@intentius/chant-lexicon-k8s 0.57.0 → 0.59.0

package/dist/api/fake-cluster.d.ts

@@ -13,7 +13,7 @@
  * all need the same thing.
  */
 import type { K8sObject } from "@intentius/chant-k8s-client";
-import type { FakeRequestLayer, RecordedRequest } from "@intentius/chant-k8s-client/testing";
+import type { FakeRequestLayer, FakeResponse, RecordedRequest } from "@intentius/chant-k8s-client/testing";
 import type { ConnectOptions, K8sConnector } from "./connect.js";
 export interface FakeClusterOptions {
     /**
@@ -28,11 +28,12 @@ export interface FakeClusterOptions {
      * CRD resolvable in a test without registering anything.
      */
     serves?: readonly string[];
-    /** Full control: return a response for a request, or undefined to fall through. */
-    respond?: (request: RecordedRequest) => {
-        status?: number;
-        body?: unknown;
-    } | undefined;
+    /**
+     * Full control: return a response for a request, or undefined to fall
+     * through. A `stream` on the response is what a watch reads (chant #1981);
+     * see `fakeWatchStream` in the client's testing harness.
+     */
+    respond?: (request: RecordedRequest) => FakeResponse | undefined;
     /** Kubeconfig to hand the client. Defaults to a single-context one. */
     kubeconfig?: string;
 }

package/dist/api/fake-cluster.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-cluster.d.ts","sourceRoot":"","sources":["../../src/api/fake-cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAE7F,OAAO,KAAK,EAAmB,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG/E,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,mFAAmF;IACnF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IACxF,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,YAAY,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpG;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,GAAE,OAAO,CAAC,SAAS,CAAM,GAC7B,SAAS,CAcX;AAwBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CA+FzE"}
+{"version":3,"file":"fake-cluster.d.ts","sourceRoot":"","sources":["../../src/api/fake-cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAE3G,OAAO,KAAK,EAAmB,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG/E,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,YAAY,GAAG,SAAS,CAAC;IACjE,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,YAAY,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpG;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,GAAE,OAAO,CAAC,SAAS,CAAM,GAC7B,SAAS,CAcX;AAwBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CAwGzE"}

package/dist/api/sweep-types.d.ts

@@ -10,8 +10,7 @@
  *
  * It lives in its own module, with no imports of its own, because both
  * consumers reach it from different directions — `../export-resources.ts`
- * pulls in the whole import parser, and a Temporal worker loading the apply
- * activity should not.
+ * pulls in the whole import parser, and the apply activity should not.
  */
 export declare const DEFAULT_IMPORT_TYPES: readonly string[];
 //# sourceMappingURL=sweep-types.d.ts.map

package/dist/api/sweep-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sweep-types.d.ts","sourceRoot":"","sources":["../../src/api/sweep-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAoBjD,CAAC"}
+{"version":3,"file":"sweep-types.d.ts","sourceRoot":"","sources":["../../src/api/sweep-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAoBjD,CAAC"}

package/dist/codegen/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqHH;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB9E"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4HH;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB9E"}

package/dist/composites/cron-schedule.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Shared CronJob schedule validation (issue #2071 item 4).
+ *
+ * `OperatorStack` and `CronWorkload` both hand their `schedule` field
+ * straight to a k8s `CronJob`, which parses only five fields (minute hour
+ * day-of-month month day-of-week). Core's own cron parser
+ * (`isValidCronExpression`, `packages/core/src/op/cron.ts`, #2120) is
+ * deliberately more permissive: it also accepts the 6-field Quartz form
+ * (`second minute hour dom month dow`) that a `ConvergeOp`'s own `schedule`
+ * may legitimately carry, since the final word on cron syntax belongs to
+ * whichever scheduler runs the string. A k8s CronJob is that scheduler here,
+ * and it is stricter than core's parser, so a 6-field `ConvergeOp` schedule
+ * reused as-is on a CronJob fails at `kubectl apply`, not at build time.
+ *
+ * This module gives both composites one place to catch that at construction,
+ * reusing core's parser rather than a second copy of it.
+ */
+/**
+ * Validate `schedule` for a k8s CronJob, throwing before a bad value ever
+ * reaches `kubectl apply`. `context` names the composite (and host, for
+ * `OperatorStack`) so the thrown message reads like the rest of that
+ * composite's build-time refusals, e.g. `OperatorStack "chant-operator",
+ * host "fountain-observe"` or `CronWorkload "backup"`.
+ */
+export declare function validateCronJobSchedule(context: string, schedule: string): void;
+//# sourceMappingURL=cron-schedule.d.ts.map

package/dist/composites/cron-schedule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-schedule.d.ts","sourceRoot":"","sources":["../../src/composites/cron-schedule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAmB/E"}

