@intentius/chant-lexicon-k8s 0.7.0 → 0.8.0

package/dist/lint/post-synth/wk8304.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8304: SSL Redirect Without Certificate
+ *
+ * Flags Ingress resources that have `alb.ingress.kubernetes.io/ssl-redirect`
+ * annotation set but are missing `alb.ingress.kubernetes.io/certificate-arn`
+ * or don't have HTTPS in their listen-ports.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8304: PostSynthCheck;
+//# sourceMappingURL=wk8304.d.ts.map

package/dist/lint/post-synth/wk8304.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8304.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8304.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA0DpB,CAAC"}

package/dist/lint/post-synth/wk8305.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WK8305: Ingress Port Not Matching Service
+ *
+ * Flags Ingress backends whose `service.port.number` does not match
+ * any declared port on the referenced Service in the manifest set.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8305: PostSynthCheck;
+//# sourceMappingURL=wk8305.d.ts.map

package/dist/lint/post-synth/wk8305.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8305.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8305.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,MAAM,EAAE,cAoEpB,CAAC"}

package/dist/lint/post-synth/wk8306.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WK8306: Container Command Starts With Flag
+ *
+ * If `command[0]` starts with `-` or `--`, it's almost certainly a mistake —
+ * the first element should be the binary/entrypoint, flags belong in `args`.
+ * This causes OCI runtime errors because the container runtime tries to
+ * execute the flag as a binary.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8306: PostSynthCheck;
+//# sourceMappingURL=wk8306.d.ts.map

package/dist/lint/post-synth/wk8306.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8306.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8306.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAqCpB,CAAC"}

package/dist/lint/post-synth/wk8401.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WK8401: shmSize exceeds container memory limit
+ *
+ * A RayCluster pod uses an emptyDir volume with medium: Memory for /dev/shm.
+ * Kubernetes counts that memory against the container's memory limit — if the
+ * sizeLimit exceeds the container's memory limit the pod will never schedule
+ * (Kubelet rejects it with "Invalid value … must be less than or equal to memory limit").
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8401: PostSynthCheck;
+//# sourceMappingURL=wk8401.d.ts.map

package/dist/lint/post-synth/wk8401.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8401.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8401.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAqFpB,CAAC"}

package/dist/lint/post-synth/wk8402.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8402: RayCluster missing spec.rayVersion
+ *
+ * KubeRay uses spec.rayVersion to select the Ray autoscaler sidecar image.
+ * Without it, KubeRay defaults to the "latest" tag — autoscaler and Ray head
+ * may run mismatched versions, leading to silent protocol failures.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8402: PostSynthCheck;
+//# sourceMappingURL=wk8402.d.ts.map

package/dist/lint/post-synth/wk8402.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8402.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8402.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA+BpB,CAAC"}

package/dist/lint/post-synth/wk8403.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8403: spec.rayVersion does not match head image tag
+ *
+ * When spec.rayVersion is set but doesn't match the version in the head
+ * container image tag, the KubeRay autoscaler sidecar will run a different
+ * Ray version than the cluster. This can cause gRPC compatibility failures.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8403: PostSynthCheck;
+//# sourceMappingURL=wk8403.d.ts.map

package/dist/lint/post-synth/wk8403.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8403.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8403.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAgDpB,CAAC"}

package/dist/lint/rules/argo-appset-single-project.d.ts

@@ -0,0 +1,18 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+/**
+ * ARGO004: ApplicationSet template must scope to a single AppProject
+ *
+ * An `ApplicationSet` generates many Applications from one template. The
+ * template's `spec.project` should name a single, static `AppProject` so every
+ * generated Application lands in the same security boundary. If `project` is
+ * missing, the generated Applications fall back to whatever default and dodge
+ * project-level RBAC; if it is templated with a generator placeholder
+ * (`{{...}}`) the set sprays Applications across many projects, which defeats
+ * the point of an AppProject as a guardrail.
+ *
+ * Bad:  new ApplicationSet({ spec: { template: { spec: { repoURL: "..." } } } })          // no project
+ * Bad:  new ApplicationSet({ spec: { template: { spec: { project: "{{path.basename}}" } } } }) // templated
+ * Good: new ApplicationSet({ spec: { template: { spec: { project: "team-a" } } } })
+ */
+export declare const argoAppSetSingleProjectRule: LintRule;
+//# sourceMappingURL=argo-appset-single-project.d.ts.map

