@konfig.ts/k8s 0.0.1

package/dist/ports.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Branded port name — a string carrying the literal `N` in its type.
+ * Constructed by `Port.make({ name, containerPort })` and `Port.ref(name)`.
+ * The brand lets probes and Service `targetPort` constrain their
+ * `port` field to a member of the container's declared port-name union
+ * rather than `string`.
+ */
+declare const PortNameBrand: unique symbol;
+export type PortName<N extends string> = string & {
+    readonly [PortNameBrand]: N;
+};
+export type ContainerProtocol = "TCP" | "UDP" | "SCTP";
+export interface ContainerPort<N extends string = string> {
+    readonly containerPort: number;
+    readonly name?: PortName<N>;
+    readonly protocol?: ContainerProtocol;
+    readonly hostPort?: number;
+    readonly hostIP?: string;
+}
+export interface PortInput<N extends string> {
+    readonly name: N;
+    readonly containerPort: number;
+    readonly protocol?: ContainerProtocol;
+    readonly hostPort?: number;
+    readonly hostIP?: string;
+}
+/**
+ * `Port` value namespace.
+ *
+ *   ports: [Port.make({ name: "http", containerPort: 8080 })],
+ *   readinessProbe: { httpGet: { port: Port.ref("http") } },
+ *
+ * - `Port.make(input)` constructs a named container port; the literal
+ *   `name` is captured in the returned `ContainerPort<N>` brand so
+ *   `Container` can infer the port-name union and constrain
+ *   cross-references (probes, Service.targetPort).
+ * - `Port.ref(name)` returns the brand alone, for probe targets and
+ *   `targetPort` references that need to name an existing declared port.
+ */
+export declare const Port: {
+    make: <const N extends string>(input: PortInput<N>) => ContainerPort<N>;
+    ref: <const N extends string>(name: N) => PortName<N>;
+};
+export interface HttpHeader {
+    readonly name: string;
+    readonly value: string;
+}
+export interface HttpGetAction<Ports extends string> {
+    readonly path?: string;
+    readonly port: number | PortName<Ports>;
+    readonly host?: string;
+    readonly scheme?: "HTTP" | "HTTPS";
+    readonly httpHeaders?: ReadonlyArray<HttpHeader>;
+}
+export interface TcpSocketAction<Ports extends string> {
+    readonly port: number | PortName<Ports>;
+    readonly host?: string;
+}
+export interface GrpcAction<Ports extends string> {
+    readonly port: number | PortName<Ports>;
+    readonly service?: string;
+}
+export interface ExecAction {
+    readonly command: ReadonlyArray<string>;
+}
+/**
+ * Probe target — `port` references on httpGet/tcpSocket/grpc are
+ * constrained to `Ports`, the union of names declared on the owning
+ * container. A bare number is always accepted; only the named variant
+ * is checked.
+ */
+export interface ProbeTarget<Ports extends string> {
+    readonly httpGet?: HttpGetAction<Ports>;
+    readonly tcpSocket?: TcpSocketAction<Ports>;
+    readonly grpc?: GrpcAction<Ports>;
+    readonly exec?: ExecAction;
+    readonly initialDelaySeconds?: number;
+    readonly periodSeconds?: number;
+    readonly timeoutSeconds?: number;
+    readonly successThreshold?: number;
+    readonly failureThreshold?: number;
+    readonly terminationGracePeriodSeconds?: number;
+}
+export type NamesOf<P extends ReadonlyArray<unknown>> = {
+    readonly [K in keyof P]: P[K] extends ContainerPort<infer N> ? N : never;
+}[number];
+/**
+ * Service-port input bound to a container's port-name union. `targetPort`
+ * accepts a bare number or a `PortName<Ports>`. The `Ports` parameter is
+ * locked by `forContainer` on `Service.fromContainer`; use `Port.ref(name)`
+ * to reference declared ports.
+ */
+export interface ServicePortSpec<Ports extends string> {
+    readonly name?: string;
+    readonly port: number;
+    readonly targetPort: number | PortName<Ports>;
+    readonly protocol?: ContainerProtocol;
+    readonly appProtocol?: string;
+    readonly nodePort?: number;
+}
+export {};

