@konfig.ts/core 0.0.1

package/dist/index.mjs

@@ -0,0 +1,1182 @@
+import { Config, Context, Data, Effect, Layer, Schema, Stream } from "effect";
+import * as YAML from "yaml";
+import { FileSystem } from "effect/FileSystem";
+import { Path } from "effect/Path";
+import { ChildProcess } from "effect/unstable/process";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { NodeRuntime, NodeServices } from "@effect/platform-node";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/_cast.ts
+/**
+* Nominal-typing primitive — attach a phantom brand to a string value.
+* Used by `Dep.*Ref` constructors and the like. Safe by construction:
+* the brand is a type-only label that the caller stamps on themselves.
+*/
+const brand = (value) => value;
+/**
+* Unsafe escape hatch — claim a value has type `T` without runtime
+* proof. Every call site MUST pass a one-line `reason` explaining why
+* the cast is sound (e.g. "variance erasure", "runtime narrowed via
+* _tag check", "Object.keys is string[]"). Audit by grepping for
+* `unsafeCoerce(` and reading the reasons.
+*
+* For values crossing a trust boundary (external command output, file
+* contents, network payloads), prefer `boundary` from
+* `@konfig.ts/core/boundary` — it produces a `BoundaryDecodeError`
+* instead of silently accepting the claim.
+*
+* The `reason` parameter is intentionally not used at runtime; it
+* documents intent for readers and audits.
+*/
+const unsafeCoerce = (value, _reason) => value;
+//#endregion
+//#region src/RenderError.ts
+var RenderError = class extends Data.TaggedError("RenderError") {};
+var EmbedYamlReadError = class extends Data.TaggedError("EmbedYamlReadError") {};
+var BoundaryDecodeError = class extends Data.TaggedError("BoundaryDecodeError") {};
+var HelmVersionTooLow = class extends Data.TaggedError("HelmVersionTooLow") {
+	get message() {
+		return `Helm CLI too old: requires >= ${this.required}, found ${this.found}`;
+	}
+};
+var HelmRenderError = class extends Data.TaggedError("HelmRenderError") {};
+var HelmDigestMismatch = class extends Data.TaggedError("HelmDigestMismatch") {
+	get message() {
+		return `Helm chart ${this.chart}@${this.version} digest mismatch: expected ${this.expected}, got ${this.actual}`;
+	}
+};
+var CrdExtractError = class extends Data.TaggedError("CrdExtractError") {};
+//#endregion
+//#region src/boundary.ts
+const boundary = (input) => (value) => Schema.decodeUnknownEffect(input.schema)(value).pipe(Effect.mapError((cause) => new BoundaryDecodeError({
+	schema: input.label ?? "boundary",
+	cause
+})));
+//#endregion
+//#region src/Compose.ts
+var Compose_exports = /* @__PURE__ */ __exportAll({
+	composeLayers: () => composeLayers,
+	makeResidualEntrypoint: () => makeResidualEntrypoint
+});
+/**
+* Runtime layer composition — `reduce(Layer.provideMerge)`. Each
+* successive module receives every prior module's Out as available
+* services. The runtime type collapses to a bottom Layer; the per-module
+* Out/In is tracked statically by `ResidualIn`.
+*/
+const composeLayers = (modules) => {
+	return modules.reduce((acc, mod) => unsafeCoerce(Layer.provideMerge(unsafeCoerce(mod.layer, "handle.layer carries its narrow type at the call site; the fold collapses to AnyLayer here"), acc), "Layer.provideMerge's return type is per-call; the fold accumulator stays AnyLayer"), unsafeCoerce(Layer.empty, "Layer.empty has type Layer<never, never, never>; widening to AnyLayer is a no-op at runtime"));
+};
+/**
+* Build an `entrypoint` function bound to a specific API name. The
+* returned function accepts only programs whose `R` channel reduces to
+* `Manifest.RenderServices`; otherwise the call fails at the program
+* argument with a `_konfig_unsatisfied` hint that names the missing
+* provider and the calling API.
+*/
+const makeResidualEntrypoint = (_api) => (program) => unsafeCoerce(program, "ResidualHintCheck is a phantom intersection; once the call typechecks, the runtime value is the original Effect");
+//#endregion
+//#region src/deps.ts
+var deps_exports = /* @__PURE__ */ __exportAll({
+	App: () => App,
+	Application: () => Application,
+	BuiltImageRef: () => BuiltImageRef,
+	ConfigMap: () => ConfigMap,
+	Image: () => Image,
+	Namespace: () => Namespace,
+	Pvc: () => Pvc,
+	Secret: () => Secret,
+	SecretValues: () => SecretValues,
+	ServiceAccount: () => ServiceAccount,
+	provideApplication: () => provideApplication,
+	provideConfigMap: () => provideConfigMap,
+	provideImage: () => provideImage,
+	provideNamespace: () => provideNamespace,
+	providePvc: () => providePvc,
+	provideSecret: () => provideSecret,
+	provideServiceAccount: () => provideServiceAccount
+});
+const Secret = (name) => Context.Service(`Secret:${name}`);
+const SecretValues = (name) => Context.Service(`SecretValues:${name}`);
+const ConfigMap = (name) => Context.Service(`ConfigMap:${name}`);
+const Namespace = (name) => Context.Service(`Namespace:${name}`);
+const ServiceAccount = (name) => Context.Service(`ServiceAccount:${name}`);
+const Application = (name) => Context.Service(`Application:${name}`);
+const Pvc = (name) => Context.Service(`Pvc:${name}`);
+const App = (name) => Context.Service(`App:${name}`);
+/**
+* Context.Service tag for a `BuiltImageRef<App>`. Modules that build an
+* image emit a Layer providing this service; modules that deploy a
+* container yield `Dep.Image(app)` to receive the typed ref. The
+* dep-graph residual at `AppOfApps.entrypoint` catches a missing
+* provider exactly like for `Dep.Secret`.
+*/
+const Image = (name) => Context.Service(`Image:${name}`);
+const _fullRef = (input) => brand(`${input.registry}/${input.app}:${input.tag}`);
+/**
+* `BuiltImageRef` value namespace.
+*
+*   const apiImage = BuiltImageRef.of({
+*     app: "api",
+*     registry: "ghcr.io/example",
+*     tag: "1.0.0",
+*   });
+*
+* `BuiltImageRef.of` constructs the brand from registry + app + tag.
+* The literal `app` is captured in the brand so a workload's
+* `Dep.Need<"Image", App>` matches only the build module that
+* provides this exact app.
+*/
+const BuiltImageRef = { of: (input) => _fullRef(input) };
+/**
+* Layer providing `Dep.Image(App)` for downstream consumers. Combine
+* with `Application.define` / `Module.fixedNs`'s `provides` slot to
+* have a build module surface its image to sibling workload modules
+* in the composition.
