@intentius/chant-lexicon-k8s 0.7.0 → 0.8.0

package/dist/import/generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/import/generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,gCAAgC,CAAC;AAyF7E;;GAEG;AACH,qBAAa,YAAa,YAAW,mBAAmB;IACtD,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,aAAa,EAAE;IA2CzC;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,yBAAyB;IAmCjC,OAAO,CAAC,SAAS;IAejB,OAAO,CAAC,SAAS;IAyBjB,OAAO,CAAC,oBAAoB;IAuB5B,OAAO,CAAC,WAAW;CA4BpB"}

package/dist/import/live-export.d.ts

@@ -0,0 +1,18 @@
+import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+/**
+ * Strip `status`, `managedFields`, and other server-written fields to reach the
+ * declared shape. Returns a new object; the input is not mutated.
+ */
+export declare function stripServerFields(obj: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Build full-fidelity export IR from a list of live Kubernetes objects (the
+ * `items` of a `kubectl get -o json` List). Reuses the import K8sParser by
+ * feeding it the cleaned objects as JSON documents — JSON is valid YAML, so no
+ * separate serializer is needed. Pure: all I/O stays in the caller.
+ */
+export declare function buildExportFromObjects(objects: unknown[], opts?: {
+    verbatim?: boolean;
+    selector?: ResourceSelector;
+    owned?: boolean;
+}): ExportedTemplate;
+//# sourceMappingURL=live-export.d.ts.map

package/dist/import/live-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-export.d.ts","sourceRoot":"","sources":["../../src/import/live-export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA8BnF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAavF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAAE,EAClB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,gBAAgB,CA8BlB"}

package/dist/import/parser.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Kubernetes YAML parser for `chant import`.
+ *
+ * Parses Kubernetes manifests (single or multi-document YAML) into the core
+ * TemplateIR format, mapping K8s resources to the K8s::{Group}::{Kind} type
+ * convention.
+ */
+import type { TemplateParser, TemplateIR } from "@intentius/chant/import/parser";
+/**
+ * Kubernetes YAML parser implementation.
+ *
+ * Supports multi-document YAML (split on `---`). Each document is expected
+ * to be a standard Kubernetes object with apiVersion, kind, and metadata.
+ */
+export declare class K8sParser implements TemplateParser {
+    parse(content: string): TemplateIR;
+    private parseDocument;
+}
+//# sourceMappingURL=parser.d.ts.map

