@intentius/chant-lexicon-k8s 0.52.1 → 0.53.0

package/dist/index.d.ts

@@ -8,6 +8,8 @@ export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-lab
 export { K8sLabels, K8sAnnotations } from "./variables.js";
 export { GENERATED_ONCE_LABEL_KEY, GENERATED_ONCE_LABEL_VALUE, isGeneratedOnce } from "./secret-labels.js";
 export { microTime, isMicroTimeFormatted } from "./micro-time.js";
+export { k8sManifest } from "./manifest-entity.js";
+export type { RenderedManifestEntity } from "./manifest-entity.js";
 export * from "./generated/index.js";
 export { WebApp, StatefulApp, CronWorkload, AutoscaledService, WorkerPool, NamespaceEnv, NodeAgent, BatchJob, SecureIngress, ConfiguredApp, SidecarApp, MonitoredService, NetworkIsolatedApp, IrsaServiceAccount, AlbIngress, EbsStorageClass, EfsStorageClass, FluentBitAgent, ExternalDnsAgent, AdotCollector, MetricsServer, WorkloadIdentityServiceAccount, GcePdStorageClass, FilestoreStorageClass, GkeGateway, ConfigConnectorContext, GceIngress, CockroachDbCluster, CockroachDbRegionStack, RayCluster, RayJob, RayService, ArgoAppFor, ArgoAppSetForRegions, registerArgoCluster, FluxGitSource, FluxAppFor, AgicIngress, AzureDiskStorageClass, AzureFileStorageClass, AzureMonitorCollector, AksWorkloadIdentityServiceAccount, GkeFluentBitAgent, GkeOtelCollector, GkeExternalDnsAgent, AksExternalDnsAgent, Model, resolveModelStorageUri, OperatorStack, deriveHostVerbClass, DEFAULT_RESOURCE_RULES, } from "./composites/index.js";
 export type { WebAppProps, WebAppResult, StatefulAppProps, StatefulAppResult, CronWorkloadProps, CronWorkloadResult, AutoscaledServiceProps, AutoscaledServiceResult, WorkerPoolProps, WorkerPoolResult, NamespaceEnvProps, NamespaceEnvResult, NodeAgentProps, NodeAgentResult, BatchJobProps, BatchJobResult, SecureIngressProps, SecureIngressResult, ConfiguredAppProps, ConfiguredAppResult, SidecarAppProps, SidecarAppResult, MonitoredServiceProps, MonitoredServiceResult, NetworkIsolatedAppProps, NetworkIsolatedAppResult, IrsaServiceAccountProps, IrsaServiceAccountResult, AlbIngressProps, AlbIngressResult, EbsStorageClassProps, EbsStorageClassResult, EfsStorageClassProps, EfsStorageClassResult, FluentBitAgentProps, FluentBitAgentResult, ExternalDnsAgentProps, ExternalDnsAgentResult, AdotCollectorProps, AdotCollectorResult, MetricsServerProps, MetricsServerResult, WorkloadIdentityServiceAccountProps, WorkloadIdentityServiceAccountResult, GcePdStorageClassProps, GcePdStorageClassResult, FilestoreStorageClassProps, FilestoreStorageClassResult, GkeGatewayProps, GkeGatewayResult, ConfigConnectorContextProps, ConfigConnectorContextResult, GceIngressProps, GceIngressResult, CockroachDbClusterProps, CockroachDbClusterResult, CockroachDbRegionStackConfig, CockroachDbRegionCockroachConfig, CockroachDbRegionTlsConfig, RayClusterProps, RayClusterResult, RayClusterSpec, ResourceSpec, HeadGroupSpec, WorkerGroupSpec, RayJobProps, RayJobResult, RayServiceProps, RayServiceResult, ArgoDestination, ArgoSyncPolicy, ArgoAppForOptions, ArgoAppForResult, ArgoRegionTarget, ArgoAppSetForRegionsOptions, ArgoAppSetForRegionsResult, RegisterArgoClusterOptions, RegisterArgoClusterResult, FluxSourceKind, FluxSourceRef, FluxGitSourceOptions, FluxGitSourceResult, FluxAppForOptions, FluxAppForResult, AgicIngressProps, AgicIngressResult, AzureDiskStorageClassProps, AzureDiskStorageClassResult, AzureFileStorageClassProps, AzureFileStorageClassResult, AzureMonitorCollectorProps, AzureMonitorCollectorResult, AksWorkloadIdentityServiceAccountProps, AksWorkloadIdentityServiceAccountResult, GkeFluentBitAgentProps, GkeFluentBitAgentResult, GkeOtelCollectorProps, GkeOtelCollectorResult, GkeExternalDnsAgentProps, GkeExternalDnsAgentResult, AksExternalDnsAgentProps, AksExternalDnsAgentResult, ModelSource, ModelProps, ModelResult, OperatorDial, OperatorRbacResourceRule, OperatorStackConvergeHost, OperatorStackConfig, OperatorStackResult, } from "./composites/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAcrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGlI,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGxG,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,aAAa,EAAE,UAAU,EACzB,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAC7E,KAAK,EAAE,sBAAsB,EAC7B,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,GAC3D,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,cAAc,EAAE,aAAa,EAC7B,oBAAoB,EAAE,mBAAmB,EACzC,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,EACnD,WAAW,EAAE,UAAU,EAAE,WAAW,EACpC,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,mBAAmB,GAC5G,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAcrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGlI,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxD,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGxG,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAIhE,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,aAAa,EAAE,UAAU,EACzB,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAC7E,KAAK,EAAE,sBAAsB,EAC7B,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,GAC3D,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,cAAc,EAAE,aAAa,EAC7B,oBAAoB,EAAE,mBAAmB,EACzC,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,EACnD,WAAW,EAAE,UAAU,EAAE,WAAW,EACpC,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,mBAAmB,GAC5G,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "b67cd487ee48d5e6dc6b802e5ba186957c69312202215c3edac385532dcd6dfb",
+    "manifest.json": "2bda115effa437642acdca7ec48284f807cced7938f3e0312c47ace0480ffe55",
     "meta.json": "8b999bc142f448b0b627ecdc9e2388bbe672c8a1f7aae5303135624cf2fe65e3",
     "types/index.d.ts": "5f67de738adb455805e72600948940af9c664283785fb68c9fd8f5ea90d42cc3",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -65,5 +65,5 @@
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5",
     "skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
   },
-  "composite": "99445b1bd18103cd0d1584e80bf49578672912d4e294ee9391542d3eb4a6d68e"
+  "composite": "eca721f5280332bb6ec7cc3060dadf6619918162e92facd25c25477f7fd5b4ea"
 }

