@konfig.ts/core 0.0.1

package/dist/RenderError.d.ts

@@ -0,0 +1,63 @@
+declare const RenderError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "RenderError";
+} & Readonly<A>;
+export declare class RenderError extends RenderError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const EmbedYamlReadError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "EmbedYamlReadError";
+} & Readonly<A>;
+export declare class EmbedYamlReadError extends EmbedYamlReadError_base<{
+    readonly path: string;
+    readonly cause: unknown;
+}> {
+}
+declare const BoundaryDecodeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "BoundaryDecodeError";
+} & Readonly<A>;
+export declare class BoundaryDecodeError extends BoundaryDecodeError_base<{
+    readonly schema: string;
+    readonly cause: unknown;
+}> {
+}
+declare const HelmVersionTooLow_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "HelmVersionTooLow";
+} & Readonly<A>;
+export declare class HelmVersionTooLow extends HelmVersionTooLow_base<{
+    readonly required: string;
+    readonly found: string;
+}> {
+    get message(): string;
+}
+declare const HelmRenderError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "HelmRenderError";
+} & Readonly<A>;
+export declare class HelmRenderError extends HelmRenderError_base<{
+    readonly chart: string;
+    readonly version: string;
+    readonly cause: unknown;
+}> {
+}
+declare const HelmDigestMismatch_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "HelmDigestMismatch";
+} & Readonly<A>;
+export declare class HelmDigestMismatch extends HelmDigestMismatch_base<{
+    readonly chart: string;
+    readonly version: string;
+    readonly expected: string;
+    readonly actual: string;
+}> {
+    get message(): string;
+}
+declare const CrdExtractError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "CrdExtractError";
+} & Readonly<A>;
+export declare class CrdExtractError extends CrdExtractError_base<{
+    readonly chart: string;
+    readonly cause: unknown;
+}> {
+}
+export type AnyRenderError = RenderError | EmbedYamlReadError | BoundaryDecodeError | HelmVersionTooLow | HelmRenderError | HelmDigestMismatch | CrdExtractError;
+export {};

package/dist/_cast.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Nominal-typing primitive — attach a phantom brand to a string value.
+ * Used by `Dep.*Ref` constructors and the like. Safe by construction:
+ * the brand is a type-only label that the caller stamps on themselves.
+ */
+export declare const brand: <T>(value: string) => T;
+/**
+ * Unsafe escape hatch — claim a value has type `T` without runtime
+ * proof. Every call site MUST pass a one-line `reason` explaining why
+ * the cast is sound (e.g. "variance erasure", "runtime narrowed via
+ * _tag check", "Object.keys is string[]"). Audit by grepping for
+ * `unsafeCoerce(` and reading the reasons.
+ *
+ * For values crossing a trust boundary (external command output, file
+ * contents, network payloads), prefer `boundary` from
+ * `@konfig.ts/core/boundary` — it produces a `BoundaryDecodeError`
+ * instead of silently accepting the claim.
+ *
+ * The `reason` parameter is intentionally not used at runtime; it
+ * documents intent for readers and audits.
+ */
+export declare const unsafeCoerce: <T>(value: unknown, _reason: string) => T;

package/dist/_unstable.d.ts

@@ -0,0 +1,2 @@
+export { ChildProcess } from "effect/unstable/process";
+export { ChildProcessSpawner, type ChildProcessSpawner as ChildProcessSpawnerType, } from "effect/unstable/process/ChildProcessSpawner";

package/dist/boundary.d.ts

@@ -0,0 +1,7 @@
+import { Effect, Schema } from "effect";
+import { BoundaryDecodeError } from "./RenderError";
+export interface BoundaryInput<S extends Schema.Top> {
+    readonly schema: S;
+    readonly label?: string;
+}
+export declare const boundary: <S extends Schema.Top>(input: BoundaryInput<S>) => (value: unknown) => Effect.Effect<S["Type"], BoundaryDecodeError, S["DecodingServices"]>;