package/dist/import/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAc,MAAM,gCAAgC,CAAC;AAwH7F;;;;;GAKG;AACH,qBAAa,SAAU,YAAW,cAAc;IAC9C,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAsClC,OAAO,CAAC,aAAa;CA8BtB"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+export { k8sSerializer } from "./serializer.js";
+export { k8sPlugin } from "./plugin.js";
+export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels.js";
+export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels.js";
+export { K8sLabels, K8sAnnotations } from "./variables.js";
+export { microTime, isMicroTimeFormatted } from "./micro-time.js";
+export * from "./generated/index.js";
+export { WebApp, StatefulApp, CronWorkload, AutoscaledService, WorkerPool, NamespaceEnv, NodeAgent, BatchJob, SecureIngress, ConfiguredApp, SidecarApp, MonitoredService, NetworkIsolatedApp, IrsaServiceAccount, AlbIngress, EbsStorageClass, EfsStorageClass, FluentBitAgent, ExternalDnsAgent, AdotCollector, MetricsServer, WorkloadIdentityServiceAccount, GcePdStorageClass, FilestoreStorageClass, GkeGateway, ConfigConnectorContext, GceIngress, CockroachDbCluster, CockroachDbRegionStack, RayCluster, RayJob, RayService, ArgoAppFor, ArgoAppSetForRegions, registerArgoCluster, AgicIngress, AzureDiskStorageClass, AzureFileStorageClass, AzureMonitorCollector, AksWorkloadIdentityServiceAccount, GkeFluentBitAgent, GkeOtelCollector, GkeExternalDnsAgent, AksExternalDnsAgent, } from "./composites/index.js";
+export type { WebAppProps, WebAppResult, StatefulAppProps, StatefulAppResult, CronWorkloadProps, CronWorkloadResult, AutoscaledServiceProps, AutoscaledServiceResult, WorkerPoolProps, WorkerPoolResult, NamespaceEnvProps, NamespaceEnvResult, NodeAgentProps, NodeAgentResult, BatchJobProps, BatchJobResult, SecureIngressProps, SecureIngressResult, ConfiguredAppProps, ConfiguredAppResult, SidecarAppProps, SidecarAppResult, MonitoredServiceProps, MonitoredServiceResult, NetworkIsolatedAppProps, NetworkIsolatedAppResult, IrsaServiceAccountProps, IrsaServiceAccountResult, AlbIngressProps, AlbIngressResult, EbsStorageClassProps, EbsStorageClassResult, EfsStorageClassProps, EfsStorageClassResult, FluentBitAgentProps, FluentBitAgentResult, ExternalDnsAgentProps, ExternalDnsAgentResult, AdotCollectorProps, AdotCollectorResult, MetricsServerProps, MetricsServerResult, WorkloadIdentityServiceAccountProps, WorkloadIdentityServiceAccountResult, GcePdStorageClassProps, GcePdStorageClassResult, FilestoreStorageClassProps, FilestoreStorageClassResult, GkeGatewayProps, GkeGatewayResult, ConfigConnectorContextProps, ConfigConnectorContextResult, GceIngressProps, GceIngressResult, CockroachDbClusterProps, CockroachDbClusterResult, CockroachDbRegionStackConfig, CockroachDbRegionCockroachConfig, CockroachDbRegionTlsConfig, RayClusterProps, RayClusterResult, RayClusterSpec, ResourceSpec, HeadGroupSpec, WorkerGroupSpec, RayJobProps, RayJobResult, RayServiceProps, RayServiceResult, ArgoDestination, ArgoSyncPolicy, ArgoAppForOptions, ArgoAppForResult, ArgoRegionTarget, ArgoAppSetForRegionsOptions, ArgoAppSetForRegionsResult, RegisterArgoClusterOptions, RegisterArgoClusterResult, AgicIngressProps, AgicIngressResult, AzureDiskStorageClassProps, AzureDiskStorageClassResult, AzureFileStorageClassProps, AzureFileStorageClassResult, AzureMonitorCollectorProps, AzureMonitorCollectorResult, AksWorkloadIdentityServiceAccountProps, AksWorkloadIdentityServiceAccountResult, GkeFluentBitAgentProps, GkeFluentBitAgentResult, GkeOtelCollectorProps, GkeOtelCollectorResult, GkeExternalDnsAgentProps, GkeExternalDnsAgentResult, AksExternalDnsAgentProps, AksExternalDnsAgentResult, } from "./composites/index.js";
+export * from "./actions/index.js";
+export { fetchK8sSchema, fetchSchemas, K8S_SCHEMA_VERSION } from "./spec/fetch.js";
+export { parseK8sSwagger, k8sShortName, k8sServiceName, gvkToTypeName, gvkToApiVersion } from "./spec/parse.js";
+export type { K8sParseResult, ParsedResource, ParsedProperty, ParsedPropertyType, ParsedEnum, GroupVersionKind } from "./spec/parse.js";
+export { generate, writeGeneratedFiles } from "./codegen/generate.js";
+export { packageLexicon } from "./codegen/package.js";
+export type { PackageOptions, PackageResult } from "./codegen/package.js";
+export type { CRDSource, CRDSpec } from "./crd/types.js";
+export { parseCRD, parseCRDSpec } from "./crd/parser.js";
+export { loadCRDs, loadMultipleCRDs } from "./crd/loader.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,GAC9E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,GACpD,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "06a6c6dd129c63c45760cb3ec4ba5c15982e19cbf46be77c024c286a078a7704",
+    "manifest.json": "3a6b6184d487d2b3195a57327f37804cba447b1ca142a6e58dfbc27e6c24e0d1",
     "meta.json": "4177925d0043a2879c34e1e871e9ca8f33093999d08fa5fc411ee11086381529",
     "types/index.d.ts": "bf626b2c92e3375a7d93b2c96a8a95a992507a679707b47a35cf6501f32a70bf",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "b83e449c4a6e459187ffa9b6cfde1aae75cae514a50cee72a0086ba2e3a66c9e"
+  "composite": "52e0f965373405403ef12c82f4da058a8a8e93073a2b6a006af22fc0b3b41076"
 }