package/dist/kustomize/rendered-entity.d.ts

@@ -2,35 +2,23 @@
  * A rendered kustomize document as a chant entity (#1548 piece 3).
  *
  * A kustomize build root's output is a set of finished manifests, not typed
- * chant source — the overlay already decided every field. So the entity that
- * carries one into the build is deliberately verbatim: `props` IS the
- * document, and the serializer emits it as-is (plus the same default-label /
- * ownership merge every discovered resource gets) instead of running the
- * spec-inference heuristics built for typed declarables. The marker is what
- * tells the serializer to take that path — `Symbol.for`, so a lexicon built
- * against a separate copy of core still matches (the #1137 lesson).
- *
- * `entityType` uses the same `K8s::{Group}::{Kind}` convention the generated
- * operation surface speaks, so `lifecycle diff --live` observes a rendered
- * Deployment through exactly the reader a declared one uses. A kind the
- * surface doesn't know reports NOT-OBSERVED with the existing "no generated
- * operation surface" reason — the honest verdict, not a silent hole.
+ * chant source — the overlay already decided every field. The entity that
+ * carries one into the build is therefore the verbatim manifest entity
+ * (`../manifest-entity`), shared since #999 with `chant carve emit`'s adoption
+ * of a Terraform `kubernetes_manifest`: `props` IS the document, and the
+ * serializer emits it as-is.
  *
  * Provenance: every rendered document is stamped with an annotation naming
  * the overlay dir it came from, so a consumer (behold#171's overlay boxes)
- * can group by declared origin instead of guessing from paths.
+ * can group by declared origin instead of guessing from paths — the one thing
+ * this adds over a plain manifest entity.
  */
-import { type Declarable } from "@intentius/chant/declarable";
-/** Marks an entity whose `props` are a complete, render-final manifest. */
-export declare const RENDERED_MANIFEST_MARKER: unique symbol;
+import { RENDERED_MANIFEST_MARKER, isRenderedManifestEntity } from "../manifest-entity.js";
+import type { RenderedManifestEntity } from "../manifest-entity.js";
+export { RENDERED_MANIFEST_MARKER, isRenderedManifestEntity };
+export type { RenderedManifestEntity };
 /** Annotation stamped on every rendered document, valued with the root dir. */
 export declare const KUSTOMIZE_ROOT_ANNOTATION = "chant.intentius.io/kustomize-root";
-export interface RenderedManifestEntity extends Declarable {
-    readonly kind: "resource";
-    readonly props: Record<string, unknown>;
-    readonly [RENDERED_MANIFEST_MARKER]: true;
-}
-export declare function isRenderedManifestEntity(entity: Declarable): entity is RenderedManifestEntity;
 /**
  * Wrap one rendered document. Returns null when the document has no string
  * `apiVersion`/`kind` — not a Kubernetes object, nothing to declare.

package/dist/kustomize/rendered-entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rendered-entity.d.ts","sourceRoot":"","sources":["../../src/kustomize/rendered-entity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGjF,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,eAA2C,CAAC;AAEjF,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,sCAAsC,CAAC;AAE7E,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC;CAC3C;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,IAAI,sBAAsB,CAE7F;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,IAAI,EAAE,MAAM,GACX,sBAAsB,GAAG,IAAI,CAuB/B"}
+{"version":3,"file":"rendered-entity.d.ts","sourceRoot":"","sources":["../../src/kustomize/rendered-entity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAkB,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,CAAC;AAC9D,YAAY,EAAE,sBAAsB,EAAE,CAAC;AAEvC,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,sCAAsC,CAAC;AAE7E;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,IAAI,EAAE,MAAM,GACX,sBAAsB,GAAG,IAAI,CAQ/B"}

