@intentius/chant-lexicon-k8s 0.44.3 → 0.44.5

package/dist/crd/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/crd/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAsEvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAoD5D"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/crd/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAoD5D"}

package/dist/describe-resources.d.ts

@@ -62,6 +62,34 @@ import { type K8sConnector } from "./api/connect.js";
  */
 export declare function statusFromObject(obj: K8sObject): string;
 export declare function unhappyConditions(obj: K8sObject): string[] | undefined;
+/**
+ * The revisions a GitOps controller writes onto its own object (#1632).
+ *
+ * Conditions lag. A Flux Kustomization mid-rollout still reports the previous
+ * reconcile's `Ready=True` for as long as the new one takes, so a consumer
+ * reading only conditions calls a half-applied estate converged. The
+ * controller's own definition of converged is a revision comparison:
+ * `lastAppliedRevision` against `lastAttemptedRevision` on the same object
+ * (attempted-but-not-applied is in flight), and a Kustomization's
+ * `lastAppliedRevision` against its source's `artifact.revision` (the
+ * cross-object half, which a consumer joins once both ends are on the wire).
+ * None of the three reached an observed entity's attributes before this.
+ *
+ * Read by path rather than by kind, which is the module's standing rule
+ * everywhere else: `status.lastAppliedRevision` / `status.lastAttemptedRevision`
+ * are what kustomize-controller and helm-controller write, and
+ * `status.artifact.revision` is what every source kind (GitRepository,
+ * OCIRepository, Bucket, HelmChart) writes. An object that has none of them —
+ * every non-GitOps kind — contributes nothing, so no kind table has to name
+ * which kinds those are, and a CRD speaking the same convention is carried for
+ * free. `artifactRevision` flattens the one nested path so every revision on
+ * the wire is a plain string next to the others.
+ */
+export declare function revisionAttributes(obj: K8sObject): {
+    lastAppliedRevision?: string;
+    lastAttemptedRevision?: string;
+    artifactRevision?: string;
+};
 export interface DescribeResourcesOptions {
     environment: string;
     buildOutput: string;
@@ -73,6 +101,25 @@ export interface DescribeResourcesOptions {
     owned?: boolean;
     /** Directory whose `chant.config.ts` carries the cluster binding. Defaults to cwd. */
     cwd?: string;
+    /**
+     * Namespace to read a namespaced entity from when it declares none (#1629).
+     *
+     * A GitOps estate splits the binding from the objects: the control-plane
+     * project declares a Kustomization with `spec.targetNamespace: app-b`, the
+     * app project declares bare Deployments and Services with no
+     * `metadata.namespace` at all — the controller stamps it at apply time. The
+     * live read of the app project had no way to be told that, so it fell
+     * through to the client's `default` and reported an estate that is running
+     * as entirely absent (#1620's `queried` line is what made that visible).
+     *
+     * A DEFAULT, never a rewrite: an entity with an explicit
+     * `metadata.namespace` reads from the namespace it declares, override or
+     * not — that declaration is the estate's own statement of where the object
+     * lives, and overruling it would make the option a way to read the wrong
+     * object rather than the right one. Cluster-scoped kinds are untouched:
+     * they have no namespace to default.
+     */
+    namespace?: string;
 }
 export declare function describeResources(options: DescribeResourcesOptions, connect?: K8sConnector): Promise<ObservationResult>;
 //# sourceMappingURL=describe-resources.d.ts.map

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAwD,MAAM,0BAA0B,CAAC;AAGxH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAmBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA2CvD;AA4FD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAetE;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAoJ5B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAwD,MAAM,0BAA0B,CAAC;AAGxH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAmBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA2CvD;AA4FD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAetE;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAUA;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CA6J5B"}

package/dist/group-namespace.d.ts

@@ -0,0 +1,46 @@
+/**
+ * API group → `K8s::{Namespace}::{Kind}` namespace segment — the ONE copy.
+ *
+ * Four surfaces build entityTypes from a group string: CRD codegen
+ * (`crd/parser.ts`), the swagger pass (`spec/parse.ts`), live discovery
+ * (`describe-resources.ts` via `gvkToTypeName`), and YAML import
+ * (`import/parser.ts`). Until #1628 each had its own copy of the rule and only
+ * CRD codegen consulted the overrides, so a Flux Kustomization arriving through
+ * a kustomize root or `chant import` was typed `K8s::Kustomize::Kustomization`
+ * — a name that matches nothing in operations.json (NOT-OBSERVED live) and
+ * nothing downstream that dispatches on kind. Every path resolves here now;
+ * the declared, rendered, imported and discovered spellings of a kind cannot
+ * skew.
+ */
+/**
+ * Group names whose first segment doesn't yield the conventional namespace.
+ * "argoproj.io" → "Argo" (not "Argoproj") to match the Argo CD vocabulary
+ * and the ArgoAppFor / ArgoAppSetForRegions composites.
+ *
+ * The Flux toolkit spreads across five `*.toolkit.fluxcd.io` groups plus the
+ * Flux Operator's `fluxcd.controlplane.io`; all six collapse to a single `Flux`
+ * namespace so a GitRepository and a Kustomization read as `K8s::Flux::*`
+ * siblings rather than scattering to Source / Kustomize / Helm / Notification /
+ * Image / Fluxcd. (`helm.toolkit.fluxcd.io` → `Helm` would also collide
+ * confusingly with the separate helm lexicon.)
+ *
+ * KubeMicroVM's `lambda.aws.amazon.com` would take `Lambda` by the
+ * first-segment rule, which reads as AWS Lambda proper and would sit
+ * confusingly beside the aws lexicon's real Lambda functions. These are
+ * Kubernetes CRs belonging to a community operator, so they take the
+ * operator's own name. `MicroVM` alone was the alternative and was rejected
+ * for stuttering: `K8s::MicroVM::MicroVM`.
+ *
+ * Note the official AWS controller uses a different group,
+ * `lambdamicrovms.services.k8s.aws`, so it can coexist here and will want its
+ * own entry rather than sharing this one.
+ */
+export declare const GROUP_NAMESPACE_OVERRIDES: Record<string, string>;
+/**
+ * Normalize an API group to its PascalCase namespace segment.
+ * "" → "Core", overrides first ("argoproj.io" → "Argo"), then the first
+ * dot-segment kebab→PascalCased: "cert-manager.io" → "CertManager",
+ * "rbac.authorization.k8s.io" → "Rbac", "apps" → "Apps".
+ */
+export declare function namespaceSegmentForGroup(group: string): string;
+//# sourceMappingURL=group-namespace.d.ts.map