package/dist/lint/post-synth/argo-helpers.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Shared helpers for the Argo post-synth checks (ARGO002, ARGO003, ARGO005).
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter.
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { type K8sManifest } from "./k8s-helpers.js";
+/** The always-present, in-cluster Argo destination. */
+export declare const IN_CLUSTER_SERVER = "https://kubernetes.default.svc";
+export declare const IN_CLUSTER_NAME = "in-cluster";
+/** Label that marks a Secret as an Argo CD external cluster registration. */
+export declare const CLUSTER_SECRET_TYPE_LABEL = "argocd.argoproj.io/secret-type";
+/** All manifests across every lexicon output. */
+export declare function allManifests(ctx: PostSynthContext): K8sManifest[];
+/** Manifests of a given Argo kind. */
+export declare function manifestsOfKind(manifests: K8sManifest[], kind: string): K8sManifest[];
+/**
+ * Read a string field from a Secret's stringData or data block.
+ * (Argo cluster Secrets conventionally use stringData.)
+ */
+export declare function secretField(manifest: K8sManifest, key: string): string | undefined;
+/** True if the Secret is labelled as an Argo cluster registration. */
+export declare function isClusterSecret(manifest: K8sManifest): boolean;
+//# sourceMappingURL=argo-helpers.d.ts.map

package/dist/lint/post-synth/argo-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argo-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/argo-helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAuC,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAEtF,uDAAuD;AACvD,eAAO,MAAM,iBAAiB,mCAAmC,CAAC;AAClE,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,mCAAmC,CAAC;AAE1E,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,EAAE,CAMjE;AAED,sCAAsC;AACtC,wBAAgB,eAAe,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAErF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQlF;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAI9D"}

package/dist/lint/post-synth/argo002.d.ts

@@ -0,0 +1,12 @@
+/**
+ * ARGO002: Application.spec.project must reference a declared AppProject
+ *
+ * An Argo `Application` names an `AppProject` in `spec.project`; the project is
+ * the RBAC and source/destination guardrail. If the named project isn't
+ * declared in the build, Argo will reject the Application at sync time. The
+ * built-in `default` project always exists on an Argo install, so a reference
+ * to `default` is never flagged.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const argo002: PostSynthCheck;
+//# sourceMappingURL=argo002.d.ts.map

package/dist/lint/post-synth/argo002.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argo002.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/argo002.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAkCrB,CAAC"}

package/dist/lint/post-synth/argo003.d.ts

@@ -0,0 +1,14 @@
+/**
+ * ARGO003: Application.spec.destination must reference a registered cluster
+ *
+ * An Argo `Application` targets a cluster via `spec.destination.server` (an API
+ * server URL) or `spec.destination.name` (a registered cluster name). External
+ * clusters are registered with a Secret labelled
+ * `argocd.argoproj.io/secret-type: cluster`. The in-cluster target
+ * (`https://kubernetes.default.svc` / name `in-cluster`) is always available.
+ * A destination that names neither a registered cluster nor the in-cluster
+ * target won't resolve at sync time.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const argo003: PostSynthCheck;
+//# sourceMappingURL=argo003.d.ts.map

package/dist/lint/post-synth/argo003.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argo003.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/argo003.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAU9G,eAAO,MAAM,OAAO,EAAE,cA0DrB,CAAC"}

package/dist/lint/post-synth/argo005.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const argo005: PostSynthCheck;
+//# sourceMappingURL=argo005.d.ts.map

package/dist/lint/post-synth/argo005.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argo005.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/argo005.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAY9G,eAAO,MAAM,OAAO,EAAE,cA+BrB,CAAC"}

package/dist/lint/post-synth/index.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const postSynthChecks: PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/post-synth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA+BvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA8B3C,CAAC"}