package/dist/manifest-entity.d.ts

@@ -0,0 +1,52 @@
+/**
+ * A complete Kubernetes manifest carried into a build as a chant entity.
+ *
+ * Two callers produce one: a kustomize build root, whose output is a set of
+ * finished documents rather than typed chant source (#1548), and `chant carve
+ * emit` adopting a Terraform `kubernetes_manifest` (#999), whose whole content
+ * is a manifest body read out of state. In both cases the document already
+ * decided every field, so `props` IS the manifest: the serializer emits it
+ * as-is — plus the default-label / ownership merge every discovered resource
+ * gets — instead of running the spec-inference heuristics built for typed
+ * declarables, which would re-nest a top-level field that is not `spec`
+ * (`rules` on a ClusterRole, `webhooks` on a webhook config).
+ *
+ * The marker is what tells the serializer to take that path — `Symbol.for`, so
+ * a lexicon built against a separate copy of core still matches (the #1137
+ * lesson).
+ *
+ * `entityType` comes from `gvkToTypeName`, the one group→namespace rule
+ * (`./group-namespace`), so a manifest declared this way is typed exactly as a
+ * generated class would be and `lifecycle diff --live` observes it through the
+ * reader a declared resource uses. A kind the generated operation surface does
+ * not know reports NOT-OBSERVED with the existing "no generated operation
+ * surface" reason — the honest verdict, not a silent hole.
+ */
+import { type Declarable } from "@intentius/chant/declarable";
+/** Marks an entity whose `props` are a complete, render-final manifest. */
+export declare const RENDERED_MANIFEST_MARKER: unique symbol;
+export interface RenderedManifestEntity extends Declarable {
+    readonly kind: "resource";
+    readonly props: Record<string, unknown>;
+    readonly [RENDERED_MANIFEST_MARKER]: true;
+}
+export declare function isRenderedManifestEntity(entity: Declarable): entity is RenderedManifestEntity;
+/**
+ * Wrap one manifest. Returns null when the document has no string
+ * `apiVersion`/`kind` — not a Kubernetes object, nothing to declare.
+ */
+export declare function manifestEntity(doc: Record<string, unknown>): RenderedManifestEntity | null;
+/**
+ * Declare an arbitrary Kubernetes object from its manifest — the escape hatch
+ * for a kind the lexicon ships no generated class for, and what `chant carve
+ * emit` writes when it adopts a `kubernetes_manifest` (#999). The typed
+ * constructors cannot serve either case: their props are the kind's own schema,
+ * so an unknown CRD has no class at all and a known one rejects an
+ * `apiVersion`/`kind` pair that differs from the generated default.
+ *
+ * Throws on a document without a string `apiVersion` and `kind`: those two
+ * fields are what makes it addressable, and a silently dropped resource is the
+ * failure this is guarding against.
+ */
+export declare function k8sManifest(doc: Record<string, unknown>): RenderedManifestEntity;
+//# sourceMappingURL=manifest-entity.d.ts.map

package/dist/manifest-entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-entity.d.ts","sourceRoot":"","sources":["../src/manifest-entity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGjF,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,eAA2C,CAAC;AAEjF,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC;CAC3C;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,IAAI,sBAAsB,CAE7F;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,sBAAsB,GAAG,IAAI,CAiB1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,sBAAsB,CAMhF"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.52.1",
+  "version": "0.53.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA6BjG,eAAO,MAAM,SAAS,EAAE,aAmsBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA6BjG,eAAO,MAAM,SAAS,EAAE,aA8sBvB,CAAC"}

package/dist/whoami.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Who chant would act as in a cluster — the lexicon half of `chant lifecycle
+ * whoami` (chant #1982).
+ *
+ * The connector already resolves all of this and hands it back on every
+ * observation: `defaultK8sConnector` picks a context from
+ * `k8s.profiles.<env>.context` or from the ambient kubeconfig, the client
+ * records the server it resolved and which credential path authorized it, and
+ * `describeResources` then throws the lot away. This reports it, and reports
+ * it BEFORE a read rather than after a wrong one.
+ *
+ * Same connector, same environment, same options, so the server named here is
+ * the server the read talks to. A test pins that: a whoami that names a
+ * cluster the read does not use would be worse than no whoami at all.
+ *
+ * ## The principal is the API server's answer, not the kubeconfig's
+ *
+ * A kubeconfig `user` entry is a local alias. The cluster may map that
+ * credential onto any subject it likes, which is exactly why "am I acting as
+ * the identity I think I am" is a real question. So the principal comes from
+ * `SelfSubjectReview` — the call behind `kubectl auth whoami` — which the API
+ * server answers with the subject it authenticated. It creates nothing.
+ *
+ * A cluster older than the review API serves no version of it. That is
+ * `read-failed` with a detail saying so, not a fallback to the local alias
+ * dressed up as an identity.
+ *
+ * ## No credential in the answer
+ *
+ * The credential path is reported by NAME — `exec-plugin` and its command,
+ * `token`, `client-certificate`. A kubeconfig holding a static bearer token is
+ * the case where the identity signal IS a secret, and the report says
+ * `credential: token` and stops there. The token, the client key and the exec
+ * plugin's output never leave the client.
+ */
+import type { DescribeIdentityOptions, DescribeIdentityResult } from "@intentius/chant/lexicon";
+import { type K8sConnector } from "./api/connect.js";
+/**
+ * The k8s `describeIdentity`. Connects the way the read connects, asks the API
+ * server who it is talking to, and reports the context that binding came from.
+ */
+export declare function describeIdentity(options: DescribeIdentityOptions, connect?: K8sConnector): Promise<DescribeIdentityResult>;
+//# sourceMappingURL=whoami.d.ts.map

package/dist/whoami.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../src/whoami.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,uBAAuB,EAChC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.52.1",
+  "version": "0.53.0",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,7 +76,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "optionalDependencies": {
-    "@intentius/chant-k8s-client": "^0.52.1"
+    "@intentius/chant-k8s-client": "^0.53.0"
   },
   "devDependencies": {
     "@intentius/chant": "*",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.52.1",
+    "@intentius/chant": "^0.53.0",
     "typescript": "^5.9.3"
   }
 }

package/src/index.ts

@@ -34,6 +34,11 @@ export { GENERATED_ONCE_LABEL_KEY, GENERATED_ONCE_LABEL_VALUE, isGeneratedOnce }
 // MicroTime helpers — see micro-time.ts for why this exists.
 export { microTime, isMicroTimeFormatted } from "./micro-time";
 