package/dist/composites/cron-workload.d.ts

@@ -11,7 +11,7 @@ export interface CronWorkloadProps {
     name: string;
     /** Container image. */
     image: string;
-    /** Cron schedule expression (e.g., "0 * * * *"). */
+    /** Cron schedule expression (e.g., "0 * * * *"). Validated at construction: a k8s CronJob takes five fields only, so a 6-field (seconds) form is refused (`./cron-schedule.ts`, #2071). */
     schedule: string;
     /** Command to run in the container. */
     command?: string[];

package/dist/composites/cron-workload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cron-workload.d.ts","sourceRoot":"","sources":["../../src/composites/cron-workload.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,0BAA0B;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,mEAAmE;IACnE,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAChD,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;CAC/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY;;;;;EAqGP,CAAC"}
+{"version":3,"file":"cron-workload.d.ts","sourceRoot":"","sources":["../../src/composites/cron-workload.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAGnE,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,2LAA2L;IAC3L,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,0BAA0B;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,mEAAmE;IACnE,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAChD,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;CAC/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY;;;;;EAuGP,CAAC"}

package/dist/composites/operator-stack.d.ts

@@ -16,39 +16,40 @@
  * (lease fencing, `chant operator status`, durable gate-as-fact semantics).
  * `OperatorStack`'s container command is deliberately `chant run <name>`,
  * the one-shot local tick `ConvergeOp` (#1484) already ships and tests
- * against (`lexicons/temporal/src/composites/converge-op.ts`'s own doc:
+ * against (`packages/core/src/op/composites/converge-op.ts`'s own doc:
  * "one-shot runnable locally for a single tick"). When #1485 lands, a
  * caller can override `command` to shell out to `chant operator tick`
  * instead — this composite doesn't need to change for that; only the
  * command a caller passes does.
  *
  * `concurrencyPolicy: "Forbid"` is the k8s-native analogue of
- * `ConvergeOp`'s own Temporal schedule `overlap: "Skip"` policy — never
- * queue a second tick behind one still running.
+ * `ConvergeOp`'s own `schedule.overlap: "skip"` policy — never queue a
+ * second tick behind one still running.
  *
  * ## RBAC derivation
  *
  * `ConvergeOp` adds no authority an environment did not already grant
  * (#1484's Autonomy table). `OperatorStack` re-derives the same bound at the
- * k8s RBAC layer, independently of the temporal lexicon (this module has no
- * dependency on it — see the layering note below): for each hosted
+ * k8s RBAC layer, from the Op configs alone (see the Layering note below for
+ * what this module imports and what it restates): for each hosted
  * ConvergeOp, walk its `dispatchTargets` (the OpConfigs its rule table's
  * `run()` actions may name) through `classifyOpVerbClass`
  * (`packages/core/src/op/op-verb-class.ts`, #1954), then keep only the
  * highest verb class this host's `dial` could ever actually free-run —
  * exactly `convergeTick`'s own `verbClassAllowedToDispatch` gate and
- * `TMP014`'s build-time refusal, restated as an RBAC ceiling:
+ * `OPS014`'s build-time refusal, restated as an RBAC ceiling:
  *
  * - `dial: "observe"` never dispatches (report-only) → read-only RBAC,
  *   regardless of what the rule table's targets could otherwise do.
- * - `dial: "reconcile"` only free-runs a read-only target (TMP014 refuses a
+ * - `dial: "reconcile"` only free-runs a read-only target (OPS014 refuses a
  *   mutating dispatch under reconcile in v1) → read-only RBAC.
  * - `dial: "apply"` free-runs read-only and mutating targets → RBAC gains
  *   create/update/patch, never delete.
  * - A `dispatchTargets` entry that itself classifies `destructive` is
- *   refused outright, at construction — TMP014 already refuses a
- *   destructive `run()` target under any dial in v1 (the local dispatch
- *   executor can't honor its required gate), so a `destructive` target
+ *   refused outright, at construction — OPS014 already refuses a
+ *   destructive `run()` target under any dial in v1 (a converge tick runs
+ *   unattended, and a destructive dispatch needs a person's approval before
+ *   it is attempted, not a gate read after the fact), so a `destructive` target
  *   reaching this composite is either a config bypassing that build check
  *   or a target `OperatorStack` should never grant permission toward.
  *   `never delete`, unconditionally, in v1 — no verb class here ever grants
@@ -61,11 +62,11 @@
  *
  * ## Layering
  *
- * `lexicons/k8s` has no workspace dependency on `lexicons/temporal` (nor
- * the reverse — see both packages' `package.json`), so this module doesn't
- * import `ConvergeOpConfig`/`ConvergeRule` types. `OperatorStackConvergeHost`
- * restates the handful of `ConvergeOp` fields this composite actually needs
- * (`name`, `schedule`, `env`, `dial`) structurally; `dispatchTargets` takes
+ * `OperatorStackConvergeHost` restates the handful of `ConvergeOp` fields
+ * this composite actually needs (`name`, `schedule`, `env`, `dial`)
+ * structurally rather than importing `ConvergeOpConfig`: the CronJob is
+ * built from a host description, not from an Op config, and a caller that
+ * has neither should still be able to describe one. `dispatchTargets` takes
  * plain `OpConfig`-shaped values from `@intentius/chant/op` (a dependency
  * this lexicon already has via the `@intentius/chant` peer dependency),
  * the same type `classifyOpVerbClass` itself takes.
@@ -74,7 +75,7 @@ import type { OpConfig, OpVerbClass } from "@intentius/chant/op";
 import { Namespace, CronJob, ServiceAccount, Role, RoleBinding } from "../generated/index.js";
 /**
  * Mirrors `ConvergeOp`'s own `ConvergeDial`
- * (`lexicons/temporal/src/composites/converge-op.ts`) structurally — see
+ * (`packages/core/src/op/composites/converge-op.ts`) structurally — see
  * this module's Layering doc for why it's restated rather than imported.
  */
 export type OperatorDial = "observe" | "reconcile" | "apply";
@@ -87,7 +88,7 @@ export interface OperatorRbacResourceRule {
 export interface OperatorStackConvergeHost {
     /** ConvergeOp's own name (`ConvergeOpConfig.name`) — the CronJob, ServiceAccount, Role, and RoleBinding name stem for this host. */
     name: string;
-    /** Cron expression driving the tick — the same string passed to `ConvergeOp`'s own `schedule`. */
+    /** Cron expression driving the tick — the same string passed to `ConvergeOp`'s own `schedule`. Validated at construction: a 6-field (seconds) form, which `ConvergeOp` accepts, is refused here since a k8s CronJob takes five fields only (`./cron-schedule.ts`, #2071). */
     schedule: string;
     /** Environment this ConvergeOp converges (`ConvergeOpConfig.env`) — carried onto the container as `CHANT_CONVERGE_ENV`, for log/estate readability only (`chant run <name>` needs no `--env`: the target op already carries it). */
     env: string;
@@ -96,7 +97,7 @@ export interface OperatorStackConvergeHost {
     /**
      * OpConfigs for every op this ConvergeOp's rule table may `run()` — the
      * sibling `*.op.ts` declarations its `run()` actions name. Used to derive
-     * least-privilege RBAC the same way `TMP014` derives its build-time
+     * least-privilege RBAC the same way `OPS014` derives its build-time
      * refusals. Omit or leave empty when every rule only `report()`s; the
      * host still gets read-only RBAC for its own observation.
      */
@@ -153,7 +154,7 @@ export declare const DEFAULT_RESOURCE_RULES: OperatorRbacResourceRule[];
  * Derive the highest verb class a host's ServiceAccount actually needs:
  * the max, across `dispatchTargets`, of each target's own class — but only
  * counting a target `dial` could ever actually dispatch (one it can't just
- * gets reported, per `TMP014`/`convergeTick`, and needs no elevated grant).
+ * gets reported, per `OPS014`/`convergeTick`, and needs no elevated grant).
  * A `dispatchTargets` entry that classifies `destructive` is refused
  * outright rather than silently ignored — see this module's RBAC
  * derivation doc on why a destructive target reaching this composite is