package/dist/refs.d.ts

@@ -0,0 +1,26 @@
+import { type ConfigMapRef as CMRef, type PvcRef as PRef, type ServiceAccountRef as SARef, type SecretRef as SRef } from "@konfig.ts/core";
+export type SecretRef<N extends string = string, K extends string = string, Ns extends string = string> = SRef<N, K, Ns>;
+export type ConfigMapRef<N extends string = string, K extends string = string> = CMRef<N, K>;
+export type ServiceAccountRef<N extends string = string> = SARef<N>;
+export type PvcRef<N extends string = string> = PRef<N>;
+export type { ConfigMapRefKeys, ConfigMapRefName, PvcRefName, SecretRefKeys, SecretRefName, } from "@konfig.ts/core";
+export type { SecretRefNamespace } from "@konfig.ts/core";
+export declare const SecretRef: {
+    of: <N extends string, K extends string = string, Ns extends string = string>(name: N) => SecretRef<N, K, Ns>;
+    /**
+     * Escape hatch — widen a typed ref's namespace slot to `any`, making
+     * it usable across any pod context. Use sparingly (legitimate
+     * cross-namespace cases: ExternalSecret reflection, in-cluster
+     * shared infra). The cast is grep-able so PR reviewers see opt-ins.
+     */
+    unsafeReNamespace: <N extends string, K extends string>(ref: SecretRef<N, K, any>) => SecretRef<N, K, any>;
+};
+export declare const ConfigMapRef: {
+    of: <N extends string, K extends string = string>(name: N) => ConfigMapRef<N, K>;
+};
+export declare const ServiceAccountRef: {
+    of: <N extends string>(name: N) => ServiceAccountRef<N>;
+};
+export declare const PvcRef: {
+    of: <N extends string>(name: N) => PvcRef<N>;
+};

package/dist/secretBind.d.ts

@@ -0,0 +1,36 @@
+import { Dep, type Manifest, RenderError, type SecretRef } from "@konfig.ts/core";
+import type { SecretEntry, SecretSource } from "@konfig.ts/env";
+import { type Context, type Layer } from "effect";
+import type { SecretBackend } from "./backend";
+import { EnvVar } from "./env";
+export interface DeclaredSecret<N extends string, K extends string, Ns extends string = string> {
+    readonly ref: SecretRef<N, K, Ns>;
+    readonly name: N;
+    readonly namespace: Ns;
+    readonly keys: ReadonlyArray<K>;
+    readonly envVars: ReadonlyArray<EnvVar>;
+    readonly manifest?: Manifest.Manifest<unknown>;
+    readonly refLayer: Layer.Layer<Dep.Provide<"Secret", N>>;
+    readonly values?: Context.Service<Dep.Need<"SecretValues", N>, Dep.SecretValuesRecord<K>>;
+    readonly layer?: Layer.Layer<Dep.Provide<"SecretValues", N>, RenderError, Manifest.RenderServices>;
+}
+export interface BindSecretInput<N extends string, K extends string, E extends Readonly<Record<K, string>>, Ns extends string = string> {
+    readonly secret: SecretEntry<N, K, E>;
+    readonly backend?: SecretBackend<N, K>;
+    readonly source?: SecretSource<K, Manifest.RenderServices>;
+    readonly labels?: Readonly<Record<string, string>>;
+    readonly annotations?: Readonly<Record<string, string>>;
+    /**
+     * Override the contract's baked-in `namespace` for this bind. Useful
+     * when the same `Secret` declaration is consumed across multiple
+     * k8s namespaces (e.g. prod / staging / local of the same workload)
+     * — the runtime read is namespace-independent, but each binding emits
+     * its manifest into a different namespace.
+     *
+     * When passed as a string literal (via `Environment.bind`'s
+     * `const namespace`), the literal flows into the ref's brand so
+     * `secretEnvForPod` can enforce cross-namespace coherence.
+     */
+    readonly namespace?: Ns;
+}
+export declare const bindSecret: <N extends string, K extends string, E extends Readonly<Record<K, string>>, const Ns extends string = string>(input: BindSecretInput<N, K, E, Ns>) => DeclaredSecret<N, K, Ns>;

