@intentius/chant-lexicon-k8s 0.58.0 → 0.60.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api/fake-cluster.d.ts +7 -6
- package/dist/api/fake-cluster.d.ts.map +1 -1
- package/dist/codegen/docs.d.ts.map +1 -1
- package/dist/composites/cron-schedule.d.ts +26 -0
- package/dist/composites/cron-schedule.d.ts.map +1 -0
- package/dist/composites/cron-workload.d.ts +1 -1
- package/dist/composites/cron-workload.d.ts.map +1 -1
- package/dist/composites/operator-stack.d.ts +1 -1
- package/dist/composites/operator-stack.d.ts.map +1 -1
- package/dist/config-schema.d.ts +3 -0
- package/dist/config-schema.d.ts.map +1 -1
- package/dist/config.d.ts +22 -0
- package/dist/config.d.ts.map +1 -1
- package/dist/deep-observe.d.ts.map +1 -1
- package/dist/describe-resources.d.ts.map +1 -1
- package/dist/effect-receipt-row.d.ts +164 -0
- package/dist/effect-receipt-row.d.ts.map +1 -0
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/integrity.json +3 -3
- package/dist/lint/post-synth/wk8505.d.ts +3 -1
- package/dist/lint/post-synth/wk8505.d.ts.map +1 -1
- package/dist/manifest.json +1 -1
- package/dist/okf/index.md +1 -1
- package/dist/okf/rules/WK8505.md +2 -2
- package/dist/okf/types/Kustomization.md +1 -1
- package/dist/op/activities/index.d.ts +6 -0
- package/dist/op/activities/index.d.ts.map +1 -1
- package/dist/op/activities/kubectl.d.ts.map +1 -1
- package/dist/plugin.d.ts.map +1 -1
- package/dist/receipt-store.d.ts +113 -0
- package/dist/receipt-store.d.ts.map +1 -0
- package/dist/rules/wk8505.ts +4 -2
- package/dist/serializer.d.ts.map +1 -1
- package/dist/subscribe-changes.d.ts +84 -0
- package/dist/subscribe-changes.d.ts.map +1 -0
- package/package.json +3 -3
- package/src/api/fake-cluster.ts +17 -4
- package/src/codegen/docs.ts +7 -0
- package/src/composites/composites.test.ts +59 -1
- package/src/composites/cron-schedule.ts +47 -0
- package/src/composites/cron-workload.ts +4 -1
- package/src/composites/operator-stack.ts +3 -4
- package/src/config-schema.ts +5 -0
- package/src/config.ts +23 -0
- package/src/deep-observe.ts +26 -7
- package/src/describe-resources.ts +31 -7
- package/src/effect-receipt-row.test.ts +285 -0
- package/src/effect-receipt-row.ts +268 -0
- package/src/index.ts +22 -0
- package/src/lint/audit-catalog.ts +1 -1
- package/src/lint/post-synth/wk8505.ts +4 -2
- package/src/op/activities/index.ts +14 -0
- package/src/op/activities/kubectl.test.ts +38 -0
- package/src/op/activities/kubectl.ts +15 -0
- package/src/plugin.ts +15 -0
- package/src/receipt-store.test.ts +380 -0
- package/src/receipt-store.ts +290 -0
- package/src/serializer.ts +92 -1
- package/src/subscribe-changes.test.ts +368 -0
- package/src/subscribe-changes.ts +210 -0
|
@@ -13,7 +13,7 @@
|
|
|
13
13
|
* all need the same thing.
|
|
14
14
|
*/
|
|
15
15
|
import type { K8sObject } from "@intentius/chant-k8s-client";
|
|
16
|
-
import type { FakeRequestLayer, RecordedRequest } from "@intentius/chant-k8s-client/testing";
|
|
16
|
+
import type { FakeRequestLayer, FakeResponse, RecordedRequest } from "@intentius/chant-k8s-client/testing";
|
|
17
17
|
import type { ConnectOptions, K8sConnector } from "./connect.js";
|
|
18
18
|
export interface FakeClusterOptions {
|
|
19
19
|
/**
|
|
@@ -28,11 +28,12 @@ export interface FakeClusterOptions {
|
|
|
28
28
|
* CRD resolvable in a test without registering anything.
|
|
29
29
|
*/
|
|
30
30
|
serves?: readonly string[];
|
|
31
|
-
/**
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
31
|
+
/**
|
|
32
|
+
* Full control: return a response for a request, or undefined to fall
|
|
33
|
+
* through. A `stream` on the response is what a watch reads (chant #1981);
|
|
34
|
+
* see `fakeWatchStream` in the client's testing harness.