+*/
+const provideImage = (input) => Layer.succeed(Image(input.app))(_fullRef(input));
+const provideSecret = (name) => Layer.succeed(Secret(name))(brand(name));
+const provideConfigMap = (name) => Layer.succeed(ConfigMap(name))(brand(name));
+const provideNamespace = (name) => Layer.succeed(Namespace(name))(name);
+const provideServiceAccount = (name) => Layer.succeed(ServiceAccount(name))(brand(name));
+const provideApplication = (name) => Layer.succeed(Application(name))(name);
+const providePvc = (name) => Layer.succeed(Pvc(name))(brand(name));
+//#endregion
+//#region src/Bundle.ts
+var Bundle_exports = /* @__PURE__ */ __exportAll({
+	define: () => define,
+	entrypoint: () => entrypoint,
+	fromModules: () => fromModules,
+	make: () => make$1,
+	makeSet: () => makeSet,
+	target: () => target
+});
+/**
+* Mutate-attach a `.layer` field to an Effect Context.Tag — same pattern
+* `argocd/Application.ts:_attachLayerToTag` uses. A single unsafe cast
+* in the dep-graph machinery; lives here so the rest of Bundle stays
+* cast-free.
+*/
+const _attachLayerToTag = (tag, layer) => unsafeCoerce(Object.assign(tag, { layer }), "Effect Context.Tag is callable + extensible; Object.assign mutates in place and the cast widens the public type");
+const make$1 = (opts) => ({
+	name: opts.name,
+	manifests: opts.manifests,
+	...opts.namespace !== void 0 ? { namespace: opts.namespace } : {}
+});
+/**
+* Build a typed handle for a manifest bundle — a name + optional
+* namespace + a set of manifests, plus dep-graph wiring. Same
+* compile-time guarantees as argocd's `Application.define` minus
+* `source: ArgoSource` / `syncPolicy` / sync-wave annotations:
+*  - the literal `Name` flows into `Dep.Provide<"App", Name>`,
+*  - the optional literal namespace flows into `Dep.Provide<"Namespace", Ns>`,
+*  - the build callback's `R` channel becomes the handle's `In` after
+*    subtracting what this bundle provides itself.
+*
+* Pair with `Bundle.fromModules` to compose multiple bundles
+* and have the dep-graph residual checked at `Bundle.entrypoint`.
+*
+* For `Module.fixedNs` / `Module.dynamicNs` use, see `Bundle.target`
+* — it adapts this `define` so namespace is required (Module wrappers
+* always thread a namespace through), which lets the dep-graph drop
+* the `Provide<"Namespace", never>` cell the optional shape needs.
+*/
+const define = (opts) => {
+	const name = unsafeCoerce(opts.name, "LiteralName<Name> resolves to Name itself once the call typechecks");
+	const namespace = opts.namespace === void 0 ? void 0 : unsafeCoerce(opts.namespace, "LiteralName<Ns> resolves to Ns itself once the call typechecks");
+	const tag = App(name);
+	const nsLayer = namespace === void 0 ? Layer.empty : Layer.succeed(Namespace(namespace))(namespace);
+	const internalLayer = opts.provides !== void 0 ? Layer.mergeAll(nsLayer, opts.provides) : nsLayer;
+	const buildEffect = Effect.isEffect(opts.build) ? opts.build : Effect.sync(opts.build);
+	const bundleLayer = Layer.effect(tag, buildEffect.pipe(Effect.map((manifests) => make$1({
+		name,
+		...namespace !== void 0 ? { namespace } : {},
+		manifests
+	})))).pipe(Layer.provide(internalLayer));
+	return unsafeCoerce(_attachLayerToTag(tag, opts.provides !== void 0 ? Layer.mergeAll(bundleLayer, nsLayer, opts.provides) : Layer.mergeAll(bundleLayer, nsLayer)), "narrow generic BundleHandle from the attachLayerToTag helper's loose Tag arg");
+};
+/**
+* `Module.Target` adapter for `Bundle.define`. `Module.fixedNs` /
+* `Module.dynamicNs` always pass a namespace through, so this adapter
+* requires `namespace` (whereas `Bundle.define` itself accepts it as
+* optional) — pinning `Ns` to a real literal lets the dep-graph emit
+* a concrete `Provide<"Namespace", Ns>` cell on the resulting handle.
+*
+* ```ts
+* const defineCache = Module.fixedNs({
+*   target: Bundle.target,
+*   namespace: "cache",
+*   build: ({ name, namespace }) => [ ... ],
+* });
+* ```
+*/
+const target = { define: (args) => unsafeCoerce(define(args), "target requires namespace so Ns is always a string literal; under that constraint Bundle.define's _NsProvides<Ns> reduces to Provide<\"Namespace\", Ns>, matching HandleKind") };
+const makeSet = (opts) => ({
+	name: opts.name ?? "bundles",
+	bundles: opts.bundles
+});
+/**
+* Phantom check that rejects a `Bundle.fromModules` program whose `R`
+* channel still carries unmet dep-graph Needs. Bound to the
+* "Bundle.fromModules" API label so the `_konfig_unsatisfied` hint
+* guides the user to the right call site.
+*/
+const entrypoint = makeResidualEntrypoint("Bundle.fromModules");
+/**
+* One-list composition for a backend-agnostic bundle set. Yields each
+* module's `Bundle` in tuple order, then wires the merged provider layer
+* with `Compose.composeLayers`. The returned Effect's R channel is the
+* residual unmet Needs after the fold (`Compose.ResidualIn<Ms>`),
+* which `entrypoint` rejects unless empty.
+*
+* **Order matters.** List providers before their consumers. A consumer
+* placed before its provider leaves an unmet `Need` in the residual,
+* which surfaces at `entrypoint` as a `_konfig_unsatisfied` hint.
