@intentius/chant-lexicon-k8s 0.66.0 → 0.67.0

package/dist/behaviour-kinds.d.ts

@@ -0,0 +1,17 @@
+/**
+ * What this lexicon's entity types are worth to a behaviour engine (#2382).
+ *
+ * Contributed as rows through the plugin's `behaviourKinds` field; the
+ * vocabulary, the resolution and the prediction are
+ * `packages/core/src/behaviour-kinds.ts`. These rows were a section of one
+ * cross-lexicon table in one lexicon until #2382 moved each substrate's
+ * rows to the lexicon that owns the types — this file can say what
+ * `K8s::Apps::Deployment` means because it is the file that defines it.
+ *
+ * A table rather than a heuristic over type names: a heuristic would map
+ * `K8s::Rbac::RoleBinding` to storage and price a join table.
+ */
+import type { BehaviourKinds } from "@intentius/chant/behaviour-kinds";
+/** This lexicon's answer for its own types. */
+export declare const k8sBehaviourKinds: BehaviourKinds;
+//# sourceMappingURL=behaviour-kinds.d.ts.map

package/dist/behaviour-kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"behaviour-kinds.d.ts","sourceRoot":"","sources":["../src/behaviour-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAmEvE,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,EAAE,cAK/B,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "8e1c655cc0e915dc9e60dad3cc82afde1fcfadd3440e79fb41b0ce2b51ed0f49",
+    "manifest.json": "3e4ee481a4be4a337c58ca4a06ba98b3ed4ee9f12aa81c957180ec72e57cec15",
     "meta.json": "8b999bc142f448b0b627ecdc9e2388bbe672c8a1f7aae5303135624cf2fe65e3",
     "types/index.d.ts": "5f67de738adb455805e72600948940af9c664283785fb68c9fd8f5ea90d42cc3",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -65,5 +65,5 @@
     "skills/chant-k8s-argo.md": "24c9a85b78a2fc5c6657424baac9cc6d6caff6f47605b8146b2c0082133181cf",
     "skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
   },
-  "composite": "30dec82ae0a163081c8468b9fe1d1917ff1d619e04aba3e55fab727106e09d32"
+  "composite": "b9cd56cc20464e4184740cb345c6fc86bcdd80cf46a1bba487a8d0cf75e37746"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.66.0",
+  "version": "0.67.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA6BjG,eAAO,MAAM,SAAS,EAAE,aA6tBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA8BjG,eAAO,MAAM,SAAS,EAAE,aA8tBvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.66.0",
+  "version": "0.67.0",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,7 +76,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "optionalDependencies": {
-    "@intentius/chant-k8s-client": "^0.66.0"
+    "@intentius/chant-k8s-client": "^0.67.0"
   },
   "devDependencies": {
     "@intentius/chant": "*",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.66.0",
+    "@intentius/chant": "^0.67.0",
     "typescript": "^5.9.3"
   }
 }

