norn-cli 2.6.1 → 2.8.0

package/dist/cli.js

@@ -101065,10 +101065,10 @@ var require_resolveCommand = __commonJS({
       }
       return resolved;
     }
-    function resolveCommand(parsed) {
+    function resolveCommand2(parsed) {
       return resolveCommandAttempt(parsed) || resolveCommandAttempt(parsed, true);
     }
-    module2.exports = resolveCommand;
+    module2.exports = resolveCommand2;
   }
 });
 
@@ -101152,19 +101152,19 @@ var require_parse2 = __commonJS({
   "node_modules/cross-spawn/lib/parse.js"(exports2, module2) {
     "use strict";
     var path20 = require("path");
-    var resolveCommand = require_resolveCommand();
+    var resolveCommand2 = require_resolveCommand();
     var escape2 = require_escape();
     var readShebang = require_readShebang();
     var isWin = process.platform === "win32";
     var isExecutableRegExp = /\.(?:com|exe)$/i;
     var isCmdShimRegExp = /node_modules[\\/].bin[\\/][^\\/]+\.cmd$/i;
     function detectShebang(parsed) {
-      parsed.file = resolveCommand(parsed);
+      parsed.file = resolveCommand2(parsed);
       const shebang = parsed.file && readShebang(parsed.file);
       if (shebang) {
         parsed.args.unshift(parsed.file);
         parsed.command = shebang;
-        return resolveCommand(parsed);
+        return resolveCommand2(parsed);
       }
       return parsed.file;
     }
@@ -101266,7 +101266,7 @@ var require_cross_spawn = __commonJS({
     var cp = require("child_process");
     var parse5 = require_parse2();
     var enoent = require_enoent();
-    function spawn5(command, args, options) {
+    function spawn6(command, args, options) {
       const parsed = parse5(command, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
@@ -101278,8 +101278,8 @@ var require_cross_spawn = __commonJS({
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
     }
-    module2.exports = spawn5;
-    module2.exports.spawn = spawn5;
+    module2.exports = spawn6;
+    module2.exports.spawn = spawn6;
     module2.exports.sync = spawnSync3;
     module2.exports._parse = parse5;
     module2.exports._enoent = enoent;
@@ -134283,6 +134283,635 @@ function applyRequestTimeoutForPath(startPath, overrideMs) {
   return timeoutMs;
 }
 
+// src/k8s/k8sRunner.ts
+var import_child_process4 = require("child_process");
+
+// src/k8s/k8sParser.ts
+function tokenizeCommandLine(line2) {
+  const tokens = [];
+  let current = "";
+  let quote;
+  let escaped = false;
+  for (const char of line2) {
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\" && quote !== "'") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (char === quote) {
+        quote = void 0;
+      } else {
+        current += char;
+      }
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += char;
+  }
+  if (escaped) {
+    current += "\\";
+  }
+  if (quote) {
+    return { tokens, error: "Unterminated quoted argument" };
+  }
+  if (current) {
+    tokens.push(current);
+  }
+  return { tokens };
+}
+function parseCommonOptions(tokens) {
+  const remaining = [];
+  let namespace;
+  let context;
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index];
+    if (token === "-n" || token === "--namespace") {
+      const value = tokens[++index];
+      if (!value) {
+        return { remaining, error: `${token} requires a namespace` };
+      }
+      namespace = value;
+      continue;
+    }
+    if (token.startsWith("--namespace=")) {
+      namespace = token.slice("--namespace=".length);
+      if (!namespace) {
+        return { remaining, error: "--namespace requires a namespace" };
+      }
+      continue;
+    }
+    if (token === "--context") {
+      const value = tokens[++index];
+      if (!value) {
+        return { remaining, error: "--context requires a context name" };
+      }
+      context = value;
+      continue;
+    }
+    if (token.startsWith("--context=")) {
+      context = token.slice("--context=".length);
+      if (!context) {
+        return { remaining, error: "--context requires a context name" };
+      }
+      continue;
+    }
+    remaining.push(token);
+  }
+  return { remaining, namespace, context };
+}
+function parseK8sCommand(rawLine, line2) {
+  const raw = stripInlineComment(rawLine).trim();