package/dist/group-namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-namespace.d.ts","sourceRoot":"","sources":["../src/group-namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAuB5D,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAS9D"}

package/dist/import/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAc,MAAM,gCAAgC,CAAC;AAwH7F;;;;;GAKG;AACH,qBAAa,SAAU,YAAW,cAAc;IAC9C,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAsClC,OAAO,CAAC,aAAa;CA8BtB"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAc,MAAM,gCAAgC,CAAC;AAyH7F;;;;;GAKG;AACH,qBAAa,SAAU,YAAW,cAAc;IAC9C,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAsClC,OAAO,CAAC,aAAa;CA8BtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "d94d393cea4fe4e3bebaa9590a85d8966e15e27d6cf2233ed07395182146501b",
+    "manifest.json": "8c679fcec79d5351a4019ac14bb0b2665f1570b67015247cda5cec6f3192c94e",
     "meta.json": "f568fb8a0cbd4adf041baccaa3e1164c2e3c5c0090186236f887f0084f5521a8",
     "types/index.d.ts": "ef2c9df6a4d1ebfbe33f96c094fbbe3fc7909522ea38e086666fbf3c8ac477fd",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -54,5 +54,5 @@
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5",
     "skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
   },
-  "composite": "1031cf6d53da6ad5ddf631aaa8160f1a5ca914c95a124b0827e42b40b99ab270"
+  "composite": "4770ee5c6ebbc3ccfeaf324c13675ae19c299ae88f5b957dcb8c7a551321306f"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.44.3",
+  "version": "0.44.5",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/spec/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAShF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6HAA6H;IAC7H,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,GAAG,EAAE,gBAAgB,CAAC;IACtB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AA4CD,UAAU,gBAAgB;IACxB,iCAAiC,CAAC,EAAE,gBAAgB,CAAC;IACrD,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,CAAC;AA+DlE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,cAAc,EAAE,CAoCvE;AAED,uFAAuF;AACvF;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAapF;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAEpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAqChH;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAG3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAK7D;AAqQD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAUhF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6HAA6H;IAC7H,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,GAAG,EAAE,gBAAgB,CAAC;IACtB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AA4CD,UAAU,gBAAgB;IACxB,iCAAiC,CAAC,EAAE,gBAAgB,CAAC;IACrD,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,CAAC;AA+DlE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,cAAc,EAAE,CAoCvE;AAED,uFAAuF;AACvF;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAapF;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAEpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAqChH;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAG3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAK7D;AA4PD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.44.3",
+  "version": "0.44.5",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,7 +76,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "optionalDependencies": {
-    "@intentius/chant-k8s-client": "^0.44.3"
+    "@intentius/chant-k8s-client": "^0.44.5"
   },
   "devDependencies": {
     "@intentius/chant": "*",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.44.3",
+    "@intentius/chant": "^0.44.5",
     "typescript": "^5.9.3"
   }
 }

package/src/crd/parser.ts

@@ -9,75 +9,10 @@
 
 import type { K8sParseResult, ParsedProperty, ParsedPropertyType, GroupVersionKind } from "../spec/parse";
 import type { CRDSpec } from "./types";
+import { namespaceSegmentForGroup } from "../group-namespace";
 import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
 import { loadAll } from "js-yaml";
 