package/dist/composites/operator-stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-stack.d.ts","sourceRoot":"","sources":["../../src/composites/operator-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIrF;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,uOAAuO;AACvO,MAAM,WAAW,wBAAwB;IACvC,kCAAkC;IAClC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oIAAoI;IACpI,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,oOAAoO;IACpO,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC;IAC3D,2LAA2L;IAC3L,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACvC,2JAA2J;IAC3J,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,iIAAiI;IACjI,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IACtC,2HAA2H;IAC3H,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC9C,iBAAiB;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,iBAAiB;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC5C,CAAC;CACH;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;IAC1C,CAAC,MAAM,EAAE,MAAM,GACX,YAAY,CAAC,OAAO,SAAS,CAAC,GAC9B,YAAY,CAAC,OAAO,cAAc,CAAC,GACnC,YAAY,CAAC,OAAO,IAAI,CAAC,GACzB,YAAY,CAAC,OAAO,WAAW,CAAC,GAChC,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;CAClC;AAID,+MAA+M;AAC/M,eAAO,MAAM,sBAAsB,EAAE,wBAAwB,EAI5D,CAAC;AAwBF;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,GAAG,WAAW,CAchJ;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,0FA6IP,CAAC"}
+{"version":3,"file":"operator-stack.d.ts","sourceRoot":"","sources":["../../src/composites/operator-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKrF;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,uOAAuO;AACvO,MAAM,WAAW,wBAAwB;IACvC,kCAAkC;IAClC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oIAAoI;IACpI,IAAI,EAAE,MAAM,CAAC;IACb,6QAA6Q;IAC7Q,QAAQ,EAAE,MAAM,CAAC;IACjB,oOAAoO;IACpO,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC;IAC3D,2LAA2L;IAC3L,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACvC,2JAA2J;IAC3J,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,iIAAiI;IACjI,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IACtC,2HAA2H;IAC3H,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC9C,iBAAiB;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,iBAAiB;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC5C,CAAC;CACH;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;IAC1C,CAAC,MAAM,EAAE,MAAM,GACX,YAAY,CAAC,OAAO,SAAS,CAAC,GAC9B,YAAY,CAAC,OAAO,cAAc,CAAC,GACnC,YAAY,CAAC,OAAO,IAAI,CAAC,GACzB,YAAY,CAAC,OAAO,WAAW,CAAC,GAChC,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;CAClC;AAID,+MAA+M;AAC/M,eAAO,MAAM,sBAAsB,EAAE,wBAAwB,EAI5D,CAAC;AAwBF;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,GAAG,WAAW,CAehJ;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,0FA2IP,CAAC"}