+  const captureMatch = raw.match(/^var\s+([a-zA-Z_][a-zA-Z0-9_-]*)\s*=\s*(.+)$/);
+  if (captureMatch) {
+    const [, captureVar, expression] = captureMatch;
+    const parts = expression.split("|");
+    if (parts.length !== 2) {
+      return { error: { line: line2, message: "Expected: var <name> = get pods [-l selector] | first" } };
+    }
+    if (parts[1].trim() !== "first") {
+      return { error: { line: line2, message: "Capture only supports '| first'" } };
+    }
+    const inner = parseK8sCommand(parts[0].trim(), line2);
+    if (inner.error) {
+      return { error: inner.error };
+    }
+    if (!inner.command || inner.command.kind !== "getPods") {
+      return { error: { line: line2, message: "Capture must read from a get pods command" } };
+    }
+    if (inner.command.allNamespaces) {
+      return { error: { line: line2, message: "Capture cannot use -A/--all-namespaces because the captured pod name would lose its namespace" } };
+    }
+    return { command: { ...inner.command, raw, captureVar, capturePick: "first" } };
+  }
+  const tokenized = tokenizeCommandLine(raw);
+  if (tokenized.error) {
+    return { error: { line: line2, message: tokenized.error } };
+  }
+  const tokens = tokenized.tokens;
+  if (tokens.length === 0) {
+    return {};
+  }
+  if (tokens[0] === "run") {
+    if (tokens.length !== 2 || !/^[a-zA-Z_][a-zA-Z0-9_-]*$/.test(tokens[1])) {
+      return { error: { line: line2, message: "Expected: run <SequenceName>" } };
+    }
+    return {
+      command: {
+        kind: "run",
+        raw,
+        line: line2,
+        sequenceName: tokens[1]
+      }
+    };
+  }
+  if (tokens[0] === "get") {
+    if (tokens[1] !== "pods") {
+      return { error: { line: line2, message: "Expected: get pods [-l selector] [-A | -n namespace] [--context name]" } };
+    }
+    const commonTokens = [];
+    let selector;
+    let allNamespaces = false;
+    const rest = tokens.slice(2);
+    for (let index = 0; index < rest.length; index++) {
+      const token = rest[index];
+      if (token === "-l" || token === "--selector") {
+        const value = rest[++index];
+        if (!value) {
+          return { error: { line: line2, message: `${token} requires a label selector` } };
+        }
+        selector = value;
+        continue;
+      }
+      if (token.startsWith("--selector=") || token.startsWith("-l=")) {
+        selector = token.slice(token.indexOf("=") + 1);
+        if (!selector) {
+          return { error: { line: line2, message: "Label selector flag requires a value" } };
+        }
+        continue;
+      }
+      if (token === "-A" || token === "--all-namespaces") {
+        allNamespaces = true;
+        continue;
+      }
+      commonTokens.push(token);
+    }
+    const options = parseCommonOptions(commonTokens);
+    if (allNamespaces && options.namespace) {
+      return { error: { line: line2, message: "get pods cannot combine -A/--all-namespaces with -n/--namespace" } };
+    }
+    if (options.error || options.remaining.length > 0) {
+      return { error: { line: line2, message: options.error ?? "Expected: get pods [-l selector] [-A | -n namespace] [--context name]" } };
+    }
+    return {
+      command: {
+        kind: "getPods",
+        raw,
+        line: line2,
+        selector,
+        allNamespaces,
+        namespace: options.namespace,
+        context: options.context
+      }
+    };
+  }
+  if (tokens[0] === "describe") {
+    if (tokens[1] !== "pod") {
+      return { error: { line: line2, message: "Expected: describe pod <name> [-n namespace] [--context name]" } };
+    }
+    const pod = tokens[2];
+    if (!pod) {
+      return { error: { line: line2, message: "Expected: describe pod <name> [-n namespace] [--context name]" } };
+    }
+    const options = parseCommonOptions(tokens.slice(3));
+    if (options.error || options.remaining.length > 0) {
+      return { error: { line: line2, message: options.error ?? "Expected: describe pod <name> [-n namespace] [--context name]" } };
+    }
+    return {
+      command: {
+        kind: "describe",
+        raw,
+        line: line2,
+        pod,
+        namespace: options.namespace,