+*/
+const fromModules = (opts) => {
+	const program = Effect.gen(function* () {
+		const bundles = [];
+		for (const mod of opts.modules) {
+			const b = yield* mod;
+			bundles.push(b);
+		}
+		return makeSet({
+			name: opts.name,
+			bundles
+		});
+	});
+	const wired = composeLayers(opts.modules);
+	return unsafeCoerce(Effect.provide(program, wired), "the runtime Effect is the same; only the static R channel is narrowed to ResidualIn<Ms> by the fold-as-type");
+};
+//#endregion
+//#region src/diff.ts
+const IGNORED_LABEL_KEYS = new Set(["helm.sh/chart"]);
+const IGNORED_ANNOTATION_KEYS = new Set(["meta.helm.sh/release-name", "meta.helm.sh/release-namespace"]);
+const MANAGED_BY_HELM_LABEL = "app.kubernetes.io/managed-by";
+const _redactLabelMap = (labels) => {
+	const out = {};
+	for (const [k, v] of Object.entries(labels)) {
+		if (IGNORED_LABEL_KEYS.has(k)) continue;
+		if (k === MANAGED_BY_HELM_LABEL && v === "Helm") continue;
+		out[k] = v;
+	}
+	return out;
+};
+const _redactAnnotationMap = (annotations) => {
+	const out = {};
+	for (const [k, v] of Object.entries(annotations)) {
+		if (IGNORED_ANNOTATION_KEYS.has(k)) continue;
+		out[k] = v;
+	}
+	return out;
+};
+const _isNumericString = (s) => /^-?\d+(\.\d+)?(e[-+]?\d+)?$/i.test(s);
+/**
+* Canonicalize a parsed YAML/JSON value for structural comparison,
+* applying two normalizations:
+*
+*  1. **Null/undefined keys are dropped.** Any object key whose value is
+*     `null` or `undefined` is omitted from the redacted output. This is
+*     deliberate: it makes an *explicit* `field: null` compare equal to
+*     an *absent* `field`, which is what we want when diffing manifests
+*     where one side spells out a null default the other side simply
+*     omits. The trade-off is that a genuine "field was set to null vs.
+*     field removed" distinction is intentionally invisible to the diff.
+*  2. **Numeric normalization** (opt-in via
+*     {@link RedactOptions.normalizeNumerics}) — see that field.
+*
+* Helm metadata redaction (dropping chart-churn labels/annotations) is
+* layered on top when a `labels`/`annotations` map appears under
+* `metadata`.
+*/
+const redact = (input) => {
+	const value = input.value;
+	const parentKey = input.parentKey ?? null;
+	const options = input.options ?? {};
+	if (Array.isArray(value)) return value.map((v) => redact({
+		value: v,
+		parentKey: null,
+		options
+	}));
+	if (value !== null && typeof value === "object") {
+		const obj = unsafeCoerce(value, "typeof === object && !Array.isArray && !== null narrowed above");
+		const out = {};
+		for (const [k, v] of Object.entries(obj)) {
+			if (v === null || v === void 0) continue;
+			if (k === "labels" && parentKey === "metadata" && v !== null && typeof v === "object") {
+				out[k] = _redactLabelMap(unsafeCoerce(v, "metadata.labels is Record<string, string>"));
+				continue;
+			}
+			if (k === "annotations" && parentKey === "metadata" && v !== null && typeof v === "object") {
+				out[k] = _redactAnnotationMap(unsafeCoerce(v, "metadata.annotations is Record<string, string>"));
+				continue;
+			}
+			out[k] = redact({
+				value: v,
+				parentKey: k,
+				options
+			});
+		}
+		return out;
+	}
+	if (options.normalizeNumerics === true) {
+		if (typeof value === "string" && _isNumericString(value)) return Number(value);
+		if (typeof value === "number" && Number.isFinite(value)) return value;
+	}
+	return value;
+};
+const deepEqual = (input) => {
+	const { a, b } = input;
+	if (a === b) return true;
+	if (a === null || b === null) return false;
+	if (typeof a !== typeof b) return false;
+	if (Array.isArray(a)) {
+		if (!Array.isArray(b) || a.length !== b.length) return false;
+		for (let i = 0; i < a.length; i++) if (!deepEqual({
+			a: a[i],
+			b: b[i]
+		})) return false;
+		return true;
+	}
+	if (typeof a === "object" && typeof b === "object") {
+		const ka = Object.keys(unsafeCoerce(a, "typeof === object branch")).sort();
+		const kb = Object.keys(unsafeCoerce(b, "typeof === object branch")).sort();
+		if (ka.length !== kb.length) return false;
+		for (let i = 0; i < ka.length; i++) if (ka[i] !== kb[i]) return false;
+		for (const k of ka) {
+			const av = unsafeCoerce(a, "typeof === object branch")[k];
+			const bv = unsafeCoerce(b, "typeof === object branch")[k];
+			if (!deepEqual({
+				a: av,
+				b: bv
+			})) return false;
+		}
+		return true;
+	}
+	return false;
+};
+const parseYaml = (text) => YAML.parse(text);
+/**
+* Parse a multi-doc YAML file into an ordered list of documents. Each
+* document's parsed structure is preserved as-is. Empty / whitespace-only
+* segments are dropped, but their position is *not* preserved — only
+* present documents are returned. Use the returned index to identify
+* documents inside one file (alongside the filename) when reporting.
+*/
+const parseYamlAll = (text) => {
+	const docs = YAML.parseAllDocuments(text);
+	const out = [];
+	for (const d of docs) {
+		const value = d.toJS();
+		if (value === null || value === void 0) continue;
+		out.push(value);
+	}
+	return out;
+};
+/**
+* Identifier for a document inside a multi-doc YAML file. We key by
+* (kind, name, namespace) when those fields are present so a
+* label-only edit on a Service inside a 12-doc file diffs against the
+* same-kind/name Service in the other side, regardless of position
+* shuffle.
