@intentius/chant-lexicon-k8s 0.44.3 → 0.44.4

package/dist/crd/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/crd/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAsEvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAoD5D"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/crd/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAoD5D"}

package/dist/group-namespace.d.ts

@@ -0,0 +1,46 @@
+/**
+ * API group → `K8s::{Namespace}::{Kind}` namespace segment — the ONE copy.
+ *
+ * Four surfaces build entityTypes from a group string: CRD codegen
+ * (`crd/parser.ts`), the swagger pass (`spec/parse.ts`), live discovery
+ * (`describe-resources.ts` via `gvkToTypeName`), and YAML import
+ * (`import/parser.ts`). Until #1628 each had its own copy of the rule and only
+ * CRD codegen consulted the overrides, so a Flux Kustomization arriving through
+ * a kustomize root or `chant import` was typed `K8s::Kustomize::Kustomization`
+ * — a name that matches nothing in operations.json (NOT-OBSERVED live) and
+ * nothing downstream that dispatches on kind. Every path resolves here now;
+ * the declared, rendered, imported and discovered spellings of a kind cannot
+ * skew.
+ */
+/**
+ * Group names whose first segment doesn't yield the conventional namespace.
+ * "argoproj.io" → "Argo" (not "Argoproj") to match the Argo CD vocabulary
+ * and the ArgoAppFor / ArgoAppSetForRegions composites.
+ *
+ * The Flux toolkit spreads across five `*.toolkit.fluxcd.io` groups plus the
+ * Flux Operator's `fluxcd.controlplane.io`; all six collapse to a single `Flux`
+ * namespace so a GitRepository and a Kustomization read as `K8s::Flux::*`
+ * siblings rather than scattering to Source / Kustomize / Helm / Notification /
+ * Image / Fluxcd. (`helm.toolkit.fluxcd.io` → `Helm` would also collide
+ * confusingly with the separate helm lexicon.)
+ *
+ * KubeMicroVM's `lambda.aws.amazon.com` would take `Lambda` by the
+ * first-segment rule, which reads as AWS Lambda proper and would sit
+ * confusingly beside the aws lexicon's real Lambda functions. These are
+ * Kubernetes CRs belonging to a community operator, so they take the
+ * operator's own name. `MicroVM` alone was the alternative and was rejected
+ * for stuttering: `K8s::MicroVM::MicroVM`.
+ *
+ * Note the official AWS controller uses a different group,
+ * `lambdamicrovms.services.k8s.aws`, so it can coexist here and will want its
+ * own entry rather than sharing this one.
+ */
+export declare const GROUP_NAMESPACE_OVERRIDES: Record<string, string>;
+/**
+ * Normalize an API group to its PascalCase namespace segment.
+ * "" → "Core", overrides first ("argoproj.io" → "Argo"), then the first
+ * dot-segment kebab→PascalCased: "cert-manager.io" → "CertManager",
+ * "rbac.authorization.k8s.io" → "Rbac", "apps" → "Apps".
+ */
+export declare function namespaceSegmentForGroup(group: string): string;
+//# sourceMappingURL=group-namespace.d.ts.map

package/dist/group-namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-namespace.d.ts","sourceRoot":"","sources":["../src/group-namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAuB5D,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAS9D"}

