From 9d79c907da9384a554b79371938ac00ffa8ae026 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robin=20Br=C3=A4mer?= <22003767+robinbraemer@users.noreply.github.com> Date: Thu, 13 Aug 2026 23:44:57 +0200 Subject: [PATCH] chore: update package repository coordinate Rationale: the source repository is now akua-dev/akuapkg, so release assets, package metadata, installers, generated site links, and contributor instructions must all use the canonical coordinate rather than rely on redirects. Tested: task site:gen; task release:check-workflows. --- CONTRIBUTING.md | 2 +- Cargo.toml | 2 +- README.md | 8 ++++---- SECURITY.md | 2 +- crates/akua-napi/loader.js | 2 +- crates/akua-napi/npm/darwin-arm64/package.json | 2 +- crates/akua-napi/npm/darwin-x64/package.json | 2 +- .../akua-napi/npm/linux-arm64-gnu/package.json | 2 +- .../npm/linux-arm64-musl/package.json | 2 +- .../akua-napi/npm/linux-x64-gnu/package.json | 2 +- .../akua-napi/npm/linux-x64-musl/package.json | 2 +- .../akua-napi/npm/win32-x64-msvc/package.json | 2 +- crates/akua-napi/package.json | 2 +- crates/akua-native-engines-npm/package.json | 2 +- crates/akuapkg-cli/Cargo.toml | 2 +- crates/helm-engine-wasm/Cargo.toml | 2 +- crates/kustomize-engine-wasm/Cargo.toml | 2 +- docs/agent-usage.md | 6 +++--- docs/releasing.md | 12 ++++++------ packages/sdk/README.md | 2 +- packages/sdk/package.json | 4 ++-- packages/sdk/src/mod.ts | 2 +- scripts/aur/akuapkg-bin/PKGBUILD | 6 +++--- scripts/check-release-workflows.sh | 4 ++-- scripts/gen-error-pages.ts | 2 +- scripts/gen-example-pages.ts | 2 +- scripts/gen-landing.ts | 6 +++--- scripts/gen-start-page.ts | 2 +- scripts/install.ps1 | 6 +++--- scripts/install.sh | 6 +++--- scripts/site/layout.ts | 2 +- scripts/site/markdown.ts | 4 ++-- site/cli/add.html | 2 +- site/cli/api.html | 2 +- site/cli/attest.html | 2 +- site/cli/audit.html | 2 +- site/cli/bench.html | 2 +- site/cli/check.html | 2 +- site/cli/cov.html | 2 +- site/cli/deploy.html | 2 +- site/cli/dev.html | 2 +- site/cli/diff.html | 2 +- site/cli/eval.html | 2 +- site/cli/export.html | 2 +- site/cli/fmt.html | 2 +- site/cli/help.html | 2 +- site/cli/index.html | 6 +++--- site/cli/infra.html | 2 +- site/cli/init.html | 2 +- site/cli/inspect.html | 2 +- site/cli/lint-cli.html | 10 +++++----- site/cli/lint.html | 2 +- site/cli/login.html | 2 +- site/cli/logout.html | 2 +- site/cli/policy.html | 2 +- site/cli/publish.html | 2 +- site/cli/pull.html | 2 +- site/cli/query.html | 2 +- site/cli/render.html | 6 +++--- site/cli/repl.html | 2 +- site/cli/rollout.html | 2 +- site/cli/secret.html | 2 +- site/cli/telemetry.html | 2 +- site/cli/test.html | 4 ++-- site/cli/trace.html | 2 +- site/cli/vendor.html | 4 ++-- site/cli/version.html | 2 +- site/cli/whoami.html | 4 ++-- site/concepts/agent-usage.html | 18 +++++++++--------- site/concepts/cli-contract.html | 2 +- site/concepts/debugging.html | 2 +- site/concepts/embedded-engines.html | 12 ++++++------ site/concepts/index.html | 2 +- site/concepts/lockfile-format.html | 2 +- site/concepts/package-format.html | 14 +++++++------- site/concepts/sdk.html | 4 ++-- site/concepts/security-model.html | 14 +++++++------- site/errors/E_ADD_DEP_EXISTS.html | 4 ++-- site/errors/E_ADD_INVALID_DEP.html | 4 ++-- site/errors/E_API_REQUEST.html | 4 ++-- site/errors/E_AUTH_INVALID.html | 4 ++-- site/errors/E_AUTH_PARSE.html | 8 ++++---- site/errors/E_AUTH_REQUIRED.html | 4 ++-- site/errors/E_CHECK_FAIL.html | 4 ++-- site/errors/E_COSIGN_SIG_MISSING.html | 4 ++-- site/errors/E_COSIGN_VERIFY.html | 4 ++-- site/errors/E_DEP_KIND_MISMATCH.html | 4 ++-- site/errors/E_DEP_RESOLVE.html | 4 ++-- site/errors/E_DIFF_FOUND.html | 4 ++-- site/errors/E_DIFF_NOT_DIR.html | 4 ++-- site/errors/E_ENGINE_NOT_AVAILABLE.html | 4 ++-- site/errors/E_FMT_CHANGED.html | 4 ++-- site/errors/E_FMT_KCL.html | 4 ++-- site/errors/E_FORBIDDEN.html | 4 ++-- site/errors/E_INIT_EMPTY_NAME.html | 4 ++-- site/errors/E_INIT_EXISTS.html | 4 ++-- site/errors/E_INPUTS_MISSING.html | 4 ++-- site/errors/E_INPUTS_PARSE.html | 4 ++-- site/errors/E_INSPECT_FAIL.html | 4 ++-- site/errors/E_INVALID_FLAG.html | 4 ++-- site/errors/E_IO.html | 4 ++-- site/errors/E_LINT_FAIL.html | 4 ++-- site/errors/E_LOCK_DRIFT.html | 4 ++-- site/errors/E_LOCK_MISSING.html | 4 ++-- site/errors/E_LOCK_PARSE.html | 4 ++-- site/errors/E_MANIFEST_GIT_USERINFO.html | 8 ++++---- site/errors/E_MANIFEST_HELM_CHART_INVALID.html | 4 ++-- site/errors/E_MANIFEST_HELM_MISSING_CHART.html | 4 ++-- .../E_MANIFEST_HELM_MISSING_VERSION.html | 4 ++-- site/errors/E_MANIFEST_HELM_USERINFO.html | 4 ++-- site/errors/E_MANIFEST_MISSING.html | 4 ++-- site/errors/E_MANIFEST_OCI_USERINFO.html | 4 ++-- site/errors/E_MANIFEST_PARSE.html | 4 ++-- site/errors/E_PACKAGE_MISSING.html | 4 ++-- site/errors/E_PACKAGE_PARSE.html | 4 ++-- site/errors/E_PATH_ESCAPE.html | 6 +++--- site/errors/E_PUBLISH_FAILED.html | 4 ++-- site/errors/E_PULL_FAILED.html | 4 ++-- site/errors/E_REMOVE_NOT_FOUND.html | 4 ++-- site/errors/E_RENDER_BUDGET_DEADLINE.html | 4 ++-- site/errors/E_RENDER_BUDGET_DEPTH.html | 4 ++-- site/errors/E_RENDER_CYCLE.html | 4 ++-- site/errors/E_RENDER_KCL.html | 4 ++-- site/errors/E_RENDER_OUTPUT_TOO_LARGE.html | 4 ++-- site/errors/E_RENDER_YAML.html | 4 ++-- site/errors/E_STRICT_UNTYPED_CHART.html | 4 ++-- site/errors/E_UNSUPPORTED.html | 4 ++-- site/errors/E_VENDOR_DEP_MISSING.html | 4 ++-- site/errors/E_VENDOR_DRIFT.html | 4 ++-- site/errors/index.html | 2 +- site/examples/00-helm-hello.html | 10 +++++----- site/examples/01-hello-webapp.html | 6 +++--- site/examples/02-webapp-postgres.html | 8 ++++---- site/examples/03-multi-env-app.html | 6 +++--- site/examples/04-policy-tier.html | 8 ++++---- site/examples/05-tests-and-golden.html | 6 +++--- site/examples/06-multi-engine.html | 6 +++--- site/examples/07-package-reuse.html | 10 +++++----- site/examples/08-pkg-compose.html | 4 ++-- site/examples/09-kustomize-hello.html | 8 ++++---- site/examples/10-kcl-ecosystem.html | 4 ++-- site/examples/11-install-as-package.html | 6 +++--- site/examples/12-vendor-offline.html | 4 ++-- site/examples/13-subpackage-helm.html | 4 ++-- site/examples/14-helm-repo-dep.html | 4 ++-- site/examples/index.html | 2 +- site/index.html | 8 ++++---- site/start/index.html | 10 +++++----- skills/README.md | 2 +- 149 files changed, 303 insertions(+), 303 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a2ee883..c4c7c3e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -19,7 +19,7 @@ Prerequisites are managed via [mise](https://mise.jdx.dev/) — task, helmfile, wasm-pack, etc.) at pinned versions. ```bash -git clone git@github.com:akua-dev/akua.git +git clone git@github.com:akua-dev/akuapkg.git cd akua mise install diff --git a/Cargo.toml b/Cargo.toml index 53e3c25..7a4efe6 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -15,7 +15,7 @@ members = [ version = "0.8.20" edition = "2021" license = "Apache-2.0" -repository = "https://github.com/akua-dev/akua" +repository = "https://github.com/akua-dev/akuapkg" authors = ["CNAP Tech "] [workspace.dependencies] diff --git a/README.md b/README.md index ca54162..832797b 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@