+*/
+const _docKey = (value, fallbackIdx) => {
+	if (value === null || typeof value !== "object") return `:doc:${fallbackIdx}`;
+	const v = unsafeCoerce(value, "typeof === object && !== null branch above narrowed value; every field access below is guarded by a typeof check");
+	const kind = typeof v.kind === "string" ? v.kind : "";
+	const name = typeof v.metadata?.name === "string" ? v.metadata.name : "";
+	const ns = typeof v.metadata?.namespace === "string" ? v.metadata.namespace : "";
+	if (kind || name) return `${kind}|${ns}|${name}`;
+	return `:doc:${fallbackIdx}`;
+};
+const _diffOne = (file, leftText, rightText, options) => {
+	const lDocs = parseYamlAll(leftText).map((v, i) => [_docKey(v, i), redact({
+		value: v,
+		options
+	})]);
+	const rDocs = parseYamlAll(rightText).map((v, i) => [_docKey(v, i), redact({
+		value: v,
+		options
+	})]);
+	if (lDocs.length <= 1 && rDocs.length <= 1) {
+		const l = lDocs[0]?.[1];
+		const r = rDocs[0]?.[1];
+		if (deepEqual({
+			a: l,
+			b: r
+		})) return {
+			_tag: "Same",
+			file
+		};
+		return {
+			_tag: "Changed",
+			file,
+			left: l,
+			right: r
+		};
+	}
+	const lByKey = new Map(lDocs);
+	const rByKey = new Map(rDocs);
+	const keys = Array.from(new Set([...lByKey.keys(), ...rByKey.keys()])).sort();
+	const docs = [];
+	let anyChange = false;
+	for (const key of keys) {
+		const l = lByKey.get(key);
+		const r = rByKey.get(key);
+		if (l === void 0) {
+			docs.push({
+				_tag: "MissingLeft",
+				key,
+				right: r
+			});
+			anyChange = true;
+		} else if (r === void 0) {
+			docs.push({
+				_tag: "MissingRight",
+				key,
+				left: l
+			});
+			anyChange = true;
+		} else if (deepEqual({
+			a: l,
+			b: r
+		})) docs.push({
+			_tag: "Same",
+			key
+		});
+		else {
+			docs.push({
+				_tag: "Changed",
+				key,
+				left: l,
+				right: r
+			});
+			anyChange = true;
+		}
+	}
+	if (!anyChange) return {
+		_tag: "Same",
+		file
+	};
+	return {
+		_tag: "Changed",
+		file,
+		left: lDocs.map((d) => d[1]),
+		right: rDocs.map((d) => d[1]),
+		docs
+	};
+};
+const diffFiles = (input) => {
+	const { left, right } = input;
+	const options = input.options ?? {};
+	const files = Array.from(new Set([...Object.keys(left), ...Object.keys(right)])).sort();
+	const entries = [];
+	for (const file of files) {
+		const hasL = Object.hasOwn(left, file);
+		const hasR = Object.hasOwn(right, file);
+		if (!hasL) {
+			entries.push({
+				_tag: "MissingLeft",
+				file
+			});
+			continue;
+		}
+		if (!hasR) {
+			entries.push({
+				_tag: "MissingRight",
+				file
+			});
+			continue;
+		}
+		entries.push(_diffOne(file, left[file] ?? "", right[file] ?? "", options));
+	}
+	return { entries };
+};
+const hasDifferences = (result) => result.entries.some((e) => e._tag !== "Same");
+const formatDiff = (input) => {
+	const { result } = input;
+	const format = input.format ?? "summary";
+	if (format === "json") return JSON.stringify(result, null, 2);
+	const changes = result.entries.filter((e) => e._tag !== "Same");
+	if (changes.length === 0) return "";
+	const lines = [];
+	for (const e of changes) {
+		if (e._tag === "MissingLeft") lines.push(`+ ${e.file}`);
+		else if (e._tag === "MissingRight") lines.push(`- ${e.file}`);
+		else lines.push(`~ ${e.file}`);
+		if (format === "detail" && e._tag === "Changed") if (e.docs && e.docs.length > 0) for (const d of e.docs) {
+			if (d._tag === "Same") continue;
+			lines.push(`  [doc ${d.key}] ${d._tag}`);
+			if (d._tag === "Changed") {
+				lines.push("    left:");
+				lines.push(...YAML.stringify(d.left, { lineWidth: 0 }).split("\n").map((l) => `      ${l}`));
+				lines.push("    right:");
+				lines.push(...YAML.stringify(d.right, { lineWidth: 0 }).split("\n").map((l) => `      ${l}`));
+			}
+		}
+		else {
+			lines.push("  left:");
+			lines.push(...YAML.stringify(e.left, { lineWidth: 0 }).split("\n").map((l) => `    ${l}`));
+			lines.push("  right:");
+			lines.push(...YAML.stringify(e.right, { lineWidth: 0 }).split("\n").map((l) => `    ${l}`));
+		}
+	}
+	return lines.join("\n");
+};
+//#endregion
+//#region src/Manifest.ts
+var Manifest_exports = /* @__PURE__ */ __exportAll({
+	ManifestTypeId: () => ManifestTypeId,
+	combine: () => combine,
+	concat: () => concat,
+	embedYaml: () => embedYaml,
+	make: () => make,
+	whenever: () => whenever
+});
+const ManifestTypeId = Symbol.for("@konfig.ts/core/Manifest");
+const variance = { _A: (_) => _ };
+const make = (run) => ({
+	[ManifestTypeId]: unsafeCoerce(variance, "phantom variance witness — A only appears in covariant position"),
+	render: (ctx) => {
+		const result = run(ctx);
+		return Effect.isEffect(result) ? unsafeCoerce(result, "Effect.isEffect narrowed `result` to an Effect; TS's narrowing doesn't carry the Effect's full type parameters") : Effect.succeed(result);
+	}
+});
+const combine = (input) => make((ctx) => Effect.all([input.a.render(ctx), input.b.render(ctx)], { concurrency: "unbounded" }));
+const concat = (...manifests) => make((ctx) => Effect.all(manifests.map((m) => m.render(ctx)), { concurrency: "unbounded" }).pipe(Effect.map((results) => results.flatMap((r) => Array.isArray(r) ? unsafeCoerce(r, "Array.isArray narrowed; element type is A by render contract") : [unsafeCoerce(r, "non-array branch carries a single A")]))));
+const whenever = (input) => make((ctx) => input.cond ? input.thunk().render(ctx) : unsafeCoerce(Effect.succeed(void 0), "undefined branch — A is the type seen by the consumer when cond=false"));
+const embedYaml = (source) => make((_ctx) => {
+	if ("literal" in source) return Effect.succeed({
+		_tag: "RawYaml",
+		content: source.literal
+	});
+	const path = source.path;
+	return Effect.gen(function* () {
+		return {
+			_tag: "RawYaml",
+			content: yield* (yield* FileSystem).readFileString(path),
+			origin: path
+		};
+	}).pipe(Effect.mapError((cause) => new EmbedYamlReadError({
+		path,
+		cause
+	})));
+});
+//#endregion
+//#region src/subprocess.ts
+/**
+* Exit code stamped on a `ProcessError` when the process never produced
+* one — i.e. the spawn itself failed (binary not found, EACCES, a stream
+* read error). Distinct from any real OS exit code.
+*/
+const SPAWN_FAILED_EXIT = -1;
+/**
+* Upper bound (in UTF-16 code units, a close proxy for bytes here) on the
+* stderr tail retained by `ProcessError` — roughly the last 2KB. Keeps a
+* failing command's diagnostics readable without pinning a runaway log in
+* memory or in the serialized error.
+*/
+const STDERR_TAIL_LIMIT = 2048;
+const _tail = (text) => text.length > STDERR_TAIL_LIMIT ? text.slice(text.length - STDERR_TAIL_LIMIT) : text;
+const _commandLabel = (command) => ChildProcess.isStandardCommand(command) ? [command.command, ...command.args].join(" ") : "<pipeline>";
+/**
+* Failure of a spawned subprocess: a non-zero exit, a spawn that never
+* started, or (for `runProcessString`) an empty stdout when a payload was
+* required. Carries the exit code and a bounded tail of stderr so callers
+* can surface a diagnostic without re-running the command.
+*
+* `command` is the program plus its already-parsed arguments; it must
+* never be interpolated with secret material by callers.