package/dist/import/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAc,MAAM,gCAAgC,CAAC;AAwH7F;;;;;GAKG;AACH,qBAAa,SAAU,YAAW,cAAc;IAC9C,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAsClC,OAAO,CAAC,aAAa;CA8BtB"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAc,MAAM,gCAAgC,CAAC;AAyH7F;;;;;GAKG;AACH,qBAAa,SAAU,YAAW,cAAc;IAC9C,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAsClC,OAAO,CAAC,aAAa;CA8BtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "d94d393cea4fe4e3bebaa9590a85d8966e15e27d6cf2233ed07395182146501b",
+    "manifest.json": "994f303cfb6edefd9d0eb5d18406f784172b3fb0bd5b524e7e3255a96f4bf338",
     "meta.json": "f568fb8a0cbd4adf041baccaa3e1164c2e3c5c0090186236f887f0084f5521a8",
     "types/index.d.ts": "ef2c9df6a4d1ebfbe33f96c094fbbe3fc7909522ea38e086666fbf3c8ac477fd",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -54,5 +54,5 @@
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5",
     "skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
   },
-  "composite": "1031cf6d53da6ad5ddf631aaa8160f1a5ca914c95a124b0827e42b40b99ab270"
+  "composite": "815ab02fe7f7325c6fbec07be9f9f8423df8d9771ddd23babef1af5ae60c0acd"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.44.3",
+  "version": "0.44.4",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/spec/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAShF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6HAA6H;IAC7H,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,GAAG,EAAE,gBAAgB,CAAC;IACtB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AA4CD,UAAU,gBAAgB;IACxB,iCAAiC,CAAC,EAAE,gBAAgB,CAAC;IACrD,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,CAAC;AA+DlE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,cAAc,EAAE,CAoCvE;AAED,uFAAuF;AACvF;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAapF;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAEpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAqChH;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAG3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAK7D;AAqQD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAUhF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6HAA6H;IAC7H,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,GAAG,EAAE,gBAAgB,CAAC;IACtB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AA4CD,UAAU,gBAAgB;IACxB,iCAAiC,CAAC,EAAE,gBAAgB,CAAC;IACrD,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,CAAC;AA+DlE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,cAAc,EAAE,CAoCvE;AAED,uFAAuF;AACvF;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAapF;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAEpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAqChH;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAG3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAK7D;AA4PD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.44.3",
+  "version": "0.44.4",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,7 +76,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "optionalDependencies": {
-    "@intentius/chant-k8s-client": "^0.44.3"
+    "@intentius/chant-k8s-client": "^0.44.4"
   },
   "devDependencies": {
     "@intentius/chant": "*",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.44.3",
+    "@intentius/chant": "^0.44.4",
     "typescript": "^5.9.3"
   }
 }

package/src/crd/parser.ts

@@ -9,75 +9,10 @@
 
 import type { K8sParseResult, ParsedProperty, ParsedPropertyType, GroupVersionKind } from "../spec/parse";
 import type { CRDSpec } from "./types";
+import { namespaceSegmentForGroup } from "../group-namespace";
 import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
 import { loadAll } from "js-yaml";
 
-/**
- * Group names whose first segment doesn't yield the conventional namespace.
- * "argoproj.io" → "Argo" (not "Argoproj") to match the Argo CD vocabulary
- * and the ArgoAppFor / ArgoAppSetForRegions composites.
- *
- * The Flux toolkit spreads across five `*.toolkit.fluxcd.io` groups plus the
- * Flux Operator's `fluxcd.controlplane.io`; all six collapse to a single `Flux`
- * namespace so a GitRepository and a Kustomization read as `K8s::Flux::*`
- * siblings rather than scattering to Source / Kustomize / Helm / Notification /
- * Image / Fluxcd. (`helm.toolkit.fluxcd.io` → `Helm` would also collide
- * confusingly with the separate helm lexicon.)
- *
- * KubeMicroVM's `lambda.aws.amazon.com` would take `Lambda` by the
- * first-segment rule, which reads as AWS Lambda proper and would sit
- * confusingly beside the aws lexicon's real Lambda functions. These are
- * Kubernetes CRs belonging to a community operator, so they take the
- * operator's own name. `MicroVM` alone was the alternative and was rejected
- * for stuttering: `K8s::MicroVM::MicroVM`.
- *
- * Note the official AWS controller uses a different group,
- * `lambdamicrovms.services.k8s.aws`, so it can coexist here and will want its
- * own entry rather than sharing this one.
- */
-const GROUP_NAMESPACE_OVERRIDES: Record<string, string> = {
-  "argoproj.io": "Argo",
-  "source.toolkit.fluxcd.io": "Flux",
-  "kustomize.toolkit.fluxcd.io": "Flux",
-  "helm.toolkit.fluxcd.io": "Flux",
-  "notification.toolkit.fluxcd.io": "Flux",
-  "image.toolkit.fluxcd.io": "Flux",
-  "fluxcd.controlplane.io": "Flux",
-  "lambda.aws.amazon.com": "KubeMicroVM",
-  // CNPG and its barman-cloud plugin ship under two groups but are one thing to
-  // an author: a Cluster's `plugins[]` names an ObjectStore. The first-segment
-  // rule would scatter them into `Postgresql` and `Barmancloud`.
-  "postgresql.cnpg.io": "Cnpg",
-  "barmancloud.cnpg.io": "Cnpg",
-  // Not `Secrets`: `K8s::Secrets::InfisicalSecret` reads like a core Secret,
-  // and `K8s::Core::Secret` is right there to be confused with.
-  "secrets.infisical.com": "Infisical",
-  // k3s's bundled controllers ship under two groups but are one thing to an
-  // author — the k3s auto-deploy surface. The first-segment rule would give
-  // `K8s::Helm::HelmChart`, which reads like it belongs to the helm lexicon,
-  // and would split HelmChart from the Addon that tracks its deployment.
-  "helm.cattle.io": "K3s",
-  "k3s.cattle.io": "K3s",
-};
-
-/**
- * Normalize a CRD group to a PascalCase namespace segment.
- * "cert-manager.io" → "CertManager"
- * "monitoring.coreos.com" → "Monitoring"
- * "argoproj.io" → "Argo" (override)
- */
-function normalizeGroupName(group: string): string {
-  const override = GROUP_NAMESPACE_OVERRIDES[group];
-  if (override) return override;
-  // Take the first segment before the first dot
-  const firstSegment = group.split(".")[0];
-  // Convert kebab-case to PascalCase
-  return firstSegment
-    .split("-")
-    .map((s) => s.charAt(0).toUpperCase() + s.slice(1))
-    .join("");
-}
-
 /**
  * Parse a CRD YAML document string into K8sParseResult entries.
  * Returns one result per served version in the CRD.
@@ -111,7 +46,7 @@ export function parseCRD(content: string): K8sParseResult[] {
  */
 export function parseCRDSpec(spec: CRDSpec): K8sParseResult[] {
   const results: K8sParseResult[] = [];
-  const groupNs = normalizeGroupName(spec.group);
+  const groupNs = namespaceSegmentForGroup(spec.group);
 