-/**
- * Group names whose first segment doesn't yield the conventional namespace.
- * "argoproj.io" → "Argo" (not "Argoproj") to match the Argo CD vocabulary
- * and the ArgoAppFor / ArgoAppSetForRegions composites.
- *
- * The Flux toolkit spreads across five `*.toolkit.fluxcd.io` groups plus the
- * Flux Operator's `fluxcd.controlplane.io`; all six collapse to a single `Flux`
- * namespace so a GitRepository and a Kustomization read as `K8s::Flux::*`
- * siblings rather than scattering to Source / Kustomize / Helm / Notification /
- * Image / Fluxcd. (`helm.toolkit.fluxcd.io` → `Helm` would also collide
- * confusingly with the separate helm lexicon.)
- *
- * KubeMicroVM's `lambda.aws.amazon.com` would take `Lambda` by the
- * first-segment rule, which reads as AWS Lambda proper and would sit
- * confusingly beside the aws lexicon's real Lambda functions. These are
- * Kubernetes CRs belonging to a community operator, so they take the
- * operator's own name. `MicroVM` alone was the alternative and was rejected
- * for stuttering: `K8s::MicroVM::MicroVM`.
- *
- * Note the official AWS controller uses a different group,
- * `lambdamicrovms.services.k8s.aws`, so it can coexist here and will want its
- * own entry rather than sharing this one.
- */
-const GROUP_NAMESPACE_OVERRIDES: Record<string, string> = {
-  "argoproj.io": "Argo",
-  "source.toolkit.fluxcd.io": "Flux",
-  "kustomize.toolkit.fluxcd.io": "Flux",
-  "helm.toolkit.fluxcd.io": "Flux",
-  "notification.toolkit.fluxcd.io": "Flux",
-  "image.toolkit.fluxcd.io": "Flux",
-  "fluxcd.controlplane.io": "Flux",
-  "lambda.aws.amazon.com": "KubeMicroVM",
-  // CNPG and its barman-cloud plugin ship under two groups but are one thing to
-  // an author: a Cluster's `plugins[]` names an ObjectStore. The first-segment
-  // rule would scatter them into `Postgresql` and `Barmancloud`.
-  "postgresql.cnpg.io": "Cnpg",
-  "barmancloud.cnpg.io": "Cnpg",
-  // Not `Secrets`: `K8s::Secrets::InfisicalSecret` reads like a core Secret,
-  // and `K8s::Core::Secret` is right there to be confused with.
-  "secrets.infisical.com": "Infisical",
-  // k3s's bundled controllers ship under two groups but are one thing to an
-  // author — the k3s auto-deploy surface. The first-segment rule would give
-  // `K8s::Helm::HelmChart`, which reads like it belongs to the helm lexicon,
-  // and would split HelmChart from the Addon that tracks its deployment.
-  "helm.cattle.io": "K3s",
-  "k3s.cattle.io": "K3s",
-};
-
-/**
- * Normalize a CRD group to a PascalCase namespace segment.
- * "cert-manager.io" → "CertManager"
- * "monitoring.coreos.com" → "Monitoring"
- * "argoproj.io" → "Argo" (override)
- */
-function normalizeGroupName(group: string): string {
-  const override = GROUP_NAMESPACE_OVERRIDES[group];
-  if (override) return override;
-  // Take the first segment before the first dot
-  const firstSegment = group.split(".")[0];
-  // Convert kebab-case to PascalCase
-  return firstSegment
-    .split("-")
-    .map((s) => s.charAt(0).toUpperCase() + s.slice(1))
-    .join("");
-}
-
 /**
  * Parse a CRD YAML document string into K8sParseResult entries.
  * Returns one result per served version in the CRD.
@@ -111,7 +46,7 @@ export function parseCRD(content: string): K8sParseResult[] {
  */
 export function parseCRDSpec(spec: CRDSpec): K8sParseResult[] {
   const results: K8sParseResult[] = [];
-  const groupNs = normalizeGroupName(spec.group);
+  const groupNs = namespaceSegmentForGroup(spec.group);
 
   // Find the storage version (the canonical version)
   const storageVersion = spec.versions.find((v) => v.storage && v.served);

package/src/describe-resources.test.ts

@@ -15,7 +15,7 @@ vi.mock("@intentius/chant/config", () => ({
   loadChantConfig: (...args: unknown[]) => loadChantConfigMock(...args),
 }));
 
-const { describeResources, statusFromObject, unhappyConditions } = await import("./describe-resources");
+const { describeResources, statusFromObject, unhappyConditions, revisionAttributes } = await import("./describe-resources");
 const { fakeCluster, objectKey, ownedObject } = await import("./api/fake-cluster");
 const { defaultK8sConnector } = await import("./api/connect");
 const { fakeKubeconfig, statusBody } = await import("@intentius/chant-k8s-client/testing");
@@ -731,7 +731,7 @@ describe("k8s describeResources", () => {
       );
 