package/dist/selector.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Selector — one source of truth for "this pod set."
+ *
+ * `Selector<L>` wraps a literal label record and brands it. Resources
+ * that *select* pods — Deployment.selector, Service.selector,
+ * NetworkPolicy.podSelector, HPA target — take the bundle directly via
+ * `Deployment.fromPodSet` / `Service.fromPodSet` / `NetworkPolicy.fromPodSet`
+ * so a drift across three resources (the classic "service has no
+ * endpoints / netpol denies everything" bug) becomes a compile error.
+ *
+ * `Workload.web` already keeps these labels coherent internally; the
+ * Selector is the win when users go off-script: StatefulSet, DaemonSet,
+ * cross-namespace selectors, or wiring a NetworkPolicy from app A to
+ * peer pods B.
+ */
+declare const SelectorBrand: unique symbol;
+export interface Selector<L extends Readonly<Record<string, string>>> {
+    readonly [SelectorBrand]: L;
+    readonly labels: L;
+}
+/**
+ * `Selector` value namespace.
+ *
+ *   const apiPods = Selector.make({ app: "api", tier: "web" });
+ */
+export declare const Selector: {
+    make: <const L extends Readonly<Record<string, string>>>(labels: L) => Selector<L>;
+};
+export type SelectorLabels<S> = S extends Selector<infer L> ? L : never;
+export {};

package/dist/volume.d.ts

@@ -0,0 +1,108 @@
+import type { ConfigMapRef, PvcRef, SecretRef } from "@konfig.ts/core";
+/**
+ * Branded volume name — a string carrying the literal `N` in its
+ * phantom. Constructed by the volume factories
+ * (`Volume.empty`, `Volume.fromSecret`, …) and `Volume.mountRef`. Lets
+ * `VolumeMount<Mounts>` and `Pod` constrain a container's
+ * `volumeMounts[i].name` to volumes that the pod actually declares.
+ */
+declare const VolumeNameBrand: unique symbol;
+export type VolumeName<N extends string> = string & {
+    readonly [VolumeNameBrand]: N;
+};
+export interface Volume<N extends string = string> {
+    readonly name: VolumeName<N>;
+    readonly secret?: {
+        readonly secretName: string;
+        readonly optional?: boolean;
+        readonly defaultMode?: number;
+    };
+    readonly configMap?: {
+        readonly name: string;
+        readonly optional?: boolean;
+        readonly defaultMode?: number;
+        readonly items?: ReadonlyArray<{
+            readonly key: string;
+            readonly path: string;
+        }>;
+    };
+    readonly emptyDir?: {
+        readonly medium?: string;
+        readonly sizeLimit?: string;
+    };
+    readonly persistentVolumeClaim?: {
+        readonly claimName: PvcRef<string>;
+        readonly readOnly?: boolean;
+    };
+    readonly hostPath?: {
+        readonly path: string;
+        readonly type?: string;
+    };
+}
+export interface EmptyVolumeInput<N extends string> {
+    readonly name: N;
+    readonly medium?: string;
+    readonly sizeLimit?: string;
+}
+export interface VolumeFromSecretInput<N extends string> {
+    readonly name: N;
+    readonly ref: SecretRef<string>;
+    readonly optional?: boolean;
+    readonly defaultMode?: number;
+}
+export interface VolumeFromConfigMapInput<N extends string> {
+    readonly name: N;
+    readonly ref: ConfigMapRef<string>;
+    readonly optional?: boolean;
+    readonly defaultMode?: number;
+    readonly items?: ReadonlyArray<{
+        readonly key: string;
+        readonly path: string;
+    }>;
+}
+export interface VolumeFromPvcInput<N extends string, PvcN extends string> {
+    readonly name: N;
+    readonly claim: PvcRef<PvcN>;
+    readonly readOnly?: boolean;
+}
+/**
+ * `Volume` value namespace.
+ *
+ *   volumes: [
+ *     Volume.empty({ name: "config" }),
+ *     Volume.fromSecret({ name: "tls", ref: tlsSecret.ref }),
+ *     Volume.fromConfigMap({ name: "settings", ref: cfg.ref }),
+ *     Volume.fromPvc({ name: "data", claim: pvc.ref }),
+ *   ],
+ *   volumeMounts: [
+ *     { name: Volume.mountRef("config"), mountPath: "/etc/conf" },
+ *   ],
+ *
+ * All four constructors capture the literal `name` in the returned
+ * `Volume<N>` brand; `Pod` infers the union and constrains each
+ * container's `volumeMounts[i].name` to it.
+ */
+export declare const Volume: {
+    empty: <const N extends string>(input: EmptyVolumeInput<N>) => Volume<N>;
+    fromSecret: <const N extends string>(input: VolumeFromSecretInput<N>) => Volume<N>;
+    fromConfigMap: <const N extends string>(input: VolumeFromConfigMapInput<N>) => Volume<N>;
+    fromPvc: <const N extends string, const PvcN extends string>(input: VolumeFromPvcInput<N, PvcN>) => Volume<N>;
+    mountRef: <const N extends string>(name: N) => VolumeName<N>;
+};
+/**
+ * Typed container volumeMount. `Mounts` is the union of volume names
+ * declared on the surrounding pod; `name` must reference one of them.
+ * Bare-number variants don't apply (mounts are always by name).
+ */
+export interface VolumeMount<Mounts extends string = string> {
+    readonly name: VolumeName<Mounts>;
+    readonly mountPath: string;
+    readonly readOnly?: boolean;
+    readonly subPath?: string;
+    readonly subPathExpr?: string;
+    readonly mountPropagation?: string;
+}
+export type VolumeNamesOf<V extends ReadonlyArray<Volume<string>>> = {
+    readonly [I in keyof V]: V[I] extends Volume<infer N> ? N : never;
+}[number];
+export {};