|
|
35
|
+
*/
|
|
36
|
+
respond?: (request: RecordedRequest) => FakeResponse | undefined;
|
|
36
37
|
/** Kubeconfig to hand the client. Defaults to a single-context one. */
|
|
37
38
|
kubeconfig?: string;
|
|
38
39
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fake-cluster.d.ts","sourceRoot":"","sources":["../../src/api/fake-cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;
|
|
1
|
+
{"version":3,"file":"fake-cluster.d.ts","sourceRoot":"","sources":["../../src/api/fake-cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAE3G,OAAO,KAAK,EAAmB,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG/E,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,YAAY,GAAG,SAAS,CAAC;IACjE,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,YAAY,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpG;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,GAAE,OAAO,CAAC,SAAS,CAAM,GAC7B,SAAS,CAcX;AAwBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CAwGzE"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;
|
|
1
|
+
{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4HH;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB9E"}
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Shared CronJob schedule validation (issue #2071 item 4).
|
|
3
|
+
*
|
|
4
|
+
* `OperatorStack` and `CronWorkload` both hand their `schedule` field
|
|
5
|
+
* straight to a k8s `CronJob`, which parses only five fields (minute hour
|
|
6
|
+
* day-of-month month day-of-week). Core's own cron parser
|
|
7
|
+
* (`isValidCronExpression`, `packages/core/src/op/cron.ts`, #2120) is
|
|
8
|
+
* deliberately more permissive: it also accepts the 6-field Quartz form
|
|
9
|
+
* (`second minute hour dom month dow`) that a `ConvergeOp`'s own `schedule`
|
|
10
|
+
* may legitimately carry, since the final word on cron syntax belongs to
|
|
11
|
+
* whichever scheduler runs the string. A k8s CronJob is that scheduler here,
|
|
12
|
+
* and it is stricter than core's parser, so a 6-field `ConvergeOp` schedule
|
|
13
|
+
* reused as-is on a CronJob fails at `kubectl apply`, not at build time.
|
|
14
|
+
*
|
|
15
|
+
* This module gives both composites one place to catch that at construction,
|
|
16
|
+
* reusing core's parser rather than a second copy of it.
|
|
17
|
+
*/
|
|
18
|
+
/**
|
|
19
|
+
* Validate `schedule` for a k8s CronJob, throwing before a bad value ever
|
|
20
|
+
* reaches `kubectl apply`. `context` names the composite (and host, for
|
|
21
|
+
* `OperatorStack`) so the thrown message reads like the rest of that
|
|
22
|
+
* composite's build-time refusals, e.g. `OperatorStack "chant-operator",
|
|
23
|
+
* host "fountain-observe"` or `CronWorkload "backup"`.
|
|
24
|
+
*/
|
|
25
|
+
export declare function validateCronJobSchedule(context: string, schedule: string): void;
|
|
26
|
+
//# sourceMappingURL=cron-schedule.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cron-schedule.d.ts","sourceRoot":"","sources":["../../src/composites/cron-schedule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAmB/E"}
|
|
@@ -11,7 +11,7 @@ export interface CronWorkloadProps {
|
|
|
11
11
|
name: string;
|
|
12
12
|
/** Container image. */
|
|
13
13
|
image: string;
|
|
14
|
-
/** Cron schedule expression (e.g., "0 * * * *"). */
|
|
14
|
+
/** Cron schedule expression (e.g., "0 * * * *"). Validated at construction: a k8s CronJob takes five fields only, so a 6-field (seconds) form is refused (`./cron-schedule.ts`, #2071). */
|
|
15
15
|
schedule: string;
|
|
16
16
|
/** Command to run in the container. */
|
|
17
17
|
command?: string[];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cron-workload.d.ts","sourceRoot":"","sources":["../../src/composites/cron-workload.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"cron-workload.d.ts","sourceRoot":"","sources":["../../src/composites/cron-workload.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAGnE,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,2LAA2L;IAC3L,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,0BAA0B;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,mEAAmE;IACnE,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAChD,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;CAC/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY;;;;;EAuGP,CAAC"}
|
|
@@ -88,7 +88,7 @@ export interface OperatorRbacResourceRule {
|
|
|
88
88
|
export interface OperatorStackConvergeHost {
|
|
89
89
|
/** ConvergeOp's own name (`ConvergeOpConfig.name`) — the CronJob, ServiceAccount, Role, and RoleBinding name stem for this host. */
|
|
90
90
|
name: string;
|
|
91
|
-
/** Cron expression driving the tick — the same string passed to `ConvergeOp`'s own `schedule`. */
|
|
91
|
+
/** Cron expression driving the tick — the same string passed to `ConvergeOp`'s own `schedule`. Validated at construction: a 6-field (seconds) form, which `ConvergeOp` accepts, is refused here since a k8s CronJob takes five fields only (`./cron-schedule.ts`, #2071). */
|
|
92
92
|
schedule: string;
|
|
93
93
|
/** Environment this ConvergeOp converges (`ConvergeOpConfig.env`) — carried onto the container as `CHANT_CONVERGE_ENV`, for log/estate readability only (`chant run <name>` needs no `--env`: the target op already carries it). */
|
|
94
94
|