   // Find the storage version (the canonical version)
   const storageVersion = spec.versions.find((v) => v.storage && v.served);

package/src/describe-resources.test.ts

@@ -731,7 +731,7 @@ describe("k8s describeResources", () => {
       );
 
       expect(result.resources["microvm-demo/kmv-dev-a-vm-42sgf"]).toMatchObject({
-        type: "K8s::Lambda::MicroVM",
+        type: "K8s::KubeMicroVM::MicroVM",
         physicalId: "vm-uid",
         ownerChain: { root: "declared", entity: "workloadReplicaSet" },
       });

package/src/group-namespace.test.ts

@@ -0,0 +1,64 @@
+import { describe, test, expect } from "vitest";
+import { namespaceSegmentForGroup } from "./group-namespace";
+import { renderedManifestEntity } from "./kustomize/rendered-entity";
+import { K8sParser } from "./import/parser";
+
+describe("namespaceSegmentForGroup", () => {
+  test("the empty core group is Core", () => {
+    expect(namespaceSegmentForGroup("")).toBe("Core");
+  });
+
+  test("a single-segment group PascalCases", () => {
+    expect(namespaceSegmentForGroup("apps")).toBe("Apps");
+  });
+
+  test("only the first dot-segment counts", () => {
+    expect(namespaceSegmentForGroup("rbac.authorization.k8s.io")).toBe("Rbac");
+  });
+
+  test("a hyphenated first segment kebab→Pascals", () => {
+    expect(namespaceSegmentForGroup("cert-manager.io")).toBe("CertManager");
+  });
+
+  test("argoproj.io takes the Argo override", () => {
+    expect(namespaceSegmentForGroup("argoproj.io")).toBe("Argo");
+  });
+
+  test("the toolkit groups collapse to Flux", () => {
+    expect(namespaceSegmentForGroup("kustomize.toolkit.fluxcd.io")).toBe("Flux");
+  });
+});
+
+// #1628: rendered and imported entityTypes used to bypass the overrides, so a
+// Flux CR arriving through a kustomize root or `chant import` was typed to a
+// name that matches nothing in operations.json.
+describe("the shared rule reaches the render and import paths", () => {
+  test("a rendered Flux Kustomization is typed K8s::Flux::Kustomization", () => {
+    const entity = renderedManifestEntity(
+      {
+        apiVersion: "kustomize.toolkit.fluxcd.io/v1",
+        kind: "Kustomization",
+        metadata: { name: "apps", namespace: "flux-system" },
+        spec: { path: "./apps/prod", prune: true },
+      },
+      "clusters/prod",
+    );
+
+    expect(entity?.entityType).toBe("K8s::Flux::Kustomization");
+  });
+
+  test("an imported Argo Application is typed K8s::Argo::Application", () => {
+    const ir = new K8sParser().parse(`
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: guestbook
+  namespace: argocd
+spec:
+  project: default
+`);
+
+    expect(ir.resources.length).toBe(1);
+    expect(ir.resources[0].type).toBe("K8s::Argo::Application");
+  });
+});