package/dist/workload.d.ts

@@ -0,0 +1,117 @@
+import { Manifest } from "@konfig.ts/core";
+import type { CronJob as K8sCronJob, Deployment as K8sDeployment, Job as K8sJob, StatefulSet as K8sStatefulSet } from "./.generated/k8s-types";
+import type { PodSpecInput } from "./container";
+import type { Selector } from "./selector";
+interface WorkloadMeta {
+    readonly name: string;
+    readonly namespace: string;
+    readonly labels?: Readonly<Record<string, string>>;
+    readonly annotations?: Readonly<Record<string, string>>;
+}
+interface SelectorAndTemplate {
+    readonly selector: {
+        readonly matchLabels: Readonly<Record<string, string>>;
+    };
+    readonly template: {
+        readonly metadata?: {
+            readonly labels?: Readonly<Record<string, string>>;
+            readonly annotations?: Readonly<Record<string, string>>;
+        };
+        readonly spec: PodSpecInput;
+    };
+}
+export interface DeploymentInput extends WorkloadMeta, SelectorAndTemplate {
+    readonly replicas?: number;
+    readonly strategy?: unknown;
+    readonly revisionHistoryLimit?: number;
+    readonly progressDeadlineSeconds?: number;
+    readonly minReadySeconds?: number;
+}
+/**
+ * Deployment built from a `Selector`. The selector's labels become both
+ * the Deployment's `spec.selector.matchLabels` and the pod template's
+ * `metadata.labels` — coherent by construction. Drift between selector
+ * and template (the classic "service has no endpoints" footgun) is
+ * structurally impossible once both consume the same `podSet`.
+ */
+export interface DeploymentFromPodSetInput<L extends Readonly<Record<string, string>>> {
+    readonly name: string;
+    readonly namespace: string;
+    readonly labels?: Readonly<Record<string, string>>;
+    readonly annotations?: Readonly<Record<string, string>>;
+    readonly podSet: Selector<L>;
+    readonly replicas?: number;
+    readonly template: {
+        readonly metadata?: {
+            readonly labels?: Readonly<Record<string, string>>;
+            readonly annotations?: Readonly<Record<string, string>>;
+        };
+        readonly spec: PodSpecInput;
+    };
+    readonly strategy?: unknown;
+    readonly revisionHistoryLimit?: number;
+    readonly progressDeadlineSeconds?: number;
+    readonly minReadySeconds?: number;
+}
+export declare const Deployment: {
+    make: (input: DeploymentInput) => Manifest.Manifest<K8sDeployment>;
+    fromPodSet: <L extends Readonly<Record<string, string>>>(input: DeploymentFromPodSetInput<L>) => Manifest.Manifest<K8sDeployment>;
+};
+export interface StatefulSetInput extends WorkloadMeta, SelectorAndTemplate {
+    readonly replicas?: number;
+    readonly serviceName: string;
+    readonly volumeClaimTemplates?: ReadonlyArray<unknown>;
+    readonly podManagementPolicy?: string;
+    readonly updateStrategy?: unknown;
+}
+export declare const StatefulSet: {
+    make: (input: StatefulSetInput) => Manifest.Manifest<K8sStatefulSet>;
+};
+export interface JobInput extends WorkloadMeta {
+    readonly parallelism?: number;
+    readonly completions?: number;
+    readonly backoffLimit?: number;
+    readonly activeDeadlineSeconds?: number;
+    readonly ttlSecondsAfterFinished?: number;
+    readonly suspend?: boolean;
+    readonly template: {
+        readonly metadata?: {
+            readonly labels?: Readonly<Record<string, string>>;
+            readonly annotations?: Readonly<Record<string, string>>;
+        };
+        readonly spec: PodSpecInput;
+    };
+}
+export declare const Job: {
+    make: (input: JobInput) => Manifest.Manifest<K8sJob>;
+};
+export interface CronJobInput extends WorkloadMeta {
+    readonly schedule: string;
+    readonly concurrencyPolicy?: string;
+    readonly successfulJobsHistoryLimit?: number;
+    readonly failedJobsHistoryLimit?: number;
+    readonly startingDeadlineSeconds?: number;
+    readonly suspend?: boolean;
+    readonly jobTemplate: {
+        readonly metadata?: {
+            readonly labels?: Readonly<Record<string, string>>;
+            readonly annotations?: Readonly<Record<string, string>>;
+        };
+        readonly spec: {
+            readonly template: {
+                readonly metadata?: {
+                    readonly labels?: Readonly<Record<string, string>>;
+                    readonly annotations?: Readonly<Record<string, string>>;
+                };
+                readonly spec: PodSpecInput;
+            };
+            readonly backoffLimit?: number;
+            readonly activeDeadlineSeconds?: number;
+            readonly ttlSecondsAfterFinished?: number;
+        };
+    };
+}
+export declare const CronJob: {
+    make: (input: CronJobInput) => Manifest.Manifest<K8sCronJob>;
+};
+export {};