package/dist/deps.d.ts

@@ -0,0 +1,126 @@
+import { Context, Layer, type Redacted } from "effect";
+declare const NeedBrand: unique symbol;
+export interface Need<K extends string, N extends string> {
+    readonly [NeedBrand]: {
+        readonly kind: K;
+        readonly name: N;
+    };
+}
+export type Provide<K extends string, N extends string> = Need<K, N>;
+declare const SecretRefBrand: unique symbol;
+declare const ConfigMapRefBrand: unique symbol;
+declare const ServiceAccountRefBrand: unique symbol;
+declare const PvcRefBrand: unique symbol;
+declare const BuiltImageRefBrand: unique symbol;
+/**
+ * Nominal reference to a named Secret. `N` brands the secret's metadata
+ * name; `K` (defaults to `string`) brands the union of declared data
+ * keys, so consumers like `secretEnv({ ref, key })` can constrain `key`
+ * to keys that actually exist; `Ns` (defaults to `string`) brands the
+ * secret's owning namespace, so pod-context consumers (like
+ * `secretEnvForPod`) can reject refs from a different namespace at
+ * compile time — eliminating the runtime "secret not found across
+ * namespaces" failure mode.
+ */
+export type SecretRef<N extends string, K extends string = string, Ns extends string = string> = string & {
+    readonly [SecretRefBrand]: {
+        readonly name: N;
+        readonly keys: K;
+        readonly namespace: Ns;
+    };
+};
+/**
+ * Nominal reference to a named ConfigMap. `N` brands the metadata name;
+ * `K` (defaults to `string`) brands the union of declared data keys, so
+ * `configMapEnv({ ref, key })` can constrain `key` to keys that actually
+ * exist on the map. Producers (e.g. `ConfigMap.make`) populate `K` from
+ * the literal `data` (or `binaryData`) record keys.
+ */
+export type ConfigMapRef<N extends string, K extends string = string> = string & {
+    readonly [ConfigMapRefBrand]: {
+        readonly name: N;
+        readonly keys: K;
+    };
+};
+export type ServiceAccountRef<N extends string> = string & {
+    readonly [ServiceAccountRefBrand]: N;
+};
+export type PvcRef<N extends string> = string & {
+    readonly [PvcRefBrand]: N;
+};
+/**
+ * Nominal reference to a container image built in-tree. Runtime value
+ * is the full image ref (`registry/app:tag`) — a string, so K8s YAML
+ * serializes it directly. The phantom `App` brand carries the literal
+ * app name and ties the ref to the dep graph via `Dep.Image`.
+ *
+ * Container `image` fields accept either a raw string (escape hatch
+ * for vendor images: `ghcr.io/bitnami/postgresql:16.0.0`) or
+ * `BuiltImageRef<App>`. The branded path catches a workload whose
+ * build module is missing from the composition at `AppOfApps.entrypoint`.
+ */
+export type BuiltImageRef<App extends string> = string & {
+    readonly [BuiltImageRefBrand]: App;
+};
+export type BuiltImageRefApp<R> = R extends BuiltImageRef<infer App> ? App : never;
+export type SecretRefName<R> = R extends SecretRef<infer N, infer _K, infer _Ns> ? N : never;
+export type SecretRefKeys<R> = R extends SecretRef<infer _N, infer K, infer _Ns> ? K : never;
+export type SecretRefNamespace<R> = R extends SecretRef<infer _N, infer _K, infer Ns> ? Ns : never;
+export type ConfigMapRefName<R> = R extends ConfigMapRef<infer N, infer _K> ? N : never;
+export type ConfigMapRefKeys<R> = R extends ConfigMapRef<infer _N, infer K> ? K : never;
+export type PvcRefName<R> = R extends PvcRef<infer N> ? N : never;
+export declare const Secret: <N extends string, K extends string = string, Ns extends string = string>(name: N) => Context.Service<Need<"Secret", N>, SecretRef<N, K, Ns>>;
+export type SecretValuesRecord<K extends string> = {
+    readonly [P in K]: Redacted.Redacted<string>;
+};
+export declare const SecretValues: <N extends string, K extends string = string>(name: N) => Context.Service<Need<"SecretValues", N>, SecretValuesRecord<K>>;
+export declare const ConfigMap: <N extends string, K extends string = string>(name: N) => Context.Service<Need<"ConfigMap", N>, ConfigMapRef<N, K>>;
+export declare const Namespace: <N extends string>(name: N) => Context.Service<Need<"Namespace", N>, N>;
+export declare const ServiceAccount: <N extends string>(name: N) => Context.Service<Need<"ServiceAccount", N>, ServiceAccountRef<N>>;
+export declare const Application: <N extends string>(name: N) => Context.Service<Need<"Application", N>, N>;
+export declare const Pvc: <N extends string>(name: N) => Context.Service<Need<"Pvc", N>, PvcRef<N>>;
+export declare const App: <N extends string, S = unknown>(name: N) => Context.Service<Need<"App", N>, S>;
+/**
+ * Context.Service tag for a `BuiltImageRef<App>`. Modules that build an
+ * image emit a Layer providing this service; modules that deploy a
+ * container yield `Dep.Image(app)` to receive the typed ref. The
+ * dep-graph residual at `AppOfApps.entrypoint` catches a missing
+ * provider exactly like for `Dep.Secret`.
+ */
+export declare const Image: <N extends string>(name: N) => Context.Service<Need<"Image", N>, BuiltImageRef<N>>;
+interface _ImageRefInput<App extends string> {
+    readonly app: App;
+    readonly registry: string;
+    readonly tag: string;
+}
+/**
+ * `BuiltImageRef` value namespace.
+ *
+ *   const apiImage = BuiltImageRef.of({
+ *     app: "api",
+ *     registry: "ghcr.io/example",
+ *     tag: "1.0.0",
+ *   });
+ *
+ * `BuiltImageRef.of` constructs the brand from registry + app + tag.
+ * The literal `app` is captured in the brand so a workload's
+ * `Dep.Need<"Image", App>` matches only the build module that
+ * provides this exact app.
+ */
+export declare const BuiltImageRef: {
+    of: <const App extends string>(input: _ImageRefInput<App>) => BuiltImageRef<App>;
+};
+/**
+ * Layer providing `Dep.Image(App)` for downstream consumers. Combine
+ * with `Application.define` / `Module.fixedNs`'s `provides` slot to
+ * have a build module surface its image to sibling workload modules
+ * in the composition.
+ */
+export declare const provideImage: <const App extends string>(input: _ImageRefInput<App>) => Layer.Layer<Provide<"Image", App>>;
+export declare const provideSecret: <const N extends string, const K extends string = string, const Ns extends string = string>(name: N) => Layer.Layer<Provide<"Secret", N>>;
+export declare const provideConfigMap: <const N extends string, const K extends string = string>(name: N) => Layer.Layer<Provide<"ConfigMap", N>>;
+export declare const provideNamespace: <const N extends string>(name: N) => Layer.Layer<Provide<"Namespace", N>>;
+export declare const provideServiceAccount: <const N extends string>(name: N) => Layer.Layer<Provide<"ServiceAccount", N>>;
+export declare const provideApplication: <const N extends string>(name: N) => Layer.Layer<Provide<"Application", N>>;
+export declare const providePvc: <const N extends string>(name: N) => Layer.Layer<Provide<"Pvc", N>>;
+export {};