       expect(result.resources["microvm-demo/kmv-dev-a-vm-42sgf"]).toMatchObject({
-        type: "K8s::Lambda::MicroVM",
+        type: "K8s::KubeMicroVM::MicroVM",
         physicalId: "vm-uid",
         ownerChain: { root: "declared", entity: "workloadReplicaSet" },
       });
@@ -1399,3 +1399,277 @@ describe("unhappyConditions (#1401)", () => {
     expect(unhappyConditions({} as never)).toBeUndefined();
   });
 });
+
+describe("revisionAttributes — the GitOps convergence fields (#1632)", () => {
+  test("carries a Kustomization's applied and attempted revisions", () => {
+    expect(
+      revisionAttributes({
+        status: {
+          lastAppliedRevision: "main@sha1:1a2b3c4d",
+          lastAttemptedRevision: "main@sha1:5e6f7a8b",
+          conditions: [{ type: "Ready", status: "True" }],
+        },
+      } as never),
+    ).toMatchObject({ lastAppliedRevision: "main@sha1:1a2b3c4d", lastAttemptedRevision: "main@sha1:5e6f7a8b" });
+  });
+
+  test("flattens a source kind's status.artifact.revision", () => {
+    expect(revisionAttributes({ status: { artifact: { revision: "main@sha1:1a2b3c4d" } } } as never)).toMatchObject({
+      artifactRevision: "main@sha1:1a2b3c4d",
+    });
+  });
+
+  test("says nothing for an object that carries none of them", () => {
+    // Every field undefined, so `pruneUndefined` drops all three and the
+    // attributes of a Deployment or a Service are byte-for-byte what they were.
+    expect(revisionAttributes({ status: { readyReplicas: 1, replicas: 1 } } as never)).toEqual({
+      lastAppliedRevision: undefined,
+      lastAttemptedRevision: undefined,
+      artifactRevision: undefined,
+    });
+    expect(revisionAttributes({} as never)).toEqual({
+      lastAppliedRevision: undefined,
+      lastAttemptedRevision: undefined,
+      artifactRevision: undefined,
+    });
+  });
+
+  test("ignores non-string and empty revisions", () => {
+    expect(
+      revisionAttributes({ status: { lastAppliedRevision: "", lastAttemptedRevision: 7, artifact: { revision: null } } } as never),
+    ).toEqual({ lastAppliedRevision: undefined, lastAttemptedRevision: undefined, artifactRevision: undefined });
+  });
+});
+
+describe("observed attributes carry the Flux revisions (#1632)", () => {
+  const applied = "main@sha1:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b";
+  const attempted = "main@sha1:5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d";
+
+  test("a Kustomization mid-rollout reports applied != attempted even with Ready=True", async () => {
+    const kustomization = {
+      apiVersion: "kustomize.toolkit.fluxcd.io/v1",
+      kind: "Kustomization",
+      metadata: { name: "apps", namespace: "flux-system", uid: "ks-uid", resourceVersion: "42" },
+      status: {
+        lastAppliedRevision: applied,
+        lastAttemptedRevision: attempted,
+        conditions: [{ type: "Ready", status: "True", reason: "ReconciliationSucceeded" }],
+      },
+    };
+    const source = {
+      apiVersion: "source.toolkit.fluxcd.io/v1",
+      kind: "GitRepository",
+      metadata: { name: "infra", namespace: "flux-system", uid: "gr-uid" },
+      status: {
+        artifact: { revision: attempted, path: "gitrepository/flux-system/infra/x.tar.gz" },
+        conditions: [{ type: "Ready", status: "True" }],
+      },
+    };
+    const cluster = fakeCluster({
+      objects: {
+        [objectKey("kustomize.toolkit.fluxcd.io/v1", "Kustomization", "apps", "flux-system")]: kustomization,
+        [objectKey("source.toolkit.fluxcd.io/v1", "GitRepository", "infra", "flux-system")]: source,
+      },
+    });
+
+    const result = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["apps", "infra"],
+        entities: makeEntities([
+          {
+            name: "apps",
+            entityType: "K8s::Flux::Kustomization",
+            props: { metadata: { name: "apps", namespace: "flux-system" } },
+          },
+          {
+            name: "infra",
+            entityType: "K8s::Flux::GitRepository",
+            props: { metadata: { name: "infra", namespace: "flux-system" } },
+          },
+        ]),
+      },
+      cluster.connector,
+    );
+
+    // The per-node half: attempted is ahead of applied, so this object is
+    // mid-flight however cheerful its Ready condition is.
+    expect(result.resources.apps?.attributes).toMatchObject({
+      lastAppliedRevision: applied,
+      lastAttemptedRevision: attempted,
+    });
+    // The cross-node half: the source's artifact revision, which a consumer
+    // joins against the Kustomization's applied revision.
+    expect(result.resources.infra?.attributes).toMatchObject({ artifactRevision: attempted });
+    expect(result.resources.apps?.status).toBe("READY");
+  });
+
+  test("a HelmRelease's revisions ride the same path, and other kinds are untouched", async () => {
+    const helmRelease = {
+      apiVersion: "helm.toolkit.fluxcd.io/v2",
+      kind: "HelmRelease",
+      metadata: { name: "podinfo", namespace: "prod", uid: "hr-uid" },
+      status: { lastAppliedRevision: "6.5.4", lastAttemptedRevision: "6.5.4", conditions: [{ type: "Ready", status: "True" }] },
+    };
+    const cluster = fakeCluster({
+      objects: {
+        [objectKey("helm.toolkit.fluxcd.io/v2", "HelmRelease", "podinfo", "prod")]: helmRelease,
+        [objectKey("apps/v1", "Deployment", "web", "prod")]: web,
+      },
+    });
+
+    const result = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["podinfo", "web"],
+        entities: makeEntities([
+          {
+            name: "podinfo",