package/dist/workloadHelpers.d.ts

@@ -0,0 +1,97 @@
+import type { Manifest, SecretRef } from "@konfig.ts/core";
+import type { CronJob as K8sCronJob, Deployment as K8sDeployment, Ingress as K8sIngress, IngressRule as K8sIngressRule, Service as K8sService, ServiceAccount as K8sServiceAccount } from "./.generated/k8s-types";
+import type { ContainerInput, ContainerSpec } from "./container";
+import { type IngressTLSInput } from "./network";
+import type { ServicePortSpec } from "./ports";
+import type { Volume } from "./volume";
+/**
+ * Union of port names declared by every `ContainerSpec` in `Cs`. Raw
+ * `ContainerInput` entries (no `Container.define`) contribute `never`,
+ * so untyped containers don't widen the result — they just don't add
+ * any named-port options to the Service. With every container untyped,
+ * the union collapses to `never` and `targetPort` is effectively
+ * `number`-only, matching Kubernetes' behaviour when no port is named.
+ */
+type _PortNamesOfContainers<Cs extends ReadonlyArray<ContainerInput>> = {
+    readonly [K in keyof Cs]: Cs[K] extends ContainerSpec<infer P, string> ? P : never;
+}[number];
+/**
+ * Reloader integration shorthand. Two complementary rotation models:
+ *
+ *  - *Build-time* rotation (re-render → new hash → rolling update). konfig
+ *    does NOT stamp this automatically; it ships `hashSecretValues` as a
+ *    helper you attach yourself — feed it your resolved secret values and
+ *    place the digest into `deployment.podAnnotations`, so a value change
+ *    flips the pod template and triggers a rollout.
+ *  - *Runtime* rotation via Stakater's Reloader (operator watches mounted
+ *    Secrets/ConfigMaps and patches the workload to restart pods on change),
+ *    selected by the option below.
+ *
+ * Pick:
+ *
+ *  - `"off"` (default) — no Reloader annotation. Pair with a build-time
+ *    `hashSecretValues` annotation if you accept the redeploy-on-edit model.
+ *  - `"stakater"` — emit `reloader.stakater.com/auto: "true"`. Reloader
+ *    watches every Secret/ConfigMap referenced by the pod spec.
+ *  - `"stakater-strict"` — emit `reloader.stakater.com/auto: "true"`
+ *    plus `reloader.stakater.com/match: "true"`, restricting watch
+ *    to objects with the matching annotation set on them.
+ *  - `{ secrets, configMaps }` — explicit per-resource lists, emitted
+ *    as `secret.reloader.stakater.com/reload` /
+ *    `configmap.reloader.stakater.com/reload` (comma-joined).
+ *
+ * See packages/k8s/README.md for the trade-off between build-time
+ * hashes and runtime reloader.
+ */
+export type ReloaderOption = "off" | "stakater" | "stakater-strict" | {
+    readonly secrets?: ReadonlyArray<string>;
+    readonly configMaps?: ReadonlyArray<string>;
+};
+interface WebInput<Cs extends ReadonlyArray<ContainerInput>> {
+    readonly name: string;
+    readonly namespace: string;
+    readonly labels?: Readonly<Record<string, string>>;
+    readonly annotations?: Readonly<Record<string, string>>;
+    /** Pod-restart-on-rotation integration. See `ReloaderOption`. */
+    readonly reloader?: ReloaderOption;
+    readonly deployment: {
+        readonly replicas?: number;
+        readonly containers: Cs;
+        readonly volumes?: ReadonlyArray<Volume>;