+// Verbatim manifest escape hatch — a kind with no generated class, and what
+// `chant carve emit` writes for a Terraform kubernetes_manifest (#999).
+export { k8sManifest } from "./manifest-entity";
+export type { RenderedManifestEntity } from "./manifest-entity";
+
 // Generated entities — export everything from generated index
 // After running `chant generate`, this re-exports all K8s resource classes
 export * from "./generated/index";

package/src/kustomize/rendered-entity.ts

@@ -2,43 +2,26 @@
  * A rendered kustomize document as a chant entity (#1548 piece 3).
  *
  * A kustomize build root's output is a set of finished manifests, not typed
- * chant source — the overlay already decided every field. So the entity that
- * carries one into the build is deliberately verbatim: `props` IS the
- * document, and the serializer emits it as-is (plus the same default-label /
- * ownership merge every discovered resource gets) instead of running the
- * spec-inference heuristics built for typed declarables. The marker is what
- * tells the serializer to take that path — `Symbol.for`, so a lexicon built
- * against a separate copy of core still matches (the #1137 lesson).
- *
- * `entityType` uses the same `K8s::{Group}::{Kind}` convention the generated
- * operation surface speaks, so `lifecycle diff --live` observes a rendered
- * Deployment through exactly the reader a declared one uses. A kind the
- * surface doesn't know reports NOT-OBSERVED with the existing "no generated
- * operation surface" reason — the honest verdict, not a silent hole.
+ * chant source — the overlay already decided every field. The entity that
+ * carries one into the build is therefore the verbatim manifest entity
+ * (`../manifest-entity`), shared since #999 with `chant carve emit`'s adoption
+ * of a Terraform `kubernetes_manifest`: `props` IS the document, and the
+ * serializer emits it as-is.
  *
  * Provenance: every rendered document is stamped with an annotation naming
  * the overlay dir it came from, so a consumer (behold#171's overlay boxes)
- * can group by declared origin instead of guessing from paths.
+ * can group by declared origin instead of guessing from paths — the one thing
+ * this adds over a plain manifest entity.
  */
-import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
-import { gvkToTypeName } from "../spec/parse";
+import { manifestEntity, RENDERED_MANIFEST_MARKER, isRenderedManifestEntity } from "../manifest-entity";
+import type { RenderedManifestEntity } from "../manifest-entity";
 
-/** Marks an entity whose `props` are a complete, render-final manifest. */
-export const RENDERED_MANIFEST_MARKER = Symbol.for("chant.k8s.renderedManifest");
+export { RENDERED_MANIFEST_MARKER, isRenderedManifestEntity };
+export type { RenderedManifestEntity };
 
 /** Annotation stamped on every rendered document, valued with the root dir. */
 export const KUSTOMIZE_ROOT_ANNOTATION = "chant.intentius.io/kustomize-root";
 
-export interface RenderedManifestEntity extends Declarable {
-  readonly kind: "resource";
-  readonly props: Record<string, unknown>;
-  readonly [RENDERED_MANIFEST_MARKER]: true;
-}
-
-export function isRenderedManifestEntity(entity: Declarable): entity is RenderedManifestEntity {
-  return (entity as unknown as Record<symbol, unknown>)[RENDERED_MANIFEST_MARKER] === true;
-}
-
 /**
  * Wrap one rendered document. Returns null when the document has no string
  * `apiVersion`/`kind` — not a Kubernetes object, nothing to declare.
@@ -47,26 +30,11 @@ export function renderedManifestEntity(
   doc: Record<string, unknown>,
   root: string,
 ): RenderedManifestEntity | null {
-  const apiVersion = doc.apiVersion;
-  const kind = doc.kind;
-  if (typeof apiVersion !== "string" || typeof kind !== "string" || !apiVersion || !kind) return null;
-
-  const slash = apiVersion.indexOf("/");
-  const group = slash === -1 ? "" : apiVersion.slice(0, slash);
-  const version = slash === -1 ? apiVersion : apiVersion.slice(slash + 1);
-
   const metadata = { ...((doc.metadata as Record<string, unknown> | undefined) ?? {}) };
   metadata.annotations = {
     ...((metadata.annotations as Record<string, unknown> | undefined) ?? {}),
     [KUSTOMIZE_ROOT_ANNOTATION]: root,
   };
 
-  return {
-    lexicon: "k8s",
-    entityType: gvkToTypeName({ group, version, kind }),
-    kind: "resource",
-    props: { ...doc, metadata },
-    [DECLARABLE_MARKER]: true,
-    [RENDERED_MANIFEST_MARKER]: true,
-  };
+  return manifestEntity({ ...doc, metadata });
 }

package/src/lint/post-synth/post-synth.test.ts

@@ -2221,6 +2221,29 @@ describe("WK8501/WK8502: custom resource spec validated against the shipped CRD
     expect(wk8502.check(ctx)).toEqual([]);
   });
 
+  // chant #2013 — the Argo AppProject from behold's example-argo-estate, as
+  // YAML text rather than JSON on purpose: `sourceRepos` is a list of bare
+  // URLs, and the core parser used to hand this check `{ https: "//github…" }`
+  // for each one. WK8502 then reported an object on a field the source had
+  // declared, and the emitter had written, as a string.
+  test.skipIf(!hasLexicon)("a bare URL in an AppProject's sourceRepos reaches the check as a string", () => {
+    const ctx = makeCtx([
+      "apiVersion: argoproj.io/v1alpha1",
+      "kind: AppProject",
+      "metadata:",
+      "  name: estate",
+      "spec:",
+      "  sourceRepos:",
+      "  - https://github.com/INTENTIUS/behold",
+      "  destinations:",
+      "  - namespace: '*'",
+      "    server: https://kubernetes.default.svc",
+      "",
+    ].join("\n"));
+    expect(wk8501.check(ctx)).toEqual([]);
+    expect(wk8502.check(ctx)).toEqual([]);
+  });
+
   test("open objects and int-or-string accept anything (stub registry)", () => {
     setCrdSchemaRegistry(new Map([[
       "example.com/v1/Widget",