+            entityType: "K8s::Flux::HelmRelease",
+            props: { metadata: { name: "podinfo", namespace: "prod" } },
+          },
+          { name: "web", entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web", namespace: "prod" } } },
+        ]),
+      },
+      cluster.connector,
+    );
+
+    expect(result.resources.podinfo?.attributes).toMatchObject({
+      lastAppliedRevision: "6.5.4",
+      lastAttemptedRevision: "6.5.4",
+    });
+    // The string wire form for every other kind is what it was — no empty
+    // revision keys appear on a Deployment (#1401's shape, unchanged).
+    expect(result.resources.web?.attributes).toEqual({
+      namespace: "prod",
+      labels: { app: "web" },
+      resourceVersion: "7",
+    });
+  });
+});
+
+// The behold#221 shape (#1629): the estate's control-plane project declares
+// the Kustomization carrying `spec.targetNamespace`, and the app project
+// declares bare objects the controller stamps at apply time. Reading the app
+// project alone, `metadata.namespace` is absent everywhere and the read
+// defaults to `default` — a running estate reported entirely absent. The
+// caller that knows the binding can now say where to look.
+describe("a per-read namespace override for entities that declare none (#1629)", () => {
+  const inAppB = {
+    apiVersion: "apps/v1",
+    kind: "Deployment",
+    metadata: { name: "web", namespace: "app-b", uid: "uid-b", resourceVersion: "11" },
+    status: { readyReplicas: 1, replicas: 1 },
+  };
+
+  test("replaces the `default` fallback for a namespaced entity that declares no namespace", async () => {
+    const cluster = fakeCluster({ objects: { [objectKey("apps/v1", "Deployment", "web", "app-b")]: inAppB } });
+    const result = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["web"],
+        entities: makeEntities([
+          { name: "web", entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web" } } },
+        ]),
+        namespace: "app-b",
+      },
+      cluster.connector,
+    );
+
+    expect(result.resources.web).toMatchObject({ type: "K8s::Apps::Deployment", physicalId: "uid-b" });
+    // The `queried` diagnosis line (#1620) reflects the overridden address —
+    // whatever the read did, the report says where it looked.
+    expect(result.queried?.web).toBe("/apis/apps/v1/namespaces/app-b/deployments/web");
+  });
+
+  test("an explicitly declared namespace still wins — the override is a default, not a rewrite", async () => {
+    const cluster = fakeCluster({
+      objects: {
+        [objectKey("apps/v1", "Deployment", "web", "prod")]: web,
+        [objectKey("apps/v1", "Deployment", "web", "app-b")]: inAppB,
+      },
+    });
+    const result = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["web"],
+        entities: makeEntities([
+          { name: "web", entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web", namespace: "prod" } } },
+        ]),
+        namespace: "app-b",
+      },
+      cluster.connector,
+    );
+
+    // Both objects exist; the declared namespace decides which one was read.
+    expect(result.resources.web).toMatchObject({ physicalId: "uid-1" });
+    expect(result.queried?.web).toBe("/apis/apps/v1/namespaces/prod/deployments/web");
+  });
+
+  test("without the override the read still defaults to `default` — nothing changed for a caller that passes none", async () => {
+    const cluster = fakeCluster({ objects: { [objectKey("apps/v1", "Deployment", "web", "app-b")]: inAppB } });
+    const result = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["web"],
+        entities: makeEntities([
+          { name: "web", entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web" } } },
+        ]),
+      },
+      cluster.connector,
+    );
+
+    expect(result.resources).toEqual({});
+    expect(result.queried?.web).toBe("/apis/apps/v1/namespaces/default/deployments/web");
+  });
+
+  test("a cluster-scoped kind is untouched — it has no namespace to default", async () => {
+    const ns = { apiVersion: "v1", kind: "Namespace", metadata: { name: "app-b", uid: "ns-uid" } };
+    const cluster = fakeCluster({ objects: { [objectKey("v1", "Namespace", "app-b")]: ns } });
+    const result = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["appB"],
+        entities: makeEntities([
+          { name: "appB", entityType: "K8s::Core::Namespace", props: { metadata: { name: "app-b" } } },
+        ]),
+        namespace: "app-b",
+      },
+      cluster.connector,
+    );
+
+    expect(result.resources.appB).toMatchObject({ physicalId: "ns-uid" });
+    expect(result.queried?.appB).toBe("/api/v1/namespaces/app-b");
+  });
+
+  test("the override reaches every declared entity, not just the first", async () => {
+    const svc = { apiVersion: "v1", kind: "Service", metadata: { name: "web-svc", namespace: "app-b", uid: "svc-b" } };
+    const cluster = fakeCluster({
+      objects: {
+        [objectKey("apps/v1", "Deployment", "web", "app-b")]: inAppB,
+        [objectKey("v1", "Service", "web-svc", "app-b")]: svc,
+      },
+    });
+    const result = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["web", "webSvc"],
+        entities: makeEntities([
+          { name: "web", entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web" } } },
+          { name: "webSvc", entityType: "K8s::Core::Service", props: { metadata: { name: "web-svc" } } },
+        ]),
+        namespace: "app-b",
+      },
+      cluster.connector,
+    );
+
+    expect(Object.keys(result.resources).sort()).toEqual(["web", "webSvc"]);
+  });
+});