package/dist/diff.d.ts

@@ -0,0 +1,96 @@
+export interface RedactOptions {
+    /**
+     * Normalize numeric strings: `"1.0"` compares equal to `1`,
+     * `"true"` stays a string (only numerics are normalized). Useful for
+     * Helm-templated manifests where some fields get stringified.
+     */
+    readonly normalizeNumerics?: boolean;
+}
+export interface RedactInput {
+    readonly value: unknown;
+    readonly parentKey?: string | null;
+    readonly options?: RedactOptions;
+}
+/**
+ * Canonicalize a parsed YAML/JSON value for structural comparison,
+ * applying two normalizations:
+ *
+ *  1. **Null/undefined keys are dropped.** Any object key whose value is
+ *     `null` or `undefined` is omitted from the redacted output. This is
+ *     deliberate: it makes an *explicit* `field: null` compare equal to
+ *     an *absent* `field`, which is what we want when diffing manifests
+ *     where one side spells out a null default the other side simply
+ *     omits. The trade-off is that a genuine "field was set to null vs.
+ *     field removed" distinction is intentionally invisible to the diff.
+ *  2. **Numeric normalization** (opt-in via
+ *     {@link RedactOptions.normalizeNumerics}) — see that field.
+ *
+ * Helm metadata redaction (dropping chart-churn labels/annotations) is
+ * layered on top when a `labels`/`annotations` map appears under
+ * `metadata`.
+ */
+export declare const redact: (input: RedactInput) => unknown;
+export interface DeepEqualInput {
+    readonly a: unknown;
+    readonly b: unknown;
+}
+export declare const deepEqual: (input: DeepEqualInput) => boolean;
+export declare const parseYaml: (text: string) => unknown;
+/**
+ * Parse a multi-doc YAML file into an ordered list of documents. Each
+ * document's parsed structure is preserved as-is. Empty / whitespace-only
+ * segments are dropped, but their position is *not* preserved — only
+ * present documents are returned. Use the returned index to identify
+ * documents inside one file (alongside the filename) when reporting.
+ */
+export declare const parseYamlAll: (text: string) => ReadonlyArray<unknown>;
+export type DocDiff = {
+    readonly _tag: "Same";
+    readonly key: string;
+} | {
+    readonly _tag: "MissingLeft";
+    readonly key: string;
+    readonly right: unknown;
+} | {
+    readonly _tag: "MissingRight";
+    readonly key: string;
+    readonly left: unknown;
+} | {
+    readonly _tag: "Changed";
+    readonly key: string;
+    readonly left: unknown;
+    readonly right: unknown;
+};
+export type FileDiff = {
+    readonly _tag: "Same";
+    readonly file: string;
+} | {
+    readonly _tag: "MissingLeft";
+    readonly file: string;
+} | {
+    readonly _tag: "MissingRight";
+    readonly file: string;
+} | {
+    readonly _tag: "Changed";
+    readonly file: string;
+    readonly left: unknown;
+    readonly right: unknown;
+    /** Per-document breakdown if the file holds a multi-doc YAML stream. */
+    readonly docs?: ReadonlyArray<DocDiff>;
+};
+export interface DiffResult {
+    readonly entries: ReadonlyArray<FileDiff>;
+}
+export interface DiffFilesInput {
+    readonly left: Readonly<Record<string, string>>;
+    readonly right: Readonly<Record<string, string>>;
+    readonly options?: RedactOptions;
+}
+export declare const diffFiles: (input: DiffFilesInput) => DiffResult;
+export declare const hasDifferences: (result: DiffResult) => boolean;
+export type DiffFormat = "summary" | "detail" | "json";
+export interface FormatDiffInput {
+    readonly result: DiffResult;
+    readonly format?: DiffFormat;
+}
+export declare const formatDiff: (input: FormatDiffInput) => string;