package/dist/lint/post-synth/k8s-helpers.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Shared helpers for Kubernetes post-synthesis lint rules.
+ *
+ * Provides YAML parsing for multi-document K8s manifests and container
+ * extraction logic that handles all common workload types.
+ */
+export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+/**
+ * A parsed Kubernetes manifest (loosely typed).
+ */
+export interface K8sManifest {
+    apiVersion?: string;
+    kind?: string;
+    metadata?: {
+        name?: string;
+        namespace?: string;
+        labels?: Record<string, string>;
+        [key: string]: unknown;
+    };
+    spec?: Record<string, unknown>;
+    data?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+/**
+ * A Kubernetes container spec (loosely typed).
+ */
+export interface K8sContainer {
+    name?: string;
+    image?: string;
+    env?: Array<{
+        name?: string;
+        value?: unknown;
+        valueFrom?: unknown;
+    }>;
+    ports?: Array<{
+        name?: string;
+        containerPort?: number;
+        [key: string]: unknown;
+    }>;
+    resources?: {
+        limits?: Record<string, unknown>;
+        requests?: Record<string, unknown>;
+    };
+    securityContext?: Record<string, unknown>;
+    livenessProbe?: unknown;
+    readinessProbe?: unknown;
+    imagePullPolicy?: string;
+    [key: string]: unknown;
+}
+/**
+ * Split a multi-document YAML string on `---` boundaries and parse each
+ * document into a K8sManifest.
+ */
+export declare function parseK8sManifests(yaml: string): K8sManifest[];
+/**
+ * Extract the pod spec from any workload manifest.
+ *
+ * Handles:
+ * - Pod: spec directly
+ * - Deployment, StatefulSet, DaemonSet: spec.template.spec
+ * - Job: spec.template.spec
+ * - CronJob: spec.jobTemplate.spec.template.spec
+ */
+export declare function extractPodSpec(manifest: K8sManifest): Record<string, unknown> | null;
+/**
+ * Extract all containers (including init containers) from a workload manifest.
+ */
+export declare function extractContainers(manifest: K8sManifest): K8sContainer[];
+/**
+ * Workload kinds that contain pod templates.
+ */
+export declare const WORKLOAD_KINDS: Set<string>;
+/**
+ * Parse a Kubernetes memory string to bytes.
+ *
+ * Handles binary suffixes (Ki, Mi, Gi, Ti) and SI suffixes (K, M, G, T).
+ * Returns NaN for unrecognised strings — callers should skip checks on NaN.
+ *
+ * @example
+ * parseMemoryBytes("4Gi")  // 4294967296
+ * parseMemoryBytes("512Mi") // 536870912
+ * parseMemoryBytes("2048") // 2048
+ */
+export declare function parseMemoryBytes(s: string): number;
+/**
+ * Extract the Ray version from an image tag.
+ *
+ * Looks for a semver-style version prefix in the image tag:
+ *   "rayproject/ray:2.40.0"          → "2.40.0"
+ *   "rayproject/ray:2.40.0-py310"    → "2.40.0"
+ *   "us-docker.pkg.dev/.../ray:2.9.3-gpu" → "2.9.3"
+ *   "rayproject/ray:latest"          → undefined
+ *
+ * Returns undefined when no version can be found.
+ */
+export declare function extractRayVersion(image: string): string | undefined;
+//# sourceMappingURL=k8s-helpers.d.ts.map

package/dist/lint/post-synth/k8s-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k8s-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/k8s-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrE,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IACjF,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAkB7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,WAAW,GACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA2BhC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAuBvE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,aAOzB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CASlD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAInE"}

package/dist/lint/post-synth/wk8005.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8005: Hardcoded Secrets in Environment Variables
+ *
+ * Detects container environment variables with names suggesting sensitive
+ * values (password, token, key, secret) that use hardcoded string values
+ * instead of secretKeyRef or configMapKeyRef.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8005: PostSynthCheck;
+//# sourceMappingURL=wk8005.d.ts.map

package/dist/lint/post-synth/wk8005.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8005.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8005.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA6CpB,CAAC"}

package/dist/lint/post-synth/wk8006.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WK8006: No :latest or Untagged Images
+ *
+ * Container images should use explicit version tags for reproducibility.
+ * Flags images using the `:latest` tag or no tag at all.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8006: PostSynthCheck;
+//# sourceMappingURL=wk8006.d.ts.map

package/dist/lint/post-synth/wk8006.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8006.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8006.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAyDpB,CAAC"}

package/dist/lint/post-synth/wk8041.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8041: Hardcoded API Keys
+ *
+ * Detects well-known API key patterns in container environment variable values.
+ * Catches Stripe keys, GitHub PATs, AWS access keys, Google API keys, and
+ * other common credential formats.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8041: PostSynthCheck;
+//# sourceMappingURL=wk8041.d.ts.map