- Release + Release npm License

@@ -127,7 +127,7 @@ curl -fsSL https://cli.akua.dev/install | sh irm https://cli.akua.dev/install.ps1 | iex # From source -cargo install --git https://github.com/akua-dev/akua akuapkg-cli +cargo install --git https://github.com/akua-dev/akuapkg akuapkg-cli ``` ```sh @@ -135,10 +135,10 @@ cargo install --git https://github.com/akua-dev/akua akuapkg-cli bun add @akua-dev/sdk # Agent skills (universal — works across 25+ agents) -npx skills install github:akua-dev/akua/skills +npx skills install github:akua-dev/akuapkg/skills ``` -Prebuilt binaries: [Releases](https://github.com/akua-dev/akua/releases). Container image: `ghcr.io/akua-dev/akua`. Agent-specific setup: [`docs/agent-usage.md`](docs/agent-usage.md). +Prebuilt binaries: [Releases](https://github.com/akua-dev/akuapkg/releases). Container image: `ghcr.io/akua-dev/akuapkg`. Agent-specific setup: [`docs/agent-usage.md`](docs/agent-usage.md). ## Documentation diff --git a/SECURITY.md b/SECURITY.md index 453b2ee..15297ea 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -139,6 +139,6 @@ retained as an escape hatch; it's safe only for trusted packages. ## Reporting Please report vulnerabilities privately via GitHub Security Advisories -at https://github.com/akua-dev/akua/security/advisories/new. +at https://github.com/akua-dev/akuapkg/security/advisories/new. Fixes are prioritized ahead of feature work; we'll coordinate disclosure timing with you. diff --git a/crates/akua-napi/loader.js b/crates/akua-napi/loader.js index fb67afa..65027ea 100644 --- a/crates/akua-napi/loader.js +++ b/crates/akua-napi/loader.js @@ -14,7 +14,7 @@ // Why a separate file: index.js is regenerated on every `napi build`, // so any setup we'd inline there gets clobbered. Keeping the env-var // plumbing in loader.js makes it survive regen + leaves the auto-gen -// machinery untouched. See akua-dev/akua#482. +// machinery untouched. See akua-dev/akuapkg#482. 'use strict'; diff --git a/crates/akua-napi/npm/darwin-arm64/package.json b/crates/akua-napi/npm/darwin-arm64/package.json index 603e35a..d14281f 100644 --- a/crates/akua-napi/npm/darwin-arm64/package.json +++ b/crates/akua-napi/npm/darwin-arm64/package.json @@ -24,7 +24,7 @@ }, "repository": { "type": "git", - "url": "git+https://github.com/akua-dev/akua.git" + "url": "git+https://github.com/akua-dev/akuapkg.git" }, "os": [ "darwin" diff --git a/crates/akua-napi/npm/darwin-x64/package.json b/crates/akua-napi/npm/darwin-x64/package.json index 0cb4eb7..d54180e 100644 --- a/crates/akua-napi/npm/darwin-x64/package.json +++ b/crates/akua-napi/npm/darwin-x64/package.json @@ -24,7 +24,7 @@ }, "repository": { "type": "git", - "url": "git+https://github.com/akua-dev/akua.git" + "url": "git+https://github.com/akua-dev/akuapkg.git" }, "os": [ "darwin" diff --git a/crates/akua-napi/npm/linux-arm64-gnu/package.json b/crates/akua-napi/npm/linux-arm64-gnu/package.json index 1f561af..c634ab0 100644 --- a/crates/akua-napi/npm/linux-arm64-gnu/package.json +++ b/crates/akua-napi/npm/linux-arm64-gnu/package.json @@ -24,7 +24,7 @@ }, "repository": { "type": "git", - "url": "git+https://github.com/akua-dev/akua.git" + "url": "git+https://github.com/akua-dev/akuapkg.git" }, "os": [ "linux" diff --git a/crates/akua-napi/npm/linux-arm64-musl/package.json b/crates/akua-napi/npm/linux-arm64-musl/package.json index fbee9bc..a6d1200 100644 --- a/crates/akua-napi/npm/linux-arm64-musl/package.json +++ b/crates/akua-napi/npm/linux-arm64-musl/package.json @@ -24,7 +24,7 @@ }, "repository": { "type": "git", - "url": "git+https://github.com/akua-dev/akua.git" + "url": "git+https://github.com/akua-dev/akuapkg.git" }, "os": [ "linux" diff --git a/crates/akua-napi/npm/linux-x64-gnu/package.json b/crates/akua-napi/npm/linux-x64-gnu/package.json index 48904d5..9a30550 100644 --- a/crates/akua-napi/npm/linux-x64-gnu/package.json +++ b/crates/akua-napi/npm/linux-x64-gnu/package.json @@ -24,7 +24,7 @@ }, "repository": { "type": "git", - "url": "git+https://github.com/akua-dev/akua.git" + "url": "git+https://github.com/akua-dev/akuapkg.git" }, "os": [ "linux" diff --git a/crates/akua-napi/npm/linux-x64-musl/package.json b/crates/akua-napi/npm/linux-x64-musl/package.json index 7f22841..723c8c3 100644 --- a/crates/akua-napi/npm/linux-x64-musl/package.json +++ b/crates/akua-napi/npm/linux-x64-musl/package.json @@ -24,7 +24,7 @@ }, "repository": { "type": "git", - "url": "git+https://github.com/akua-dev/akua.git" + "url": "git+https://github.com/akua-dev/akuapkg.git" }, "os": [ "linux" diff --git a/crates/akua-napi/npm/win32-x64-msvc/package.json b/crates/akua-napi/npm/win32-x64-msvc/package.json index b06ab13..79d326a 100644 --- a/crates/akua-napi/npm/win32-x64-msvc/package.json +++ b/crates/akua-napi/npm/win32-x64-msvc/package.json @@ -24,7 +24,7 @@ }, "repository": { "type": "git", - "url": "git+https://github.com/akua-dev/akua.git" + "url": "git+https://github.com/akua-dev/akuapkg.git" }, "os": [ "win32" diff --git a/crates/akua-napi/package.json b/crates/akua-napi/package.json index b7b2cda..8a27446 100644 --- a/crates/akua-napi/package.json +++ b/crates/akua-napi/package.json @@ -7,7 +7,7 @@ "license": "Apache-2.0", "repository": { "type": "git", - "url": "git+https://github.com/akua-dev/akua.git" + "url": "git+https://github.com/akua-dev/akuapkg.git" }, "engines": { "node": ">= 22" diff --git a/crates/akua-native-engines-npm/package.json b/crates/akua-native-engines-npm/package.json index 545631c..0431ae5 100644 --- a/crates/akua-native-engines-npm/package.json +++ b/crates/akua-native-engines-npm/package.json @@ -5,7 +5,7 @@ "license": "Apache-2.0", "repository": { "type": "git", - "url": "git+https://github.com/akua-dev/akua.git" + "url": "git+https://github.com/akua-dev/akuapkg.git" }, "main": "index.js", "files": [ diff --git a/crates/akuapkg-cli/Cargo.toml b/crates/akuapkg-cli/Cargo.toml index 9708405..c06f005 100644 --- a/crates/akuapkg-cli/Cargo.toml +++ b/crates/akuapkg-cli/Cargo.toml @@ -37,7 +37,7 @@ precompile-engines = ["akua-core/precompile-engines"] # `embed-engines` (default on): include_bytes!() the helm + kustomize # engine wasm into the binary. Disable for the napi npm distribution # where the engines ship via `@akua-dev/native-engines` and the -# loader points at them via AKUA_NATIVE_ENGINES_DIR. See akua-dev/akua#482. +# loader points at them via AKUA_NATIVE_ENGINES_DIR. See akua-dev/akuapkg#482. embed-engines = ["akua-core/embed-engines"] # OpenTelemetry export. Default on; activates only when the runtime sees # OTEL_EXPORTER_OTLP_ENDPOINT (or OTEL_EXPORTER_OTLP_TRACES_ENDPOINT). Off diff --git a/crates/helm-engine-wasm/Cargo.toml b/crates/helm-engine-wasm/Cargo.toml index 8d22e00..563421a 100644 --- a/crates/helm-engine-wasm/Cargo.toml +++ b/crates/helm-engine-wasm/Cargo.toml @@ -21,7 +21,7 @@ authors.workspace = true # helm-engine.{cwasm|wasm} file. Set OFF on the napi-rs build so the # 7 per-platform `@akua-dev/native-*` packages don't each duplicate # the 73 MB helm wasm; the bytes ship once via -# `@akua-dev/native-engines`. See akua-dev/akua#482. +# `@akua-dev/native-engines`. See akua-dev/akuapkg#482. [features] default = ["precompile", "embed-engines"] precompile = [] diff --git a/crates/kustomize-engine-wasm/Cargo.toml b/crates/kustomize-engine-wasm/Cargo.toml index fc33f57..3bf5636 100644 --- a/crates/kustomize-engine-wasm/Cargo.toml +++ b/crates/kustomize-engine-wasm/Cargo.toml @@ -15,7 +15,7 @@ authors.workspace = true # directly. With OFF, the binary carries no bytes; consumer points # `AKUA_NATIVE_ENGINES_DIR` at a directory containing the # kustomize-engine.{cwasm|wasm} file. Mirrors helm-engine-wasm. -# See akua-dev/akua#482. +# See akua-dev/akuapkg#482. [features] default = ["precompile", "embed-engines"] precompile = [] diff --git a/docs/agent-usage.md b/docs/agent-usage.md index 0f830dc..c9dac08 100644 --- a/docs/agent-usage.md +++ b/docs/agent-usage.md @@ -60,7 +60,7 @@ cp -r path/to/akua/skills/* ~/.claude/skills/ Install via the Codex skills manager: ```sh -codex skills install github:akua-dev/akua/skills +codex skills install github:akua-dev/akuapkg/skills ``` ### Cursor @@ -84,7 +84,7 @@ gemini extensions install @akua/skills All support the open [Agent Skills Specification](https://agentskills.io). Any of: - Symlink `skills/` into the agent's expected location -- Use `npx skills install github:akua-dev/akua/skills` +- Use `npx skills install github:akua-dev/akuapkg/skills` - Follow each agent's skill-installation instructions (linked from [agentskills.io/overview](https://agentskills.io/)) ### Universal: `npx skills` @@ -92,7 +92,7 @@ All support the open [Agent Skills Specification](https://agentskills.io). Any o The [Vercel Labs skills manager](https://github.com/vercel-labs/skills) works across all Agent Skills compatible agents: ```sh -npx skills install github:akua-dev/akua/skills +npx skills install github:akua-dev/akuapkg/skills npx skills list npx skills remove akua-* ``` diff --git a/docs/releasing.md b/docs/releasing.md index c17db49..ebc2854 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -39,7 +39,7 @@ request a GitHub OIDC token, but it cannot create or repair the trust relationsh An npm package administrator must confirm the following identity on all ten packages before any recovery dispatch: -- GitHub owner/repository: `akua-dev/akua` +- GitHub owner/repository: `akua-dev/akuapkg` - Workflow filename: `release-publish.yml` - Environment: none (leave the optional npm Environment field empty) - Allowed action: `npm publish` @@ -60,7 +60,7 @@ The affected packages are: Change each package under npm package settings → Trusted Publisher. Do not create, request, or pass an npm token: the workflow has `id-token: write`, uses GitHub-hosted runners, and deliberately has no `NODE_AUTH_TOKEN`. Each package manifest also uses -the exact repository URL `git+https://github.com/akua-dev/akua.git`, as required for +the exact repository URL `git+https://github.com/akua-dev/akuapkg.git`, as required for trusted publishing. ## Recovering the partial v0.8.25 release @@ -86,12 +86,12 @@ current `main` commit, and an npm administrator has confirmed the trusted-publisher identity above for all ten packages: ```sh -reviewed_workflow_commit=$(gh pr view 69 --repo akua-dev/akua --json mergeCommit --jq '.mergeCommit.oid') -main_commit=$(gh api repos/akua-dev/akua/commits/main --jq '.sha') +reviewed_workflow_commit=$(gh pr view 69 --repo akua-dev/akuapkg --json mergeCommit --jq '.mergeCommit.oid') +main_commit=$(gh api repos/akua-dev/akuapkg/commits/main --jq '.sha') test "$main_commit" = "$reviewed_workflow_commit" gh workflow run release.yml \ - --repo akua-dev/akua \ + --repo akua-dev/akuapkg \ --ref main \ -f tag=v0.8.25 \ -f expected-source-commit=6452eb662445d2ad7c108128f93b9c55138729bb \ @@ -100,6 +100,6 @@ gh workflow run release.yml \ ``` That single deliberate dispatch rebuilds from the immutable tag, verifies the existing -GitHub Release without changing any asset bytes, publishes `ghcr.io/akua-dev/akua`, +GitHub Release without changing any asset bytes, publishes `ghcr.io/akua-dev/akuapkg`, and then dispatches the idempotent npm publish lane from that run's artifacts. It has no Homebrew side effects. There are no automatic recovery retries. diff --git a/packages/sdk/README.md b/packages/sdk/README.md index ae643b9..b8d545f 100644 --- a/packages/sdk/README.md +++ b/packages/sdk/README.md @@ -1,6 +1,6 @@ # @akua-dev/sdk -TypeScript SDK for [akua](https://github.com/akua-dev/akua). Every verb runs in-process via a bundled native addon (napi-rs) — same `akua-core` the CLI uses, no `akua` binary on `$PATH` required. +TypeScript SDK for [Akuapkg](https://github.com/akua-dev/akuapkg). Every verb runs in-process via a bundled native addon (napi-rs) — same `akua-core` the CLI uses, no `akuapkg` binary on `$PATH` required. ## Install diff --git a/packages/sdk/package.json b/packages/sdk/package.json index c744de2..1670e40 100644 --- a/packages/sdk/package.json +++ b/packages/sdk/package.json @@ -5,9 +5,9 @@ "license": "Apache-2.0", "repository": { "type": "git", - "url": "git+https://github.com/akua-dev/akua.git" + "url": "git+https://github.com/akua-dev/akuapkg.git" }, - "homepage": "https://github.com/akua-dev/akua#readme", + "homepage": "https://github.com/akua-dev/akuapkg#readme", "type": "module", "main": "./dist/mod.js", "types": "./dist/mod.d.ts", diff --git a/packages/sdk/src/mod.ts b/packages/sdk/src/mod.ts index f8c8491..442cefa 100644 --- a/packages/sdk/src/mod.ts +++ b/packages/sdk/src/mod.ts @@ -461,7 +461,7 @@ export class Akua { * * Field-level docstrings become `description`; `@ui(...)` decorators * become OpenAPI-3.1-compliant `x-ui` extensions. See - * [`docs/cli.md`](https://github.com/akua-dev/akua/blob/main/docs/cli.md#akua-export) + * [`docs/cli.md`](https://github.com/akua-dev/akuapkg/blob/main/docs/cli.md#akuapkg-export) * for the full schema contract. */ async export(opts: ExportOptions = {}): Promise> { diff --git a/scripts/aur/akuapkg-bin/PKGBUILD b/scripts/aur/akuapkg-bin/PKGBUILD index 21286a6..40feba6 100644 --- a/scripts/aur/akuapkg-bin/PKGBUILD +++ b/scripts/aur/akuapkg-bin/PKGBUILD @@ -21,14 +21,14 @@ pkgver=0.1.0 pkgrel=1 pkgdesc="Cloud-native package build, transform, and preview toolkit" arch=('x86_64' 'aarch64') -url="https://github.com/akua-dev/akua" +url="https://github.com/akua-dev/akuapkg" license=('Apache-2.0') provides=('akuapkg') conflicts=('akuapkg') # Per-arch sources — each tag publishes both amd64 and arm64 tarballs. -source_x86_64=("https://github.com/akua-dev/akua/releases/download/v${pkgver}/${_pkgname}-v${pkgver}-x86_64-unknown-linux-gnu.tar.gz") -source_aarch64=("https://github.com/akua-dev/akua/releases/download/v${pkgver}/${_pkgname}-v${pkgver}-aarch64-unknown-linux-gnu.tar.gz") +source_x86_64=("https://github.com/akua-dev/akuapkg/releases/download/v${pkgver}/${_pkgname}-v${pkgver}-x86_64-unknown-linux-gnu.tar.gz") +source_aarch64=("https://github.com/akua-dev/akuapkg/releases/download/v${pkgver}/${_pkgname}-v${pkgver}-aarch64-unknown-linux-gnu.tar.gz") # SHA256 checksums — bump alongside pkgver. The release workflow # writes each tarball's sha256 next to it as `.tar.gz.sha256`; diff --git a/scripts/check-release-workflows.sh b/scripts/check-release-workflows.sh index 5ecc4db..0b6c3e9 100644 --- a/scripts/check-release-workflows.sh +++ b/scripts/check-release-workflows.sh @@ -320,7 +320,7 @@ for manifest in \ crates/akua-napi/package.json \ crates/akua-napi/npm/*/package.json \ packages/sdk/package.json; do - if [[ "$(jq -r '.repository.url' "$manifest")" != "git+https://github.com/akua-dev/akua.git" ]]; then + if [[ "$(jq -r '.repository.url' "$manifest")" != "git+https://github.com/akua-dev/akuapkg.git" ]]; then echo "ERROR: $manifest has stale npm repository provenance" >&2 exit 1 fi @@ -338,7 +338,7 @@ assert_job_contains ".github/workflows/release.yml" \ # The external trusted-publisher identity and the deliberately gated recovery # command are authoritative release contract, not tribal knowledge. -assert_file_contains "docs/releasing.md" "akua-dev/akua" +assert_file_contains "docs/releasing.md" "akua-dev/akuapkg" assert_file_contains "docs/releasing.md" "release-publish.yml" assert_file_contains "docs/releasing.md" "Environment: none" assert_file_contains "docs/releasing.md" "--ref main" diff --git a/scripts/gen-error-pages.ts b/scripts/gen-error-pages.ts index 8a6fe5f..225c542 100755 --- a/scripts/gen-error-pages.ts +++ b/scripts/gen-error-pages.ts @@ -128,7 +128,7 @@ function renderCodePage( const bodyHtml = richMarkdown ? renderMarkdown(richMarkdown) - : `