package/dist/lint/rules/argo-appset-single-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argo-appset-single-project.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/argo-appset-single-project.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF;;;;;;;;;;;;;;GAcG;AAEH,eAAO,MAAM,2BAA2B,EAAE,QA8CzC,CAAC"}

package/dist/lint/rules/argo-ast.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Shared AST helpers for the Argo declarative lint rules (ARGO001, ARGO004).
+ *
+ * The Argo CRDs are constructed like any other k8s resource —
+ * `new Application({ metadata, spec })` / `new ApplicationSet({ ... })`. These
+ * helpers walk the object-literal first argument so a rule can read a nested
+ * property by path without re-implementing the traversal each time.
+ */
+import * as ts from "typescript";
+/**
+ * Find the object-literal first argument of every `new <Kind>(...)` expression
+ * in the file, where Kind is one of the supplied resource kinds.
+ */
+export declare function findResourceLiterals(sourceFile: ts.SourceFile, kinds: Set<string>): Array<{
+    kind: string;
+    literal: ts.ObjectLiteralExpression;
+    node: ts.NewExpression;
+}>;
+/** Read the initializer node for `key` on an object literal, if present. */
+export declare function getProp(obj: ts.ObjectLiteralExpression, key: string): ts.Expression | undefined;
+/** Read a nested object literal by walking `path` (each segment an object). */
+export declare function getNestedObject(obj: ts.ObjectLiteralExpression, path: string[]): ts.ObjectLiteralExpression | undefined;
+/** Read a string-literal property value by path (last segment is the key). */
+export declare function getNestedString(obj: ts.ObjectLiteralExpression, path: string[]): string | undefined;
+/** Read a boolean-literal property value by path (last segment is the key). */
+export declare function getNestedBoolean(obj: ts.ObjectLiteralExpression, path: string[]): boolean | undefined;
+/**
+ * True if the literal carries the given annotation key under
+ * `metadata.annotations`, regardless of value.
+ */
+export declare function hasAnnotation(obj: ts.ObjectLiteralExpression, annotationKey: string): boolean;
+/** Line/column (1-based) for a node, for diagnostics. */
+export declare function lineCol(sourceFile: ts.SourceFile, node: ts.Node): {
+    line: number;
+    column: number;
+};
+//# sourceMappingURL=argo-ast.d.ts.map

package/dist/lint/rules/argo-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argo-ast.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/argo-ast.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GACjB,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,EAAE,CAAC,uBAAuB,CAAC;IAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAA;CAAE,CAAC,CAuBtF;AAED,4EAA4E;AAC5E,wBAAgB,OAAO,CACrB,GAAG,EAAE,EAAE,CAAC,uBAAuB,EAC/B,GAAG,EAAE,MAAM,GACV,EAAE,CAAC,UAAU,GAAG,SAAS,CAW3B;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,GAAG,EAAE,EAAE,CAAC,uBAAuB,EAC/B,IAAI,EAAE,MAAM,EAAE,GACb,EAAE,CAAC,uBAAuB,GAAG,SAAS,CAQxC;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAC7B,GAAG,EAAE,EAAE,CAAC,uBAAuB,EAC/B,IAAI,EAAE,MAAM,EAAE,GACb,MAAM,GAAG,SAAS,CAMpB;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,EAAE,CAAC,uBAAuB,EAC/B,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,GAAG,SAAS,CASrB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,EAAE,CAAC,uBAAuB,EAC/B,aAAa,EAAE,MAAM,GACpB,OAAO,CAIT;AAED,yDAAyD;AACzD,wBAAgB,OAAO,CACrB,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,IAAI,EAAE,EAAE,CAAC,IAAI,GACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAGlC"}