package/src/behaviour-kinds.ts

@@ -0,0 +1,88 @@
+/**
+ * What this lexicon's entity types are worth to a behaviour engine (#2382).
+ *
+ * Contributed as rows through the plugin's `behaviourKinds` field; the
+ * vocabulary, the resolution and the prediction are
+ * `packages/core/src/behaviour-kinds.ts`. These rows were a section of one
+ * cross-lexicon table in one lexicon until #2382 moved each substrate's
+ * rows to the lexicon that owns the types — this file can say what
+ * `K8s::Apps::Deployment` means because it is the file that defines it.
+ *
+ * A table rather than a heuristic over type names: a heuristic would map
+ * `K8s::Rbac::RoleBinding` to storage and price a join table.
+ */
+
+import type { BehaviourKinds } from "@intentius/chant/behaviour-kinds";
+
+/** Types an engine prices, with the declared property its size is read from. */
+const MAPPED: BehaviourKinds["mapped"] = {
+
+  // No `sizeProp` on the five workload kinds. A workload's size is its pod
+  // template's container resource requests — an object, per container, over an
+  // array — and this contract's `size` is one string in the provider's own
+  // vocabulary. Kubernetes has no such string for a workload. Naming
+  // `spec.template.spec.containers` here, as the first version did, advertised
+  // a column that resolved to an array and therefore to nothing, on every
+  // Kubernetes workload in the repository.
+  "K8s::Apps::Deployment": { kind: "compute" },
+  "K8s::Apps::StatefulSet": { kind: "compute" },
+  "K8s::Apps::DaemonSet": { kind: "compute" },
+  "K8s::Core::Pod": { kind: "compute" },
+  "K8s::Batch::Job": { kind: "serverless" },
+  "K8s::Batch::CronJob": { kind: "serverless" },
+  // These two do state a size, as a single string in Kubernetes' own
+  // vocabulary: a quantity (`20Gi`) and a service type (`LoadBalancer`).
+  "K8s::Core::PersistentVolumeClaim": { kind: "block-store", sizeProp: "spec.resources.requests.storage", sizeType: "string" },
+  "K8s::Core::Service": { kind: "load-balancer", sizeProp: "spec.type", sizeType: "string" },
+  "K8s::Networking::Ingress": { kind: "load-balancer" },
+};
+
+/**
+ * Types considered and declared unsendable, each with the reason it carries no
+ * rate. The fifth family core's contributor guidance names is this lexicon's
+ * own: a controller's request is not the thing it creates. A `Certificate`
+ * costs nothing; the issuer's work and the Secret it writes are elsewhere in
+ * the graph or outside the cluster entirely.
+ */
+const UNMAPPED: BehaviourKinds["unmapped"] = {
+  "K8s::Rbac::Role": "an RBAC role is a grant; the workloads it admits are what cost and saturate",
+  "K8s::Rbac::RoleBinding": "an RBAC binding is a grant; the workloads it admits are what cost and saturate",
+  "K8s::Rbac::ClusterRole": "the cluster-scoped twin of an RBAC role, and a grant for the same reason",
+  "K8s::Rbac::ClusterRoleBinding": "the cluster-scoped twin of an RBAC binding, and a grant for the same reason",
+  "K8s::Core::ServiceAccount": "an identity, not a workload",
+  "K8s::Core::Namespace": "a boundary the workloads sit inside, and the workloads carry the figures",
+  "K8s::Networking::IngressClass": "names which controller handles an Ingress; the controller and the load balancer it creates carry the figures",
+  "K8s::Networking::NetworkPolicy": "a filter on edges that already exist, not a thing at either end of one",
+  "K8s::Storage::StorageClass": "the kind of disk a claim may ask for; the PersistentVolumeClaim carries the figures",
+  "K8s::Autoscaling::HorizontalPodAutoscaler": "an instruction about how many replicas to run; the workload it scales carries the figures, and a prediction is at one stated traffic level rather than across a scaling range",
+  "K8s::HorizontalPodAutoscaler": "an instruction about how many replicas to run; the workload it scales carries the figures, and a prediction is at one stated traffic level rather than across a scaling range",
+  "K8s::Policy::PodDisruptionBudget": "a constraint on voluntary eviction. It shapes what a lost zone does to a workload and has no rate of its own; expressing that constraint to an engine is a resilience input this contract has no field for",
+  "K8s::Core::LimitRange": "a default and a ceiling for workloads in a namespace; the workloads carry the figures",
+  "K8s::Core::ResourceQuota": "a ceiling on a namespace's total requests; the workloads under it carry the figures",
+  // ── A controller's request is not the thing it creates ───────────
+  "K8s::Argo::Application": "a request to Argo CD to reconcile a source; whatever it creates is priced where that lands",
+  "K8s::Flux::GitRepository": "a source Flux polls; the workloads it reconciles carry the figures",
+  "K8s::Flux::Kustomization": "a request to Flux to apply a source; whatever it creates is priced where that lands",
+  "K8s::CertManager::Certificate": "a request to an issuer. The certificate costs nothing; the issuer's work and the Secret it writes are elsewhere",
+  "K8s::CertManager::ClusterIssuer": "the issuer a certificate request names; it holds no capacity and serves no traffic",
+  "K8s::ExternalSecrets::ExternalSecret": "a request to copy a value from an external store into a Secret; neither end is a rate",
+  "K8s::ExternalSecrets::ClusterSecretStore": "names where secrets are fetched from; it holds no capacity and serves no traffic",
+  "K8s::Monitoring::ServiceMonitor": "tells Prometheus what to scrape; Prometheus is a workload elsewhere in the graph and carries the figures",
+  "K8s::Monitoring::PrometheusRule": "alerting and recording rules evaluated by Prometheus, which carries the figures",
+  "K8s::Traefik::IngressRoute": "routing handled by the Traefik workload, which carries the figures",
+  "K8s::Calico::FelixConfiguration": "tuning for the CNI agent on every node; the nodes carry the figures",
+  "K8s::GKE::BackendConfig": "tuning for a Google load balancer an Ingress creates; the gcp substrate is not modelled here, so neither end is priced here",
+  "K8s::NetworkingGKE::ManagedCertificate": "a certificate Google issues for an Ingress; the gcp substrate is not modelled here",
+  "K8s::NetworkingGKEBeta::FrontendConfig": "tuning for a Google load balancer an Ingress creates; the gcp substrate is not modelled here",
+  // ── Configuration and secrets: real, declared, carrying no rate ──
+  "K8s::Core::ConfigMap": "configuration the workloads read; it has no rate and no saturation axis of its own",
+  "K8s::Core::Secret": "configuration the workloads read; it has no rate and no saturation axis of its own",
+};
+
+/** This lexicon's answer for its own types. */
+export const k8sBehaviourKinds: BehaviourKinds = {
+  provider: "kubernetes",
+  prefixes: ["K8s::"],
+  mapped: MAPPED,
+  unmapped: UNMAPPED,
+};

package/src/plugin.ts

@@ -6,6 +6,7 @@
  */
 
 import type { LexiconPlugin, InitTemplateSet, ResourceMetadata } from "@intentius/chant/lexicon";
+import { k8sBehaviourKinds } from "./behaviour-kinds";
 import type { CommandGroup } from "@intentius/chant/cli/command-group";
 import { kubeCommandGroup } from "./kube/group";
 import { detectTemplate } from "./detect";
@@ -35,6 +36,7 @@ import { encryptedSecretBuildRoot } from "./sops/encrypted-secret-file";
 import type { Declarable } from "@intentius/chant/declarable";
 
 export const k8sPlugin: LexiconPlugin = {
+  behaviourKinds: k8sBehaviourKinds,
   name: "k8s",
   ownershipChannel: { keys: LABEL_OWNERSHIP_KEYS, reads: ["describeResources", "observeResourcesDeep", "exportResources"] },
   configSchema: k8sConfigSchema,