package/dist/config-schema.d.ts

@@ -25,6 +25,9 @@ export declare const k8sConfigSchema: z.ZodObject<{
     kustomize: z.ZodOptional<z.ZodObject<{
         roots: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    receipts: z.ZodOptional<z.ZodObject<{
+        namespace: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 declare module "@intentius/chant/config" {
     interface ChantConfig {

package/dist/config-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-schema.d.ts","sourceRoot":"","sources":["../src/config-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,eAAO,MAAM,uBAAuB;;kBAElC,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;kBAQ1B,CAAC;AAEH,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,GAAG,CAAC,EAAE,cAAc,CAAC;KACtB;CACF;AAED,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAEjE;;;GAGG;AACH,KAAK,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,SAAS,cAAc,GAChF,cAAc,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,GACpD,IAAI,GACJ,KAAK,GACP,KAAK,CAAC;AACV,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC"}
+{"version":3,"file":"config-schema.d.ts","sourceRoot":"","sources":["../src/config-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,eAAO,MAAM,uBAAuB;;kBAElC,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;kBAa1B,CAAC;AAEH,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,GAAG,CAAC,EAAE,cAAc,CAAC;KACtB;CACF;AAED,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAEjE;;;GAGG;AACH,KAAK,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,SAAS,cAAc,GAChF,cAAc,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,GACpD,IAAI,GACJ,KAAK,GACP,KAAK,CAAC;AACV,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC"}

package/dist/config.d.ts

@@ -2,8 +2,8 @@
  * K8s environment → cluster binding — chant #1100.
  *
  * Every cloud lexicon binds an environment to a scope: AWS resolves `<env>`
- * to a CloudFormation stack, Azure treats `<env>` as the resource group,
- * Temporal looks up `temporal.profiles.<env>`. Before this, k8s bound
+ * to a CloudFormation stack, Azure treats `<env>` as the resource group.
+ * Before this, k8s bound
  * nothing — `describeResources` shelled out to `kubectl get` with no
  * `--context`, so `chant lifecycle diff prod --live` read whichever cluster
  * `kubectl config current-context` happened to point at.
@@ -40,8 +40,8 @@
  *   and the missing binding.
  *
  * `ChantConfig` uses `.passthrough()` in its Zod schema so the `k8s` key is
- * accepted at runtime without core changes, exactly like `temporal.profiles`
- * (see `lexicons/temporal/src/config.ts`). The type side is the declaration
+ * accepted at runtime without core changes, exactly like the `terraform` key
+ * (see `lexicons/terraform/src/config.ts`). The type side is the declaration
  * merge at the bottom of this file — without it the snippet above compiles
  * only until someone adds `satisfies ChantConfig`, which every example
  * project does and which is the only thing type-checking the rest of the
@@ -107,6 +107,28 @@ export interface K8sChantConfig {
         /** Kustomization directories to render into the build. */
         roots?: string[];
     };
+    /**
+     * Effect receipt settings (#2074, epic #1703).
+     *
+     * `namespace` is where this project's receipt ConfigMaps live. The name is
+     * derived from the ownership fields (`chant-receipt.<stack>.<env>.<effect>`,
+     * see `./effect-receipt-row.ts`); the namespace is the one part of the
+     * address the ownership block cannot answer, so it is declared here. Unset,
+     * receipts land in `default`, the same namespace every other namespace-less
+     * k8s read and write in this lexicon falls through to. It is never derived
+     * from the stack or the environment: a guessed namespace is one chant would
+     * have to create, and the receipt row creates nothing but the receipt.
+     *
+     * ```ts
+     * k8s: {
+     *   receipts: { namespace: "chant-system" },
+     * } satisfies K8sChantConfig
+     * ```
+     */
+    receipts?: {
+        /** Namespace the receipt ConfigMaps live in. Defaults to `default`. */
+        namespace?: string;
+    };
 }
 declare module "@intentius/chant/config" {
     interface ChantConfig {