env: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"operator-stack.d.ts","sourceRoot":"","sources":["../../src/composites/operator-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"operator-stack.d.ts","sourceRoot":"","sources":["../../src/composites/operator-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKrF;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,uOAAuO;AACvO,MAAM,WAAW,wBAAwB;IACvC,kCAAkC;IAClC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oIAAoI;IACpI,IAAI,EAAE,MAAM,CAAC;IACb,6QAA6Q;IAC7Q,QAAQ,EAAE,MAAM,CAAC;IACjB,oOAAoO;IACpO,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC;IAC3D,2LAA2L;IAC3L,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACvC,2JAA2J;IAC3J,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,iIAAiI;IACjI,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IACtC,2HAA2H;IAC3H,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC9C,iBAAiB;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,iBAAiB;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC5C,CAAC;CACH;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;IAC1C,CAAC,MAAM,EAAE,MAAM,GACX,YAAY,CAAC,OAAO,SAAS,CAAC,GAC9B,YAAY,CAAC,OAAO,cAAc,CAAC,GACnC,YAAY,CAAC,OAAO,IAAI,CAAC,GACzB,YAAY,CAAC,OAAO,WAAW,CAAC,GAChC,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;CAClC;AAID,+MAA+M;AAC/M,eAAO,MAAM,sBAAsB,EAAE,wBAAwB,EAI5D,CAAC;AAwBF;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,GAAG,WAAW,CAehJ;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,0FA2IP,CAAC"}
|
package/dist/config-schema.d.ts
CHANGED
|
@@ -25,6 +25,9 @@ export declare const k8sConfigSchema: z.ZodObject<{
|
|
|
25
25
|
kustomize: z.ZodOptional<z.ZodObject<{
|
|
26
26
|
roots: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
27
27
|
}, z.core.$strict>>;
|
|
28
|
+
receipts: z.ZodOptional<z.ZodObject<{
|
|
29
|
+
namespace: z.ZodOptional<z.ZodString>;
|
|
30
|
+
}, z.core.$strict>>;
|
|
28
31
|
}, z.core.$strict>;
|
|
29
32
|
declare module "@intentius/chant/config" {
|
|
30
33
|
interface ChantConfig {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-schema.d.ts","sourceRoot":"","sources":["../src/config-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,eAAO,MAAM,uBAAuB;;kBAElC,CAAC;AAEH,eAAO,MAAM,eAAe
|
|
1
|
+
{"version":3,"file":"config-schema.d.ts","sourceRoot":"","sources":["../src/config-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,eAAO,MAAM,uBAAuB;;kBAElC,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;kBAa1B,CAAC;AAEH,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,GAAG,CAAC,EAAE,cAAc,CAAC;KACtB;CACF;AAED,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAEjE;;;GAGG;AACH,KAAK,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,SAAS,cAAc,GAChF,cAAc,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,GACpD,IAAI,GACJ,KAAK,GACP,KAAK,CAAC;AACV,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC"}
|
package/dist/config.d.ts
CHANGED
|
@@ -107,6 +107,28 @@ export interface K8sChantConfig {
|
|
|
107
107
|
/** Kustomization directories to render into the build. */
|
|
108
108
|
roots?: string[];
|
|
109
109
|
};
|
|
110
|
+
/**
|
|
111
|
+
* Effect receipt settings (#2074, epic #1703).
|
|
112
|
+
*
|
|
113
|
+
* `namespace` is where this project's receipt ConfigMaps live. The name is
|
|
114
|
+
* derived from the ownership fields (`chant-receipt.<stack>.<env>.<effect>`,
|
|
115
|
+
* see `./effect-receipt-row.ts`); the namespace is the one part of the
|
|
116
|
+
* address the ownership block cannot answer, so it is declared here. Unset,
|
|
117
|
+
* receipts land in `default`, the same namespace every other namespace-less
|
|
118
|
+
* k8s read and write in this lexicon falls through to. It is never derived
|
|
119
|
+
* from the stack or the environment: a guessed namespace is one chant would
|
|
120
|
+
* have to create, and the receipt row creates nothing but the receipt.
|
|
121
|
+
*
|
|
122
|
+
* ```ts
|
|
123
|
+
* k8s: {
|
|
124
|
+
* receipts: { namespace: "chant-system" },
|
|
125
|
+
* } satisfies K8sChantConfig
|
|
126
|
+
* ```
|
|
127
|
+
*/
|
|
128
|
+
receipts?: {
|
|
129
|
+
/** Namespace the receipt ConfigMaps live in. Defaults to `default`. */
|
|
130
|
+
namespace?: string;
|
|
131
|
+
};
|
|
110
132
|
}
|
|
111
133
|
declare module "@intentius/chant/config" {
|
|
112
134
|
interface ChantConfig {
|
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,CAAC,EAAE;QACV,0DAA0D;QAC1D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAED,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,GAAG,CAAC,EAAE,cAAc,CAAC;KACtB;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,CAAC,EAAE;QACV,0DAA0D;QAC1D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,EAAE;QACT,uEAAuE;QACvE,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,GAAG,CAAC,EAAE,cAAc,CAAC;KACtB;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACzF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACzF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAUjE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAQD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAkIhC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAwD,MAAM,0BAA0B,CAAC;AAGxH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAwD,MAAM,0BAA0B,CAAC;AAGxH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAoBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA2CvD;AA4FD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAuBtE;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzC,GAAG,EAAE,SAAS,GACb,MAAM,GAAG,SAAS,CAIpB;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CA0L5B"}
|
|
@@ -0,0 +1,164 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The k8s effect-receipt materialization row (#2074, epic #1703): an effect
|
|
3
|
+
* receipt stored as a core `ConfigMap`, named
|
|
4
|
+
* `chant-receipt.<stack>.<env>.<effect>`, holding the expectation under
|
|
5
|
+
* `data.expectation`.