package/dist/lint/post-synth/wk8041.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8041.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8041.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAsB9G,eAAO,MAAM,MAAM,EAAE,cA0CpB,CAAC"}

package/dist/lint/post-synth/wk8042.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8042: Private Keys in ConfigMap
+ *
+ * Detects PEM-encoded private keys stored in ConfigMap data values.
+ * Private keys should be stored in Secrets, not ConfigMaps, since
+ * ConfigMaps are not encrypted at rest by default.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8042: PostSynthCheck;
+//# sourceMappingURL=wk8042.d.ts.map

package/dist/lint/post-synth/wk8042.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8042.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8042.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAkCpB,CAAC"}

package/dist/lint/post-synth/wk8101.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8101: Deployment Selector Must Match Template Labels
+ *
+ * A Deployment's spec.selector.matchLabels must be a subset of
+ * spec.template.metadata.labels. If they don't match, the Deployment
+ * controller cannot find the Pods it creates, causing a runtime failure.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8101: PostSynthCheck;
+//# sourceMappingURL=wk8101.d.ts.map

package/dist/lint/post-synth/wk8101.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8101.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8101.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAqDpB,CAAC"}

package/dist/lint/post-synth/wk8102.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WK8102: Resources Should Have Metadata Labels
+ *
+ * All Kubernetes resources should have metadata.labels for organizational
+ * purposes. Labels enable filtering, selection, and operational tooling.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8102: PostSynthCheck;
+//# sourceMappingURL=wk8102.d.ts.map

package/dist/lint/post-synth/wk8102.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8102.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8102.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA+BpB,CAAC"}

package/dist/lint/post-synth/wk8103.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WK8103: Containers Must Have Name
+ *
+ * Every container in a pod spec must have a `name` field. This is required
+ * by the Kubernetes API and will be rejected at apply time if missing.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8103: PostSynthCheck;
+//# sourceMappingURL=wk8103.d.ts.map

package/dist/lint/post-synth/wk8103.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8103.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8103.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAkCpB,CAAC"}

package/dist/lint/post-synth/wk8104.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8104: Ports Should Be Named
+ *
+ * Container ports and Service ports should have names. Named ports enable
+ * referencing by name in Service targetPort and NetworkPolicy rules,
+ * improving maintainability.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8104: PostSynthCheck;
+//# sourceMappingURL=wk8104.d.ts.map

package/dist/lint/post-synth/wk8104.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8104.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8104.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAyDpB,CAAC"}

package/dist/lint/post-synth/wk8105.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8105: ImagePullPolicy Should Be Explicit
+ *
+ * Containers should have an explicit imagePullPolicy. When omitted,
+ * Kubernetes defaults to "Always" for :latest and "IfNotPresent" for
+ * other tags, which can lead to unexpected behavior.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8105: PostSynthCheck;
+//# sourceMappingURL=wk8105.d.ts.map

package/dist/lint/post-synth/wk8105.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8105.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8105.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAiCpB,CAAC"}

package/dist/lint/post-synth/wk8201.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8201: Resource Limits Required
+ *
+ * Containers should have CPU and memory limits defined in resources.limits.
+ * Without limits, a container can consume unbounded resources, potentially
+ * affecting other workloads on the node.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8201: PostSynthCheck;
+//# sourceMappingURL=wk8201.d.ts.map

package/dist/lint/post-synth/wk8201.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8201.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8201.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA2CpB,CAAC"}

package/dist/lint/post-synth/wk8202.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8202: No Privileged Containers
+ *
+ * Containers should not run in privileged mode. Privileged containers
+ * have full access to the host's devices and kernel capabilities,
+ * which is a significant security risk.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8202: PostSynthCheck;
+//# sourceMappingURL=wk8202.d.ts.map

package/dist/lint/post-synth/wk8202.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8202.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8202.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAkCpB,CAAC"}

package/dist/lint/post-synth/wk8203.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8203: ReadOnlyRootFilesystem Recommended
+ *
+ * Containers should set securityContext.readOnlyRootFilesystem to true.
+ * A read-only root filesystem prevents runtime modification of the container
+ * image, reducing the attack surface.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8203: PostSynthCheck;
+//# sourceMappingURL=wk8203.d.ts.map

package/dist/lint/post-synth/wk8203.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8203.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8203.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAkCpB,CAAC"}