What happened

${summaryHtml}

How to fix it

This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

`; + : `

What happened

${summaryHtml}

How to fix it

This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

`; const inner = `
diff --git a/scripts/gen-example-pages.ts b/scripts/gen-example-pages.ts index 7fa5bfe..270a682 100644 --- a/scripts/gen-example-pages.ts +++ b/scripts/gen-example-pages.ts @@ -124,7 +124,7 @@ ${readmeHtml} ${packageKBlock} ${renderedBlock}

- Source: examples/${escape(example.slug)}/ + Source: examples/${escape(example.slug)}/

`; diff --git a/scripts/gen-landing.ts b/scripts/gen-landing.ts index f137721..6588ea2 100644 --- a/scripts/gen-landing.ts +++ b/scripts/gen-landing.ts @@ -33,7 +33,7 @@ const body = ` 
> irm https://cli.akua.dev/install.ps1 | iex

From source

-
$ cargo install --git https://github.com/akua-dev/akua akuapkg-cli
+
$ cargo install --git https://github.com/akua-dev/akuapkg akuapkg-cli

SDK

$ npm install @akua-dev/sdk
@@ -47,8 +47,8 @@ const body = `
  • Concepts
  • Examples
  • Errors
    • -
  • GitHub
    • -
  • Releases
    • +
  • GitHub
    • +
  • Releases