+        context: options.context
+      }
+    };
+  }
+  if (tokens[0] === "logs") {
+    const pod = tokens[1];
+    if (!pod) {
+      return { error: { line: line2, message: "Expected: logs <pod> [--tail N] [-n namespace] [--context name]" } };
+    }
+    const commonTokens = [];
+    let tail;
+    for (let index = 2; index < tokens.length; index++) {
+      const token = tokens[index];
+      if (token === "--tail") {
+        const value = tokens[++index];
+        if (!value || !/^\d+$/.test(value) && !/^\{\{[^}]+\}\}$/.test(value)) {
+          return { error: { line: line2, message: "--tail requires a non-negative integer" } };
+        }
+        tail = /^\d+$/.test(value) ? Number(value) : value;
+        continue;
+      }
+      if (token.startsWith("--tail=")) {
+        const value = token.slice("--tail=".length);
+        if (!/^\d+$/.test(value) && !/^\{\{[^}]+\}\}$/.test(value)) {
+          return { error: { line: line2, message: "--tail requires a non-negative integer" } };
+        }
+        tail = /^\d+$/.test(value) ? Number(value) : value;
+        continue;
+      }
+      commonTokens.push(token);
+    }
+    const options = parseCommonOptions(commonTokens);
+    if (options.error || options.remaining.length > 0) {
+      return { error: { line: line2, message: options.error ?? "Expected: logs <pod> [--tail N] [-n namespace] [--context name]" } };
+    }
+    return {
+      command: {
+        kind: "logs",
+        raw,
+        line: line2,
+        pod,
+        tail,
+        namespace: options.namespace,
+        context: options.context
+      }
+    };
+  }
+  if (tokens[0] === "restart") {
+    const resource = tokens[1];
+    const options = parseCommonOptions(tokens.slice(2));
+    if (!resource?.startsWith("deployment/") || resource.length === "deployment/".length || options.error || options.remaining.length > 0) {
+      return { error: { line: line2, message: options.error ?? "Expected: restart deployment/<name> [-n namespace] [--context name]" } };
+    }
+    return {
+      command: {
+        kind: "restart",
+        raw,
+        line: line2,
+        resource,
+        namespace: options.namespace,
+        context: options.context
+      }
+    };
+  }
+  return { error: { line: line2, message: `Unsupported Kubernetes command: ${tokens[0]}` } };
+}
+function parseK8sDocument(text) {
+  const lines = text.split(/\r?\n/);
+  const document2 = {
+    sequences: [],
+    standaloneCommands: [],
+    errors: []
+  };
+  let currentSequence;
+  const sequenceNames = /* @__PURE__ */ new Set();
+  for (let lineNumber = 0; lineNumber < lines.length; lineNumber++) {
+    const raw = lines[lineNumber];
+    const line2 = stripInlineComment(raw).trim();
+    if (!line2) {
+      continue;
+    }
+    const sequenceMatch = line2.match(/^(runbook\s+)?sequence\s+([a-zA-Z_][a-zA-Z0-9_-]*)\s*$/);
+    if (sequenceMatch) {
+      if (currentSequence) {
+        document2.errors.push({ line: lineNumber, message: "Nested sequences are not supported" });
+        continue;
+      }
+      const name = sequenceMatch[2];
+      if (sequenceNames.has(name)) {
+        document2.errors.push({ line: lineNumber, message: `Duplicate sequence '${name}'` });
+      }
+      sequenceNames.add(name);
+      currentSequence = {
+        name,
+        isRunbook: Boolean(sequenceMatch[1]),
+        startLine: lineNumber,
+        endLine: lineNumber,
+        commands: []
+      };
+      continue;
+    }
+    if (line2 === "end sequence") {
+      if (!currentSequence) {
+        document2.errors.push({ line: lineNumber, message: "Unexpected end sequence" });
+        continue;
+      }
+      currentSequence.endLine = lineNumber;
+      document2.sequences.push(currentSequence);
+      currentSequence = void 0;
+      continue;
+    }
+    if (line2.startsWith("namespace ")) {
+      if (currentSequence) {
+        document2.errors.push({ line: lineNumber, message: "namespace is a file-level directive and cannot appear inside a sequence" });
+        continue;
+      }
+      const value = line2.slice("namespace ".length).trim();
+      if (!value) {
+        document2.errors.push({ line: lineNumber, message: "namespace requires a value" });