package/dist/lint/post-synth/wk8204.d.ts

@@ -0,0 +1,14 @@
+/**
+ * WK8204: RunAsNonRoot Recommended
+ *
+ * Containers should set securityContext.runAsNonRoot to true at either
+ * the container level or pod level. Running as root inside a container
+ * increases the blast radius of a container breakout.
+ *
+ * Additionally warns when runAsNonRoot: true is set but no explicit
+ * runAsUser is provided — without a numeric UID, K8s relies on the
+ * image's USER directive, which may be root (UID 0).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8204: PostSynthCheck;
+//# sourceMappingURL=wk8204.d.ts.map

package/dist/lint/post-synth/wk8204.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8204.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8204.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAsEpB,CAAC"}

package/dist/lint/post-synth/wk8205.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8205: Drop ALL Capabilities
+ *
+ * Containers should drop all Linux capabilities and only add back those
+ * explicitly needed. This follows the principle of least privilege and
+ * reduces the attack surface.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8205: PostSynthCheck;
+//# sourceMappingURL=wk8205.d.ts.map

package/dist/lint/post-synth/wk8205.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8205.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8205.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA4CpB,CAAC"}

package/dist/lint/post-synth/wk8207.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8207: No hostNetwork
+ *
+ * Pods should not use hostNetwork: true. Using the host network namespace
+ * bypasses network isolation and allows the pod to access all network
+ * interfaces on the host.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8207: PostSynthCheck;
+//# sourceMappingURL=wk8207.d.ts.map

package/dist/lint/post-synth/wk8207.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8207.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8207.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAiCpB,CAAC"}

package/dist/lint/post-synth/wk8208.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8208: No hostPID
+ *
+ * Pods should not use hostPID: true. Sharing the host PID namespace
+ * allows the pod to see and interact with all processes on the host,
+ * which is a significant security risk.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8208: PostSynthCheck;
+//# sourceMappingURL=wk8208.d.ts.map

package/dist/lint/post-synth/wk8208.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8208.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8208.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAiCpB,CAAC"}

package/dist/lint/post-synth/wk8209.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8209: No hostIPC
+ *
+ * Pods should not use hostIPC: true. Sharing the host IPC namespace
+ * allows the pod to access shared memory segments on the host, which
+ * can be used to escalate privileges or exfiltrate data.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8209: PostSynthCheck;
+//# sourceMappingURL=wk8209.d.ts.map

package/dist/lint/post-synth/wk8209.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8209.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8209.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAiCpB,CAAC"}

package/dist/lint/post-synth/wk8301.d.ts

@@ -0,0 +1,15 @@
+/**
+ * WK8301: Probes Required
+ *
+ * Containers that expose a port should have both livenessProbe and
+ * readinessProbe configured. Without probes, Kubernetes cannot detect
+ * unhealthy containers or know when a container is ready to receive traffic.
+ *
+ * Containers that declare no port (queue/Temporal workers, batch consumers)
+ * are exempt: they take no inbound traffic, so there is no endpoint to
+ * HTTP-probe and no readiness signal for a Service to gate on. Flagging them
+ * would force a placeholder exec probe on a correct, port-less pattern.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8301: PostSynthCheck;
+//# sourceMappingURL=wk8301.d.ts.map

package/dist/lint/post-synth/wk8301.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8301.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8301.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA0CpB,CAAC"}

package/dist/lint/post-synth/wk8302.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WK8302: Replicas >= 2 for High Availability
+ *
+ * Deployments should have at least 2 replicas for high availability.
+ * A single replica means any pod disruption causes downtime.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8302: PostSynthCheck;
+//# sourceMappingURL=wk8302.d.ts.map

package/dist/lint/post-synth/wk8302.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8302.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8302.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAmCpB,CAAC"}

package/dist/lint/post-synth/wk8303.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WK8303: PodDisruptionBudget Recommended for HA Deployments
+ *
+ * Deployments with 2 or more replicas should have a corresponding
+ * PodDisruptionBudget (PDB) to ensure minimum availability during
+ * voluntary disruptions like node drains and cluster upgrades.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8303: PostSynthCheck;
+//# sourceMappingURL=wk8303.d.ts.map

package/dist/lint/post-synth/wk8303.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8303.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8303.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,MAAM,EAAE,cA4CpB,CAAC"}