@intentius/chant-lexicon-k8s 0.46.0 → 0.50.0

package/dist/lint/post-synth/wk8503.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8503.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8503.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AA+H9G,eAAO,MAAM,MAAM,EAAE,cAwDpB,CAAC"}

package/dist/lint/post-synth/wk8504.d.ts

@@ -0,0 +1,28 @@
+/**
+ * WK8504: committed-encrypted secret declaration does not resolve
+ *
+ * `declareSecret({ provenance: "committed-encrypted", file })` is a claim
+ * about an artifact INSIDE the build, which is what separates it from the
+ * three kinds that promise something outside one. A claim inside the build
+ * should be verified rather than taken on trust, and this is the check that
+ * makes it falsifiable: it fires when the declared file produced no sidecar,
+ * when the emitted document is not a `v1` Secret of the declared name, when
+ * it carries no `sops` block, or when a `data`/`stringData` value is not
+ * `ENC[...]`-shaped.
+ *
+ * That last case is the failure this rule exists for: someone edits
+ * `db-credentials.sops.yaml` by hand, forgets `sops -e`, and commits
+ * plaintext. Before this, nothing in chant would notice.
+ *
+ * It reads `output.files`, not `getPrimaryOutput`. The ciphertext is
+ * deliberately kept out of the primary output — that is what makes applying
+ * an undecrypted Secret structurally impossible — so every other post-synth
+ * check in the lexicon is blind to it by construction, and this one has to
+ * ask for the sidecars explicitly.
+ *
+ * A value is only ever tested for the `ENC[` prefix; the message names the
+ * offending KEY, never what was found there.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8504: PostSynthCheck;
+//# sourceMappingURL=wk8504.d.ts.map

package/dist/lint/post-synth/wk8504.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8504.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8504.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAsBpB,CAAC"}

package/dist/lint/post-synth/wk8505.d.ts

@@ -0,0 +1,28 @@
+/**
+ * WK8505: committed-encrypted secret with no Flux decryption wiring
+ *
+ * Flux is the thing that actually decrypts a committed-encrypted secret's
+ * sidecar, via `spec.decryption` on the reconciling `Kustomization`
+ * (`FluxAppFor`'s `decryption` option). Nothing forces the two calls to be
+ * wired together: `declareSecret({ provenance: "committed-encrypted" })` and
+ * `FluxAppFor(...)` are independent, so it is easy to add the ciphertext
+ * without adding the wiring — the build succeeds, WK8504 passes because the
+ * file resolves cleanly, and Flux still applies the sidecar as raw
+ * `ENC[...]` bytes because nothing told it to decrypt first.
+ *
+ * Warning, not error. The reference project shape (`examples/flux-apps`)
+ * runs the workload build and the Flux build as separate `chant build`
+ * invocations, so "no Kustomization in THIS build sets spec.decryption" can
+ * mean "wired up in the other build" as easily as "forgotten" — the design
+ * doc's §4 explains why no path-to-build-target join exists to tell those
+ * apart. Promote to error if that join ever becomes available.
+ *
+ * Fires only on claims that actually resolved (`problems.length === 0`, via
+ * `resolveEncryptedSecretClaims`), not on every raw declaration. An
+ * unresolved declaration is already WK8504's job at error severity; firing
+ * this warning on top of it would report a Flux wiring gap for a Secret the
+ * build has not confirmed exists.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8505: PostSynthCheck;
+//# sourceMappingURL=wk8505.d.ts.map

package/dist/lint/post-synth/wk8505.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8505.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8505.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAa9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.46.0",
+  "version": "0.50.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],