+      } else if (document2.namespace) {
+        document2.errors.push({ line: lineNumber, message: "Only one namespace directive is allowed per file" });
+      } else {
+        document2.namespace = { value, line: lineNumber };
+      }
+      continue;
+    }
+    const parsed = parseK8sCommand(raw, lineNumber);
+    if (parsed.error) {
+      document2.errors.push(parsed.error);
+      continue;
+    }
+    if (!parsed.command) {
+      continue;
+    }
+    if (currentSequence) {
+      currentSequence.commands.push(parsed.command);
+    } else if (parsed.command.kind === "run") {
+      document2.errors.push({ line: lineNumber, message: "run <SequenceName> is only valid inside a sequence" });
+    } else if (parsed.command.captureVar) {
+      document2.errors.push({ line: lineNumber, message: "var capture is only valid inside a sequence" });
+    } else {
+      document2.standaloneCommands.push(parsed.command);
+    }
+  }
+  if (currentSequence) {
+    document2.errors.push({ line: currentSequence.startLine, message: `Sequence '${currentSequence.name}' is missing end sequence` });
+  }
+  return document2;
+}
+
+// src/k8s/k8sRunner.ts
+function quoteDisplayArg(value) {
+  return /^[a-zA-Z0-9_./:=@-]+$/.test(value) ? value : JSON.stringify(value);
+}
+function unresolvedVariables(text) {
+  return Array.from(text.matchAll(/\{\{([^}]+)\}\}/g), (match) => match[1]);
+}
+function substituteOrThrow(text, variables, description) {
+  const substituted = substituteVariables(text, variables);
+  const unresolved = unresolvedVariables(substituted);
+  if (unresolved.length > 0) {
+    throw new Error(`Unresolved variable${unresolved.length === 1 ? "" : "s"} in ${description}: ${unresolved.join(", ")}`);
+  }
+  return substituted;
+}
+function resolveCommand(command, variables) {
+  const substituted = substituteOrThrow(command.raw, variables, `line ${command.line + 1}`);
+  const parsed = parseK8sCommand(substituted, command.line);
+  if (parsed.error || !parsed.command) {
+    throw new Error(parsed.error?.message ?? `Invalid Kubernetes command on line ${command.line + 1}`);
+  }
+  return parsed.command;
+}
+function buildKubectlInvocation(command, defaultNamespace, selectedContext) {
+  const args = [];
+  const context = command.context ?? selectedContext;
+  const namespace = command.namespace ?? defaultNamespace;
+  if (context) {
+    args.push("--context", context);
+  }
+  if (command.allNamespaces) {
+    args.push("-A");
+  } else if (namespace) {
+    args.push("-n", namespace);
+  }
+  switch (command.kind) {
+    case "getPods":
+      args.push("get", "pods");
+      if (command.selector) {
+        args.push("-l", command.selector);
+      }
+      break;
+    case "logs":
+      args.push("logs", command.pod, "--tail", String(command.tail ?? 200));
+      break;
+    case "restart":
+      args.push("rollout", "restart", command.resource);
+      break;
+    case "describe":
+      args.push("describe", "pod", command.pod);
+      break;
+    case "run":
+      throw new Error("Sequence calls cannot be converted directly to kubectl commands");
+  }
+  return { args, command };
+}
+function executeKubectl(args, options) {
+  const command = options.kubectlCommand ?? "kubectl";
+  const startTime = Date.now();
+  return new Promise((resolve16) => {
+    const child = (0, import_child_process4.spawn)(command, args, {
+      cwd: options.workingDirectory,
+      env: options.env ?? process.env,
+      shell: false
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (result) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      resolve16(result);
+    };
+    child.stdout.on("data", (data) => {
+      const text = data.toString();
+      stdout += text;
+      options.onOutput?.(text, "stdout");
+    });
+    child.stderr.on("data", (data) => {
+      const text = data.toString();
+      stderr += text;
+      options.onOutput?.(text, "stderr");
+    });
+    child.on("error", (error2) => {
+      const message = `Failed to start ${command}: ${error2.message}`;
+      options.onOutput?.(`${message}
+`, "stderr");
+      finish({
+        success: false,
+        command,