|
|
6
|
+
*
|
|
7
|
+
* Core's `EffectReceipt` factory (#1831) declares a receipt under the `chant`
|
|
8
|
+
* pseudo-lexicon, which no serializer claims. This module is the k8s
|
|
9
|
+
* materialization, built to the same shape as the aws SSM row (#1835,
|
|
10
|
+
* `lexicons/aws/src/effect-receipt-row.ts`): the {@link EffectReceipt} factory
|
|
11
|
+
* here produces core's declaration under `lexicon: "k8s"`, so the build
|
|
12
|
+
* partitions it to the k8s serializer, #1832's write-exclusion seam withholds
|
|
13
|
+
* it from the apply-bound entity set, and the serializer renders it for
|
|
14
|
+
* visibility through `SerializeContext.receipts` (see ./serializer.ts).
|
|
15
|
+
*
|
|
16
|
+
* Where the aws row parks its rendered rows in the CloudFormation template's
|
|
17
|
+
* `Metadata` (deliberately outside `Resources`, the section an applier writes
|
|
18
|
+
* from), this row parks them in a YAML COMMENT at the end of the manifest
|
|
19
|
+
* stream. Kubernetes YAML has no metadata channel outside the documents
|
|
20
|
+
* themselves, and a document is exactly what an applier applies: `loadAll`
|
|
21
|
+
* yields no object for a comment, so the receipt block is structurally
|
|
22
|
+
* unreachable from `applyManifest` while still riding the one build output the
|
|
23
|
+
* observation leg is handed. See {@link EFFECT_RECEIPTS_COMMENT_MARKER}.
|
|
24
|
+
*
|
|
25
|
+
* ## Name and namespace
|
|
26
|
+
*
|
|
27
|
+
* Path identity (epic decision 4): the ConfigMap name derives from the SAME
|
|
28
|
+
* ownership-block fields that stamp markers, `ownership.stack` and an explicit
|
|
29
|
+
* `ownership.env`, plus the receipt's `effect`. The separator is `.`, which no
|
|
30
|
+
* segment may contain, so `stack=a-b env=c` and `stack=a env=b-c` cannot
|
|
31
|
+
* produce the same name. The result is a valid RFC 1123 DNS subdomain, which
|
|
32
|
+
* is what a ConfigMap name has to be.
|
|
33
|
+
*
|
|
34
|
+
* The namespace is the project's `k8s.receipts.namespace`, and `default` when
|
|
35
|
+
* the project sets none, which is where every other namespace-less k8s read
|
|
36
|
+
* and write in this lexicon already lands. It is never invented from the stack
|
|
37
|
+
* or the environment: a namespace chant guessed would be a namespace chant has
|
|
38
|
+
* to create, and the receipt row creates nothing but the receipt.
|
|
39
|
+
*
|
|
40
|
+
* ## Ownership, and why the prune leaves it alone
|
|
41
|
+
*
|
|
42
|
+
* Every receipt ConfigMap carries chant's ownership marker labels plus
|
|
43
|
+
* {@link RECEIPT_LABEL_KEY}. The marker is what makes `chant kube get` and the
|
|
44
|
+
* observation classify it as chant's rather than foreign. The receipt label is
|
|
45
|
+
* what keeps `delete: "owned-only"` from pruning it: the receipt is owned and
|
|
46
|
+
* is never in any apply set (the effect step is its sole writer), which is the
|
|
47
|
+
* exact shape the owned-only sweep deletes. `pruneOrphans`
|
|
48
|
+
* (./op/activities/kubectl.ts) reports it `retained` instead, the same
|
|
49
|
+
* treatment a generated-once Secret gets (./secret-labels.ts) and for the same
|
|
50
|
+
* reason: destroying it silently converts at-least-once into a re-run nobody
|
|
51
|
+
* asked for, or worse, into never.
|
|
52
|
+
*
|
|
53
|
+
* Plain store (#1833's COR023): a ConfigMap is the plain half of the
|
|
54
|
+
* ConfigMap/Secret pair, and the entityType alone is what the guard reads. A
|
|
55
|
+
* receipt value is a witness (an existence marker or a `sha256:` digest),
|
|
56
|
+
* never a secret; materializing one into a `K8s::Core::Secret` fails COR023.