    • diff --git a/scripts/gen-start-page.ts b/scripts/gen-start-page.ts index 59f4fbd..9b63d98 100644 --- a/scripts/gen-start-page.ts +++ b/scripts/gen-start-page.ts @@ -22,7 +22,7 @@ const md = ` $ curl -fsSL https://cli.akua.dev/install | sh \`\`\` -Or grab a pinned binary from [Releases](https://github.com/akua-dev/akua/releases). Windows: \`irm https://cli.akua.dev/install.ps1 | iex\`. +Or grab a pinned binary from [Releases](https://github.com/akua-dev/akuapkg/releases). Windows: \`irm https://cli.akua.dev/install.ps1 | iex\`. Verify the install: diff --git a/scripts/install.ps1 b/scripts/install.ps1 index fc35e34..1ddb1b3 100644 --- a/scripts/install.ps1 +++ b/scripts/install.ps1 @@ -28,7 +28,7 @@ $triple = switch ($arch) { 'x86_64' { 'x86_64-pc-windows-msvc' } # aarch64-pc-windows-msvc builds aren't shipped yet. Users on ARM64 # Windows get a clear error rather than a silently-broken binary. - 'ARM64' { Die "ARM64 Windows not yet supported. File an issue at https://github.com/akua-dev/akua/issues" } + 'ARM64' { Die "ARM64 Windows not yet supported. File an issue at https://github.com/akua-dev/akuapkg/issues" } default { Die "unsupported Windows arch: $arch" } } @@ -50,7 +50,7 @@ function Resolve-Version($v) { # -MaximumRedirection 0 means: stop at the first redirect and read # its Location header, rather than actually following it. $resp = try { - Invoke-WebRequest -Uri 'https://github.com/akua-dev/akua/releases/latest' ` + Invoke-WebRequest -Uri 'https://github.com/akua-dev/akuapkg/releases/latest' ` -MaximumRedirection 0 -ErrorAction SilentlyContinue } catch { $_.Exception.Response @@ -69,7 +69,7 @@ $version = Resolve-Version $requestedVersion $base = if ($env:AKUAPKG_DOWNLOAD_BASE) { $env:AKUAPKG_DOWNLOAD_BASE } else { 'https://github.com' } $asset = "akuapkg-$version-$triple.zip" -$url = "$base/akua-dev/akua/releases/download/$version/$asset" +$url = "$base/akua-dev/akuapkg/releases/download/$version/$asset" $installRoot = if ($env:AKUAPKG_INSTALL) { $env:AKUAPKG_INSTALL } else { Join-Path $env:USERPROFILE '.akuapkg' } $binDir = Join-Path $installRoot 'bin' diff --git a/scripts/install.sh b/scripts/install.sh index 122c43d..c164ac0 100644 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -39,7 +39,7 @@ main() { local base="${AKUAPKG_DOWNLOAD_BASE:-https://github.com}" local asset="akuapkg-${resolved_version}-${triple}.tar.gz" - local url="${base}/akua-dev/akua/releases/download/${resolved_version}/${asset}" + local url="${base}/akua-dev/akuapkg/releases/download/${resolved_version}/${asset}" local install_root="${AKUAPKG_INSTALL:-$HOME/.akuapkg}" local bin_dir="${install_root}/bin" @@ -90,7 +90,7 @@ detect_triple() { # bail rather than give them a broken glibc binary that fails # at runtime with a confusing dynamic-linker error. if [ -f /etc/alpine-release ]; then - error "Alpine/musl not yet supported. Build from source:\n\n cargo install --git https://github.com/akua-dev/akua akuapkg-cli\n" + error "Alpine/musl not yet supported. Build from source:\n\n cargo install --git https://github.com/akua-dev/akuapkg akuapkg-cli\n" fi case "$machine" in x86_64|amd64) triple="x86_64-unknown-linux-gnu" ;; @@ -137,7 +137,7 @@ resolve_version() { # redirect on `/releases/latest` itself. local location location="$(curl -fsSLI -o /dev/null -w '%{url_effective}\n' \ - https://github.com/akua-dev/akua/releases/latest)" + https://github.com/akua-dev/akuapkg/releases/latest)" # URL ends with .../tag/vX.Y.Z. echo "$location" | sed -e 's|.*/tag/||' } diff --git a/scripts/site/layout.ts b/scripts/site/layout.ts index 29e50ee..eccbcfa 100644 --- a/scripts/site/layout.ts +++ b/scripts/site/layout.ts @@ -442,7 +442,7 @@ ${sidebarHtml} ${opts.body}

    diff --git a/scripts/site/markdown.ts b/scripts/site/markdown.ts index 7c6da3a..bdbaf5d 100644 --- a/scripts/site/markdown.ts +++ b/scripts/site/markdown.ts @@ -9,8 +9,8 @@ import { escape } from './layout.ts'; /** Github-blob base for rewriting `../foo.md` links found in `docs/`. */ -const GITHUB_BLOB = 'https://github.com/akua-dev/akua/blob/main'; -const GITHUB_TREE = 'https://github.com/akua-dev/akua/tree/main'; +const GITHUB_BLOB = 'https://github.com/akua-dev/akuapkg/blob/main'; +const GITHUB_TREE = 'https://github.com/akua-dev/akuapkg/tree/main'; /** * Rewrite source-tree links to URLs that resolve on the deployed diff --git a/site/cli/add.html b/site/cli/add.html index 84eaf70..645073d 100644 --- a/site/cli/add.html +++ b/site/cli/add.html @@ -337,7 +337,7 @@

    JSON output

    diff --git a/site/cli/api.html b/site/cli/api.html index 49ecb86..c3059c9 100644 --- a/site/cli/api.html +++ b/site/cli/api.html @@ -348,7 +348,7 @@

    Exit codes

    diff --git a/site/cli/attest.html b/site/cli/attest.html index 28c95e8..e28565c 100644 --- a/site/cli/attest.html +++ b/site/cli/attest.html @@ -320,7 +320,7 @@

    JSON output

    diff --git a/site/cli/audit.html b/site/cli/audit.html index ed198df..e7fc606 100644 --- a/site/cli/audit.html +++ b/site/cli/audit.html @@ -336,7 +336,7 @@

    JSON output (explain)

    diff --git a/site/cli/bench.html b/site/cli/bench.html index 26f3eb9..f9d6040 100644 --- a/site/cli/bench.html +++ b/site/cli/bench.html @@ -323,7 +323,7 @@

    JSON output

    diff --git a/site/cli/check.html b/site/cli/check.html index a0bc85d..7ac2b1b 100644 --- a/site/cli/check.html +++ b/site/cli/check.html @@ -326,7 +326,7 @@

    JSON output

    diff --git a/site/cli/cov.html b/site/cli/cov.html index bc77d04..58c9e39 100644 --- a/site/cli/cov.html +++ b/site/cli/cov.html @@ -310,7 +310,7 @@

    Flags

    diff --git a/site/cli/deploy.html b/site/cli/deploy.html index 3cd6f91..e1fbc2b 100644 --- a/site/cli/deploy.html +++ b/site/cli/deploy.html @@ -334,7 +334,7 @@

    JSON output (status)

    diff --git a/site/cli/dev.html b/site/cli/dev.html index 0ba5f5d..33bed47 100644 --- a/site/cli/dev.html +++ b/site/cli/dev.html @@ -319,7 +319,7 @@

    JSON output (when --json)

    diff --git a/site/cli/diff.html b/site/cli/diff.html index c349118..a64e399 100644 --- a/site/cli/diff.html +++ b/site/cli/diff.html @@ -332,7 +332,7 @@

    JSON output

    diff --git a/site/cli/eval.html b/site/cli/eval.html index ce3a755..e571829 100644 --- a/site/cli/eval.html +++ b/site/cli/eval.html @@ -318,7 +318,7 @@

    JSON output

    diff --git a/site/cli/export.html b/site/cli/export.html index e201f51..b796ac6 100644 --- a/site/cli/export.html +++ b/site/cli/export.html @@ -345,7 +345,7 @@

    Exit codes

    diff --git a/site/cli/fmt.html b/site/cli/fmt.html index e3c35f6..db2c0a8 100644 --- a/site/cli/fmt.html +++ b/site/cli/fmt.html @@ -312,7 +312,7 @@

    Exit codes

    diff --git a/site/cli/help.html b/site/cli/help.html index 13e1a7a..0505e09 100644 --- a/site/cli/help.html +++ b/site/cli/help.html @@ -309,7 +309,7 @@

    akuapkg help

    diff --git a/site/cli/index.html b/site/cli/index.html index 2ea7135..9c0e03e 100644 --- a/site/cli/index.html +++ b/site/cli/index.html @@ -304,7 +304,7 @@

    CLI reference

    akua CLI reference

    Complete reference for the akua binary. Every verb, every subcommand, every flag.

    -

    For the universal contract every verb honors (JSON output, exit codes, idempotency, plan mode, timeouts), see cli-contract.md.

    +

    For the universal contract every verb honors (JSON output, exit codes, idempotency, plan mode, timeouts), see cli-contract.md.

    Status marker. Sections marked ✅ describe verbs available in the shipping binary. Sections marked 🚧 describe verbs from the target surface that aren't wired yet. If a verb isn't marked, assume 🚧. Shipped today (28 verbs): init · whoami · version · verify · render · add · vendor · dev · test · tree · pull · publish · sign · update · lock · push · repl · pack · remove · diff · check · inspect · lint · fmt · cache · auth · export · api Run akua --help at the command line for the authoritative live list.

    Top-level flags

    @@ -319,7 +319,7 @@

    Agent-context auto-detection

    # Agent context — auto-JSON, no flag needed $ CLAUDECODE=1 akuapkg render {"format":"raw-manifests","target":"./deploy","manifests":3,"hash":"sha256:…"} -

    See cli-contract.md §1.5 for the full detection rules, override semantics, and env-var reference.

    +

    See cli-contract.md §1.5 for the full detection rules, override semantics, and env-var reference.

    Verb index

    AUTHOR              PUBLISH             DEPLOY              OPERATE
@@ -488,7 +488,7 @@ 
    Verb index
    
 
 
 
diff --git a/site/cli/infra.html b/site/cli/infra.html
index 0f42d06..6c75452 100644
--- a/site/cli/infra.html
+++ b/site/cli/infra.html
@@ -313,7 +313,7 @@ 
    Subcommands
    
 
 
 
diff --git a/site/cli/init.html b/site/cli/init.html
index 27a2ae1..2aa9ee9 100644
--- a/site/cli/init.html
+++ b/site/cli/init.html
@@ -322,7 +322,7 @@ 
    JSON output
    
 
 
 
diff --git a/site/cli/inspect.html b/site/cli/inspect.html
index 7e54dfe..5d62303 100644
--- a/site/cli/inspect.html
+++ b/site/cli/inspect.html
@@ -323,7 +323,7 @@ 
    JSON output
    
 
 
 
diff --git a/site/cli/lint-cli.html b/site/cli/lint-cli.html
index 0c1f65f..2437d7f 100644
--- a/site/cli/lint-cli.html
+++ b/site/cli/lint-cli.html
@@ -313,20 +313,20 @@ 
    akua-specific
    
 
    Agent-context env vars (detected, never written)
    
 
    These are set by agent runtimes, not by akua. akua reads them to determine whether it's running in an agent context.
    
 
    varset by
    AGENT=<name>Goose (goose), Amp (amp), Codex (codex), Cline (cline), OpenCode (opencode) — emerging standard
    CLAUDECODE=1Claude Code
    GEMINI_CLI=1Gemini CLI
    CURSOR_CLI=1Cursor CLI
    GOOSE_TERMINAL=1, AMP_THREAD_ID=<id>, CODEX_SANDBOX=<id>, CLINE_ACTIVE=truesecondary identifiers per agent — recorded as context
    
-
    See cli-contract.md §1.5 for detection rules and precedence.
    
+
    See cli-contract.md §1.5 for detection rules and precedence.
    