+*/
+var ProcessError = class extends Data.TaggedError("ProcessError") {
+	get message() {
+		const tail = this.stderrTail.trim();
+		const suffix = tail.length > 0 ? `: ${tail}` : "";
+		return `command \`${this.command}\` failed (exit ${this.exitCode})${suffix}`;
+	}
+};
+const _collect = (stream) => Stream.mkString(Stream.decodeText(stream));
+/**
+* Spawn `command` exactly once and, concurrently, drain stdout and stderr
+* to strings while awaiting the exit code. Draining both pipes alongside
+* `exitCode` avoids the classic pipe-buffer deadlock. A spawn/stream
+* failure (PlatformError) is folded into a `ProcessError` so callers see a
+* single error channel.
+*/
+const _spawnCollect = (command) => Effect.scoped(Effect.gen(function* () {
+	const handle = yield* (yield* ChildProcessSpawner).spawn(command);
+	const [exitCode, stdout, stderr] = yield* Effect.all([
+		handle.exitCode,
+		_collect(handle.stdout),
+		_collect(handle.stderr)
+	], { concurrency: "unbounded" });
+	return {
+		exitCode,
+		stdout,
+		stderr
+	};
+})).pipe(Effect.mapError((cause) => new ProcessError({
+	command: _commandLabel(command),
+	exitCode: SPAWN_FAILED_EXIT,
+	stderrTail: _tail(String(cause))
+})));
+/**
+* Run `command` and return its stdout, checking the exit code — the guard
+* that `spawner.string` omits. Fails with `ProcessError` (carrying the
+* stderr tail) on any non-zero exit. Unless `allowEmptyStdout` is `true`,
+* also fails when the trimmed stdout is empty, so a silently-failing
+* command can never masquerade as an empty-but-successful result.
+*/
+const runProcessString = (command, options) => Effect.gen(function* () {
+	const result = yield* _spawnCollect(command);
+	if (result.exitCode !== 0) return yield* Effect.fail(new ProcessError({
+		command: _commandLabel(command),
+		exitCode: result.exitCode,
+		stderrTail: _tail(result.stderr)
+	}));
+	if (options?.allowEmptyStdout !== true && result.stdout.trim().length === 0) return yield* Effect.fail(new ProcessError({
+		command: _commandLabel(command),
+		exitCode: result.exitCode,
+		stderrTail: _tail(result.stderr)
+	}));
+	return result.stdout;
+});
+/**
+* Run `command` for its success/failure only — stdout is drained (to avoid
+* a pipe deadlock) but discarded. Fails with `ProcessError` on any
+* non-zero exit, attaching the stderr tail when present.
+*/
+const runProcessExit = (command) => Effect.gen(function* () {
+	const result = yield* _spawnCollect(command);
+	if (result.exitCode !== 0) return yield* Effect.fail(new ProcessError({
+		command: _commandLabel(command),
+		exitCode: result.exitCode,
+		stderrTail: _tail(result.stderr)
+	}));
+});
+//#endregion
+//#region src/Helm.ts
+var Helm_exports = /* @__PURE__ */ __exportAll({ release: () => release });
+const CLUSTER_SCOPED_KINDS = new Set([
+	"APIService",
+	"ClusterRole",
+	"ClusterRoleBinding",
+	"ComponentStatus",
+	"CSIDriver",
+	"CSINode",
+	"CustomResourceDefinition",
+	"FlowSchema",
+	"IngressClass",
+	"MutatingWebhookConfiguration",
+	"Namespace",
+	"Node",
+	"PersistentVolume",
+	"PodSecurityPolicy",
+	"PriorityClass",
+	"PriorityLevelConfiguration",
+	"RuntimeClass",
+	"StorageClass",
+	"ValidatingAdmissionPolicy",
+	"ValidatingAdmissionPolicyBinding",
+	"ValidatingWebhookConfiguration",
+	"VolumeAttachment"
+]);
+const _asDocShape = (value) => value !== null && typeof value === "object" ? unsafeCoerce(value, "parseYamlAll returned a parsed document object; the kind/metadata reads below are each typeof-guarded") : null;
+/**
+* Turn `helm template` stdout into individual `RawYaml` docs.
+*
+* Document boundaries come from the shared `parseYamlAll`
+* (`YAML.parseAllDocuments`) helper rather than a naive `/^---$/m` split,
+* so a `---` appearing inside a block scalar can't spuriously split one
+* manifest into two. `parseYamlAll` also drops empty / comment-only
+* segments for us.
+*
+* When a `namespace` is supplied, each namespaced-kind document that
+* lacks an explicit namespace is patched to carry it (the re-parse
+* branch behavior). Cluster-scoped kinds and documents that already pin
+* a namespace are left untouched.
+*/
+const _parseHelmOutput = (input) => Effect.sync(() => {
+	const { output, chart, version, namespace } = input;
+	const origin = `helm:${chart}@${version}`;
+	const results = [];
+	for (const parsed of parseYamlAll(output)) {
+		let value = parsed;
+		if (namespace !== void 0) {
+			const shape = _asDocShape(parsed);
+			if (shape !== null && typeof shape.kind === "string" && !CLUSTER_SCOPED_KINDS.has(shape.kind) && (shape.metadata?.namespace === void 0 || shape.metadata.namespace === "")) value = {
+				...shape,
+				metadata: {
+					...shape.metadata,
+					namespace
+				}
+			};
+		}
+		let content = `---\n${YAML.stringify(value, { lineWidth: 0 })}`;
+		if (!content.endsWith("\n")) content += "\n";
+		results.push({
+			_tag: "RawYaml",
+			content,
+			origin
+		});
+	}
+	return results;
+});
+const _HELM_VERSION_RE = /v?(\d+)\.(\d+)\.(\d+)/;
+/** Extract a `major.minor.patch` triple from a version string, or `null`. */
+const _parseVersionTriple = (text) => {
+	const m = _HELM_VERSION_RE.exec(text.trim());
+	if (m === null) return null;
+	return [
+		Number(m[1]),
+		Number(m[2]),
+		Number(m[3])
+	];
+};
+/** True when `found` is strictly older than `min` (release triple compare). */
+const _isBelow = (found, min) => {
+	for (let i = 0; i < 3; i++) {
+		const f = found[i] ?? 0;
+		const m = min[i] ?? 0;
+		if (f < m) return true;
+		if (f > m) return false;
+	}
+	return false;
+};
+/**
+* One-shot `helm version --short` preflight. Fails `HelmVersionTooLow`
+* when helm is absent/unparseable or older than `minVersion`. Pre-release
+* / build metadata on the installed version is ignored — only the release
+* triple gates the check.