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,CAAC,EAAE;QACV,0DAA0D;QAC1D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAED,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,GAAG,CAAC,EAAE,cAAc,CAAC;KACtB;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,CAAC,EAAE;QACV,0DAA0D;QAC1D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,EAAE;QACT,uEAAuE;QACvE,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,GAAG,CAAC,EAAE,cAAc,CAAC;KACtB;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC"}

package/dist/deep-observe-hooks.d.ts

@@ -49,7 +49,8 @@ import type { DeepArrayElement, DeepNormalizationHooks } from "@intentius/chant/
  * Kubernetes-defaulted fields, per entity type, as index-erased property
  * paths. Subtracted only where source never declared the property
  * (`side === "live" && counterpart === "absent"`) — cdk-real-drift's default
- * subtraction, same convention as AWS/Azure/Temporal's tables.
+ * subtraction, same convention as the AWS and Azure tables
+ * (`AWS_SERVICE_DEFAULTS`, `AZURE_SERVICE_DEFAULTS`).
  *
  * Sparse and evidence-based rather than derived from the generated schema:
  * the k8s OpenAPI spec this lexicon's codegen consumes
@@ -58,9 +59,8 @@ import type { DeepArrayElement, DeepNormalizationHooks } from "@intentius/chant/
  * actually expressible today. Widening this table is additive and needs no
  * contract change.
  *
- * `spec.strategy` is listed whole, not as `spec.strategy.type`, for the same
- * reason Temporal's `TEMPORAL_SCHEDULE_DEFAULTS` lists `state` whole: pruning
- * only the leaf would still recurse into the object, and a nested default the
+ * `spec.strategy` is listed whole rather than as `spec.strategy.type`, because
+ * pruning only the leaf would still recurse into the object, and a nested default the
  * table does not separately name (`rollingUpdate.maxSurge`/`maxUnavailable`,
  * both `"25%"` when `spec.strategy` is omitted entirely) would leave behind an
  * empty `strategy: {}` — a value distinct from no `strategy` key at all, and

package/dist/deep-observe.d.ts

@@ -9,10 +9,10 @@
  *
  * ## What managedFields decides, and what it does not
  *
- * AWS, Azure and Temporal's rows all prune by a **static, entityType-keyed**
- * table: an ARN always looks like an ARN, `provisioningState` is always
- * server-populated, a namespace's retention default is always the same
- * value. None of that needs the specific live object in hand — it is exactly
+ * The AWS and Azure rows both prune by a **static, entityType-keyed** table
+ * (`AWS_SERVICE_DEFAULTS`, `AZURE_SERVICE_DEFAULTS`): an ARN always looks like
+ * an ARN, `provisioningState` is always server-populated. Neither needs the
+ * specific live object in hand — it is exactly
  * what `./deep-observe-hooks.ts`'s `k8sDeepNormalizationHooks` is, and it
  * covers Kubernetes' *equivalent* static noise (`status`,
  * `metadata.{uid,resourceVersion,generation,creationTimestamp}`, a handful of
@@ -31,7 +31,7 @@
  * was controller noise. It silenced exactly the case the deep read exists
  * for — `kubectl label deploy web team=platform` is foreign-owned
  * (`kubectl-edit`) and undeclared, and never appeared in fieldDrift. The
- * policy now (recorded on #1202) is:
+ * policy now (recorded on #1202, refined by #2160) is:
  *
  * 1. **Chant-owned** (`chant`, `chant:<stack>` — chant #1075, matched on the
  *    family so a stack rename does not stop recognizing its own history) is
@@ -41,18 +41,25 @@
  *    write currently holds the field, and a foreign write that overrides a
  *    value chant's manifest asks for is the thing `lifecycle diff --live`
  *    exists to surface. It reports as `changed`.
- * 3. **Foreign-owned and undeclared** is reported as `undeclared` drift,
- *    unless the accepted baseline already carries it at that value. The
- *    baseline (`--update-baseline`) is the noise valve: an HPA that owns
- *    `spec.replicas` on a Deployment whose source is silent about replicas
- *    reports once, gets accepted, and stays quiet until the value moves.
+ * 3. **Undeclared** — a path outside the declaration's claimed-field set
+ *    (`@intentius/chant/claimed-fields`) — is reported as unclaimed and
+ *    is not drift at all. Before #2160 it was `undeclared` drift that the
+ *    accepted baseline had to absorb one path at a time; the declaration
+ *    answers on the first read instead, so an HPA that owns `spec.replicas`
+ *    on a Deployment whose source is silent about replicas is quiet with
+ *    nothing recorded anywhere.
  *
- * So ownership decides nothing about *whether* a path is compared. What it
- * contributes is `fieldOwners` (#1189): every reported drift names the
- * manager that holds the field live, which is how an operator tells
- * `hpa-controller` doing its job from somebody running `kubectl edit`. The
- * only fields subtracted because a foreign manager wrote them are the
- * well-known system ones on the static allowlist.
+ * So ownership decides nothing about *whether* a path is compared, and since
+ * #2160 it no longer decides the verdict either — the declaration does. What
+ * it contributes is `fieldOwners` (#1189), and that is worth more here than
+ * anywhere else: on every other substrate a held field can only be reported
+ * as "not chant's", while here it is reported as `hpa-controller`'s or
+ * `kubectl-edit`'s by name, which is the difference between a controller
+ * doing its job and somebody bypassing the pipeline. Core takes the manager
+ * where this reader supplies one and falls back to the claim where it does
+ * not (a path inside a key-addressed list, which no `fieldsV1` entry names in
+ * that form). The only fields subtracted because a foreign manager wrote them
+ * are the well-known system ones on the static allowlist.
  *
  * ## Resolving a managedFields entry against a live array
  *