package/dist/images.d.ts

@@ -0,0 +1,44 @@
+import { Effect, Schema } from "effect";
+export declare const EnvImages: Schema.$Record<Schema.String, Schema.String>;
+export type EnvImages = typeof EnvImages.Type;
+export declare const ImagesConfig: Schema.Struct<{
+    readonly envs: Schema.$Record<Schema.String, Schema.$Record<Schema.String, Schema.String>>;
+}>;
+export type ImagesConfig = typeof ImagesConfig.Type;
+export declare const decodeImagesSync: (input: unknown) => ImagesConfig;
+export declare const decodeImagesEffect: (input: unknown) => Effect.Effect<{
+    readonly envs: {
+        readonly [x: string]: {
+            readonly [x: string]: string;
+        };
+    };
+}, Schema.SchemaError, never>;
+declare const ImagesEnvMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ImagesEnvMissing";
+} & Readonly<A>;
+export declare class ImagesEnvMissing extends ImagesEnvMissing_base<{
+    readonly env: string;
+}> {
+}
+export interface LookupEnvInput {
+    readonly cfg: ImagesConfig;
+    readonly env: string;
+}
+export declare const lookupEnv: (input: LookupEnvInput) => EnvImages | undefined;
+export declare const lookupEnvEffect: (input: LookupEnvInput) => Effect.Effect<EnvImages, ImagesEnvMissing>;
+export declare const imagesFor: (input: LookupEnvInput) => EnvImages;
+declare const ImagesAppMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ImagesAppMissing";
+} & Readonly<A>;
+export declare class ImagesAppMissing extends ImagesAppMissing_base<{
+    readonly env: string;
+    readonly app: string;
+}> {
+}
+export interface RequireImageInput {
+    readonly e: EnvImages;
+    readonly app: string;
+    readonly envName: string;
+}
+export declare const requireImage: (input: RequireImageInput) => string;
+export {};

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+export { brand, unsafeCoerce } from "./_cast";
+export { boundary } from "./boundary";
+export type { BundleHandle, BundleSetResult } from "./Bundle";
+export * as Bundle from "./Bundle";
+export * as Compose from "./Compose";
+export type { BuiltImageRefApp, ConfigMapRef, ConfigMapRefKeys, ConfigMapRefName, Need, Provide, PvcRef, PvcRefName, SecretRef, SecretRefKeys, SecretRefName, SecretRefNamespace, ServiceAccountRef } from "./deps";
+export * as Dep from "./deps";
+export { BuiltImageRef } from "./deps";
+export { deepEqual, diffFiles, type DiffFormat, type DiffResult, type DocDiff, type FileDiff, formatDiff, hasDifferences, parseYaml, parseYamlAll, redact, type RedactOptions } from "./diff";
+export * as Helm from "./Helm";
+export { decodeImagesEffect, decodeImagesSync, EnvImages, ImagesAppMissing, ImagesConfig, ImagesEnvMissing, imagesFor, lookupEnv, lookupEnvEffect, requireImage } from "./images";
+export { ClusterSpec, CrdConfig, decodeKonfigConfigEffect, decodeKonfigConfigSync, DiffConfig, EnvEntry, HelmConfig, KonfigConfig, OutDir, type ResolvedKonfigConfig, ServicesConfig } from "./konfigConfig";
+export type { EmbedYamlSource, RawYaml } from "./Manifest";
+export * as Manifest from "./Manifest";
+export * as Module from "./Module";
+export { render, type RenderOptions } from "./render";
+export { RenderContext } from "./RenderContext";
+export { type AnyRenderError, BoundaryDecodeError, CrdExtractError, EmbedYamlReadError, HelmDigestMismatch, HelmRenderError, HelmVersionTooLow, RenderError } from "./RenderError";
+export { renderManifest } from "./renderManifest";
+export { ProcessError, runProcessExit, runProcessString } from "./subprocess";
+export * as Yaml from "./yaml";