package/src/manifest-entity.test.ts

@@ -0,0 +1,78 @@
+import { describe, test, expect } from "vitest";
+import { k8sManifest, manifestEntity, isRenderedManifestEntity } from "./manifest-entity";
+import { k8sSerializer } from "./serializer";
+import type { Declarable } from "@intentius/chant/declarable";
+
+/**
+ * The verbatim manifest escape hatch, and the round trip `chant carve emit`
+ * depends on (chant #999): a `kubernetes_manifest` body adopted out of
+ * Terraform state has to serialize back to the same object, kind included, or
+ * the carve loses configuration on the way out of Terraform.
+ */
+describe("k8sManifest", () => {
+  test("types itself from apiVersion + kind through the shared group rule", () => {
+    expect(k8sManifest({ apiVersion: "v1", kind: "ConfigMap", metadata: { name: "app-config" } }).entityType).toBe(
+      "K8s::Core::ConfigMap",
+    );
+    expect(k8sManifest({ apiVersion: "apps/v1", kind: "Deployment", metadata: { name: "web" } }).entityType).toBe(
+      "K8s::Apps::Deployment",
+    );
+    expect(k8sManifest({ apiVersion: "cert-manager.io/v1", kind: "Certificate", metadata: { name: "tls" } }).entityType).toBe(
+      "K8s::CertManager::Certificate",
+    );
+    // The overrides apply too — this is the one group→namespace rule, not a copy.
+    expect(k8sManifest({ apiVersion: "argoproj.io/v1alpha1", kind: "Application", metadata: { name: "app" } }).entityType).toBe(
+      "K8s::Argo::Application",
+    );
+  });
+
+  test("refuses a document that is not a Kubernetes object", () => {
+    expect(() => k8sManifest({ metadata: { name: "x" } })).toThrow(/apiVersion/);
+    expect(manifestEntity({ metadata: { name: "x" } })).toBeNull();
+  });
+
+  test("serializes verbatim, including a kind the lexicon ships no class for", () => {
+    const entities = new Map<string, Declarable>();
+    entities.set(
+      "webCert",
+      k8sManifest({
+        apiVersion: "cert-manager.io/v1",
+        kind: "Certificate",
+        metadata: { name: "web-tls", namespace: "web" },
+        spec: { secretName: "web-tls", dnsNames: ["web.example.com"] },
+      }),
+    );
+
+    const yaml = k8sSerializer.serialize(entities);
+    expect(yaml).toContain("apiVersion: cert-manager.io/v1");
+    expect(yaml).toContain("kind: Certificate");
+    expect(yaml).toContain("name: web-tls");
+    expect(yaml).toContain("- web.example.com");
+  });
+
+  test("a top-level field that is not spec stays at the top level", () => {
+    // The spec-inference heuristics are for typed declarables; a finished
+    // manifest must not have its `rules` re-nested under a synthetic spec.
+    const entities = new Map<string, Declarable>();
+    entities.set(
+      "viewer",
+      k8sManifest({
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "ClusterRole",
+        metadata: { name: "viewer" },
+        rules: [{ apiGroups: [""], resources: ["pods"], verbs: ["get", "list"] }],
+      }),
+    );
+
+    const yaml = k8sSerializer.serialize(entities);
+    expect(yaml).toMatch(/^rules:/m);
+    expect(yaml).not.toMatch(/^spec:\s*\n\s+rules:/m);
+  });
+
+  test("is the same verbatim entity a rendered kustomize document is", () => {
+    const entity = k8sManifest({ apiVersion: "v1", kind: "Namespace", metadata: { name: "web" } });
+    expect(isRenderedManifestEntity(entity)).toBe(true);
+    expect(entity.lexicon).toBe("k8s");
+    expect(entity.kind).toBe("resource");
+  });
+});

package/src/manifest-entity.ts

@@ -0,0 +1,82 @@
+/**
+ * A complete Kubernetes manifest carried into a build as a chant entity.
+ *
+ * Two callers produce one: a kustomize build root, whose output is a set of
+ * finished documents rather than typed chant source (#1548), and `chant carve
+ * emit` adopting a Terraform `kubernetes_manifest` (#999), whose whole content
+ * is a manifest body read out of state. In both cases the document already
+ * decided every field, so `props` IS the manifest: the serializer emits it
+ * as-is — plus the default-label / ownership merge every discovered resource
+ * gets — instead of running the spec-inference heuristics built for typed
+ * declarables, which would re-nest a top-level field that is not `spec`
+ * (`rules` on a ClusterRole, `webhooks` on a webhook config).
+ *
+ * The marker is what tells the serializer to take that path — `Symbol.for`, so
+ * a lexicon built against a separate copy of core still matches (the #1137
+ * lesson).
+ *
+ * `entityType` comes from `gvkToTypeName`, the one group→namespace rule
+ * (`./group-namespace`), so a manifest declared this way is typed exactly as a
+ * generated class would be and `lifecycle diff --live` observes it through the
+ * reader a declared resource uses. A kind the generated operation surface does
+ * not know reports NOT-OBSERVED with the existing "no generated operation
+ * surface" reason — the honest verdict, not a silent hole.
+ */
+import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
+import { gvkToTypeName } from "./spec/parse";
+
+/** Marks an entity whose `props` are a complete, render-final manifest. */
+export const RENDERED_MANIFEST_MARKER = Symbol.for("chant.k8s.renderedManifest");
+
+export interface RenderedManifestEntity extends Declarable {
+  readonly kind: "resource";
+  readonly props: Record<string, unknown>;
+  readonly [RENDERED_MANIFEST_MARKER]: true;
+}
+
+export function isRenderedManifestEntity(entity: Declarable): entity is RenderedManifestEntity {
+  return (entity as unknown as Record<symbol, unknown>)[RENDERED_MANIFEST_MARKER] === true;
+}
+
+/**
+ * Wrap one manifest. Returns null when the document has no string
+ * `apiVersion`/`kind` — not a Kubernetes object, nothing to declare.
+ */
+export function manifestEntity(doc: Record<string, unknown>): RenderedManifestEntity | null {
+  const apiVersion = doc.apiVersion;
+  const kind = doc.kind;
+  if (typeof apiVersion !== "string" || typeof kind !== "string" || !apiVersion || !kind) return null;
+
+  const slash = apiVersion.indexOf("/");
+  const group = slash === -1 ? "" : apiVersion.slice(0, slash);
+  const version = slash === -1 ? apiVersion : apiVersion.slice(slash + 1);
+
+  return {
+    lexicon: "k8s",
+    entityType: gvkToTypeName({ group, version, kind }),
+    kind: "resource",
+    props: { ...doc },
+    [DECLARABLE_MARKER]: true,
+    [RENDERED_MANIFEST_MARKER]: true,
+  };
+}
+
+/**
+ * Declare an arbitrary Kubernetes object from its manifest — the escape hatch
+ * for a kind the lexicon ships no generated class for, and what `chant carve
+ * emit` writes when it adopts a `kubernetes_manifest` (#999). The typed
+ * constructors cannot serve either case: their props are the kind's own schema,
+ * so an unknown CRD has no class at all and a known one rejects an
+ * `apiVersion`/`kind` pair that differs from the generated default.
+ *
+ * Throws on a document without a string `apiVersion` and `kind`: those two
+ * fields are what makes it addressable, and a silently dropped resource is the
+ * failure this is guarding against.
+ */
+export function k8sManifest(doc: Record<string, unknown>): RenderedManifestEntity {
+  const entity = manifestEntity(doc);
+  if (!entity) {
+    throw new Error("k8sManifest requires a document with string `apiVersion` and `kind` fields.");
+  }
+  return entity;
+}