package/src/group-namespace.ts

@@ -0,0 +1,79 @@
+/**
+ * API group → `K8s::{Namespace}::{Kind}` namespace segment — the ONE copy.
+ *
+ * Four surfaces build entityTypes from a group string: CRD codegen
+ * (`crd/parser.ts`), the swagger pass (`spec/parse.ts`), live discovery
+ * (`describe-resources.ts` via `gvkToTypeName`), and YAML import
+ * (`import/parser.ts`). Until #1628 each had its own copy of the rule and only
+ * CRD codegen consulted the overrides, so a Flux Kustomization arriving through
+ * a kustomize root or `chant import` was typed `K8s::Kustomize::Kustomization`
+ * — a name that matches nothing in operations.json (NOT-OBSERVED live) and
+ * nothing downstream that dispatches on kind. Every path resolves here now;
+ * the declared, rendered, imported and discovered spellings of a kind cannot
+ * skew.
+ */
+
+/**
+ * Group names whose first segment doesn't yield the conventional namespace.
+ * "argoproj.io" → "Argo" (not "Argoproj") to match the Argo CD vocabulary
+ * and the ArgoAppFor / ArgoAppSetForRegions composites.
+ *
+ * The Flux toolkit spreads across five `*.toolkit.fluxcd.io` groups plus the
+ * Flux Operator's `fluxcd.controlplane.io`; all six collapse to a single `Flux`
+ * namespace so a GitRepository and a Kustomization read as `K8s::Flux::*`
+ * siblings rather than scattering to Source / Kustomize / Helm / Notification /
+ * Image / Fluxcd. (`helm.toolkit.fluxcd.io` → `Helm` would also collide
+ * confusingly with the separate helm lexicon.)
+ *
+ * KubeMicroVM's `lambda.aws.amazon.com` would take `Lambda` by the
+ * first-segment rule, which reads as AWS Lambda proper and would sit
+ * confusingly beside the aws lexicon's real Lambda functions. These are
+ * Kubernetes CRs belonging to a community operator, so they take the
+ * operator's own name. `MicroVM` alone was the alternative and was rejected
+ * for stuttering: `K8s::MicroVM::MicroVM`.
+ *
+ * Note the official AWS controller uses a different group,
+ * `lambdamicrovms.services.k8s.aws`, so it can coexist here and will want its
+ * own entry rather than sharing this one.
+ */
+export const GROUP_NAMESPACE_OVERRIDES: Record<string, string> = {
+  "argoproj.io": "Argo",
+  "source.toolkit.fluxcd.io": "Flux",
+  "kustomize.toolkit.fluxcd.io": "Flux",
+  "helm.toolkit.fluxcd.io": "Flux",
+  "notification.toolkit.fluxcd.io": "Flux",
+  "image.toolkit.fluxcd.io": "Flux",
+  "fluxcd.controlplane.io": "Flux",
+  "lambda.aws.amazon.com": "KubeMicroVM",
+  // CNPG and its barman-cloud plugin ship under two groups but are one thing to
+  // an author: a Cluster's `plugins[]` names an ObjectStore. The first-segment
+  // rule would scatter them into `Postgresql` and `Barmancloud`.
+  "postgresql.cnpg.io": "Cnpg",
+  "barmancloud.cnpg.io": "Cnpg",
+  // Not `Secrets`: `K8s::Secrets::InfisicalSecret` reads like a core Secret,
+  // and `K8s::Core::Secret` is right there to be confused with.
+  "secrets.infisical.com": "Infisical",
+  // k3s's bundled controllers ship under two groups but are one thing to an
+  // author — the k3s auto-deploy surface. The first-segment rule would give
+  // `K8s::Helm::HelmChart`, which reads like it belongs to the helm lexicon,
+  // and would split HelmChart from the Addon that tracks its deployment.
+  "helm.cattle.io": "K3s",
+  "k3s.cattle.io": "K3s",
+};
+
+/**
+ * Normalize an API group to its PascalCase namespace segment.
+ * "" → "Core", overrides first ("argoproj.io" → "Argo"), then the first
+ * dot-segment kebab→PascalCased: "cert-manager.io" → "CertManager",
+ * "rbac.authorization.k8s.io" → "Rbac", "apps" → "Apps".
+ */
+export function namespaceSegmentForGroup(group: string): string {
+  if (!group || group === "") return "Core";
+  const override = GROUP_NAMESPACE_OVERRIDES[group];
+  if (override) return override;
+  const firstSegment = group.split(".")[0];
+  return firstSegment
+    .split("-")
+    .map((s) => s.charAt(0).toUpperCase() + s.slice(1))
+    .join("");
+}