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACzF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AASjE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAQD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAgHhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACzF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAUjE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAQD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAkIhC"}

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAwD,MAAM,0BAA0B,CAAC;AAGxH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAmBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA2CvD;AA4FD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAuBtE;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzC,GAAG,EAAE,SAAS,GACb,MAAM,GAAG,SAAS,CAIpB;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAmK5B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAwD,MAAM,0BAA0B,CAAC;AAGxH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAoBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA2CvD;AA4FD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAuBtE;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzC,GAAG,EAAE,SAAS,GACb,MAAM,GAAG,SAAS,CAIpB;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CA0L5B"}

package/dist/effect-receipt-row.d.ts

@@ -0,0 +1,164 @@
+/**
+ * The k8s effect-receipt materialization row (#2074, epic #1703): an effect
+ * receipt stored as a core `ConfigMap`, named
+ * `chant-receipt.<stack>.<env>.<effect>`, holding the expectation under
+ * `data.expectation`.
+ *
+ * Core's `EffectReceipt` factory (#1831) declares a receipt under the `chant`
+ * pseudo-lexicon, which no serializer claims. This module is the k8s
+ * materialization, built to the same shape as the aws SSM row (#1835,
+ * `lexicons/aws/src/effect-receipt-row.ts`): the {@link EffectReceipt} factory
+ * here produces core's declaration under `lexicon: "k8s"`, so the build
+ * partitions it to the k8s serializer, #1832's write-exclusion seam withholds
+ * it from the apply-bound entity set, and the serializer renders it for
+ * visibility through `SerializeContext.receipts` (see ./serializer.ts).
+ *
+ * Where the aws row parks its rendered rows in the CloudFormation template's
+ * `Metadata` (deliberately outside `Resources`, the section an applier writes
+ * from), this row parks them in a YAML COMMENT at the end of the manifest
+ * stream. Kubernetes YAML has no metadata channel outside the documents
+ * themselves, and a document is exactly what an applier applies: `loadAll`
+ * yields no object for a comment, so the receipt block is structurally
+ * unreachable from `applyManifest` while still riding the one build output the
+ * observation leg is handed. See {@link EFFECT_RECEIPTS_COMMENT_MARKER}.
+ *
+ * ## Name and namespace
+ *
+ * Path identity (epic decision 4): the ConfigMap name derives from the SAME
+ * ownership-block fields that stamp markers, `ownership.stack` and an explicit
+ * `ownership.env`, plus the receipt's `effect`. The separator is `.`, which no
+ * segment may contain, so `stack=a-b env=c` and `stack=a env=b-c` cannot
+ * produce the same name. The result is a valid RFC 1123 DNS subdomain, which
+ * is what a ConfigMap name has to be.
+ *
+ * The namespace is the project's `k8s.receipts.namespace`, and `default` when
+ * the project sets none, which is where every other namespace-less k8s read
+ * and write in this lexicon already lands. It is never invented from the stack
+ * or the environment: a namespace chant guessed would be a namespace chant has
+ * to create, and the receipt row creates nothing but the receipt.
+ *
+ * ## Ownership, and why the prune leaves it alone
+ *
+ * Every receipt ConfigMap carries chant's ownership marker labels plus
+ * {@link RECEIPT_LABEL_KEY}. The marker is what makes `chant kube get` and the
+ * observation classify it as chant's rather than foreign. The receipt label is
+ * what keeps `delete: "owned-only"` from pruning it: the receipt is owned and
+ * is never in any apply set (the effect step is its sole writer), which is the
+ * exact shape the owned-only sweep deletes. `pruneOrphans`
+ * (./op/activities/kubectl.ts) reports it `retained` instead, the same
+ * treatment a generated-once Secret gets (./secret-labels.ts) and for the same
+ * reason: destroying it silently converts at-least-once into a re-run nobody
+ * asked for, or worse, into never.
+ *
+ * Plain store (#1833's COR023): a ConfigMap is the plain half of the
+ * ConfigMap/Secret pair, and the entityType alone is what the guard reads. A
+ * receipt value is a witness (an existence marker or a `sha256:` digest),
+ * never a secret; materializing one into a `K8s::Core::Secret` fails COR023.
+ */
+import { type Declarable } from "@intentius/chant/declarable";
+import { EFFECT_RECEIPT_MARKER, type EffectReceiptFlavor, type EffectReceiptOptions } from "@intentius/chant/effect-receipt";
+/** The entityType of the k8s materialization row, the real resource kind the
+ * receipt is stored as, which is what lint's plain-store guard checks. */
+export declare const K8S_EFFECT_RECEIPT_ENTITY_TYPE = "K8s::Core::ConfigMap";
+/** apiVersion/kind of the materialized row, for the client reads and writes. */
+export declare const RECEIPT_CONFIGMAP_REF: {
+    readonly apiVersion: "v1";
+    readonly kind: "ConfigMap";
+};
+/**