+*/
+const _assertHelmMinVersion = (minVersion) => Effect.gen(function* () {
+	const stdout = yield* runProcessString(ChildProcess.make("helm", ["version", "--short"]), { allowEmptyStdout: false }).pipe(Effect.mapError(() => new HelmVersionTooLow({
+		required: minVersion,
+		found: "not found"
+	})));
+	const found = _parseVersionTriple(stdout);
+	const min = _parseVersionTriple(minVersion);
+	if (found === null || min !== null && _isBelow(found, min)) return yield* Effect.fail(new HelmVersionTooLow({
+		required: minVersion,
+		found: stdout.trim()
+	}));
+});
+const _normalizeDigest = (digest) => digest.startsWith("sha256:") ? digest : `sha256:${digest}`;
+const _toHex = (buf) => {
+	const view = new Uint8Array(buf);
+	let hex = "";
+	for (let i = 0; i < view.length; i++) hex += (view[i] ?? 0).toString(16).padStart(2, "0");
+	return hex;
+};
+/**
+* SHA-256 the file at `filePath` via Web Crypto API (`crypto.subtle.digest`).
+* `crypto.subtle` is a runtime global on Node ≥ 20 and on Bun; no
+* `node:crypto` import is needed, which keeps the file portable across
+* the runtimes Effect targets.
+*/
+const _hashFile = (filePath) => Effect.gen(function* () {
+	const bytes = yield* (yield* FileSystem).readFile(filePath);
+	const subtle = unsafeCoerce(globalThis, "globalThis.crypto is provided by the runtime (Node ≥ 20, Bun) — typed via local _CryptoGlobal interface").crypto.subtle;
+	return `sha256:${_toHex(yield* Effect.promise(() => subtle.digest("SHA-256", bytes)))}`;
+});
+const _verifyDigest = (input) => Effect.gen(function* () {
+	const fs = yield* FileSystem;
+	const expected = _normalizeDigest(input.opts.digest);
+	const actual = yield* _hashFile(input.cachedTgz);
+	if (expected !== actual) {
+		yield* fs.remove(input.cachedTgz).pipe(Effect.ignore);
+		return yield* Effect.fail(new HelmDigestMismatch({
+			chart: input.opts.chart,
+			version: input.opts.version,
+			expected,
+			actual
+		}));
+	}
+});
+const _ensureCachedTarball = (input) => Effect.gen(function* () {
+	const { opts, cacheDir, cachedTgz } = input;
+	const fs = yield* FileSystem;
+	const path = yield* Path;
+	if (yield* fs.exists(cachedTgz)) {
+		yield* _verifyDigest({
+			opts,
+			cachedTgz
+		});
+		return;
+	}
+	const beforeFiles = new Set(yield* fs.readDirectory(cacheDir).pipe(Effect.orElseSucceed(() => [])));
+	yield* runProcessExit(ChildProcess.make("helm", [
+		"pull",
+		"--repo",
+		opts.repo,
+		opts.chart,
+		"--version",
+		opts.version,
+		"--destination",
+		cacheDir
+	]));
+	const candidates = (yield* fs.readDirectory(cacheDir)).filter((f) => f.endsWith(".tgz") && f.startsWith(opts.chart) && !beforeFiles.has(f) && path.join(cacheDir, f) !== cachedTgz);
+	if (candidates.length > 0) yield* fs.rename(path.join(cacheDir, candidates[0] ?? ""), cachedTgz);
+	yield* _verifyDigest({
+		opts,
+		cachedTgz
+	});
+});
+const release = (opts) => {
+	const extraOpts = opts.extraOpts ?? [];
+	return make(() => Effect.gen(function* () {
+		const fs = yield* FileSystem;
+		const path = yield* Path;
+		if (opts.minVersion !== void 0) yield* _assertHelmMinVersion(opts.minVersion);
+		const cacheDir = yield* Config.string("KONFIG_HELM_CACHE").pipe(Config.withDefault(path.resolve(".konfig", "helm-cache")));
+		yield* fs.makeDirectory(cacheDir, { recursive: true });
+		const digestSuffix = opts.digest.replace(/^sha256:/, "").slice(0, 12);
+		const cachedTgz = path.join(cacheDir, `${opts.chart}-${opts.version}-${digestSuffix}.tgz`);
+		yield* _ensureCachedTarball({
+			opts,
+			cacheDir,
+			cachedTgz
+		});
+		const tmpDir = yield* fs.makeTempDirectoryScoped({ prefix: "konfig-helm-" });
+		const valuesFile = path.join(tmpDir, "values.yaml");
+		yield* fs.writeFileString(valuesFile, YAML.stringify(opts.values, { lineWidth: 0 }));
+		const releaseName = opts.releaseName ?? opts.chart;
+		return yield* _parseHelmOutput({
+			output: yield* runProcessString(ChildProcess.make("helm", [
+				"template",
+				releaseName,
+				cachedTgz,
+				"--values",
+				valuesFile,
+				...opts.namespace !== void 0 ? ["--namespace", opts.namespace] : [],
+				...extraOpts
+			]), { allowEmptyStdout: false }),
+			chart: opts.chart,
+			version: opts.version,
+			namespace: opts.namespace
+		});
+	}).pipe(Effect.scoped, Effect.mapError((cause) => cause instanceof HelmVersionTooLow ? cause : new HelmRenderError({
+		chart: opts.chart,
+		version: opts.version,
+		cause
+	}))));
+};
+//#endregion
+//#region src/images.ts
+const EnvImages = Schema.Record(Schema.String, Schema.String);
+const ImagesConfig = Schema.Struct({ envs: Schema.Record(Schema.String, EnvImages) });
+const decodeEff$1 = Schema.decodeUnknownEffect(ImagesConfig);
+const strict$1 = { onExcessProperty: "error" };
+const decodeImagesSync = (input) => Effect.runSync(decodeEff$1(input, strict$1));
+const decodeImagesEffect = (input) => decodeEff$1(input, strict$1);
+var ImagesEnvMissing = class extends Data.TaggedError("ImagesEnvMissing") {};
+const lookupEnv = (input) => input.cfg.envs[input.env];
+const lookupEnvEffect = (input) => {
+	const e = input.cfg.envs[input.env];
+	return e === void 0 ? Effect.fail(new ImagesEnvMissing({ env: input.env })) : Effect.succeed(e);
+};
+const imagesFor = (input) => {
+	const e = input.cfg.envs[input.env];
+	if (e === void 0) throw new ImagesEnvMissing({ env: input.env });
+	return e;
+};
+var ImagesAppMissing = class extends Data.TaggedError("ImagesAppMissing") {};
+const requireImage = (input) => {
+	const v = input.e[input.app];
+	if (v === void 0) throw new ImagesAppMissing({
+		env: input.envName,
+		app: input.app
+	});
+	return v;
+};
+//#endregion
+//#region src/konfigConfig.ts
+const _stringWithKeyDefault = (def) => Schema.String.pipe(Schema.optionalKey, Schema.withDecodingDefaultKey(Effect.succeed(def)));
+const _stringArrayWithKeyDefault = (def) => Schema.Array(Schema.String).pipe(Schema.optionalKey, Schema.withDecodingDefaultKey(Effect.succeed(def)));
+const EnvEntry = Schema.Struct({ entry: Schema.String });
+const OutDir = Schema.Struct({ manifests: Schema.String });
+const CrdConfig = Schema.Struct({ outDir: _stringWithKeyDefault(".generated/crd") });
+const HelmConfig = Schema.Struct({