 
    Exit code reference (summary)
    
-
    From cli-contract.md:
    
+
    From cli-contract.md:
    
 
    codemeaning
    0success
    1user error
    2system error
    3policy deny
    4rate limited
    5needs approval
    6timeout
    
 
    Stability and versioning
    
 
    • Pre-v1.0: breaking changes require a minor version bump + changelog entry.
    • v1.0 onward: flag removal requires 6-month deprecation; exit code semantics never change.
    • JSON output keys are part of the stability contract.
    • New verbs can be added without bumping major.
    
 
    What's not in this reference
    
-
+
 
    Spec cross-references
    
-
+
 
 
 
diff --git a/site/cli/lint.html b/site/cli/lint.html
index 4b1843a..29a9fcd 100644
--- a/site/cli/lint.html
+++ b/site/cli/lint.html
@@ -331,7 +331,7 @@ 
    JSON output
    
 
 
 
diff --git a/site/cli/login.html b/site/cli/login.html
index 341739e..0c34f2e 100644
--- a/site/cli/login.html
+++ b/site/cli/login.html
@@ -312,7 +312,7 @@ 
    Examples
    
 
 
 
diff --git a/site/cli/logout.html b/site/cli/logout.html
index d425aac..a110ed8 100644
--- a/site/cli/logout.html
+++ b/site/cli/logout.html
@@ -308,7 +308,7 @@ 
    akuapkg logout
    
 
 
 
diff --git a/site/cli/policy.html b/site/cli/policy.html
index b17fc55..287c50f 100644
--- a/site/cli/policy.html
+++ b/site/cli/policy.html
@@ -335,7 +335,7 @@ 
    JSON output (check)
    
 
 
 
diff --git a/site/cli/publish.html b/site/cli/publish.html
index 9e73eaf..93372bb 100644
--- a/site/cli/publish.html
+++ b/site/cli/publish.html
@@ -321,7 +321,7 @@ 
    JSON output
    
 
 
 
diff --git a/site/cli/pull.html b/site/cli/pull.html
index 81e7973..2ada43a 100644
--- a/site/cli/pull.html
+++ b/site/cli/pull.html
@@ -309,7 +309,7 @@ 
    Flags
    
 
 
 
diff --git a/site/cli/query.html b/site/cli/query.html
index b278efa..38b01ca 100644
--- a/site/cli/query.html
+++ b/site/cli/query.html
@@ -322,7 +322,7 @@ 
    Example
    
 
 
 
diff --git a/site/cli/render.html b/site/cli/render.html
index 77872a9..ed87e51 100644
--- a/site/cli/render.html
+++ b/site/cli/render.html
@@ -304,11 +304,11 @@ 
    akuapkg render
    
 
    Shipped
    
 
    Run the Package's program. Evaluate the KCL, invoke every source engine (Helm, kro, Kustomize), compose results, produce deploy-ready manifests.
    
 
    akuapkg render [path] [flags]
    
-
    Discovery. With no path, renders every user-authored document in the workspace whose schema declares render semantics — typically the workspace's App-shaped documents that reference a Package and carry inputs. With a path, renders only that file. Users author their own App / Environment / etc. schemas (akua does not specify them; see package-format.md); render processes whichever documents the workspace declares as renderable.
    
+
    Discovery. With no path, renders every user-authored document in the workspace whose schema declares render semantics — typically the workspace's App-shaped documents that reference a Package and carry inputs. With a path, renders only that file. Users author their own App / Environment / etc. schemas (akua does not specify them; see package-format.md); render processes whichever documents the workspace declares as renderable.
    
 
    Not the same as akuapkg export. render executes the full pipeline against customer inputs and writes manifests a reconciler applies to a cluster. export converts a canonical artifact (schema, user-authored KCL document, policy bundle) into a format view (JSON Schema, YAML, OpenAPI, Rego bundle). Render needs inputs; export usually doesn't. Render invokes engines; export is format translation. See akuapkg export below.
    
 
    Flags
    
 
    flagdescription
    --package=<path>path to the package.k file (default ./package.k)
    --inputs=<file>inputs file (JSON or YAML). When omitted, probes ./inputs.yaml then ./inputs.example.yaml next to the package; falls back to schema defaults if neither exists
    --out=<dir>write to directory (default: ./deploy/)
    --stdoutprint rendered manifests as multi-doc YAML to stdout instead of writing files
    --dry-runrender but don't write files
    
-
    Engines. Helm and Akua-package composition reach the user via alias-method calls — webapp.template(webapp.TemplateOpts{values = webapp.Values{...}}), upstream.render(upstream.Input{...}) — synthesized per dep from akua.toml. Kustomize stays engine-direct (kustomize.build({path = "./overlays"})) because its input is a within-Package directory, not a typed dep. All backends ship as embedded WASM modules; akua never shells out to helm or kustomize binaries — every engine runs inside the wasmtime sandbox alongside the render worker. See docs/security-model.md and docs/embedded-engines.md.  One render output. akua writes raw YAML manifests, one file per resource. Distribution shapes like Helm charts or OCI bundles are future akuapkg publish --as <format> concerns — they wrap rendered manifests at distribution time, not as a Package-declared output.
    
+
    Engines. Helm and Akua-package composition reach the user via alias-method calls — webapp.template(webapp.TemplateOpts{values = webapp.Values{...}}), upstream.render(upstream.Input{...}) — synthesized per dep from akua.toml. Kustomize stays engine-direct (kustomize.build({path = "./overlays"})) because its input is a within-Package directory, not a typed dep. All backends ship as embedded WASM modules; akua never shells out to helm or kustomize binaries — every engine runs inside the wasmtime sandbox alongside the render worker. See docs/security-model.md and docs/embedded-engines.md.  One render output. akua writes raw YAML manifests, one file per resource. Distribution shapes like Helm charts or OCI bundles are future akuapkg publish --as <format> concerns — they wrap rendered manifests at distribution time, not as a Package-declared output.
    
 
    Exit codes
    
 
    0 success, 1 user error, 2 system error. (Phase B adds 3 for policy deny.)
    
 
    JSON output
    
@@ -323,7 +323,7 @@ 
    JSON output
    
 
 
 
diff --git a/site/cli/repl.html b/site/cli/repl.html
index e5f21bb..d844fcb 100644
--- a/site/cli/repl.html
+++ b/site/cli/repl.html
@@ -310,7 +310,7 @@ 
    akuapkg repl
    
 
 
 
diff --git a/site/cli/rollout.html b/site/cli/rollout.html
index 53f6a3d..7a07efe 100644
--- a/site/cli/rollout.html
+++ b/site/cli/rollout.html
@@ -317,7 +317,7 @@ 
    Flags
    
 
 
 
diff --git a/site/cli/secret.html b/site/cli/secret.html
index 814156d..3dacf60 100644
--- a/site/cli/secret.html
+++ b/site/cli/secret.html
@@ -331,7 +331,7 @@ 
    JSON output (trace)
    
 
 
 
diff --git a/site/cli/telemetry.html b/site/cli/telemetry.html
index 9ae3c34..c7748b0 100644
--- a/site/cli/telemetry.html
+++ b/site/cli/telemetry.html
@@ -311,7 +311,7 @@ 
    akuapkg telemetry
    
 
 
 
diff --git a/site/cli/test.html b/site/cli/test.html
index da1e311..ef03afa 100644
--- a/site/cli/test.html
+++ b/site/cli/test.html
@@ -307,7 +307,7 @@ 
    akuapkg test
    
 
    Discovers and runs:
    
 
    • **/*_test.rego — Rego policy tests via embedded OPA
    • **/_test.k / test_.k — KCL test files via embedded KCL
    • Kyverno test.yaml bundle tests (when the bundle is imported)
    • Golden-output tests (*.golden.yaml compared against current render)
    
 
    Flags
    
-
    flagdescription
    --coverageemit per-rule / per-schema coverage report
    --watchre-run on file change
    --goldenenable / verify golden-output comparisons
    --filter=<regex>run only matching tests
    --timeout=<dur>per-test timeout (default 30s)
    `--engine=<auto\embedded\shell>`engine selection (see embedded-engines.md)
    
+
    flagdescription
    --coverageemit per-rule / per-schema coverage report
    --watchre-run on file change
    --goldenenable / verify golden-output comparisons
    --filter=<regex>run only matching tests
    --timeout=<dur>per-test timeout (default 30s)
    `--engine=<auto\embedded\shell>`engine selection (see embedded-engines.md)
    
 
    Exit codes
    
 
    0 if all pass, 1 if any fail, 2 on infrastructure error.
    
 
    JSON output
    
@@ -333,7 +333,7 @@ 
    JSON output
    
 
 
 
diff --git a/site/cli/trace.html b/site/cli/trace.html
index 930d621..25bf8a3 100644
--- a/site/cli/trace.html
+++ b/site/cli/trace.html
@@ -317,7 +317,7 @@ 
    Example
    
 
 
 
diff --git a/site/cli/vendor.html b/site/cli/vendor.html
index d70512a..6f926a4 100644
--- a/site/cli/vendor.html
+++ b/site/cli/vendor.html
@@ -308,7 +308,7 @@ 
    akuapkg vendor
    
 
    • add <name> — copy the declared dependency into .akua/vendor/<name>/ and pin its digest in akua.lock. The dependency must already exist in [dependencies]; otherwise the command fails with a suggestion to declare it in akua.toml. Works for path, oci, git, and helm (repo) deps alike — the resolver's vendor-first lookup is universal across all four source kinds, so once added, the canonical source can be deleted and akuapkg render still succeeds via the vendored bytes.
    • check — compare the on-disk vendor trees against akua.toml + akua.lock. Drift exits with code 1.
    • list — enumerate on-disk vendor trees, including orphaned entries.
    
 
    add honors the universal write-contract flags: --plan, --timeout, and --idempotency-key. check and list are read-only.
    
 
    Auth flags (private git remotes)
    
-
    vendor add accepts credentials at the call site for fetching private git deps. Akua never reads ambient credential files (~/.netrc, ~/.docker/config.json, env vars) — the SDK and CLI surface are the only auth sources. See E_MANIFEST_GIT_USERINFO for why credentials in akua.toml URLs are rejected.
    