package/src/describe-resources.ts

@@ -233,6 +233,45 @@ export function unhappyConditions(obj: K8sObject): string[] | undefined {
   return out.length > 0 ? out : undefined;
 }
 
+/**
+ * The revisions a GitOps controller writes onto its own object (#1632).
+ *
+ * Conditions lag. A Flux Kustomization mid-rollout still reports the previous
+ * reconcile's `Ready=True` for as long as the new one takes, so a consumer
+ * reading only conditions calls a half-applied estate converged. The
+ * controller's own definition of converged is a revision comparison:
+ * `lastAppliedRevision` against `lastAttemptedRevision` on the same object
+ * (attempted-but-not-applied is in flight), and a Kustomization's
+ * `lastAppliedRevision` against its source's `artifact.revision` (the
+ * cross-object half, which a consumer joins once both ends are on the wire).
+ * None of the three reached an observed entity's attributes before this.
+ *
+ * Read by path rather than by kind, which is the module's standing rule
+ * everywhere else: `status.lastAppliedRevision` / `status.lastAttemptedRevision`
+ * are what kustomize-controller and helm-controller write, and
+ * `status.artifact.revision` is what every source kind (GitRepository,
+ * OCIRepository, Bucket, HelmChart) writes. An object that has none of them —
+ * every non-GitOps kind — contributes nothing, so no kind table has to name
+ * which kinds those are, and a CRD speaking the same convention is carried for
+ * free. `artifactRevision` flattens the one nested path so every revision on
+ * the wire is a plain string next to the others.
+ */
+export function revisionAttributes(obj: K8sObject): {
+  lastAppliedRevision?: string;
+  lastAttemptedRevision?: string;
+  artifactRevision?: string;
+} {
+  const status = obj.status as
+    | { lastAppliedRevision?: unknown; lastAttemptedRevision?: unknown; artifact?: { revision?: unknown } }
+    | undefined;
+  const str = (v: unknown): string | undefined => (typeof v === "string" && v.length > 0 ? v : undefined);
+  return {
+    lastAppliedRevision: str(status?.lastAppliedRevision),
+    lastAttemptedRevision: str(status?.lastAttemptedRevision),
+    artifactRevision: str(status?.artifact?.revision),
+  };
+}
+
 interface Declared {
   entityName: string;
   entityType: string;
@@ -247,6 +286,25 @@ export interface DescribeResourcesOptions {
   owned?: boolean;
   /** Directory whose `chant.config.ts` carries the cluster binding. Defaults to cwd. */
   cwd?: string;
+  /**
+   * Namespace to read a namespaced entity from when it declares none (#1629).
+   *
+   * A GitOps estate splits the binding from the objects: the control-plane
+   * project declares a Kustomization with `spec.targetNamespace: app-b`, the
+   * app project declares bare Deployments and Services with no
+   * `metadata.namespace` at all — the controller stamps it at apply time. The
+   * live read of the app project had no way to be told that, so it fell
+   * through to the client's `default` and reported an estate that is running
+   * as entirely absent (#1620's `queried` line is what made that visible).
+   *
+   * A DEFAULT, never a rewrite: an entity with an explicit
+   * `metadata.namespace` reads from the namespace it declares, override or
+   * not — that declaration is the estate's own statement of where the object
+   * lives, and overruling it would make the option a way to read the wrong
+   * object rather than the right one. Cluster-scoped kinds are untouched:
+   * they have no namespace to default.
+   */
+  namespace?: string;
 }
 
 export async function describeResources(
@@ -331,11 +389,17 @@ export async function describeResources(
       return;
     }
 
+    // The declared namespace wins; the caller's override only fills the hole a
+    // declaration left, and only for a kind that HAS a namespace (#1629). With
+    // neither, the client defaults to `default` exactly as it did.
+    const namespace =
+      metadata?.namespace ?? (operation.scope === "Namespaced" ? options.namespace : undefined);
+
     const ref = {
       apiVersion: operation.apiVersion,
       kind: operation.kind,
       name,
-      ...(metadata?.namespace ? { namespace: metadata.namespace } : {}),
+      ...(namespace ? { namespace } : {}),
     };
 
     // Resolve the address BEFORE the read, so every verdict below — present,
@@ -379,6 +443,9 @@ export async function describeResources(
           resourceVersion: obj.metadata?.resourceVersion,
           // What the object's own controller says is wrong with it (#1401).
           conditions: unhappyConditions(obj),
+          // What a GitOps controller says it has applied and is applying
+          // (#1632) — the convergence signal conditions cannot carry.
+          ...revisionAttributes(obj),
         }),
       };
     } catch (err) {