package/dist/lint/rules/argo-automated-prune.d.ts

@@ -0,0 +1,20 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+/**
+ * ARGO001: Production Application must not enable automated prune
+ *
+ * An Argo CD `Application` whose `syncPolicy.automated.prune` is `true` lets the
+ * controller delete live resources that disappear from git. On a production
+ * Application that is a foot-gun — a bad merge can sweep away running
+ * infrastructure. Require `prune: false` for prod Applications unless the author
+ * opts in explicitly with the `argocd.chant.dev/allow-prune` annotation.
+ *
+ * "Production" is inferred from the Application name, its `metadata.namespace`,
+ * or its `spec.destination.namespace` containing `prod`.
+ *
+ * Bad:  new Application({ metadata: { name: "api-prod" }, spec: { syncPolicy: { automated: { prune: true } } } })
+ * Good: new Application({ metadata: { name: "api-prod" }, spec: { syncPolicy: { automated: { prune: false } } } })
+ * Good: new Application({ metadata: { name: "api-prod", annotations: { "argocd.chant.dev/allow-prune": "true" } }, spec: { syncPolicy: { automated: { prune: true } } } })
+ */
+export declare const ALLOW_PRUNE_ANNOTATION = "argocd.chant.dev/allow-prune";
+export declare const argoAutomatedPruneRule: LintRule;
+//# sourceMappingURL=argo-automated-prune.d.ts.map

package/dist/lint/rules/argo-automated-prune.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argo-automated-prune.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/argo-automated-prune.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAWxF;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AAWrE,eAAO,MAAM,sBAAsB,EAAE,QAmCpC,CAAC"}

package/dist/lint/rules/hardcoded-namespace.d.ts

@@ -0,0 +1,13 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+/**
+ * WK8001: Hardcoded Namespace
+ *
+ * Detects hardcoded namespace strings in Kubernetes resource constructors.
+ * Namespaces should be parameterized or derived from configuration, not
+ * hardcoded as string literals.
+ *
+ * Bad:  new Deployment({ metadata: { namespace: "production" } })
+ * Good: new Deployment({ metadata: { namespace: config.namespace } })
+ */
+export declare const hardcodedNamespaceRule: LintRule;
+//# sourceMappingURL=hardcoded-namespace.d.ts.map

package/dist/lint/rules/hardcoded-namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-namespace.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/hardcoded-namespace.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,QA0CpC,CAAC"}

package/dist/lint/rules/latest-image-tag.d.ts

@@ -0,0 +1,3 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const latestImageTagRule: LintRule;
+//# sourceMappingURL=latest-image-tag.d.ts.map

package/dist/lint/rules/latest-image-tag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"latest-image-tag.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/latest-image-tag.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AA4DxF,eAAO,MAAM,kBAAkB,EAAE,QA4DhC,CAAC"}

package/dist/lint/rules/missing-resource-limits.d.ts

@@ -0,0 +1,3 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const missingResourceLimitsRule: LintRule;
+//# sourceMappingURL=missing-resource-limits.d.ts.map

package/dist/lint/rules/missing-resource-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-resource-limits.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-resource-limits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAuBxF,eAAO,MAAM,yBAAyB,EAAE,QAuFvC,CAAC"}

package/dist/lsp/completions.d.ts

@@ -0,0 +1,6 @@
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+/**
+ * Provide Kubernetes resource completions based on context.
+ */
+export declare function k8sCompletions(ctx: CompletionContext): CompletionItem[];
+//# sourceMappingURL=completions.d.ts.map

package/dist/lsp/completions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEvE"}

package/dist/lsp/hover.d.ts

@@ -0,0 +1,6 @@
+import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
+/**
+ * Provide hover information for Kubernetes resource types.
+ */
+export declare function k8sHover(ctx: HoverContext): HoverInfo | undefined;
+//# sourceMappingURL=hover.d.ts.map