package/src/plugin.ts

@@ -697,6 +697,17 @@ const { deployment, service, serviceMonitor, prometheusRule } = MonitoredService
     return describeResources(options);
   },
 
+  /**
+   * Who chant would act as in this cluster, before it acts (#1982) — the
+   * connector's own context/credential resolution plus the API server's
+   * `SelfSubjectReview`, reported through the same connect path the read uses
+   * so the cluster named is the cluster read. Implementation in ./whoami.ts.
+   */
+  async describeIdentity(options) {
+    const { describeIdentity } = await import("./whoami");
+    return describeIdentity(options);
+  },
+
   // Env teardown (#1222): enumeration + execution over the marker label
   // selector (managed-by + stack + env), through the same typed client the
   // prune uses. Execution deletes namespaces last. See ./teardown.ts.

package/src/serializer.ts

@@ -14,7 +14,7 @@ import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { emitYAML } from "@intentius/chant/yaml";
 import { isDefaultLabels, isDefaultAnnotations, type DefaultLabels, type DefaultAnnotations } from "./default-labels";
-import { isRenderedManifestEntity } from "./kustomize/rendered-entity";
+import { isRenderedManifestEntity } from "./manifest-entity";
 import { isEncryptedSecretFileEntity } from "./sops/entity";
 
 const require = createRequire(import.meta.url);