+	cacheDir: _stringWithKeyDefault(".konfig/helm-cache"),
+	minVersion: _stringWithKeyDefault("3.16.0")
+});
+const ClusterSpec = Schema.Struct({
+	registry: Schema.optionalKey(Schema.String),
+	ingressClass: Schema.optionalKey(Schema.String),
+	storageClass: Schema.optionalKey(Schema.String),
+	repositoryUrl: Schema.optionalKey(Schema.String)
+});
+const DiffConfig = Schema.Struct({ baseline: Schema.String });
+const ServicesConfig = Schema.Struct({
+	outFile: Schema.optionalKey(Schema.String),
+	globalPaths: _stringArrayWithKeyDefault([])
+});
+const KonfigConfig = Schema.Struct({
+	root: Schema.String,
+	cluster: _stringWithKeyDefault("cluster.ts"),
+	modules: _stringWithKeyDefault("modules"),
+	charts: _stringWithKeyDefault("charts"),
+	envs: Schema.Record(Schema.String, EnvEntry),
+	outDir: OutDir,
+	crd: Schema.optionalKey(CrdConfig).pipe(Schema.withDecodingDefaultKey(Effect.succeed({ outDir: ".generated/crd" }))),
+	helm: Schema.optionalKey(HelmConfig).pipe(Schema.withDecodingDefaultKey(Effect.succeed({
+		cacheDir: ".konfig/helm-cache",
+		minVersion: "3.16.0"
+	}))),
+	diff: Schema.optionalKey(DiffConfig),
+	services: Schema.optionalKey(ServicesConfig),
+	clusters: Schema.optionalKey(Schema.Record(Schema.String, ClusterSpec))
+});
+const strict = { onExcessProperty: "error" };
+const decodeEff = Schema.decodeUnknownEffect(KonfigConfig);
+const decodeKonfigConfigSync = (input) => Effect.runSync(decodeEff(input, strict));
+const decodeKonfigConfigEffect = (input) => decodeEff(input, strict);
+//#endregion
+//#region src/Module.ts
+var Module_exports = /* @__PURE__ */ __exportAll({
+	dynamicNs: () => dynamicNs,
+	fixedNs: () => fixedNs
+});
+const _liftBuild = (result) => Effect.isEffect(result) ? result : Effect.succeed(result);
+/**
+* Build a typed wrapper for a module whose namespace is part of its
+* identity (e.g. `cert-manager` always installs into `cert-manager`).
+*
+* `target` is the backend adapter — typically `Application.target`
+* (argocd) or `Bundle.target` (k8s). The wrapper's call signature
+* merges the backend's per-instance fields (`source` for argocd,
+* none for bundle) with the user-defined `Opts`.
+*
+* ```ts
+* const defineSops = Module.fixedNs({
+*   target: Application.target,
+*   namespace: "sops",
+*   annotations: Sync.wave(-1),
+*   build: ({ namespace }, _opts: Record<never, never>) => [
+*     Namespace.make({ name: namespace }),
+*     Helm.release({ ... }),
+*   ],
+* });
+*
+* const sops = defineSops({ name: "sops-operator", source: src("sops") });
+* ```
+*/
+const fixedNs = (config) => {
+	const { target, namespace, provides, build, ...extraConfig } = unsafeCoerce(config, "Record spread shape mirrors the FixedNsConfig & ExtraConfig intersection");
+	const adapter = unsafeCoerce(target, "target was destructured from config without preserving its typed shape; reattach the constraint");
+	return (args) => {
+		const { name, ...rest } = unsafeCoerce(args, "destructuring the wrapper args; rest carries ExtraCallArgs & Opts as a flat record");
+		const buildResult = build({
+			name: unsafeCoerce(name, "LiteralName<Name> resolves to Name itself once the wrapper call typechecks"),
+			namespace
+		}, unsafeCoerce(rest, "rest carries Opts fields; ExtraCallArgs flow to target.define below"));
+		return adapter.define(unsafeCoerce({
+			...extraConfig,
+			...rest,
+			name,
+			namespace: unsafeCoerce(namespace, "Ns is a const string literal; LiteralName<Ns> resolves to Ns itself"),
+			build: _liftBuild(buildResult),
+			...provides !== void 0 ? { provides } : {}
+		}, "the assembled object structurally matches the target's define-args; spread layout matches the intersection"));
+	};
+};
+/**
+* Build a typed wrapper for a module whose namespace is chosen per
+* instance (e.g. an `api` module deployed into different namespaces
+* per env).
+*
+* ```ts
+* const defineApi = Module.dynamicNs({
+*   target: Application.target,
+*   annotations: Sync.wave(1),
+*   build: ({ name, namespace }, opts: ApiOpts) => [ ... ],
+* });
+*
+* const api = defineApi({
+*   name: "api",
+*   namespace: "prod",
+*   source: src("api"),
+*   replicas: 2,
+* });
+* ```
+*/
+const dynamicNs = (config) => {
+	const { target, provides, build, ...extraConfig } = unsafeCoerce(config, "Record spread shape mirrors the DynamicNsConfig & ExtraConfig intersection");
+	const adapter = unsafeCoerce(target, "target was destructured from config without preserving its typed shape; reattach the constraint");
+	return (args) => {
+		const { name, namespace, ...rest } = unsafeCoerce(args, "destructuring the wrapper args; rest carries ExtraCallArgs & Opts as a flat record");
+		const buildResult = build({
+			name: unsafeCoerce(name, "LiteralName<Name> resolves to Name itself once the wrapper call typechecks"),
+			namespace: unsafeCoerce(namespace, "LiteralName<Ns> resolves to Ns itself once the wrapper call typechecks")
+		}, unsafeCoerce(rest, "rest carries Opts fields; ExtraCallArgs flow to target.define below"));
+		return adapter.define(unsafeCoerce({
+			...extraConfig,
+			...rest,
+			name,
+			namespace,
+			build: _liftBuild(buildResult),
+			...provides !== void 0 ? { provides } : {}
+		}, "the assembled object structurally matches the target's define-args; spread layout matches the intersection"));
+	};
+};
+//#endregion
+//#region src/RenderContext.ts
+const RenderContext = {
+	make: (env) => ({ env }),
+	makeFull: (input) => ({
+		env: input.env,
+		...input.cluster !== void 0 ? { cluster: input.cluster } : {},
+		...input.k8sVersion !== void 0 ? { k8sVersion: input.k8sVersion } : {},
+		...input.flags !== void 0 ? { flags: input.flags } : {}
+	})
+};
+//#endregion
+//#region src/render.ts
+/** @internal */
+const _resolveEnv = (env) => env ?? "prod";
+/** @internal */
+const _buildLayers = (extra) => extra === void 0 ? NodeServices.layer : Layer.mergeAll(NodeServices.layer, extra);
+/**
+* @internal
+* Compose the ctx + layers wiring `render` hands to `NodeRuntime.runMain`
+* into a single runnable Effect (context fully provided). Extracted so
+* tests can exercise the composition with `Effect.runPromise` instead of
+* `runMain`, which would exit the process.