|
|
57
|
+
*/
|
|
58
|
+
import { type Declarable } from "@intentius/chant/declarable";
|
|
59
|
+
import { EFFECT_RECEIPT_MARKER, type EffectReceiptFlavor, type EffectReceiptOptions } from "@intentius/chant/effect-receipt";
|
|
60
|
+
/** The entityType of the k8s materialization row, the real resource kind the
|
|
61
|
+
* receipt is stored as, which is what lint's plain-store guard checks. */
|
|
62
|
+
export declare const K8S_EFFECT_RECEIPT_ENTITY_TYPE = "K8s::Core::ConfigMap";
|
|
63
|
+
/** apiVersion/kind of the materialized row, for the client reads and writes. */
|
|
64
|
+
export declare const RECEIPT_CONFIGMAP_REF: {
|
|
65
|
+
readonly apiVersion: "v1";
|
|
66
|
+
readonly kind: "ConfigMap";
|
|
67
|
+
};
|
|
68
|
+
/**
|
|
69
|
+
* The line prefix the serializer renders receipt rows behind, and the
|
|
70
|
+
* observation leg reads them back from. A YAML comment: an applier's `loadAll`
|
|
71
|
+
* produces no document for it, so a receipt can never enter an apply set, and
|
|
72
|
+
* `kubectl apply -f` ignores it exactly as it ignores every other comment.
|
|
73
|
+
* The remainder of the line is one JSON object keyed by entity name.
|
|
74
|
+
*/
|
|
75
|
+
export declare const EFFECT_RECEIPTS_COMMENT_MARKER = "# chant:effect-receipts ";
|
|
76
|
+
/** First segment of every receipt ConfigMap name. */
|
|
77
|
+
export declare const RECEIPT_NAME_PREFIX = "chant-receipt";
|
|
78
|
+
/** The `data` key the expectation is stored under. One key, the same single
|
|
79
|
+
* value the aws row puts in the SSM parameter's `Value`. */
|
|
80
|
+
export declare const RECEIPT_DATA_KEY = "expectation";
|
|
81
|
+
/** The label a live receipt ConfigMap carries, valued with the effect it
|
|
82
|
+
* witnesses. Recognition for the observation leg and, more importantly, the
|
|
83
|
+
* exclusion the owned-only prune keys on. */
|
|
84
|
+
export declare const RECEIPT_LABEL_KEY = "chant.intentius.io/effect-receipt";
|
|
85
|
+
/** Where receipts live when the project names no namespace. */
|
|
86
|
+
export declare const RECEIPT_DEFAULT_NAMESPACE = "default";
|
|
87
|
+
/**
|
|
88
|
+
* The rendered value of a hash-flavor receipt that still carries reference
|
|
89
|
+
* inputs at synthesis. References resolve at plan and at run, never at
|
|
90
|
+
* synthesis (epic decision 5), so the row carries this note instead of a
|
|
91
|
+
* digest hashed over placeholders.
|
|
92
|
+
*/
|
|
93
|
+
export declare const RECEIPT_UNRESOLVED_VALUE_NOTE = "unresolved at synthesis, reference inputs; the expectation resolves at plan and at run (chant #1703, decision 5)";
|
|
94
|
+
/**
|
|
95
|
+
* The ConfigMap name of one effect's receipt:
|
|
96
|
+
* `chant-receipt.<stack>.<env>.<effect>`, from the resolved ownership marker
|
|
97
|
+
* fields (epic decision 4). The single source of the name identity: the
|
|
98
|
+
* serializer's rendered row, the receipt store's reads and writes, and the
|
|
99
|
+
* observation leg all call this.
|
|
100
|
+
*/
|
|
101
|
+
export declare function receiptConfigMapName(stack: string, env: string, effect: string): string;
|
|
102
|
+
/** The project's receipt namespace: `k8s.receipts.namespace`, else `default`.
|
|
103
|
+
* The serializer reads it off `SerializeContext.config` and the store reads it
|
|
104
|
+
* off the project config, so both derive one namespace from one setting. */
|
|
105
|
+
export declare function receiptNamespaceFrom(config: Record<string, unknown> | undefined): string;
|
|
106
|
+
/** Name and namespace of one effect's receipt ConfigMap. */
|
|
107
|
+
export interface ReceiptConfigMapRef {
|
|
108
|
+
name: string;
|
|
109
|
+
namespace: string;
|
|
110
|
+
}
|
|
111
|
+
/** The full address of one effect's receipt ConfigMap. */
|
|
112
|
+
export declare function receiptConfigMapRef(stack: string, env: string, effect: string, namespace?: string): ReceiptConfigMapRef;
|
|
113
|
+
/** True when a live object's labels mark it a chant effect receipt. Any
|
|
114
|
+
* non-empty value counts: the label's presence is the claim, and a sweep must
|
|
115
|
+
* err on the side of keeping. */
|
|
116
|
+
export declare function isEffectReceiptObject(labels: Record<string, unknown> | undefined): boolean;
|
|
117
|
+
/** One rendered receipt row, as the comment block carries it. */
|
|
118
|
+
export interface RenderedReceiptRow {
|
|
119
|
+
kind: typeof RECEIPT_CONFIGMAP_REF.kind;
|
|
120
|
+
namespace: string;
|
|
121
|
+
name: string;
|
|
122
|
+
data: Record<string, string>;
|
|
123
|
+
}
|
|
124
|
+
/**
|
|
125
|
+
* Render the receipt block the serializer appends to the manifest stream.