+ * The line prefix the serializer renders receipt rows behind, and the
+ * observation leg reads them back from. A YAML comment: an applier's `loadAll`
+ * produces no document for it, so a receipt can never enter an apply set, and
+ * `kubectl apply -f` ignores it exactly as it ignores every other comment.
+ * The remainder of the line is one JSON object keyed by entity name.
+ */
+export declare const EFFECT_RECEIPTS_COMMENT_MARKER = "# chant:effect-receipts ";
+/** First segment of every receipt ConfigMap name. */
+export declare const RECEIPT_NAME_PREFIX = "chant-receipt";
+/** The `data` key the expectation is stored under. One key, the same single
+ * value the aws row puts in the SSM parameter's `Value`. */
+export declare const RECEIPT_DATA_KEY = "expectation";
+/** The label a live receipt ConfigMap carries, valued with the effect it
+ * witnesses. Recognition for the observation leg and, more importantly, the
+ * exclusion the owned-only prune keys on. */
+export declare const RECEIPT_LABEL_KEY = "chant.intentius.io/effect-receipt";
+/** Where receipts live when the project names no namespace. */
+export declare const RECEIPT_DEFAULT_NAMESPACE = "default";
+/**
+ * The rendered value of a hash-flavor receipt that still carries reference
+ * inputs at synthesis. References resolve at plan and at run, never at
+ * synthesis (epic decision 5), so the row carries this note instead of a
+ * digest hashed over placeholders.
+ */
+export declare const RECEIPT_UNRESOLVED_VALUE_NOTE = "unresolved at synthesis, reference inputs; the expectation resolves at plan and at run (chant #1703, decision 5)";
+/**
+ * The ConfigMap name of one effect's receipt:
+ * `chant-receipt.<stack>.<env>.<effect>`, from the resolved ownership marker
+ * fields (epic decision 4). The single source of the name identity: the
+ * serializer's rendered row, the receipt store's reads and writes, and the
+ * observation leg all call this.
+ */
+export declare function receiptConfigMapName(stack: string, env: string, effect: string): string;
+/** The project's receipt namespace: `k8s.receipts.namespace`, else `default`.
+ * The serializer reads it off `SerializeContext.config` and the store reads it
+ * off the project config, so both derive one namespace from one setting. */
+export declare function receiptNamespaceFrom(config: Record<string, unknown> | undefined): string;
+/** Name and namespace of one effect's receipt ConfigMap. */
+export interface ReceiptConfigMapRef {
+    name: string;
+    namespace: string;
+}
+/** The full address of one effect's receipt ConfigMap. */
+export declare function receiptConfigMapRef(stack: string, env: string, effect: string, namespace?: string): ReceiptConfigMapRef;
+/** True when a live object's labels mark it a chant effect receipt. Any
+ * non-empty value counts: the label's presence is the claim, and a sweep must
+ * err on the side of keeping. */
+export declare function isEffectReceiptObject(labels: Record<string, unknown> | undefined): boolean;
+/** One rendered receipt row, as the comment block carries it. */
+export interface RenderedReceiptRow {
+    kind: typeof RECEIPT_CONFIGMAP_REF.kind;
+    namespace: string;
+    name: string;
+    data: Record<string, string>;
+}
+/**
+ * Render the receipt block the serializer appends to the manifest stream.
+ * Deterministic: one line, entity names sorted.
+ */
+export declare function renderReceiptComment(rows: Record<string, RenderedReceiptRow>): string;
+/**
+ * Read the receipt rows back out of a build output. Returns an empty record
+ * for an output that carries no block, which is every project that declares no
+ * receipt. Never throws: an unparseable block is no block, and the observation
+ * leg reports the receipts it could not address as absent rather than
+ * inventing one.
+ */
+export declare function parseReceiptComment(buildOutput: string): Record<string, RenderedReceiptRow>;
+/**
+ * A k8s-materialized effect receipt: core's declaration shape (so
+ * `isEffectReceipt`, `effect(...)`, lint, and the plan engine all recognize it
+ * through the marker), under the k8s lexicon and the real resource kind.
+ */
+export interface K8sEffectReceiptDeclaration extends Declarable {
+    readonly [EFFECT_RECEIPT_MARKER]: true;
+    readonly lexicon: "k8s";
+    readonly entityType: typeof K8S_EFFECT_RECEIPT_ENTITY_TYPE;
+    /** The receipt's own name (the export-level identity of the witness). */
+    readonly name: string;
+    /** The effect this receipt witnesses, the name's final segment. */
+    readonly effect: string;
+    /** How the receipt is compared: mere presence, or a digest of the inputs. */
+    readonly flavor: EffectReceiptFlavor;
+    /** The effect's inputs as recorded at synthesis (references as placeholders). */
+    readonly inputs: Readonly<Record<string, unknown>>;
+}
+/**
+ * Declare a k8s-materialized effect receipt. Same signature and semantics as
+ * core's `EffectReceipt` (#1831), whose factory validates and freezes the
+ * options, but the declaration lands in the k8s partition, so the k8s
+ * serializer renders the ConfigMap row and the receipt store
+ * (./receipt-store.ts) is its writer. Pass the returned const straight to the
+ * `effect(...)` op step.
+ */
+export declare function EffectReceipt(name: string, options: EffectReceiptOptions): K8sEffectReceiptDeclaration;
+//# sourceMappingURL=effect-receipt-row.d.ts.map