package/src/whoami.test.ts

@@ -0,0 +1,203 @@
+/**
+ * `chant lifecycle whoami` for Kubernetes (chant #1982).
+ *
+ * Every case drives the real client against a literal kubeconfig with the
+ * transport faked, so no ambient kubeconfig is read and no cluster is
+ * contacted. The load-bearing case is the last one: whoami and
+ * `describeResources` must resolve the same cluster, or the report describes a
+ * binding the read does not use.
+ */
+
+import { describe, test, expect, vi, beforeEach } from "vitest";
+
+const loadChantConfigMock = vi.fn();
+vi.mock("@intentius/chant/config", () => ({
+  loadChantConfig: (...args: unknown[]) => loadChantConfigMock(...args),
+}));
+
+const { describeIdentity } = await import("./whoami");
+const { describeResources } = await import("./describe-resources");
+const { fakeCluster, objectKey } = await import("./api/fake-cluster");
+const { defaultK8sConnector } = await import("./api/connect");
+const { fakeKubeconfig, statusBody } = await import("@intentius/chant-k8s-client/testing");
+import type { RecordedRequest } from "@intentius/chant-k8s-client/testing";
+import type { ResolvedIdentity, UnresolvedIdentity } from "@intentius/chant/lexicon";
+
+const REVIEW_V1 = "/apis/authentication.k8s.io/v1/selfsubjectreviews";
+
+/** The API server's own answer to "who am I". */
+function reviewResponse(username: string): { body: Record<string, unknown> } {
+  return {
+    body: {
+      apiVersion: "authentication.k8s.io/v1",
+      kind: "SelfSubjectReview",
+      status: { userInfo: { username, groups: ["system:authenticated"] } },
+    },
+  };
+}
+
+const twoContexts = fakeKubeconfig({
+  contexts: [
+    { name: "prod-eks", cluster: "prod", user: "prod-user", namespace: "chant" },
+    { name: "staging-eks", cluster: "staging", user: "staging-user" },
+  ],
+  currentContext: "staging-eks",
+  server: "https://cluster.test:6443",
+});
+
+const resolved = (r: unknown): ResolvedIdentity => r as ResolvedIdentity;
+const refusal = (r: unknown): UnresolvedIdentity => (r as { unresolved: UnresolvedIdentity }).unresolved;
+
+describe("k8s describeIdentity (#1982)", () => {
+  beforeEach(() => {
+    loadChantConfigMock.mockReset();
+    loadChantConfigMock.mockResolvedValue({ config: {} });
+  });
+
+  test("reports the API server's subject, the bound context as scope, and the binding as source", async () => {
+    loadChantConfigMock.mockResolvedValue({ config: { k8s: { profiles: { prod: { context: "prod-eks" } } } } });
+    const cluster = fakeCluster({
+      kubeconfig: twoContexts,
+      respond: (req: RecordedRequest) => (req.path === REVIEW_V1 ? reviewResponse("system:serviceaccount:chant:deployer") : undefined),
+    });
+
+    const result = resolved(
+      await describeIdentity({ environment: "prod" }, (o) =>
+        defaultK8sConnector({ ...o, client: { kubeconfig: twoContexts, requestLayer: cluster.layer } }),
+      ),
+    );
+
+    expect(result.identity).toBe("system:serviceaccount:chant:deployer");
+    expect(result.scope).toBe("prod-eks ns=chant");
+    expect(result.source).toContain("k8s.profiles.prod.context");
+    expect(result.source).toContain("credential token");
+    expect(result.endpoint).toBe("https://cluster.test:6443");
+  });
+
+  test("an unbound environment says which binding is missing rather than staying quiet", async () => {
+    const cluster = fakeCluster({
+      kubeconfig: twoContexts,
+      respond: (req: RecordedRequest) => (req.path === REVIEW_V1 ? reviewResponse("kubernetes-admin") : undefined),
+    });
+
+    const result = resolved(
+      await describeIdentity({ environment: "prod" }, (o) =>
+        defaultK8sConnector({ ...o, client: { kubeconfig: twoContexts, requestLayer: cluster.layer } }),
+      ),
+    );
+
+    expect(result.identity).toBe("kubernetes-admin");
+    expect(result.scope).toContain("staging-eks");
+    expect(result.source).toContain("no k8s.profiles.prod binding");
+  });
+
+  test("a cluster with no review API is 'could not determine', not the kubeconfig's local alias", async () => {
+    // The kubeconfig user is `prod-user` here. Reporting that as the identity
+    // would be a guess: the cluster maps a credential onto whatever subject it
+    // likes, which is the whole reason the question is worth asking.
+    loadChantConfigMock.mockResolvedValue({ config: { k8s: { profiles: { prod: { context: "prod-eks" } } } } });
+    const cluster = fakeCluster({ kubeconfig: twoContexts });
+
+    const result = refusal(
+      await describeIdentity({ environment: "prod" }, (o) =>
+        defaultK8sConnector({ ...o, client: { kubeconfig: twoContexts, requestLayer: cluster.layer } }),
+      ),
+    );
+
+    expect(result.reason).toBe("read-failed");
+    expect(result.detail).toContain("SelfSubjectReview");
+    expect(result.detail).toContain("local credential entry");
+  });
+
+  test("a refused review is no-credentials, keeping it apart from a broken one", async () => {
+    const cluster = fakeCluster({
+      kubeconfig: twoContexts,
+      respond: (req: RecordedRequest) =>
+        req.path === REVIEW_V1
+          ? { status: 403, body: statusBody(403, "Forbidden", "selfsubjectreviews is forbidden") }
+          : undefined,
+    });
+
+    const result = refusal(
+      await describeIdentity({ environment: "prod" }, (o) =>
+        defaultK8sConnector({ ...o, client: { kubeconfig: twoContexts, requestLayer: cluster.layer } }),
+      ),
+    );
+    expect(result.reason).toBe("no-credentials");
+  });
+
+  test("a binding naming a context the kubeconfig does not have is no-binding", async () => {
+    loadChantConfigMock.mockResolvedValue({ config: { k8s: { profiles: { prod: { context: "missing-eks" } } } } });
+    const cluster = fakeCluster({ kubeconfig: twoContexts });
+
+    const result = refusal(
+      await describeIdentity({ environment: "prod" }, (o) =>
+        defaultK8sConnector({ ...o, client: { kubeconfig: twoContexts, requestLayer: cluster.layer } }),
+      ),
+    );
+    expect(result.reason).toBe("no-binding");
+    expect(result.detail).toContain("missing-eks");
+  });
+
+  test("the credential is named, never printed", async () => {
+    const withToken = fakeKubeconfig({ token: "a-static-bearer-token-value" });
+    const cluster = fakeCluster({
+      kubeconfig: withToken,
+      respond: (req: RecordedRequest) => (req.path === REVIEW_V1 ? reviewResponse("ci@acme.example") : undefined),
+    });
+
+    const result = await describeIdentity({ environment: "prod" }, (o) =>
+      defaultK8sConnector({ ...o, client: { kubeconfig: withToken, requestLayer: cluster.layer } }),
+    );
+    // A kubeconfig holding a static token is the case where the identity
+    // signal IS a secret. The report says `credential token` and stops.
+    expect(resolved(result).source).toContain("credential token");
+    expect(JSON.stringify(result)).not.toContain("a-static-bearer-token-value");
+  });
+});
+
+describe("whoami and the live read resolve the same cluster (#1982 acceptance)", () => {
+  test("the reported endpoint is the server describeResources reads against", async () => {
+    loadChantConfigMock.mockResolvedValue({ config: { k8s: { profiles: { prod: { context: "prod-eks" } } } } });
+    const web = {
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "web", namespace: "chant", uid: "uid-1", resourceVersion: "7" },
+      status: { readyReplicas: 1, replicas: 1 },
+    };
+    const cluster = fakeCluster({
+      kubeconfig: twoContexts,
+      objects: { [objectKey("apps/v1", "Deployment", "web", "chant")]: web },
+      respond: (req: RecordedRequest) => (req.path === REVIEW_V1 ? reviewResponse("system:serviceaccount:chant:deployer") : undefined),
+    });
+    const connects: Array<string | undefined> = [];
+    const connect = (o: Parameters<typeof defaultK8sConnector>[0]) => {
+      connects.push(o.environment);
+      return defaultK8sConnector({ ...o, client: { kubeconfig: twoContexts, requestLayer: cluster.layer } });
+    };
+
+    const identity = resolved(await describeIdentity({ environment: "prod" }, connect));
+    const reviewUrl = cluster.layer.requests.find((r) => r.path === REVIEW_V1)!.url;
+
+    cluster.layer.requests.length = 0;
+    const observed = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["web"],
+        entities: new Map([["web", { entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web", namespace: "chant" } } }]]),
+      },
+      connect,
+    );
+    expect(observed.resources.web).toBeDefined();
+
+    const origin = (url: string): string => new URL(url).origin;
+    expect(origin(reviewUrl)).toBe(identity.endpoint);
+    for (const request of cluster.layer.requests) {
+      expect(origin(request.url)).toBe(identity.endpoint);
+    }
+    // Both connect calls resolved the same environment through the same
+    // connector, so the binding cannot diverge between the two.
+    expect(connects).toEqual(["prod", "prod"]);
+  });
+});