+        args,
+        stdout,
+        stderr: stderr || message,
+        exitCode: 1,
+        duration: Date.now() - startTime
+      });
+    });
+    child.on("close", (code) => {
+      finish({
+        success: code === 0,
+        command,
+        args,
+        stdout,
+        stderr,
+        exitCode: code ?? 1,
+        duration: Date.now() - startTime
+      });
+    });
+  });
+}
+async function captureFirstPod(command, defaultNamespace, options) {
+  const context = command.context ?? options.selectedContext;
+  const namespace = command.namespace ?? defaultNamespace;
+  const args = [];
+  if (context) {
+    args.push("--context", context);
+  }
+  if (command.allNamespaces) {
+    args.push("-A");
+  } else if (namespace) {
+    args.push("-n", namespace);
+  }
+  args.push("get", "pods");
+  if (command.selector) {
+    args.push("-l", command.selector);
+  }
+  args.push("-o", "name");
+  const binary = options.kubectlCommand ?? "kubectl";
+  options.onCommand?.([binary, ...args].map(quoteDisplayArg).join(" "));
+  const result = options.execute ? await options.execute(args) : await executeKubectl(args, options);
+  if (!result.success) {
+    throw new Error(result.stderr.trim() || `kubectl exited with code ${result.exitCode}`);
+  }
+  const names = result.stdout.split(/\r?\n/).map((name) => name.trim().replace(/^pod\//, "")).filter(Boolean);
+  if (names.length === 0) {
+    throw new Error(command.selector ? `No pods matched selector ${command.selector}` : "No pods found to capture");
+  }
+  return { result, podName: names[0] };
+}
+async function authorizeRestart(command, options) {
+  if (options.allowRestart) {
+    return true;
+  }
+  if (options.confirmRestart) {
+    return options.confirmRestart(command);
+  }
+  return false;
+}
+async function executeCommand(sourceCommand, defaultNamespace, options) {
+  const command = resolveCommand(sourceCommand, options.variables ?? {});
+  const confirmationCommand = {
+    ...command,
+    namespace: command.namespace ?? defaultNamespace,
+    context: command.context ?? options.selectedContext
+  };
+  if (command.kind === "restart" && !await authorizeRestart(confirmationCommand, options)) {
+    throw new Error(`Restart requires confirmation for ${command.resource}`);
+  }
+  const invocation = buildKubectlInvocation(command, defaultNamespace, options.selectedContext);
+  const binary = options.kubectlCommand ?? "kubectl";
+  options.onCommand?.([binary, ...invocation.args].map(quoteDisplayArg).join(" "));
+  return options.execute ? options.execute(invocation.args) : executeKubectl(invocation.args, options);
+}
+function formatParseErrors(document2) {
+  return document2.errors.map((error2) => `Line ${error2.line + 1}: ${error2.message}`);
+}
+async function runSequenceCommands(sequence, sequencesByName, defaultNamespace, options, callStack, results) {
+  if (callStack.includes(sequence.name)) {
+    return `Circular sequence call: ${[...callStack, sequence.name].join(" -> ")}`;
+  }
+  const nextStack = [...callStack, sequence.name];
+  for (const command of sequence.commands) {
+    if (command.kind === "run") {
+      const target = sequencesByName.get(command.sequenceName);
+      if (!target) {
+        return `Line ${command.line + 1}: Sequence '${command.sequenceName}' not found`;
+      }
+      const nestedError = await runSequenceCommands(target, sequencesByName, defaultNamespace, options, nextStack, results);
+      if (nestedError) {
+        return nestedError;
+      }
+      continue;
+    }
+    if (command.captureVar) {
+      try {
+        const resolved = resolveCommand(command, options.variables ?? {});
+        const { result, podName } = await captureFirstPod(resolved, defaultNamespace, options);
+        results.push(result);
+        (options.variables ??= {})[command.captureVar] = podName;
+        options.onOutput?.(`# ${command.captureVar} = ${podName}
+`, "stdout");
+      } catch (error2) {
+        return `Line ${command.line + 1}: ${error2 instanceof Error ? error2.message : String(error2)}`;
+      }
+      continue;
+    }
+    try {
+      const result = await executeCommand(command, defaultNamespace, options);