package/dist/effect-receipt-row.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effect-receipt-row.d.ts","sourceRoot":"","sources":["../src/effect-receipt-row.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAEL,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC;0EAC0E;AAC1E,eAAO,MAAM,8BAA8B,yBAAyB,CAAC;AAErE,gFAAgF;AAChF,eAAO,MAAM,qBAAqB;;;CAAmD,CAAC;AAEtF;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,6BAA6B,CAAC;AAEzE,qDAAqD;AACrD,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD;4DAC4D;AAC5D,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C;;6CAE6C;AAC7C,eAAO,MAAM,iBAAiB,sCAAsC,CAAC;AAErE,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,qHAC0E,CAAC;AAqBrH;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASvF;AAED;;4EAE4E;AAC5E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAIxF;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAkC,GAC5C,mBAAmB,CAErB;AAED;;iCAEiC;AACjC,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CAG1F;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,MAAM,CAIrF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAY3F;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA4B,SAAQ,UAAU;IAC7D,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,OAAO,8BAA8B,CAAC;IAC3D,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,2BAA2B,CAyBtG"}

package/dist/export-resources.d.ts

@@ -25,7 +25,7 @@ import { DEFAULT_IMPORT_TYPES } from "./api/sweep-types.js";
  * reachable by naming it with `--selector type=...`. Defined in
  * `./api/sweep-types.ts` and re-exported here, its original home — chant
  * #1075's ownership-scoped prune needs the same list without pulling the
- * import parser into a Temporal worker.
+ * import parser in behind the apply activity.
  */
 export { DEFAULT_IMPORT_TYPES };
 export declare function exportResources(options: {

package/dist/index.d.ts

@@ -6,6 +6,8 @@ export { kustomizeApplyCapability, createKustomizeApplyCapability, type Kustomiz
 export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels.js";
 export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels.js";
 export { K8sLabels, K8sAnnotations } from "./variables.js";
+export { EffectReceipt, receiptConfigMapName, receiptConfigMapRef, receiptNamespaceFrom, isEffectReceiptObject, K8S_EFFECT_RECEIPT_ENTITY_TYPE, EFFECT_RECEIPTS_COMMENT_MARKER, RECEIPT_NAME_PREFIX, RECEIPT_DATA_KEY, RECEIPT_LABEL_KEY, RECEIPT_DEFAULT_NAMESPACE, RECEIPT_UNRESOLVED_VALUE_NOTE, parseReceiptComment, renderReceiptComment, } from "./effect-receipt-row.js";
+export type { K8sEffectReceiptDeclaration, ReceiptConfigMapRef, RenderedReceiptRow } from "./effect-receipt-row.js";
 export { GENERATED_ONCE_LABEL_KEY, GENERATED_ONCE_LABEL_VALUE, isGeneratedOnce } from "./secret-labels.js";
 export { microTime, isMicroTimeFormatted } from "./micro-time.js";
 export { k8sManifest } from "./manifest-entity.js";