+
    vendor add accepts credentials at the call site for fetching private git deps. Akua never reads ambient credential files (~/.netrc, ~/.docker/config.json, env vars) — the SDK and CLI surface are the only auth sources. See E_MANIFEST_GIT_USERINFO for why credentials in akua.toml URLs are rejected.
    
 
    flagdescription
    --auth <prefix>=<user>:<password>Repeatable. Credential for a private git remote, keyed by URL prefix. The prefix is matched longest-first against the dep's URL — same rule git's credential helper uses. Example: --auth akua-git.cnap.tech/org-A=org-A:token.
    --auth-file <path>TOML file with a [auth] table keyed by URL prefix. --auth flags override file entries on conflict. The path must be explicit; akua never auto-discovers credential files.
    
 
    --auth-file shape:
    
 
    [auth]
@@ -321,7 +321,7 @@ 
    Git HTTPS trust
    
 
 
 
diff --git a/site/cli/version.html b/site/cli/version.html
index a3b397f..fc252d6 100644
--- a/site/cli/version.html
+++ b/site/cli/version.html
@@ -315,7 +315,7 @@ 
    akuapkg version
    
 
 
 
diff --git a/site/cli/whoami.html b/site/cli/whoami.html
index 9937ba8..56ece68 100644
--- a/site/cli/whoami.html
+++ b/site/cli/whoami.html
@@ -318,11 +318,11 @@ 
    JSON output
    
     "source_env": "CLAUDECODE"
   }
 }
    
-
    agent_context is present when akua auto-detected an agent session (see cli-contract.md §1.5). When no agent is detected, the field is {"detected": false}.
    
+
    agent_context is present when akua auto-detected an agent session (see cli-contract.md §1.5). When no agent is detected, the field is {"detected": false}.
    
 
 
 
diff --git a/site/concepts/agent-usage.html b/site/concepts/agent-usage.html
index 487bf3c..2c668b3 100644
--- a/site/concepts/agent-usage.html
+++ b/site/concepts/agent-usage.html
@@ -304,7 +304,7 @@ 
    Agent usage
    
 
    akua is designed agent-first. This doc covers how agents discover akua's capabilities, what ships out of the box, and why the architecture is the way it is.
    
 
    
 
    The short version
    
-
    • akua auto-detects agent sessions from standard env vars (AGENT=…, CLAUDECODE=1, etc.) and silently enables JSON output, structured errors, no-interactive, no-color. See cli-contract.md §1.5.
    • The akua CLI surface follows a strict contract (JSON-first, typed exit codes, idempotent writes, plan mode, time-bounded) — the CLI is the agent API. See cli-contract.md.
    • Agent-ready workflows ship as skills in skills/ following the open Agent Skills Specification. Install them into Claude Code, Cursor, Codex, Gemini CLI, Goose, Amp, OpenCode, or any of the 35+ supported agents.
    • No MCP server. Shell + skills is structurally more efficient than MCP for operational tools (token cost, composability).
    
+
    • akua auto-detects agent sessions from standard env vars (AGENT=…, CLAUDECODE=1, etc.) and silently enables JSON output, structured errors, no-interactive, no-color. See cli-contract.md §1.5.
    • The akua CLI surface follows a strict contract (JSON-first, typed exit codes, idempotent writes, plan mode, time-bounded) — the CLI is the agent API. See cli-contract.md.
    • Agent-ready workflows ship as skills in skills/ following the open Agent Skills Specification. Install them into Claude Code, Cursor, Codex, Gemini CLI, Goose, Amp, OpenCode, or any of the 35+ supported agents.
    • No MCP server. Shell + skills is structurally more efficient than MCP for operational tools (token cost, composability).
    
 
    
 
    Why no MCP server?
    
 
    MCP tool definitions consume 30k–90k tokens of agent context per connection before any reasoning starts. For a CLI with 20 verbs and 100+ subcommands, that's catastrophic.
    
@@ -324,7 +324,7 @@ 
    Claude Code
    
 
    cp -r path/to/akua/skills/* ~/.claude/skills/
    
 
    OpenAI Codex
    
 
    Install via the Codex skills manager:
    
-
    codex skills install github:akua-dev/akua/skills
    
+
    codex skills install github:akua-dev/akuapkg/skills
    
 
    Cursor
    
 
    Add skills/ to Cursor's skill paths in .cursor/config.json:
    
 
    { "skills": { "paths": ["./skills"] } }
    
@@ -333,16 +333,16 @@ 
    Gemini CLI
    
 
    gemini extensions install @akua/skills
    
 
    Goose, Amp, OpenCode, Cline, Roo Code, Amp, Command Code, Kiro, Factory, and 25+ others
    
 
    All support the open Agent Skills Specification. Any of:
    
-
    • Symlink skills/ into the agent's expected location
    • Use npx skills install github:akua-dev/akua/skills
    • Follow each agent's skill-installation instructions (linked from agentskills.io/overview)
    
+
    • Symlink skills/ into the agent's expected location
    • Use npx skills install github:akua-dev/akuapkg/skills
    • Follow each agent's skill-installation instructions (linked from agentskills.io/overview)
    
 
    Universal: npx skills
    
 
    The Vercel Labs skills manager works across all Agent Skills compatible agents:
    
-
    npx skills install github:akua-dev/akua/skills
+
    npx skills install github:akua-dev/akuapkg/skills
 npx skills list
 npx skills remove akua-*
    
 
    
 
    Shipped skills
    
-
    Eight initial skills covering the most common akua workflows. See skills/ for details.
    
-
    skilluse when
    new-packageuser wants to start a new akua Package
    inspect-packageauditing a third-party Package before use
    diff-gatesetting up CI to block breaking upgrades
    dev-loopiterating on a Package with hot-reload
    migrate-helmfileconverting Helmfile to akua
    rotate-secretrotating a shared secret across installs
    publish-signedreleasing a signed + attested Package
    apply-policy-tiersubscribing to a compliance / production tier
    
+
    Eight initial skills covering the most common akua workflows. See skills/ for details.
    
+
    skilluse when
    new-packageuser wants to start a new akua Package
    inspect-packageauditing a third-party Package before use
    diff-gatesetting up CI to block breaking upgrades
    dev-loopiterating on a Package with hot-reload
    migrate-helmfileconverting Helmfile to akua
    rotate-secretrotating a shared secret across installs
    publish-signedreleasing a signed + attested Package
    apply-policy-tiersubscribing to a compliance / production tier
    
 
    
 
    Writing your own skill
    
 
    Follow the spec:
    
@@ -362,7 +362,7 @@ 
    Writing your own skill
    
 Step-by-step instructions...
    
 
    Validation: npx skills-ref validate ./skills/my-skill
    
 
    Good descriptions include trigger keywords agents would recognize. Agents load metadata for all skills (~100 tokens each) at startup; they load the full body only when they decide a skill applies.
    
-
    See the shipped skills for canonical examples.
    
+
    See the shipped skills for canonical examples.
    
 
    
 
    Running agents against akua — example loop
    
 
    agent receives user intent:
@@ -397,11 +397,11 @@ 
    Running agents against akua 
 
    The whole loop: ~300 tokens of agent context for metadata, ~1000-2000 for the activated skill, plus primary task context. No MCP, no separate protocol, no magic — shell + git + markdown.
    
 
    
 
    
-
+
 
 
 
diff --git a/site/concepts/cli-contract.html b/site/concepts/cli-contract.html
index 398483e..73185a7 100644
--- a/site/concepts/cli-contract.html
+++ b/site/concepts/cli-contract.html
@@ -431,7 +431,7 @@ 
    15. Enforcement
    
 
 
 
diff --git a/site/concepts/debugging.html b/site/concepts/debugging.html
index 919771e..5995d8c 100644
--- a/site/concepts/debugging.html
+++ b/site/concepts/debugging.html
@@ -368,7 +368,7 @@ 
    Anti-patterns
    
 
 
 
diff --git a/site/concepts/embedded-engines.html b/site/concepts/embedded-engines.html
index d0f36f8..e6735d7 100644
--- a/site/concepts/embedded-engines.html
+++ b/site/concepts/embedded-engines.html
@@ -302,7 +302,7 @@ 
    Embedded engines
    
   
    How KCL, Helm, OPA, Regal, Kustomize, kro, and the Kyverno→Rego converter ship as wasip1 modules inside akua.
    
 
 
    akua bundles every engine it dispatches to — KCL, OPA (Rego), Kyverno, CEL, Helm, kro, Kustomize, Regal — into the akua binary itself. No $PATH dependencies. No helm or opa or kcl required to be installed separately. One binary, everything works out of the box.
    
-
    This doc covers the embedding strategy, per-engine status, and what it means for agents and CI. No shell-out escape hatch anywhere in the render pipeline — see CLAUDE.md's "No shell-out, ever" invariant and security-model.md for the threat model.
    
+
    This doc covers the embedding strategy, per-engine status, and what it means for agents and CI. No shell-out escape hatch anywhere in the render pipeline — see CLAUDE.md's "No shell-out, ever" invariant and security-model.md for the threat model.
    
 
    
 
    Why embed
    
 
    Three reasons, same as the helm-engine-wasm decision:
    
@@ -327,7 +327,7 @@ 
    Embedding strategy
    
 typed FFI: Rust host ↔ WASM guest
    
 
    Shared Engine, many Stores. akua follows wasmtime's canonical pattern. One engine_host_wasm::shared_engine() singleton hosts:
    
 
    • the akua-render-worker (per-render Store with the tenant's preopens + memory cap + epoch deadline);
    • every engine plugin (helm, kustomize, future kro/CEL/kyverno) — each call gets its own Store on the same Engine.
    
-
    Plugin callouts from sandboxed KCL cross the boundary once — through a single host-function import, env::kcl_plugin_invoke_json_wasm, that reads arguments from guest memory and dispatches to handlers registered against akua-core's plugin registry. The handler's engine Store runs, produces bytes, the bridge writes them back into the worker's linear memory. See docs/security-model.md — one Engine, many Stores — with a plugin bridge for the full picture + docs/spikes/wasmtime-multi-engine.md for the architecture decision.
    
+
    Plugin callouts from sandboxed KCL cross the boundary once — through a single host-function import, env::kcl_plugin_invoke_json_wasm, that reads arguments from guest memory and dispatches to handlers registered against akua-core's plugin registry. The handler's engine Store runs, produces bytes, the bridge writes them back into the worker's linear memory. See docs/security-model.md — one Engine, many Stores — with a plugin bridge for the full picture + docs/spikes/wasmtime-multi-engine.md for the architecture decision.
    