+      results.push(result);
+      if (!result.success) {
+        return `Line ${command.line + 1}: kubectl exited with code ${result.exitCode}${result.stderr.trim() ? `: ${result.stderr.trim()}` : ""}`;
+      }
+    } catch (error2) {
+      return `Line ${command.line + 1}: ${error2 instanceof Error ? error2.message : String(error2)}`;
+    }
+  }
+  return void 0;
+}
+function resolveDefaultNamespace(document2, variables) {
+  if (!document2.namespace) {
+    return void 0;
+  }
+  return substituteOrThrow(document2.namespace.value, variables, `namespace directive on line ${document2.namespace.line + 1}`);
+}
+async function runK8sSequence(text, sequenceName, options = {}) {
+  const startTime = Date.now();
+  const document2 = parseK8sDocument(text);
+  const errors = formatParseErrors(document2);
+  const commands = [];
+  const sequence = document2.sequences.find((candidate) => candidate.name === sequenceName);
+  if (!sequence) {
+    errors.push(`Sequence '${sequenceName}' not found`);
+  }
+  if (errors.length > 0 || !sequence) {
+    return { name: sequenceName, success: false, commands, errors, duration: Date.now() - startTime };
+  }
+  try {
+    const runOptions = {
+      ...options,
+      variables: copyEnvironmentScope({ ...options.variables ?? {} }, options.variables ?? {})
+    };
+    const defaultNamespace = resolveDefaultNamespace(document2, runOptions.variables ?? {});
+    const runtimeError = await runSequenceCommands(
+      sequence,
+      new Map(document2.sequences.map((candidate) => [candidate.name, candidate])),
+      defaultNamespace,
+      runOptions,
+      [],
+      commands
+    );
+    if (runtimeError) {
+      errors.push(runtimeError);
+    }
+  } catch (error2) {
+    errors.push(error2 instanceof Error ? error2.message : String(error2));
+  }
+  return {
+    name: sequenceName,
+    success: errors.length === 0,
+    commands,
+    errors,
+    duration: Date.now() - startTime
+  };
+}
+async function runK8sRunbooks(text, options = {}) {
+  const document2 = parseK8sDocument(text);
+  if (document2.errors.length > 0) {
+    return [{
+      name: "parse",
+      success: false,
+      commands: [],
+      errors: formatParseErrors(document2),
+      duration: 0
+    }];
+  }
+  const results = [];
+  for (const sequence of document2.sequences.filter((candidate) => candidate.isRunbook)) {
+    results.push(await runK8sSequence(text, sequence.name, options));
+  }
+  return results;
+}
+
 // src/cli.ts
 function handleImportResolutionErrors(errors, colors) {
   const { blockingErrors, warningErrors } = splitImportResolutionErrors(errors);
@@ -134407,7 +135036,8 @@ function parseArgs(args) {
     tagsFilter: [],
     insecure: false,
     refactorRegionPattern: false,
-    writeRefactor: false
+    writeRefactor: false,
+    yes: false
   };
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -134439,6 +135069,15 @@ function parseArgs(args) {
       options.refactorRegionPattern = true;
     } else if (arg === "--write") {
       options.writeRefactor = true;
+    } else if (arg === "--context") {
+      const contextName = args[++i];
+      if (!contextName || contextName.startsWith("-")) {
+        console.error("Error: --context requires a Kubernetes context name.");
+        process.exit(1);
+      }
+      options.k8sContext = contextName;
+    } else if (arg === "--yes" || arg === "-y") {
+      options.yes = true;
     } else if (arg === "--no-fail") {
       options.failOnError = false;
     } else if (arg === "--no-redact") {
@@ -134471,18 +135110,20 @@ function parseArgs(args) {
 }
 function printHelp() {
   console.log(`
-Norn CLI - Run HTTP requests and test sequences from .norn files
+Norn CLI - Run HTTP requests, test sequences, and Kubernetes runbooks
 
-Usage: norn <file.norn|directory> [options]
+Usage: norn <file.norn|file.nornk8s|directory> [options]
        norn secrets <command> [options]
 
-  When given a directory, recursively discovers and runs all test sequences
-  from .norn files within that directory and subdirectories.
+  When given a directory, recursively discovers .norn test sequences and
+  .nornk8s runbook sequences within that directory and subdirectories.