+*/
+const _compose = (program, options = {}) => {
+	const ctx = RenderContext.make(_resolveEnv(options.env));
+	const layers = _buildLayers(options.layers);
+	return program(ctx).pipe(Effect.scoped, Effect.provide(layers));
+};
+/**
+* Run a render program against `NodeRuntime`.
+*
+* The callback receives a `RenderContext` keyed on `options.env`
+* (default `"prod"`) and returns an Effect whose only required
+* services are `NodeServices` and whatever the caller supplies via
+* `options.layers`. `render` provides both, wraps in `Effect.scoped`,
+* and hands off to `NodeRuntime.runMain`.
+*
+* Replaces the per-file `NodeRuntime.runMain(program.pipe(...))`
+* boilerplate every example used to repeat.
+*/
+const render = (program, options = {}) => {
+	NodeRuntime.runMain(_compose(program, options));
+};
+//#endregion
+//#region src/renderManifest.ts
+const renderManifest = (input) => input.manifest.render(input.ctx);
+//#endregion
+//#region src/yaml/serialize.ts
+const ORDER_ROOT = [
+	"apiVersion",
+	"kind",
+	"metadata",
+	"spec",
+	"status"
+];
+const ORDER_METADATA = [
+	"name",
+	"namespace",
+	"labels",
+	"annotations"
+];
+const _reorderObject = (input) => {
+	const { obj, depth, parentKey } = input;
+	const keys = Object.keys(obj).filter((k) => obj[k] !== null && obj[k] !== void 0);
+	const order = depth === 0 ? ORDER_ROOT : depth === 1 && parentKey === "metadata" ? ORDER_METADATA : null;
+	let sortedKeys;
+	if (order !== null) {
+		const known = order.filter((k) => keys.includes(k));
+		const rest = keys.filter((k) => !order.includes(k)).sort();
+		sortedKeys = [...known, ...rest];
+	} else sortedKeys = keys.slice().sort();
+	const out = {};
+	for (const k of sortedKeys) out[k] = _normalize({
+		value: obj[k],
+		depth: depth + 1,
+		parentKey: k
+	});
+	return out;
+};
+const _normalize = (input) => {
+	const { value, depth, parentKey } = input;
+	if (value === null || value === void 0) return value;
+	if (Array.isArray(value)) return value.map((v) => _normalize({
+		value: v,
+		depth: depth + 1,
+		parentKey: null
+	}));
+	if (typeof value === "object") return _reorderObject({
+		obj: unsafeCoerce(value, "typeof === object branch (value !== null, !Array.isArray above) — treated as a keyed record for reordering"),
+		depth,
+		parentKey
+	});
+	return value;
+};
+const serialize = (input) => {
+	const normalized = _normalize({
+		value: input.value,
+		depth: 0,
+		parentKey: null
+	});
+	const lf = YAML.stringify(normalized, {
+		indent: 2,
+		indentSeq: true,
+		lineWidth: 0,
+		minContentWidth: 0,
+		defaultStringType: "PLAIN",
+		defaultKeyType: "PLAIN",
+		nullStr: "null",
+		version: "1.1"
+	}).replace(/\r\n/g, "\n").replace(/\s+$/g, "");
+	return input.trailingNewline ?? true ? `${lf}\n` : lf;
+};
+/**
+* Derive the on-disk filename (`<Kind>-<name>.yaml`) for a rendered
+* resource.
+*
+* **Precondition (caller invariant):** `resource.kind` and
+* `resource.metadata.name` MUST both be non-empty strings. A rendered
+* Kubernetes object always satisfies this, so callers are expected to
+* validate/decode the object *before* reaching this point (the CLI keys
+* files by kind+name only for objects it has already confirmed carry
+* both fields).
+*
+* Because the precondition is a caller invariant rather than runtime
+* input, a violation is a programming error: this throws synchronously
+* (a defect) instead of returning a typed error. It is deliberately kept
+* out of the `AnyRenderError` channel — do not route untrusted resources
+* through it; narrow them first.
+*
+* @throws {Error} if `kind` or `metadata.name` is missing or empty.
+*/
+const filenameFor = (resource) => {
+	const kind = resource.kind;
+	const name = resource.metadata?.name;
+	if (typeof kind !== "string" || kind.length === 0) throw new Error(`filenameFor: resource has no string kind`);
+	if (typeof name !== "string" || name.length === 0) throw new Error(`filenameFor: resource '${kind}' has no metadata.name`);
+	return `${kind}-${_sanitizeNameForFilename(name)}.yaml`;
+};
+const _sanitizeNameForFilename = (name) => name.replace(/[./]/g, "-");
+//#endregion
+//#region src/yaml/index.ts
+var yaml_exports = /* @__PURE__ */ __exportAll({
+	filenameFor: () => filenameFor,
+	serialize: () => serialize
+});
+//#endregion
+export { BoundaryDecodeError, BuiltImageRef, Bundle_exports as Bundle, ClusterSpec, Compose_exports as Compose, CrdConfig, CrdExtractError, deps_exports as Dep, DiffConfig, EmbedYamlReadError, EnvEntry, EnvImages, Helm_exports as Helm, HelmConfig, HelmDigestMismatch, HelmRenderError, HelmVersionTooLow, ImagesAppMissing, ImagesConfig, ImagesEnvMissing, KonfigConfig, Manifest_exports as Manifest, Module_exports as Module, OutDir, ProcessError, RenderContext, RenderError, ServicesConfig, yaml_exports as Yaml, boundary, brand, decodeImagesEffect, decodeImagesSync, decodeKonfigConfigEffect, decodeKonfigConfigSync, deepEqual, diffFiles, formatDiff, hasDifferences, imagesFor, lookupEnv, lookupEnvEffect, parseYaml, parseYamlAll, redact, render, renderManifest, requireImage, runProcessExit, runProcessString, unsafeCoerce };
+
+//# sourceMappingURL=index.mjs.map