][0] = i;
+  for (let j = 0; j <= n; j++) dp[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    for (let j = 1; j <= n; j++) {
+      dp[i][j] = a[i - 1] === b[j - 1]
+        ? dp[i - 1][j - 1]
+        : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
+    }
+  }
+  return dp[m][n];
+}
+
+/** Closest known field within Levenshtein distance 3 (case-insensitive), if any. */
+export function suggestField(unknown: string, known: string[]): string | undefined {
+  let best: string | undefined;
+  let bestDist = 4;
+  for (const field of known) {
+    const dist = levenshtein(unknown.toLowerCase(), field.toLowerCase());
+    if (dist < bestDist) {
+      bestDist = dist;
+      best = field;
+    }
+  }
+  return best;
+}
+
+/** `metadata.name` or the kind, for diagnostics. */
+export function resourceLabel(manifest: K8sManifest): string {
+  return manifest.metadata?.name ?? manifest.kind ?? "resource";
+}

package/dist/rules/wk8501.ts

@@ -0,0 +1,40 @@
+/**
+ * WK8501: Custom resource spec has a field its CRD schema does not declare
+ *
+ * A generated CRD class takes `spec: Record<string, unknown>`, so a misspelled
+ * field (`classname` for `className`) type-checks and serializes. The API
+ * server accepts the object and prunes the unknown field, the controller
+ * never sees it, and the resource runs with a default nobody chose. The
+ * lexicon ships each CRD's `spec` schema (chant #1372); this check flags any
+ * field that schema does not list, unless the enclosing object declares
+ * `x-kubernetes-preserve-unknown-fields` or `additionalProperties`.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { customResources, resourceLabel, validateSpec } from "./crd-schema-helpers";
+
+export const wk8501: PostSynthCheck = {
+  id: "WK8501",
+  description: "Custom resource spec contains a field its CRD schema does not declare",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { manifest, schema } of customResources(ctx)) {
+      if (manifest.spec === undefined) continue;
+      const name = resourceLabel(manifest);
+      for (const finding of validateSpec(manifest.spec, schema)) {
+        if (finding.kind !== "unknown-field") continue;
+        diagnostics.push({
+          checkId: "WK8501",
+          severity: "error",
+          message: `${manifest.kind} "${name}": ${finding.message}. The API server prunes it and the controller never sees it.`,
+          entity: name,
+          lexicon: "k8s",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wk8502.ts

@@ -0,0 +1,39 @@
+/**
+ * WK8502: Custom resource spec field has the wrong type or an invalid enum value
+ *
+ * With `spec: Record<string, unknown>` on every generated CRD class, nothing
+ * at compile time stops `replicas: "2"` or `desiredState: "Runing"`. The API
+ * server rejects the first at apply and the controller ignores the second.
+ * The lexicon ships each CRD's `spec` schema (chant #1372); this check
+ * compares every scalar against its declared type and enum before apply.
+ * `x-kubernetes-int-or-string` and untyped nodes accept anything.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { customResources, resourceLabel, validateSpec } from "./crd-schema-helpers";
+
+export const wk8502: PostSynthCheck = {
+  id: "WK8502",
+  description: "Custom resource spec field has the wrong type or a value outside its enum",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { manifest, schema } of customResources(ctx)) {
+      if (manifest.spec === undefined) continue;
+      const name = resourceLabel(manifest);
+      for (const finding of validateSpec(manifest.spec, schema)) {
+        if (finding.kind !== "type-mismatch") continue;
+        diagnostics.push({
+          checkId: "WK8502",
+          severity: "error",
+          message: `${manifest.kind} "${name}": ${finding.message}`,
+          entity: name,
+          lexicon: "k8s",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/spec/parse.d.ts

@@ -64,6 +64,32 @@ export interface ParsedOperation {
     /** Verbs the schema documents for the named resource, e.g. `get`, `patch`. */
     verbs: string[];
 }
+/**
+ * Compact, recursive field schema for a custom resource's `spec` — chant #1372.
+ *
+ * Built-in kinds get their field typing from the generated `.d.ts`. A CRD's
+ * constructor takes `spec: Record<string, unknown>`, so its field names, enums
+ * and scalar types have to travel through the lexicon JSON instead. This is
+ * the shape that ships there: no descriptions, no numeric bounds, only what a
+ * validator needs to reject a misspelled field or a wrong-typed value.
+ */
+export interface CrdFieldSchema {
+    /** OpenAPI type; `integer` is kept distinct from `number`. Absent when the schema says nothing. */
+    type?: "string" | "integer" | "number" | "boolean" | "object" | "array";
+    enum?: string[];
+    /** Object members, keyed by field name. */
+    fields?: Record<string, CrdFieldSchema>;
+    /** Required member names of an object. */
+    required?: string[];
+    /** Element schema of an array. */
+    items?: CrdFieldSchema;
+    /**
+     * True when the object accepts members its `fields` do not list —
+     * `x-kubernetes-preserve-unknown-fields` or `additionalProperties`.
+     * `x-kubernetes-int-or-string` also sets it on a scalar, meaning either type passes.
+     */
+    open?: true;
+}
 export interface K8sParseResult {
     resource: ParsedResource;
     propertyTypes: ParsedPropertyType[];
@@ -73,6 +99,12 @@ export interface K8sParseResult {
     isProperty?: boolean;
     /** How the API addresses this resource. Absent for property types. */
     operation?: ParsedOperation;
+    /**
+     * The `spec` field schema of a custom resource (chant #1372). Present only
+     * for CRD-derived kinds whose `openAPIV3Schema` declares a `spec`; built-in
+     * kinds carry their typing in the `.d.ts` instead.
+     */
+    specSchema?: CrdFieldSchema;
 }
 interface SwaggerOperation {
     "x-kubernetes-group-version-kind"?: GroupVersionKind;

package/dist/spec/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAUhF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6HAA6H;IAC7H,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,GAAG,EAAE,gBAAgB,CAAC;IACtB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AA4CD,UAAU,gBAAgB;IACxB,iCAAiC,CAAC,EAAE,gBAAgB,CAAC;IACrD,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,CAAC;AA+DlE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,cAAc,EAAE,CAoCvE;AAED,uFAAuF;AACvF;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAapF;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAEpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAqChH;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAG3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAK7D;AA4PD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAUhF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6HAA6H;IAC7H,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IACxE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kCAAkC;IAClC,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;;;OAIG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,GAAG,EAAE,gBAAgB,CAAC;IACtB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AA4CD,UAAU,gBAAgB;IACxB,iCAAiC,CAAC,EAAE,gBAAgB,CAAC;IACrD,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,CAAC;AA+DlE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,cAAc,EAAE,CAoCvE;AAED,uFAAuF;AACvF;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAapF;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAEpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAqChH;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAG3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAK7D;AA4PD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAElG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAuBvF;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAYpF"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAElG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAuBvF;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAepF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.44.13",
+  "version": "0.45.0",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,7 +76,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "optionalDependencies": {
-    "@intentius/chant-k8s-client": "^0.44.13"
+    "@intentius/chant-k8s-client": "^0.45.0"
   },
   "devDependencies": {
     "@intentius/chant": "*",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.44.13",
+    "@intentius/chant": "^0.45.0",
     "typescript": "^5.9.3"
   }
 }