 
 Options:
   -s, --sequence <name>  Run a specific sequence by name (single file only)
   -r, --request <name>   Run a specific named request (single file only)
   -e, --env <name>       Use environment from .nornenv (e.g., dev, prod)
+  --context <name>       Use a Kubernetes context for .nornk8s execution
+  -y, --yes              Allow restart commands in .nornk8s execution
   -t, --timeout <time>   Request timeout override (e.g. 180s, 3m, 300000ms; default: norn.config.json or 30s)
   --insecure             Disable TLS certificate verification (dev/self-signed only)
   -j, --json             Output results as JSON (for CI/CD)
@@ -134540,6 +135181,8 @@ Examples:
   norn api-tests.norn --html report.html    # Generate HTML report (explicit)
   norn api-tests.norn --insecure            # Allow self-signed/local TLS certs
   norn api-tests.norn --no-redact           # Show all data (no redaction)
+  norn triage.nornk8s --context docker-desktop
+  norn triage.nornk8s -s Triage --context prelive --yes
   norn .nornenv --refactor-region-pattern   # Print refactored .nornenv
   norn .nornenv --refactor-region-pattern --write
   norn secrets keygen --name team-main      # Generate shared key and cache locally
@@ -134596,6 +135239,109 @@ function runNornenvRegionRefactor(filePath, options) {
   }
   process.exit(0);
 }
+function redactK8sResult(result, redaction) {
+  return {
+    ...result,
+    errors: result.errors.map((error2) => redactString(error2, redaction)),
+    commands: result.commands.map((command) => ({
+      ...command,
+      args: command.args.map((arg) => redactString(arg, redaction)),
+      stdout: redactString(command.stdout, redaction),
+      stderr: redactString(command.stderr, redaction)
+    }))
+  };
+}
+function writeK8sProcessOutput(text, stream4) {
+  if (!text) {
+    return;
+  }
+  stream4.write(text);
+  if (!text.endsWith("\n")) {
+    stream4.write("\n");
+  }
+}
+async function runK8sCliFile(filePath, options, colors) {
+  if (options.request) {
+    console.error("Error: --request is not supported for .nornk8s files");
+    return false;
+  }
+  if (options.junitOutput || options.htmlOutput || options.outputDir) {
+    console.error(colors.warning("Warning: reports are not supported for .nornk8s files in the MVP."));
+  }
+  const secretUnlockResult = await ensureCliSecretsUnlocked(filePath);
+  if (!secretUnlockResult.ok) {
+    if (secretUnlockResult.errors.length > 0) {
+      printSecretResolutionErrors(secretUnlockResult.errors, secretUnlockResult.envFilePath);
+    } else {
+      console.error("Unable to unlock encrypted secrets.");
+    }
+    return false;
+  }
+  const resolvedEnv = resolveEnvironmentForPath(filePath, options.env);
+  if (resolvedEnv.envNotFound) {
+    console.error(`Error: Environment '${resolvedEnv.envNotFound}' not found in .nornenv`);
+    console.error(`Available environments: ${resolvedEnv.availableEnvironments.join(", ") || "none"}`);
+    return false;
+  }
+  if (resolvedEnv.secretErrors.length > 0) {
+    for (const error2 of resolvedEnv.secretErrors) {
+      console.error(`Error: ${error2}`);
+    }
+    return false;
+  }
+  if (!resolvedEnv.envFilePath && options.env) {
+    console.error(colors.warning("Warning: --env specified but no .nornenv file found"));
+  } else if (resolvedEnv.envFilePath && options.env && options.verbose) {
+    console.log(colors.info(`Using environment: ${options.env}`));
+  }
+  const redaction = createRedactionOptions(resolvedEnv.secretNames, resolvedEnv.secretValues, !options.noRedact);
+  const fileContent = fs19.readFileSync(filePath, "utf-8");
+  const parsed = parseK8sDocument(fileContent);
+  const variables = attachEnvironmentScope({ ...resolvedEnv.variables }, resolvedEnv.variables);
+  const executionOptions = {
+    variables,
+    selectedContext: options.k8sContext,
+    workingDirectory: path19.dirname(filePath),
+    allowRestart: options.yes,
+    onCommand: options.output === "pretty" ? (command) => console.log(colors.dim(`$ ${redactString(command, redaction)}`)) : void 0
+  };
+  let results;
+  if (options.sequence) {
+    results = [await runK8sSequence(fileContent, options.sequence, executionOptions)];
+  } else {
+    results = await runK8sRunbooks(fileContent, executionOptions);
+    if (results.length === 0) {
+      if (options.output === "json") {
+        console.log(JSON.stringify({ success: true, results: [] }, null, 2));
+      } else {
+        const sequenceCount = parsed.sequences.length;
+        console.log(colors.info(
+          sequenceCount > 0 ? 'No Kubernetes runbooks found. Use "runbook sequence" to mark sequences for CLI execution.' : "No Kubernetes sequences found."