|
|
126
|
+
* Deterministic: one line, entity names sorted.
|
|
127
|
+
*/
|
|
128
|
+
export declare function renderReceiptComment(rows: Record<string, RenderedReceiptRow>): string;
|
|
129
|
+
/**
|
|
130
|
+
* Read the receipt rows back out of a build output. Returns an empty record
|
|
131
|
+
* for an output that carries no block, which is every project that declares no
|
|
132
|
+
* receipt. Never throws: an unparseable block is no block, and the observation
|
|
133
|
+
* leg reports the receipts it could not address as absent rather than
|
|
134
|
+
* inventing one.
|
|
135
|
+
*/
|
|
136
|
+
export declare function parseReceiptComment(buildOutput: string): Record<string, RenderedReceiptRow>;
|
|
137
|
+
/**
|
|
138
|
+
* A k8s-materialized effect receipt: core's declaration shape (so
|
|
139
|
+
* `isEffectReceipt`, `effect(...)`, lint, and the plan engine all recognize it
|
|
140
|
+
* through the marker), under the k8s lexicon and the real resource kind.
|
|
141
|
+
*/
|
|
142
|
+
export interface K8sEffectReceiptDeclaration extends Declarable {
|
|
143
|
+
readonly [EFFECT_RECEIPT_MARKER]: true;
|
|
144
|
+
readonly lexicon: "k8s";
|
|
145
|
+
readonly entityType: typeof K8S_EFFECT_RECEIPT_ENTITY_TYPE;
|
|
146
|
+
/** The receipt's own name (the export-level identity of the witness). */
|
|
147
|
+
readonly name: string;
|
|
148
|
+
/** The effect this receipt witnesses, the name's final segment. */
|
|
149
|
+
readonly effect: string;
|
|
150
|
+
/** How the receipt is compared: mere presence, or a digest of the inputs. */
|
|
151
|
+
readonly flavor: EffectReceiptFlavor;
|
|
152
|
+
/** The effect's inputs as recorded at synthesis (references as placeholders). */
|
|
153
|
+
readonly inputs: Readonly<Record<string, unknown>>;
|
|
154
|
+
}
|
|
155
|
+
/**
|
|
156
|
+
* Declare a k8s-materialized effect receipt. Same signature and semantics as
|
|
157
|
+
* core's `EffectReceipt` (#1831), whose factory validates and freezes the
|
|
158
|
+
* options, but the declaration lands in the k8s partition, so the k8s
|
|
159
|
+
* serializer renders the ConfigMap row and the receipt store
|
|
160
|
+
* (./receipt-store.ts) is its writer. Pass the returned const straight to the
|
|
161
|
+
* `effect(...)` op step.
|
|
162
|
+
*/
|
|
163
|
+
export declare function EffectReceipt(name: string, options: EffectReceiptOptions): K8sEffectReceiptDeclaration;
|
|
164
|
+
//# sourceMappingURL=effect-receipt-row.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"effect-receipt-row.d.ts","sourceRoot":"","sources":["../src/effect-receipt-row.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAEL,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC;0EAC0E;AAC1E,eAAO,MAAM,8BAA8B,yBAAyB,CAAC;AAErE,gFAAgF;AAChF,eAAO,MAAM,qBAAqB;;;CAAmD,CAAC;AAEtF;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,6BAA6B,CAAC;AAEzE,qDAAqD;AACrD,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD;4DAC4D;AAC5D,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C;;6CAE6C;AAC7C,eAAO,MAAM,iBAAiB,sCAAsC,CAAC;AAErE,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,qHAC0E,CAAC;AAqBrH;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASvF;AAED;;4EAE4E;AAC5E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAIxF;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAkC,GAC5C,mBAAmB,CAErB;AAED;;iCAEiC;AACjC,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CAG1F;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,MAAM,CAIrF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAY3F;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA4B,SAAQ,UAAU;IAC7D,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,OAAO,8BAA8B,CAAC;IAC3D,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,2BAA2B,CAyBtG"}
|
package/dist/index.d.ts
CHANGED
|
@@ -6,6 +6,8 @@ export { kustomizeApplyCapability, createKustomizeApplyCapability, type Kustomiz
|
|
|
6
6
|
export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels.js";
|
|
7
7
|