package/src/group-namespace.test.ts

@@ -0,0 +1,64 @@
+import { describe, test, expect } from "vitest";
+import { namespaceSegmentForGroup } from "./group-namespace";
+import { renderedManifestEntity } from "./kustomize/rendered-entity";
+import { K8sParser } from "./import/parser";
+
+describe("namespaceSegmentForGroup", () => {
+  test("the empty core group is Core", () => {
+    expect(namespaceSegmentForGroup("")).toBe("Core");
+  });
+
+  test("a single-segment group PascalCases", () => {
+    expect(namespaceSegmentForGroup("apps")).toBe("Apps");
+  });
+
+  test("only the first dot-segment counts", () => {
+    expect(namespaceSegmentForGroup("rbac.authorization.k8s.io")).toBe("Rbac");
+  });
+
+  test("a hyphenated first segment kebab→Pascals", () => {
+    expect(namespaceSegmentForGroup("cert-manager.io")).toBe("CertManager");
+  });
+
+  test("argoproj.io takes the Argo override", () => {
+    expect(namespaceSegmentForGroup("argoproj.io")).toBe("Argo");
+  });
+
+  test("the toolkit groups collapse to Flux", () => {
+    expect(namespaceSegmentForGroup("kustomize.toolkit.fluxcd.io")).toBe("Flux");
+  });
+});
+
+// #1628: rendered and imported entityTypes used to bypass the overrides, so a
+// Flux CR arriving through a kustomize root or `chant import` was typed to a
+// name that matches nothing in operations.json.
+describe("the shared rule reaches the render and import paths", () => {
+  test("a rendered Flux Kustomization is typed K8s::Flux::Kustomization", () => {
+    const entity = renderedManifestEntity(
+      {
+        apiVersion: "kustomize.toolkit.fluxcd.io/v1",
+        kind: "Kustomization",
+        metadata: { name: "apps", namespace: "flux-system" },
+        spec: { path: "./apps/prod", prune: true },
+      },
+      "clusters/prod",
+    );
+
+    expect(entity?.entityType).toBe("K8s::Flux::Kustomization");
+  });
+
+  test("an imported Argo Application is typed K8s::Argo::Application", () => {
+    const ir = new K8sParser().parse(`
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: guestbook
+  namespace: argocd
+spec:
+  project: default
+`);
+
+    expect(ir.resources.length).toBe(1);
+    expect(ir.resources[0].type).toBe("K8s::Argo::Application");
+  });
+});

package/src/group-namespace.ts

@@ -0,0 +1,79 @@
+/**
+ * API group → `K8s::{Namespace}::{Kind}` namespace segment — the ONE copy.
+ *
+ * Four surfaces build entityTypes from a group string: CRD codegen
+ * (`crd/parser.ts`), the swagger pass (`spec/parse.ts`), live discovery
+ * (`describe-resources.ts` via `gvkToTypeName`), and YAML import
+ * (`import/parser.ts`). Until #1628 each had its own copy of the rule and only
+ * CRD codegen consulted the overrides, so a Flux Kustomization arriving through
+ * a kustomize root or `chant import` was typed `K8s::Kustomize::Kustomization`
+ * — a name that matches nothing in operations.json (NOT-OBSERVED live) and
+ * nothing downstream that dispatches on kind. Every path resolves here now;
+ * the declared, rendered, imported and discovered spellings of a kind cannot
+ * skew.
+ */
+
+/**
+ * Group names whose first segment doesn't yield the conventional namespace.
+ * "argoproj.io" → "Argo" (not "Argoproj") to match the Argo CD vocabulary
+ * and the ArgoAppFor / ArgoAppSetForRegions composites.
+ *
+ * The Flux toolkit spreads across five `*.toolkit.fluxcd.io` groups plus the
+ * Flux Operator's `fluxcd.controlplane.io`; all six collapse to a single `Flux`
+ * namespace so a GitRepository and a Kustomization read as `K8s::Flux::*`
+ * siblings rather than scattering to Source / Kustomize / Helm / Notification /
+ * Image / Fluxcd. (`helm.toolkit.fluxcd.io` → `Helm` would also collide
+ * confusingly with the separate helm lexicon.)
+ *
+ * KubeMicroVM's `lambda.aws.amazon.com` would take `Lambda` by the
+ * first-segment rule, which reads as AWS Lambda proper and would sit
+ * confusingly beside the aws lexicon's real Lambda functions. These are
+ * Kubernetes CRs belonging to a community operator, so they take the
+ * operator's own name. `MicroVM` alone was the alternative and was rejected
+ * for stuttering: `K8s::MicroVM::MicroVM`.
+ *
+ * Note the official AWS controller uses a different group,
+ * `lambdamicrovms.services.k8s.aws`, so it can coexist here and will want its
+ * own entry rather than sharing this one.
+ */
+export const GROUP_NAMESPACE_OVERRIDES: Record<string, string> = {
+  "argoproj.io": "Argo",
+  "source.toolkit.fluxcd.io": "Flux",
+  "kustomize.toolkit.fluxcd.io": "Flux",
+  "helm.toolkit.fluxcd.io": "Flux",
+  "notification.toolkit.fluxcd.io": "Flux",
+  "image.toolkit.fluxcd.io": "Flux",
+  "fluxcd.controlplane.io": "Flux",
+  "lambda.aws.amazon.com": "KubeMicroVM",
+  // CNPG and its barman-cloud plugin ship under two groups but are one thing to
+  // an author: a Cluster's `plugins[]` names an ObjectStore. The first-segment
+  // rule would scatter them into `Postgresql` and `Barmancloud`.
+  "postgresql.cnpg.io": "Cnpg",
+  "barmancloud.cnpg.io": "Cnpg",
+  // Not `Secrets`: `K8s::Secrets::InfisicalSecret` reads like a core Secret,
+  // and `K8s::Core::Secret` is right there to be confused with.
+  "secrets.infisical.com": "Infisical",
+  // k3s's bundled controllers ship under two groups but are one thing to an
+  // author — the k3s auto-deploy surface. The first-segment rule would give
+  // `K8s::Helm::HelmChart`, which reads like it belongs to the helm lexicon,
+  // and would split HelmChart from the Addon that tracks its deployment.
+  "helm.cattle.io": "K3s",
+  "k3s.cattle.io": "K3s",
+};
+
+/**
+ * Normalize an API group to its PascalCase namespace segment.
+ * "" → "Core", overrides first ("argoproj.io" → "Argo"), then the first
+ * dot-segment kebab→PascalCased: "cert-manager.io" → "CertManager",
+ * "rbac.authorization.k8s.io" → "Rbac", "apps" → "Apps".
+ */
+export function namespaceSegmentForGroup(group: string): string {
+  if (!group || group === "") return "Core";
+  const override = GROUP_NAMESPACE_OVERRIDES[group];
+  if (override) return override;
+  const firstSegment = group.split(".")[0];
+  return firstSegment
+    .split("-")
+    .map((s) => s.charAt(0).toUpperCase() + s.slice(1))
+    .join("");
+}