+        ));
+      }
+      return true;
+    }
+  }
+  const redactedResults = results.map((result) => redactK8sResult(result, redaction));
+  const success2 = results.every((result) => result.success);
+  if (options.output === "json") {
+    console.log(JSON.stringify({ success: success2, results: redactedResults }, null, 2));
+  } else {
+    for (const result of redactedResults) {
+      for (const command of result.commands) {
+        writeK8sProcessOutput(command.stdout, process.stdout);
+        writeK8sProcessOutput(command.stderr, process.stderr);
+      }
+      const status = result.success ? colors.checkmark : colors.cross;
+      console.log(`${status} ${result.name} (${formatDuration(result.duration)})`);
+      for (const error2 of result.errors) {
+        const restartHint = error2.includes("Restart requires confirmation") ? `${error2}. Re-run with --yes to allow mutations.` : error2;
+        console.error(`  ${colors.bullet} ${colors.error(restartHint)}`);
+      }
+    }
+  }
+  return success2;
+}
 async function runSingleRequest(fileContent, variables, cookieJar, apiDefinitions, filePath, envContext) {
   const lines = fileContent.split("\n");
   const requestLines = [];
@@ -134643,6 +135389,24 @@ function discoverNornFiles(dirPath) {
   walkDir(dirPath);
   return files.sort();
 }
+function discoverNornK8sFiles(dirPath) {
+  const files = [];
+  function walkDir(currentPath) {
+    const entries = fs19.readdirSync(currentPath, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = path19.join(currentPath, entry.name);
+      if (entry.isDirectory()) {
+        if (!entry.name.startsWith(".") && entry.name !== "node_modules") {
+          walkDir(fullPath);
+        }
+      } else if (entry.isFile() && entry.name.endsWith(".nornk8s")) {
+        files.push(fullPath);
+      }
+    }
+  }
+  walkDir(dirPath);
+  return files.sort();
+}
 function countTestSequences(fileContent, tagFilterOptions) {
   const allSequences = extractSequences(fileContent);
   const testSequences = allSequences.filter((seq) => seq.isTest);
@@ -134771,15 +135535,20 @@ async function main() {
     }
     runNornenvRegionRefactor(inputPath, options);
   }
+  if (!isDirectory && path19.extname(inputPath).toLowerCase() === ".nornk8s") {
+    const success2 = await runK8sCliFile(inputPath, options, colors);
+    process.exit(success2 || !options.failOnError ? 0 : 1);
+  }
+  const k8sFilesToRun = isDirectory ? discoverNornK8sFiles(inputPath) : [];
   let filesToRun;
   if (isDirectory) {
     filesToRun = discoverNornFiles(inputPath);
-    if (filesToRun.length === 0) {
-      console.log(colors.info(`No .norn files found in ${inputPath}`));
+    if (filesToRun.length === 0 && k8sFilesToRun.length === 0) {
+      console.log(colors.info(`No .norn or .nornk8s files found in ${inputPath}`));
       process.exit(0);
     }
     if (options.verbose) {
-      console.log(colors.info(`Discovered ${filesToRun.length} .norn file(s) in ${inputPath}`));
+      console.log(colors.info(`Discovered ${filesToRun.length} .norn and ${k8sFilesToRun.length} .nornk8s file(s) in ${inputPath}`));
     }
   } else {
     filesToRun = [inputPath];
@@ -134806,6 +135575,22 @@ async function main() {
     console.error("Error: --sequence and --request flags require a specific file, not a directory");
     process.exit(1);
   }
+  if (isDirectory && k8sFilesToRun.length > 0 && options.output === "json") {
+    console.error("Error: --json is not supported for directory runs containing .nornk8s files in the MVP");
+    process.exit(1);
+  }
+  for (const filePath of k8sFilesToRun) {
+    if (options.output !== "json") {
+      console.log(colors.info(`
+\u2501\u2501\u2501 ${path19.relative(inputPath, filePath)} \u2501\u2501\u2501`));
+    }
+    if (!await runK8sCliFile(filePath, options, colors)) {
+      overallSuccess = false;
+    }
+  }
+  if (filesToRun.length === 0) {
+    process.exit(overallSuccess || !options.failOnError ? 0 : 1);
+  }
   if (options.sequence || options.request) {
     const filePath = filesToRun[0];
     applyCliRequestTimeout(filePath, options, colors);
@@ -135000,6 +135785,9 @@ ${fileContent}` : fileContent;
     filteredTestCount += counts.filtered;
   }
   if (filteredTestCount === 0) {
+    if (k8sFilesToRun.length > 0 && totalTestCount === 0) {
+      process.exit(overallSuccess || !options.failOnError ? 0 : 1);
+    }
     if (totalTestCount > 0 && tagFilterOptions) {
       console.log(colors.info(`No test sequences match the tag filter (${totalTestCount} total test sequences found)`));
     } else if (totalTestCount === 0) {