package/dist/lsp/hover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa1E;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEjE"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/micro-time.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Helpers for K8s `MicroTime` fields.
+ *
+ * The K8s API server validates fields like `coordination.k8s.io/v1.Lease.spec.renewTime`
+ * (kind: MicroTime) with the exact format `2006-01-02T15:04:05.000000Z07:00`
+ * — microsecond precision, always 6 fractional digits, UTC offset.
+ *
+ * The naive JS `Date.toISOString()` (millisecond precision, 3 fractional
+ * digits) is accepted by the API server too — the schema is more permissive
+ * than the documented format string — but `time.RFC3339Nano`-style strings
+ * with nanosecond precision (9 fractional digits) are rejected as
+ * `422 Unprocessable Entity` with:
+ *
+ *   parsing time "...754Z" as "2006-01-02T15:04:05.000000Z07:00":
+ *     cannot parse "754Z" as "Z07:00"
+ *
+ * Pass a JS Date through `microTime()` to get a string the API server
+ * always accepts. This is the canonical way to populate MicroTime fields
+ * when authoring chant resources by hand.
+ */
+/**
+ * Format a Date as a K8s MicroTime string (UTC, exactly 6 fractional digits).
+ *
+ * @example
+ *   import { Lease } from "@intentius/chant-lexicon-k8s";
+ *   import { microTime } from "@intentius/chant-lexicon-k8s/micro-time";
+ *
+ *   new Lease({
+ *     metadata: { name: "my-lease", namespace: "default" },
+ *     spec: {
+ *       holderIdentity: "node-1",
+ *       leaseDurationSeconds: 15,
+ *       renewTime: microTime(new Date()),
+ *     },
+ *   });
+ */
+export declare function microTime(date?: Date): string;
+/**
+ * Returns true if `value` is a string in the K8s MicroTime canonical format
+ * (UTC, microsecond precision). Useful in lint/validation contexts.
+ */
+export declare function isMicroTimeFormatted(value: string): boolean;
+//# sourceMappingURL=micro-time.d.ts.map

package/dist/micro-time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"micro-time.d.ts","sourceRoot":"","sources":["../src/micro-time.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,IAAiB,GAAG,MAAM,CAKzD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/package-cli.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env tsx
+/**
+ * CLI entry point for Kubernetes lexicon packaging.
+ */
+export {};
+//# sourceMappingURL=package-cli.d.ts.map

package/dist/package-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-cli.d.ts","sourceRoot":"","sources":["../src/package-cli.ts"],"names":[],"mappings":";AACA;;GAEG"}

package/dist/plugin.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Kubernetes lexicon plugin.
+ *
+ * Provides serializer, template detection, code generation,
+ * lint rules, and LSP/MCP integration for Kubernetes manifests.
+ */
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+export declare const k8sPlugin: LexiconPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAkBjG,eAAO,MAAM,SAAS,EAAE,aAwkBvB,CAAC"}

package/dist/serializer.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Kubernetes YAML serializer.
+ *
+ * Converts Chant declarables to multi-document K8s YAML output with
+ * apiVersion, kind, metadata, and spec structure.
+ */
+import type { Serializer } from "@intentius/chant/serializer";
+/**
+ * Kubernetes YAML serializer implementation.
+ */
+export declare const k8sSerializer: Serializer;
+//# sourceMappingURL=serializer.d.ts.map

package/dist/serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA2IlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA2I3B,CAAC"}

package/dist/spec/fetch.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Kubernetes OpenAPI schema fetching — downloads the Swagger 2.0 spec
+ * and caches it locally.
+ */
+/**
+ * Pinned Kubernetes version for schema download.
+ */
+export declare const K8S_SCHEMA_VERSION = "v1.32.0";
+/**
+ * Get the cache file path for the K8s schema.
+ */
+export declare function getCachePath(version?: string): string;
+/**
+ * Fetch the Kubernetes OpenAPI Swagger spec, returning the raw JSON buffer.
+ * Uses local file caching with 24-hour TTL.
+ *
+ * @param force  Bypass cache and download fresh.
+ * @param version  Kubernetes version tag. Defaults to {@link K8S_SCHEMA_VERSION}.
+ */
+export declare function fetchK8sSchema(force?: boolean, version?: string): Promise<Buffer>;
+/**
+ * Fetch the K8s schema and return it as a Map<typeName, Buffer>
+ * compatible with the generatePipeline fetchSchemas callback.
+ *
+ * The K8s schema is a single document, so we return a single entry
+ * keyed by "Kubernetes::OpenAPI" — the parse step will split it
+ * into multiple resources.
+ */
+export declare function fetchSchemas(force?: boolean, version?: string): Promise<Map<string, Buffer>>;
+/**
+ * Clear the cached schema file.
+ */
+export declare function clearCache(version?: string): void;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/spec/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/spec/fetch.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;GAEG;AACH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAS5C;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASvF;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKlG;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAEjD"}