 
    Precompilation: each engine's build.rs calls engine_host_wasm::precompile(...) against shared_config() at akua build time, producing a .cwasm deserialized in ~microseconds on first use.
    
 
    
 
    Engine inventory
    
@@ -336,7 +336,7 @@ 
    Engine inventory
    
 
    Binary size impact per engine: KCL ~8 MB, Helm (stripped fork) ~20 MB, OPA (with Regal) ~15 MB, Kyverno converter ~18 MB, CEL ~5 MB, Kustomize ~12 MB, kro instantiator ~6 MB. Total overhead versus a bare akua: ~85 MB. We consider this acceptable for "everything just works" — same order of magnitude as Bun (~45 MB) or Deno (~110 MB).
    
 
    
 
    Per-verb engine routing
    
-
    Each verb that invokes engines documents which ones. From cli.md:
    
+
    Each verb that invokes engines documents which ones. From cli.md:
    
 
    verbengines used
    akuapkg initKCL (scaffold)
    akuapkg add(fetch/convert) Kyverno-to-Rego converter, KCL schema generator
    akuapkg renderKCL + Helm + kro offline instantiator + Kustomize + output emitters
    akuapkg lintKCL + Regal
    akuapkg fmtKCL + opa fmt
    akuapkg checkKCL + OPA (parse-only)
    akuapkg testKCL + OPA
    akua traceOPA (--explain)
    akua benchOPA partial evaluation, KCL interpreter timing
    akua policy checkOPA + CEL (via Rego runtime)
    akuapkg replKCL + OPA
    akua evalKCL or OPA per --lang
    akua attest(no engines; just signing + SLSA predicate generation)
    akuapkg diffKCL + OPA (for policy compat diff)
    
 
    
 
    Determinism guarantees
    
@@ -352,17 +352,17 @@ 
    What's NOT embedded
    
 
    • kubectl — used only by akua deploy --to=kubectl. Too specific to a user's cluster context; we rely on the system version.
    • git — used for akuapkg publish and workspace operations. Extremely stable and universally available.
    • cosign — used for signing. We embed the verification path (cryptographic primitives are in akua-core) but use cosign CLI for signing operations that need hardware keys.
    • docker / podman — used only if a user opts into a Dockerfile-based build. Rare for akua workflows.
    
 
    
 
    Performance notes
    
-
    • Cold-start overhead for a wasmtime-hosted engine: ~5-30 ms per engine, once per akua invocation. With precompile cache: ~2-5 ms.
    • akuapkg dev keeps engines warm for the session. Subsequent renders skip cold-start entirely.
    • Benchmarks at docs/bench/ (forthcoming) show akua's embedded OPA within 5% of native opa eval for realistic policy workloads.
    
+
    • Cold-start overhead for a wasmtime-hosted engine: ~5-30 ms per engine, once per akua invocation. With precompile cache: ~2-5 ms.
    • akuapkg dev keeps engines warm for the session. Subsequent renders skip cold-start entirely.
    • Benchmarks at docs/bench/ (forthcoming) show akua's embedded OPA within 5% of native opa eval for realistic policy workloads.
    
 
    
 
    For agents
    
 
    Agents get the full engine toolkit from one install with zero PATH management. When writing skills that invoke akuapkg test, akuapkg fmt, akua bench, they never need to check which opa. Skills remain portable across fresh sandboxes, CI runners, and developer laptops without setup instructions beyond curl -fsSL https://cli.akua.dev/install | sh.
    
 
    
 
    Relationship to other docs
    
-
+
 
 
 
diff --git a/site/concepts/index.html b/site/concepts/index.html
index 3e3734e..79a625d 100644
--- a/site/concepts/index.html
+++ b/site/concepts/index.html
@@ -336,7 +336,7 @@ 
    Concepts
    
 
 
 
diff --git a/site/concepts/lockfile-format.html b/site/concepts/lockfile-format.html
index e2cc792..22ab46f 100644
--- a/site/concepts/lockfile-format.html
+++ b/site/concepts/lockfile-format.html
@@ -512,7 +512,7 @@ 
    Example: a real workspace
    
 
 
 
diff --git a/site/concepts/package-format.html b/site/concepts/package-format.html
index 434e0eb..2e067ed 100644
--- a/site/concepts/package-format.html
+++ b/site/concepts/package-format.html
@@ -302,7 +302,7 @@ 
    Package format
    
   
    Package.k authoring shape — imports, schemas, body, and the `resources` output.
    
 
 
    The canonical shape of an akua Package. A Package is a reusable definition authored in KCL and published as a signed OCI artifact. Package.k is the only shape akua itself specifies; higher-level workspace concepts (App / Environment / Cluster / PolicySet / etc.) are user-defined KCL schemas in the consumer's workspace, not akua-owned kinds.
    
-
    This document specifies what a package.k file may contain. Companion references: lockfile-format.md for akua.toml / akua.lock, policy-format.md for Rego.
    
+
    This document specifies what a package.k file may contain. Companion references: lockfile-format.md for akua.toml / akua.lock, policy-format.md for Rego.
    
 
    
 
    1. Anatomy
    
 
    Every Package is one KCL program with three typed regions:
    
@@ -395,7 +395,7 @@ 
    3. Schema — the public input cont
     hostname: str
     priority: int = 0

    UI hints (optional) ✅

    -

    When a Package is consumed through a UI (merchant install form, Package Studio, generated Swagger form), renderers benefit from hints about field ordering, labels, placeholders, grouping. akua reads UI hints from two sources, both projected into the JSON Schema / OpenAPI output of akuapkg export.

    +

    When a Package is consumed through a UI (merchant install form, Package Studio, generated Swagger form), renderers benefit from hints about field ordering, labels, placeholders, grouping. akua reads UI hints from two sources, both projected into the JSON Schema / OpenAPI output of akuapkg export.

    KCL docstrings — the field's """…""" docstring becomes the schema property's description:

    schema Input:
     """Public inputs for this package."""
@@ -467,7 +467,7 @@ 
    4. Body — engine calls + transforms<
 }
 
 resources = [*_pg, *_app, *_glue, *_addons, _servicemonitor]
    -

    Schema-level validation via check: blocks — this is KCL's role in the two-layer validation model (schema → Rego for cross-resource policy, see policy-format.md):

    +

    Schema-level validation via check: blocks — this is KCL's role in the two-layer validation model (schema → Rego for cross-resource policy, see policy-format.md):

    schema Deployment:
     spec: DeploymentSpec
     check:
@@ -512,7 +512,7 @@ 
    6. Metadata
    
 
    
 
    7. What's disallowed
    
 
    Because determinism and the WASI sandbox are load-bearing:
    
-
    • No runtime I/O. No os.read, http.get, file.exists, env-var lookups. KCL's sandbox enforces this.
    • No non-determinism. No random(), no now(), no uuid(). Results depend only on input and imports.
    • No cluster reads at render time. Use RGD output + kro for runtime late-binding; never a live query from KCL.
    • No input overwrite at runtime. Inputs are provided once at render start and treated as immutable through the body.
    • No cross-source value imports. Source A cannot reference Source B's output. Both derive from input. (Runtime cross-refs are the RGD case; see policy-format.md for the broader framing.)
    
+
    • No runtime I/O. No os.read, http.get, file.exists, env-var lookups. KCL's sandbox enforces this.
    • No non-determinism. No random(), no now(), no uuid(). Results depend only on input and imports.
    • No cluster reads at render time. Use RGD output + kro for runtime late-binding; never a live query from KCL.
    • No input overwrite at runtime. Inputs are provided once at render start and treated as immutable through the body.
    • No cross-source value imports. Source A cannot reference Source B's output. Both derive from input. (Runtime cross-refs are the RGD case; see policy-format.md for the broader framing.)
    
 
    Violation of any of these is a compile error with a clear message.
    
 
    
 
    8. Rendering model
    
@@ -593,15 +593,15 @@ 
    Running
    
 akuapkg test --filter=default      # only tests matching 'default'

    Tests run via the embedded KCL engine (see embedded-engines.md) — fast, sandboxed, deterministic.

    What to test

    -
    • Schema defaults and constraints — does input.replicas = 0 correctly fail the check: block?
    • Rendered-output shape — does the Deployment have the right labels, the right replicaCount?
    • Policy compat — does rendering with a specific tier succeed? (Integration test; see policy-format.md §9)
    • Upgrade compatibility — golden tests catch "dep bump accidentally changed the rendered manifest."
    +
    • Schema defaults and constraints — does input.replicas = 0 correctly fail the check: block?
    • Rendered-output shape — does the Deployment have the right labels, the right replicaCount?
    • Policy compat — does rendering with a specific tier succeed? (Integration test; see policy-format.md §9)
    • Upgrade compatibility — golden tests catch "dep bump accidentally changed the rendered manifest."

    Packages without tests ship with a lint warning; platform teams can enforce a policy rule requiring tests for production-tier packages.

    11. Relationship to other docs

    - + diff --git a/site/concepts/sdk.html b/site/concepts/sdk.html index ab8bf4f..d495588 100644 --- a/site/concepts/sdk.html +++ b/site/concepts/sdk.html @@ -425,11 +425,11 @@

    Errors

    }
    - + diff --git a/site/concepts/security-model.html b/site/concepts/security-model.html index f556351..cf85bbb 100644 --- a/site/concepts/security-model.html +++ b/site/concepts/security-model.html @@ -301,7 +301,7 @@

    Security model

    Wasmtime sandbox, capability-model preopens, replace-rejection in production, and the cosign + SLSA chain.

    -

    akua is a sandboxed-by-default render substrate. Every render runs inside a wasmtime WASI sandbox with memory / CPU / wall-clock caps and capability-model filesystem preopens. The invariant lives in CLAUDE.md; this document records what that actually means, what's guaranteed, and what's not.

    +

    akua is a sandboxed-by-default render substrate. Every render runs inside a wasmtime WASI sandbox with memory / CPU / wall-clock caps and capability-model filesystem preopens. The invariant lives in CLAUDE.md; this document records what that actually means, what's guaranteed, and what's not.

    Threat model

    Who is the adversary? The Package itself — author of the KCL program + the charts, overlays, policies it depends on.