export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels.js";
|
|
8
8
|
export { K8sLabels, K8sAnnotations } from "./variables.js";
|
|
9
|
+
export { EffectReceipt, receiptConfigMapName, receiptConfigMapRef, receiptNamespaceFrom, isEffectReceiptObject, K8S_EFFECT_RECEIPT_ENTITY_TYPE, EFFECT_RECEIPTS_COMMENT_MARKER, RECEIPT_NAME_PREFIX, RECEIPT_DATA_KEY, RECEIPT_LABEL_KEY, RECEIPT_DEFAULT_NAMESPACE, RECEIPT_UNRESOLVED_VALUE_NOTE, parseReceiptComment, renderReceiptComment, } from "./effect-receipt-row.js";
|
|
10
|
+
export type { K8sEffectReceiptDeclaration, ReceiptConfigMapRef, RenderedReceiptRow } from "./effect-receipt-row.js";
|
|
9
11
|
export { GENERATED_ONCE_LABEL_KEY, GENERATED_ONCE_LABEL_VALUE, isGeneratedOnce } from "./secret-labels.js";
|
|
10
12
|
export { microTime, isMicroTimeFormatted } from "./micro-time.js";
|
|
11
13
|
export { k8sManifest } from "./manifest-entity.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAcrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGlI,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAcrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGlI,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAMxD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAIjH,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGxG,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAIhE,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,aAAa,EAAE,UAAU,EACzB,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAC7E,KAAK,EAAE,sBAAsB,EAC7B,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,GAC3D,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,cAAc,EAAE,aAAa,EAC7B,oBAAoB,EAAE,mBAAmB,EACzC,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,EACnD,WAAW,EAAE,UAAU,EAAE,WAAW,EACpC,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,mBAAmB,GAC5G,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}
|
package/dist/integrity.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"algorithm": "sha256",
|
|
3
3
|
"artifacts": {
|
|
4
|
-
"manifest.json": "
|
|
4
|
+
"manifest.json": "e4110c74a85faafddc0d41af9ebaa37ba06f511052a0a9a64254dd4866a4bd50",
|
|
5
5
|
"meta.json": "8b999bc142f448b0b627ecdc9e2388bbe672c8a1f7aae5303135624cf2fe65e3",
|
|
6
6
|
"types/index.d.ts": "5f67de738adb455805e72600948940af9c664283785fb68c9fd8f5ea90d42cc3",
|
|
7
7
|
"rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
|
|
@@ -54,7 +54,7 @@
|
|
|
54
54
|
"rules/wk8502.ts": "c13813543b4ec42b9b87d2ebfe20bae3e6e954a8d7c4e9387581a753484aa778",
|
|
55
55
|
"rules/wk8503.ts": "4ee80ded81a0b2cff24013b300ee3fcadbfd29e20346b964a97e557afa1147f3",
|
|
56
56
|
"rules/wk8504.ts": "b1dd7689e37f788fb4524c42254d5d99048a38203643a405f25383ac21b74e36",
|
|
57
|
-
"rules/wk8505.ts": "
|
|
57
|
+
"rules/wk8505.ts": "b866168e8c8ed55edb5d69666258cdb6c4a2e2db3e41951a59fe54fd7d5bda5b",
|
|
58
58
|
"skills/chant-k8s.md": "222268f9e6b19912ece4b066d8897f009b90a3fe6f14e9c5059d0717e7ee0f82",
|
|
59
59
|
"skills/chant-k8s-patterns.md": "683148e9f0f9da6879bd65d97c82cc29dbff897e31bc11b3c1de654cd6baeea3",
|
|
60
60
|
"skills/chant-k8s-deployment-strategies.md": "c4cc93cba064230567baa755b5a3493dc69bfc6e74a62e1990d12039ffaaf5f8",
|
|
@@ -65,5 +65,5 @@
|
|
|
65
65
|
"skills/chant-k8s-argo.md": "24c9a85b78a2fc5c6657424baac9cc6d6caff6f47605b8146b2c0082133181cf",
|
|
66
66
|
"skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
|
|
67
67
|
},
|
|
68
|
-
"composite": "
|
|
68
|
+
"composite": "6e9a29cfd33d1d85138621c71da31ac1c89a1a1e90d9aaaca1b50e55d9efa5b2"
|
|
69
69
|
}
|
|
@@ -15,7 +15,9 @@
|
|
|
15
15
|
* invocations, so "no Kustomization in THIS build sets spec.decryption" can
|
|
16
16
|
* mean "wired up in the other build" as easily as "forgotten" — the design
|
|
17
17
|
* doc's §4 explains why no path-to-build-target join exists to tell those
|
|
18
|
-
* apart.
|
|
18
|
+
* apart. Single-build-root scoped, tracked by chant #1939 as a candidate for
|
|
19
|
+
* an opt-in project-level mode; promote to error if that join ever becomes
|
|
20
|
+
* available.