package/dist/spec/parse.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Kubernetes OpenAPI Swagger 2.0 parser.
+ *
+ * Parses the single swagger.json into multiple K8sParseResult entries —
+ * one per resource identified by `x-kubernetes-group-version-kind`.
+ * Property types (Container, PodSpec, Volume, etc.) are extracted as
+ * nested property types within their parent resources.
+ */
+import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
+export type { PropertyConstraints };
+export interface ParsedProperty {
+    name: string;
+    tsType: string;
+    required: boolean;
+    description?: string;
+    enum?: string[];
+    constraints: PropertyConstraints;
+}
+export interface ParsedPropertyType {
+    name: string;
+    /** The definition key in the original schema */
+    defType: string;
+    properties: ParsedProperty[];
+}
+export interface ParsedEnum {
+    name: string;
+    values: string[];
+}
+export interface ParsedResource {
+    typeName: string;
+    description?: string;
+    properties: ParsedProperty[];
+    attributes: Array<{
+        name: string;
+        tsType: string;
+    }>;
+    deprecatedProperties: string[];
+}
+export interface GroupVersionKind {
+    group: string;
+    version: string;
+    kind: string;
+}
+export interface K8sParseResult {
+    resource: ParsedResource;
+    propertyTypes: ParsedPropertyType[];
+    enums: ParsedEnum[];
+    gvk: GroupVersionKind;
+    /** Whether this entity is a property type (nested inside resources) */
+    isProperty?: boolean;
+}
+/**
+ * Parse the Kubernetes OpenAPI swagger.json into multiple resource results.
+ * Returns one result per top-level resource identified by x-kubernetes-group-version-kind.
+ */
+export declare function parseK8sSwagger(data: string | Buffer): K8sParseResult[];
+/**
+ * Convert GVK to our type name convention: K8s::{Group}::{Kind}
+ */
+export declare function gvkToTypeName(gvk: GroupVersionKind): string;
+/**
+ * Convert GVK to apiVersion string for serialization.
+ */
+export declare function gvkToApiVersion(gvk: GroupVersionKind): string;
+/**
+ * Extract short name: "K8s::Apps::Deployment" → "Deployment"
+ */
+export declare function k8sShortName(typeName: string): string;
+/**
+ * Extract service/group name: "K8s::Apps::Deployment" → "Apps"
+ */
+export declare function k8sServiceName(typeName: string): string;
+//# sourceMappingURL=parse.d.ts.map

package/dist/spec/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAShF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,GAAG,EAAE,gBAAgB,CAAC;IACtB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA8FD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,cAAc,EAAE,CA+BvE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAG3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAK7D;AA6PD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}

package/dist/validate-cli.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env tsx
+/**
+ * CLI entry point for Kubernetes lexicon validation.
+ */
+export {};
+//# sourceMappingURL=validate-cli.d.ts.map

package/dist/validate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-cli.d.ts","sourceRoot":"","sources":["../src/validate-cli.ts"],"names":[],"mappings":";AACA;;GAEG"}

package/dist/validate.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Validate generated lexicon-k8s artifacts.
+ *
+ * Thin wrapper around the core validation framework
+ * with Kubernetes-specific configuration.
+ */
+import { type ValidateResult } from "@intentius/chant/codegen/validate";
+export type { ValidateCheck, ValidateResult } from "@intentius/chant/codegen/validate";
+/**
+ * Validate the generated lexicon-k8s artifacts.
+ */
+export declare function validate(opts?: {
+    basePath?: string;
+}): Promise<ValidateResult>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAElG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAuBvF;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAQpF"}