+        readonly imagePullSecrets?: ReadonlyArray<{
+            readonly name: SecretRef<string>;
+        }>;
+        readonly serviceAccountName?: string;
+        readonly podLabels?: Readonly<Record<string, string>>;
+        readonly podAnnotations?: Readonly<Record<string, string>>;
+    };
+    readonly service: {
+        readonly ports: ReadonlyArray<ServicePortSpec<NoInfer<_PortNamesOfContainers<Cs>>>>;
+        readonly type?: "ClusterIP" | "NodePort" | "LoadBalancer";
+    };
+    readonly ingress?: {
+        readonly ingressClassName?: string;
+        readonly rules?: ReadonlyArray<K8sIngressRule>;
+        readonly tls?: ReadonlyArray<IngressTLSInput>;
+        readonly annotations?: Readonly<Record<string, string>>;
+    };
+}
+export declare const web: <const Cs extends ReadonlyArray<ContainerInput>>(input: WebInput<Cs>) => Manifest.Manifest<readonly [K8sDeployment, K8sService] | readonly [K8sDeployment, K8sService, K8sIngress]>;
+interface CronInput {
+    readonly name: string;
+    readonly namespace: string;
+    readonly schedule: string;
+    readonly labels?: Readonly<Record<string, string>>;
+    readonly annotations?: Readonly<Record<string, string>>;
+    readonly concurrencyPolicy?: "Allow" | "Forbid" | "Replace";
+    readonly successfulJobsHistoryLimit?: number;
+    readonly failedJobsHistoryLimit?: number;
+    readonly containers: ReadonlyArray<ContainerInput>;
+    readonly volumes?: ReadonlyArray<Volume>;
+    readonly imagePullSecrets?: ReadonlyArray<{
+        readonly name: SecretRef<string>;
+    }>;
+    readonly restartPolicy?: "OnFailure" | "Never";
+}
+export declare const cron: (input: CronInput) => Manifest.Manifest<readonly [K8sServiceAccount, K8sCronJob]>;
+export {};

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@konfig.ts/k8s",
+  "version": "0.0.1",
+  "description": "Kubernetes resource builders (workloads, network, identity, policy, volume, env) for konfig.ts.",
+  "license": "MIT",
+  "author": "David Stahl-Gruber",
+  "homepage": "https://github.com/DwieDave/konfig.ts#readme",
+  "bugs": "https://github.com/DwieDave/konfig.ts/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DwieDave/konfig.ts.git",
+    "directory": "packages/k8s"
+  },
+  "keywords": [
+    "kubernetes",
+    "k8s",
+    "config",
+    "effect",
+    "typescript"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsdown ./src/index.ts --format=esm --target=node20 --sourcemap --clean --no-dts && tsc -p tsconfig.build.json",
+    "check": "tsc -p tsconfig.check.json --noEmit",
+    "test": "vitest run",
+    "lint": "oxlint",
+    "lint:apply": "oxlint --fix",
+    "prepublishOnly": "bun run build",
+    "prepack": "node ../../scripts/prepack-exports.mjs strip",
+    "postpack": "node ../../scripts/prepack-exports.mjs restore"
+  },
+  "dependencies": {
+    "@konfig.ts/core": "0.0.1",
+    "@konfig.ts/env": "0.0.1",
+    "kubernetes-types": "~1.30.0"
+  },
+  "peerDependencies": {
+    "effect": "4.0.0-beta.70"
+  },
+  "devDependencies": {
+    "@effect/platform-node": "catalog:",
+    "@effect/vitest": "catalog:",
+    "@types/bun": "catalog:",
+    "effect": "catalog:",
+    "fast-check": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  }
+}