|
|
19
21
|
*
|
|
20
22
|
* Fires only on claims that actually resolved (`problems.length === 0`, via
|
|
21
23
|
* `resolveEncryptedSecretClaims`), not on every raw declaration. An
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"wk8505.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8505.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"wk8505.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8505.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAa9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}
|
package/dist/manifest.json
CHANGED
package/dist/okf/index.md
CHANGED
|
@@ -279,4 +279,4 @@ okf_version: '0.2'
|
|
|
279
279
|
* [WK8502](/rules/WK8502.md) - Custom resource spec field has the wrong type or a value outside its enum
|
|
280
280
|
* [WK8503](/rules/WK8503.md) - Workload consumes a Secret nothing in the output produces — produce it (Secret, ExternalSecret, InfisicalSecret, Certificate) or declare its provenance with...
|
|
281
281
|
* [WK8504](/rules/WK8504.md) - committed-encrypted secret declaration does not resolve — the declared file is missing, is not the named Secret, or is not encrypted
|
|
282
|
-
* [WK8505](/rules/WK8505.md) - committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it
|
|
282
|
+
* [WK8505](/rules/WK8505.md) - committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it. Sees one build roo...
|
package/dist/okf/rules/WK8505.md
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
---
|
|
2
2
|
type: post-synth-check
|
|
3
3
|
title: WK8505
|
|
4
|
-
description: 'committed-encrypted secret with no Flux decryption wiring — add decryption: ''sops'' to the FluxAppFor reconciling the path that carries it'
|
|
4
|
+
description: 'committed-encrypted secret with no Flux decryption wiring — add decryption: ''sops'' to the FluxAppFor reconciling the path that carries it. Sees one build root at a time, so it goes silent when that...'
|
|
5
5
|
id: WK8505
|
|
6
6
|
severity: error
|
|
7
7
|
category: post-synth
|
|
8
8
|
lexicon: k8s
|
|
9
9
|
docs: https://intentius.io/chant/lexicons/k8s/rules/
|
|
10
10
|
---
|
|
11
|
-
committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it
|
|
11
|
+
committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it. Sees one build root at a time, so it goes silent when that Kustomization lives in a different build root (chant #1939).
|
|
12
12
|
|
|
13
13
|
## Applies to
|
|
14
14
|
|
|
@@ -18,4 +18,4 @@ resource_type: K8s::Flux::Kustomization
|
|
|
18
18
|
- [FLUX001](/rules/FLUX001.md): GitRepository must pin spec.ref
|
|
19
19
|
- [FLUX002](/rules/FLUX002.md): Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)
|
|
20
20
|
- [FLUX003](/rules/FLUX003.md): Kustomization.spec.dependsOn entries should name Kustomizations declared in the build
|
|
21
|
-
- [WK8505](/rules/WK8505.md): committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it
|
|
21
|
+
- [WK8505](/rules/WK8505.md): committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it. Sees one build root at a time, so it goes silent when that Kustomization lives in a different build root (chant #1939).
|
|
@@ -29,4 +29,10 @@ export { waitForReady, defaultResourceFetcher, apiResourceFetcher, ReadinessFail
|
|
|
29
29
|
export type { WaitForReadyArgs, ResourceFetcher, ReadinessSpec, ReadinessMatch, ConditionMatch, PathMatch, } from "./wait-for-ready.js";
|
|
30
30
|
export { resolveClusterTarget, ClusterBindingMismatchError } from "@intentius/chant/kubectl-context";
|
|
31
31
|
export type { ResolvedClusterTarget, K8sClusterProfile, K8sConfigShape } from "@intentius/chant/kubectl-context";
|
|
32
|
+
export declare const receiptRead: (args: import("@intentius/chant/op/receipt-store").ReceiptReadArgs, signal?: AbortSignal) => Promise<import("@intentius/chant/op/receipt-store").ReceiptReadResult>;
|
|
33
|
+
export declare const receiptWrite: (args: import("@intentius/chant/op/receipt-store").ReceiptWriteArgs, signal?: AbortSignal) => Promise<{
|
|
34
|
+
written: true;
|
|
35
|
+
receipt: string;
|
|
36
|
+
}>;
|
|
37
|
+
export declare const receiptStaleness: (args: import("@intentius/chant/op/receipt-store").ReceiptStalenessArgs, signal?: AbortSignal) => Promise<import("@intentius/chant/op/receipt-store").ReceiptStalenessResult>;
|
|
32
38
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMpG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMpG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAYjH,eAAO,MAAM,WAAW,qKAAqC,CAAC;AAC9D,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,eAAO,MAAM,gBAAgB,+KAA0C,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAWH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAWH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAM3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAqHD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAqD9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}
|
package/dist/plugin.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA6BjG,eAAO,MAAM,SAAS,EAAE,
|
|
1
|
+
{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA6BjG,eAAO,MAAM,SAAS,EAAE,aA6tBvB,CAAC"}
|