package/dist/variables.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Kubernetes pseudo-parameters / well-known variables.
+ *
+ * Unlike AWS which has built-in pseudo-parameters (AWS::Region, etc.),
+ * Kubernetes doesn't have equivalent built-in variables. This module
+ * provides common label key constants for use in resource definitions.
+ */
+/**
+ * Well-known Kubernetes label keys from the standard label taxonomy.
+ * These are string constants, not runtime-resolved pseudo-parameters.
+ */
+export declare const K8sLabels: {
+    /** app.kubernetes.io/name */
+    readonly AppName: "app.kubernetes.io/name";
+    /** app.kubernetes.io/instance */
+    readonly AppInstance: "app.kubernetes.io/instance";
+    /** app.kubernetes.io/version */
+    readonly AppVersion: "app.kubernetes.io/version";
+    /** app.kubernetes.io/component */
+    readonly AppComponent: "app.kubernetes.io/component";
+    /** app.kubernetes.io/part-of */
+    readonly AppPartOf: "app.kubernetes.io/part-of";
+    /** app.kubernetes.io/managed-by */
+    readonly AppManagedBy: "app.kubernetes.io/managed-by";
+};
+/**
+ * Well-known Kubernetes annotation keys.
+ */
+export declare const K8sAnnotations: {
+    /** kubernetes.io/change-cause */
+    readonly ChangeCause: "kubernetes.io/change-cause";
+    /** kubernetes.io/description */
+    readonly Description: "kubernetes.io/description";
+};
+//# sourceMappingURL=variables.d.ts.map

package/dist/variables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../src/variables.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,eAAO,MAAM,SAAS;IACpB,6BAA6B;;IAE7B,iCAAiC;;IAEjC,gCAAgC;;IAEhC,kCAAkC;;IAElC,gCAAgC;;IAEhC,mCAAmC;;CAE3B,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;IACzB,iCAAiC;;IAEjC,gCAAgC;;CAExB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -29,8 +29,26 @@
     "access": "public"
   },
   "exports": {
-    ".": "./src/index.ts",
-    "./*": "./src/*.ts",
+    ".": {
+      "development": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./src/index.ts"
+    },
+    "./*": {
+      "development": "./src/*.ts",
+      "types": "./dist/*.d.ts",
+      "default": "./src/*.ts"
+    },
+    "./detect": {
+      "development": "./src/detect.ts",
+      "types": "./dist/detect.d.ts",
+      "default": "./src/detect.ts"
+    },
+    "./lint/post-synth": {
+      "development": "./src/lint/post-synth/index.ts",
+      "types": "./dist/lint/post-synth/index.d.ts",
+      "default": "./src/lint/post-synth/index.ts"
+    },
     "./manifest": "./dist/manifest.json",
     "./meta": "./dist/meta.json",
     "./types": "./dist/types/index.d.ts"
@@ -40,7 +58,8 @@
     "bundle": "tsx src/package-cli.ts",
     "validate": "tsx src/validate-cli.ts",
     "docs": "tsx src/codegen/docs-cli.ts",
-    "prepack": "npm run generate && npm run bundle && npm run validate"
+    "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
+    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
   },
   "dependencies": {
     "js-yaml": "^4.1.1",
@@ -51,6 +70,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.1.0"
+    "@intentius/chant": "^0.8.0"
   }
 }

package/src/composites/argo-app.ts

@@ -97,7 +97,7 @@ export interface ArgoAppForOptions {
   defaults?: { application?: Partial<Record<string, unknown>> };
 }
 
-export interface ArgoAppForResult {
+export type ArgoAppForResult = {
   application: InstanceType<typeof ApplicationResource>;
 }
 
@@ -196,7 +196,7 @@ export interface ArgoAppSetForRegionsOptions {
   defaults?: { applicationSet?: Partial<Record<string, unknown>> };
 }
 
-export interface ArgoAppSetForRegionsResult {
+export type ArgoAppSetForRegionsResult = {
   applicationSet: InstanceType<typeof ApplicationSetResource>;
 }
 
@@ -324,7 +324,7 @@ export interface RegisterArgoClusterOptions {
   defaults?: { secret?: Partial<Record<string, unknown>> };
 }
 
-export interface RegisterArgoClusterResult {
+export type RegisterArgoClusterResult = {
   secret: InstanceType<typeof SecretResource>;
 }
 

package/src/detect.ts

@@ -0,0 +1,9 @@
+/** Edge-safe template detection for k8s — extracted from plugin.ts so it imports
+ * without the lint rules (and the TypeScript compiler they pull in). See #426. */
+export function detectTemplate(data: unknown): boolean {
+  if (typeof data !== "object" || data === null) return false;
+  const obj = data as Record<string, unknown>;
+  // K8s manifests have apiVersion + kind
+  if (typeof obj.apiVersion === "string" && typeof obj.kind === "string") return true;
+  return false;
+}