package/src/import/parser.ts

@@ -8,6 +8,7 @@
 
 import type { TemplateParser, TemplateIR, ResourceIR } from "@intentius/chant/import/parser";
 import { parseYAML } from "@intentius/chant/yaml";
+import { namespaceSegmentForGroup } from "../group-namespace";
 
 // ── GVK to type name mapping ───────────────────────────────────────
 
@@ -91,20 +92,20 @@ function resolveTypeName(apiVersion: string, kind: string): string {
 }
 
 /**
- * Extract PascalCase group name from an apiVersion string.
+ * Extract the namespace segment from an apiVersion string.
  * "apps/v1" → "Apps"
  * "v1" → "Core"
- * "networking.k8s.io/v1" → "Networking"
  * "rbac.authorization.k8s.io/v1" → "Rbac"
+ * "argoproj.io/v1alpha1" → "Argo" (override)
+ *
+ * Splits the version off and hands the group to the shared rule, so an
+ * imported manifest is typed exactly as a declared one is.
  */
 function apiVersionToGroup(apiVersion: string): string {
   const slashIdx = apiVersion.indexOf("/");
   if (slashIdx === -1) return "Core"; // core group (v1)
 
-  const groupStr = apiVersion.slice(0, slashIdx);
-  const firstSegment = groupStr.split(".")[0];
-  if (firstSegment === "rbac") return "Rbac";
-  return firstSegment.charAt(0).toUpperCase() + firstSegment.slice(1);
+  return namespaceSegmentForGroup(apiVersion.slice(0, slashIdx));
 }
 
 /**

package/src/kustomize/root.test.ts

@@ -94,7 +94,9 @@ describe("renderKustomizeRoots", () => {
     // The generated operation surface's naming, so `lifecycle diff --live`
     // observes a rendered Deployment through the same reader a declared one uses.
     expect(deployment.entityType).toBe("K8s::Apps::Deployment");
-    expect(entities.get("overlays/prod/certificateProdWebTls")!.entityType).toBe("K8s::Cert-manager::Certificate");
+    // Hyphenated groups PascalCase the same way the declarable surface does
+    // (#1628), so this Certificate matches the reader a declared one gets.
+    expect(entities.get("overlays/prod/certificateProdWebTls")!.entityType).toBe("K8s::CertManager::Certificate");
 
     const props = (deployment as unknown as { props: Record<string, unknown> }).props;
     const metadata = props.metadata as { annotations: Record<string, string> };

package/src/spec/parse.ts

@@ -13,6 +13,7 @@ import {
   primaryType,
   type JsonSchemaProperty,
 } from "@intentius/chant/codegen/json-schema";
+import { namespaceSegmentForGroup } from "../group-namespace";
 
 // ── Types ──────────────────────────────────────────────────────────
 
@@ -343,22 +344,13 @@ export function gvkToApiVersion(gvk: GroupVersionKind): string {
 }
 
 /**
- * Normalize API group to a PascalCase segment.
- * Empty group (core API) → "Core"
- * "apps" → "Apps"
- * "batch" → "Batch"
- * "rbac.authorization.k8s.io" → "Rbac"
- * "networking.k8s.io" → "Networking"
+ * Normalize API group to a PascalCase segment — the shared rule, so the
+ * swagger-generated surface, kustomize-rendered entities and live discovery
+ * (all three reach here through `gvkToTypeName`) spell a kind exactly as CRD
+ * codegen and `chant import` do. See `../group-namespace`.
  */
 function normalizeGroup(group: string): string {
-  if (!group || group === "") return "Core";
-
-  // Take the first segment before any dots
-  const firstSegment = group.split(".")[0];
-  // Special-case RBAC
-  if (firstSegment === "rbac") return "Rbac";
-  // PascalCase the first segment
-  return firstSegment.charAt(0).toUpperCase() + firstSegment.slice(1);
+  return namespaceSegmentForGroup(group);
 }
 
 /**