package/src/import/parser.ts

@@ -8,6 +8,7 @@
 
 import type { TemplateParser, TemplateIR, ResourceIR } from "@intentius/chant/import/parser";
 import { parseYAML } from "@intentius/chant/yaml";
+import { namespaceSegmentForGroup } from "../group-namespace";
 
 // ── GVK to type name mapping ───────────────────────────────────────
 
@@ -91,20 +92,20 @@ function resolveTypeName(apiVersion: string, kind: string): string {
 }
 
 /**
- * Extract PascalCase group name from an apiVersion string.
+ * Extract the namespace segment from an apiVersion string.
  * "apps/v1" → "Apps"
  * "v1" → "Core"
- * "networking.k8s.io/v1" → "Networking"
  * "rbac.authorization.k8s.io/v1" → "Rbac"
+ * "argoproj.io/v1alpha1" → "Argo" (override)
+ *
+ * Splits the version off and hands the group to the shared rule, so an
+ * imported manifest is typed exactly as a declared one is.
  */
 function apiVersionToGroup(apiVersion: string): string {
   const slashIdx = apiVersion.indexOf("/");
   if (slashIdx === -1) return "Core"; // core group (v1)
 
-  const groupStr = apiVersion.slice(0, slashIdx);
-  const firstSegment = groupStr.split(".")[0];
-  if (firstSegment === "rbac") return "Rbac";
-  return firstSegment.charAt(0).toUpperCase() + firstSegment.slice(1);
+  return namespaceSegmentForGroup(apiVersion.slice(0, slashIdx));
 }
 
 /**

package/src/kustomize/root.test.ts

@@ -94,7 +94,9 @@ describe("renderKustomizeRoots", () => {
     // The generated operation surface's naming, so `lifecycle diff --live`
     // observes a rendered Deployment through the same reader a declared one uses.
     expect(deployment.entityType).toBe("K8s::Apps::Deployment");
-    expect(entities.get("overlays/prod/certificateProdWebTls")!.entityType).toBe("K8s::Cert-manager::Certificate");
+    // Hyphenated groups PascalCase the same way the declarable surface does
+    // (#1628), so this Certificate matches the reader a declared one gets.
+    expect(entities.get("overlays/prod/certificateProdWebTls")!.entityType).toBe("K8s::CertManager::Certificate");
 
     const props = (deployment as unknown as { props: Record<string, unknown> }).props;
     const metadata = props.metadata as { annotations: Record<string, string> };

package/src/spec/parse.ts

@@ -13,6 +13,7 @@ import {
   primaryType,
   type JsonSchemaProperty,
 } from "@intentius/chant/codegen/json-schema";
+import { namespaceSegmentForGroup } from "../group-namespace";
 
 // ── Types ──────────────────────────────────────────────────────────
 
@@ -343,22 +344,13 @@ export function gvkToApiVersion(gvk: GroupVersionKind): string {
 }
 
 /**
- * Normalize API group to a PascalCase segment.
- * Empty group (core API) → "Core"
- * "apps" → "Apps"
- * "batch" → "Batch"
- * "rbac.authorization.k8s.io" → "Rbac"
- * "networking.k8s.io" → "Networking"
+ * Normalize API group to a PascalCase segment — the shared rule, so the
+ * swagger-generated surface, kustomize-rendered entities and live discovery
+ * (all three reach here through `gvkToTypeName`) spell a kind exactly as CRD
+ * codegen and `chant import` do. See `../group-namespace`.
  */
 function normalizeGroup(group: string): string {
-  if (!group || group === "") return "Core";
-
-  // Take the first segment before any dots
-  const firstSegment = group.split(".")[0];
-  // Special-case RBAC
-  if (firstSegment === "rbac") return "Rbac";
-  // PascalCase the first segment
-  return firstSegment.charAt(0).toUpperCase() + firstSegment.slice(1);
+  return namespaceSegmentForGroup(group);
 }
 
 /**