package/src/whoami.ts

@@ -0,0 +1,122 @@
+/**
+ * Who chant would act as in a cluster — the lexicon half of `chant lifecycle
+ * whoami` (chant #1982).
+ *
+ * The connector already resolves all of this and hands it back on every
+ * observation: `defaultK8sConnector` picks a context from
+ * `k8s.profiles.<env>.context` or from the ambient kubeconfig, the client
+ * records the server it resolved and which credential path authorized it, and
+ * `describeResources` then throws the lot away. This reports it, and reports
+ * it BEFORE a read rather than after a wrong one.
+ *
+ * Same connector, same environment, same options, so the server named here is
+ * the server the read talks to. A test pins that: a whoami that names a
+ * cluster the read does not use would be worse than no whoami at all.
+ *
+ * ## The principal is the API server's answer, not the kubeconfig's
+ *
+ * A kubeconfig `user` entry is a local alias. The cluster may map that
+ * credential onto any subject it likes, which is exactly why "am I acting as
+ * the identity I think I am" is a real question. So the principal comes from
+ * `SelfSubjectReview` — the call behind `kubectl auth whoami` — which the API
+ * server answers with the subject it authenticated. It creates nothing.
+ *
+ * A cluster older than the review API serves no version of it. That is
+ * `read-failed` with a detail saying so, not a fallback to the local alias
+ * dressed up as an identity.
+ *
+ * ## No credential in the answer
+ *
+ * The credential path is reported by NAME — `exec-plugin` and its command,
+ * `token`, `client-certificate`. A kubeconfig holding a static bearer token is
+ * the case where the identity signal IS a secret, and the report says
+ * `credential: token` and stops there. The token, the client key and the exec
+ * plugin's output never leave the client.
+ */
+
+import type { DescribeIdentityOptions, DescribeIdentityResult } from "@intentius/chant/lexicon";
+import { defaultK8sConnector, type K8sConnector } from "./api/connect";
+import { classifyApiFailure, isMissingClientPackage, MISSING_CLIENT_DETAIL } from "./api/classify";
+
+/** Everything about the caller's credential except the credential. */
+function credentialNote(credential: string, execCommand?: string): string {
+  return execCommand ? `credential ${credential} (${execCommand})` : `credential ${credential}`;
+}
+
+/**
+ * The k8s `describeIdentity`. Connects the way the read connects, asks the API
+ * server who it is talking to, and reports the context that binding came from.
+ */
+export async function describeIdentity(
+  options: DescribeIdentityOptions,
+  connect: K8sConnector = defaultK8sConnector,
+): Promise<DescribeIdentityResult> {
+  let connected;
+  try {
+    connected = await connect({ environment: options.environment, cwd: options.cwd });
+  } catch (err) {
+    if (isMissingClientPackage(err)) {
+      return { unresolved: { reason: "read-failed", detail: MISSING_CLIENT_DETAIL } };
+    }
+    const outcome = classifyApiFailure(err);
+    return {
+      unresolved:
+        outcome.kind === "unobserved"
+          ? { reason: outcome.reason, detail: outcome.detail }
+          : { reason: "no-binding", detail: err instanceof Error ? err.message : String(err) },
+    };
+  }
+
+  const { client, target } = connected;
+  const provenance = client.provenance;
+  const context = provenance.context ?? "(unset)";
+  const scope = `${context} ns=${client.defaultNamespace}`;
+  // Where the context came from, in the project's own vocabulary. An ambient
+  // context is not a failure — but it is the one an operator most often did
+  // not mean, so it says which binding is missing.
+  const binding =
+    target.source === "bound"
+      ? `k8s.profiles.${options.environment}.context`
+      : `ambient kubeconfig current-context (no k8s.profiles.${options.environment} binding)`;
+  const source = [
+    binding,
+    credentialNote(provenance.credential, provenance.execCommand),
+    `kubeconfig ${provenance.kubeconfigSource}`,
+  ].join("; ");
+
+  let subject;
+  try {
+    subject = await client.selfSubjectReview();
+  } catch (err) {
+    const outcome = classifyApiFailure(err);
+    return {
+      unresolved: {
+        reason: outcome.kind === "unobserved" ? outcome.reason : "read-failed",
+        detail:
+          outcome.kind === "unobserved"
+            ? `SelfSubjectReview against ${provenance.server}: ${outcome.detail}`
+            : `SelfSubjectReview against ${provenance.server} did not answer`,
+      },
+    };
+  }
+
+  if (!subject) {
+    return {
+      unresolved: {
+        reason: "read-failed",
+        detail:
+          `${provenance.server} serves no authentication.k8s.io SelfSubjectReview, so the API server ` +
+          `cannot be asked who it authenticated (the API landed in Kubernetes 1.26). The kubeconfig ` +
+          `context is "${context}" with ${credentialNote(provenance.credential, provenance.execCommand)}, ` +
+          `which names a local credential entry, not the subject the cluster resolves it to.`,
+      },
+    };
+  }
+
+  return {
+    identity: subject.username,
+    scope,
+    source,
+    endpoint: provenance.server,
+  };
+}