    @@ -309,7 +309,7 @@

    Threat model

    What must we prevent?

    1. Reading files outside the Package directory and its explicit dep scope
    2. Writing files outside the designated output directory
    3. Making network requests
    4. Spawning subprocesses
    5. Exhausting host memory
    6. Exhausting host CPU (runaway loops, pathological schema evaluation)
    7. Exceeding a wall-clock deadline
    8. Escaping the sandbox to compromise the host process

    What are we NOT trying to prevent?

    -
    • Declarative mischief in the Package's rendered output. akua produces whatever YAML the author writes. Policy evaluation (docs/policy-format.md) is the layer that catches "this Package declares a root-privileged Deployment." The renderer's job is faithful execution of the Package, not moral judgment.
    • Side-channel leaks (timing, memory-access patterns). wasmtime provides strong isolation but not constant-time; a sophisticated adversary could extract bits via timing. Not our bar.
    • Bugs in the dep supply chain beyond what the lockfile catches. akua.lock pins OCI deps by sha256 of the chart blob; a drift between what the lockfile recorded and what the registry now serves is rejected (LockDigestMismatch). But if the initial akuapkg add pulled from a compromised registry that served a malicious chart and recorded its digest, every subsequent render faithfully reproduces it. Phase 6 (cosign verification + SLSA attestation walk) closes this gap.
    +
    • Declarative mischief in the Package's rendered output. akua produces whatever YAML the author writes. Policy evaluation (docs/policy-format.md) is the layer that catches "this Package declares a root-privileged Deployment." The renderer's job is faithful execution of the Package, not moral judgment.
    • Side-channel leaks (timing, memory-access patterns). wasmtime provides strong isolation but not constant-time; a sophisticated adversary could extract bits via timing. Not our bar.
    • Bugs in the dep supply chain beyond what the lockfile catches. akua.lock pins OCI deps by sha256 of the chart blob; a drift between what the lockfile recorded and what the registry now serves is rejected (LockDigestMismatch). But if the initial akuapkg add pulled from a compromised registry that served a malicious chart and recorded its digest, every subsequent render faithfully reproduces it. Phase 6 (cosign verification + SLSA attestation walk) closes this gap.

    Execution model

    The render path runs in a wasmtime WASI sandbox. Concretely:

    @@ -328,7 +328,7 @@

    One Engine, many Stores ⇡ manifests bytes ⇡ host writes response into Store A's guest memory, returns ptr ⇡ KCL continues in Store A -

    Both Stores live on the same Engine and the same OS thread. Wasmtime's TLS tracks which Store is currently active; the paused Store resumes correctly when the plugin callout returns. Nested Engines were explicitly ruled out — they share process-global signal handlers in an untested way and duplicate the JIT cache. See docs/spikes/wasmtime-multi-engine.md for the research + verification.

    +

    Both Stores live on the same Engine and the same OS thread. Wasmtime's TLS tracks which Store is currently active; the paused Store resumes correctly when the plugin callout returns. Nested Engines were explicitly ruled out — they share process-global signal handlers in an untested way and duplicate the JIT cache. See docs/spikes/wasmtime-multi-engine.md for the research + verification.

    Plugin bridge boundary

    The env::kcl_plugin_invoke_json_wasm import is the one hole in the worker's sandbox — the only place untrusted KCL can call out to host code. It has exactly one job: read three JSON-string arguments from the guest's linear memory, dispatch to akua-core's plugin registry on the host, allocate response bytes in the guest via the worker's exported akua_bridge_alloc, and hand back a pointer. The host never runs arbitrary guest-supplied code; only the dispatcher and its registered handlers. Plugin handlers themselves run in their own Store, not on the host — so even a compromised helm engine can't escape to the native process.

    The bridge emits a one-line trace per call under AKUA_BRIDGE_TRACE=1 (stderr), useful for debugging misrouted plugin invocations.

    @@ -339,20 +339,20 @@

    What's enforc
    • Path-traversal guard on every plugin callable's path argument. kcl_plugin::resolve_in_package canonicalizes + asserts-under-package-dir + resolves symlinks. A Package that passes "../../etc/passwd" to pkg.render(...) gets a typed error, not a render. Absolute paths are accepted only when they fall under an allowed_roots entry the renderer registered — today, that's exactly the set of resolved charts.* deps (path-based dep dir or OCI cache dir for the blob we just pulled). Nothing else.
    • KCL language-level sandbox. The KCL language itself has no os.read, http.get, env reads, or time.now(). A pure-KCL Package is deterministic by construction. This is upstream KCL's own invariant.
    • Plugin registry is closed. Only akua-core can register plugins (kcl_plugin::register is pub but only called at akua startup). Packages cannot invent their own.
    • Strict render mode (--strict): reject raw-string paths in plugin callables. Forces typed charts.* imports resolved via akua.toml. Default for akuapkg publish and akua serve; optional for interactive akuapkg render.

    What's NOT shipped yet

    -

    This is the current-state gap vs the target. See docs/roadmap.md phases for timing.

    +

    This is the current-state gap vs the target. See docs/roadmap.md phases for timing.

    GuaranteeState todayPhase
    Path-traversal rejection in plugin handlersShipped — resolve_in_package + allowed_roots✅ Phase 0
    helm.template / kustomize.build via WASM enginesShipped — no shell-out, wasmtime-hosted✅ Phases 1 + 3
    Typed charts.* imports + lockfile digestsShipped — path + OCI, replace override✅ Phase 2a, 2b A+B
    akuapkg render --strict rejects raw chart pathsShipped — E_STRICT_UNTYPED_CHART✅ Phase 2b C
    akuapkg verify path-dep digest drift detectionShipped — PathDigestDrift / PathMissing✅ Phase 2b C
    Render worker wrapped in wasmtimeShipped — every render runs inside a Store with memory/epoch caps + capability-model preopens✅ Phase 4
    akua serve per-tenant isolationVerb doesn't existPhase 5
    cosign keyed verification on OCI depsShipped — [signing] cosign_public_key, ECDSA P-256✅ Phase 6 A
    akuapkg publish with cosign sign-by-defaultShipped — P-256 PKCS#8 PEM private keys✅ Phase 7 A
    akuapkg pull with manifest digest verifyShipped✅ Phase 7 A
    cosign keyless (fulcio + rekor) verificationNot implementedPhase 6 B
    SLSA v1 attestation generation on publishShipped — DSSE envelope, in-toto v1 statement✅ Phase 7 B
    akuapkg verify attestation chain walkShipped — pulls .att sidecars + DSSE verify + subject-digest check for every OCI dep✅ Phase 7 C
    Recursive attestation walk over transitive depsNot implemented — needs published Package to attest its own depsPhase 7 C (follow-up)
    Encrypted cosign private keys — PKCS#8 PBES2Shipped — $AKUA_COSIGN_PASSPHRASE env var✅ Phase 7 C
    OCI-vendored deps → network-free akuapkg render after pullShipped — .akua/vendor/<name>/ convention✅ Phase 7 C
    HSM / cosign-native key formatNot implementedPhase 7 D
    Git dep checkout via gixShipped — pure Rust, no shell-out✅ Phase 2b C
    Private-repo OCI auth (docker config / akuapkg auth.toml)Shipped — Basic + bearer PAT✅ Phase 2b C
    Docker credential helpersNot implemented — would require shell-outWon't ship

    Why no shell-out, ever

    A prior design considered keeping helm.template as shell-out for convenience, with a feature flag and clear "trusted input only" warnings. That design is rejected. Reasons:

    -
    1. Opt-in security is not security. If the flag defaults to safe but can be flipped by a single command, every hosted service will eventually flip it for a one-off, forget, and get hit. "Secure by default" means the unsafe path doesn't exist, not that it's one flag away.
    2. Shell-out inherits host privileges. helm runs as the akua process's user with full PATH, env, cwd, network. Sandboxing individual subprocess invocations (seccomp, unshared namespaces) is possible but fragile, platform-specific, and hard to verify.
    3. WASM engines are the viable alternative. Benchmarks at docs/performance.md show KCL under wasmtime/WASI runs at ~2× native — comfortably inside the sub-100ms render budget. helm-engine-wasm prior work hit 20 MB WASM + 2.3s cold render. These are fine numbers.
    4. Removing shell-out forces the right engineering. As long as shell-out is "available as an escape hatch," investment flows there instead of toward the WASM engines. Cutting it is what unblocks Phases 1 + 3.
    +
    1. Opt-in security is not security. If the flag defaults to safe but can be flipped by a single command, every hosted service will eventually flip it for a one-off, forget, and get hit. "Secure by default" means the unsafe path doesn't exist, not that it's one flag away.
    2. Shell-out inherits host privileges. helm runs as the akua process's user with full PATH, env, cwd, network. Sandboxing individual subprocess invocations (seccomp, unshared namespaces) is possible but fragile, platform-specific, and hard to verify.
    3. WASM engines are the viable alternative. Benchmarks at docs/performance.md show KCL under wasmtime/WASI runs at ~2× native — comfortably inside the sub-100ms render budget. helm-engine-wasm prior work hit 20 MB WASM + 2.3s cold render. These are fine numbers.
    4. Removing shell-out forces the right engineering. As long as shell-out is "available as an escape hatch," investment flows there instead of toward the WASM engines. Cutting it is what unblocks Phases 1 + 3.

    The alternative — keep shell-out with lots of warnings — would ship a sandbox that has a hole in it. That's worse than shipping no sandbox; users would assume protection that doesn't exist.

    - + diff --git a/site/errors/E_ADD_DEP_EXISTS.html b/site/errors/E_ADD_DEP_EXISTS.html index 9f8b7bb..8d63a27 100644 --- a/site/errors/E_ADD_DEP_EXISTS.html +++ b/site/errors/E_ADD_DEP_EXISTS.html @@ -315,11 +315,11 @@

    General

    E_ADD_DEP_EXISTS

    Add

    -

    What happened

    Error code emitted by the akua CLI: E_ADD_DEP_EXISTS.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_ADD_DEP_EXISTS.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_ADD_INVALID_DEP.html b/site/errors/E_ADD_INVALID_DEP.html index 1f5c3e7..5996788 100644 --- a/site/errors/E_ADD_INVALID_DEP.html +++ b/site/errors/E_ADD_INVALID_DEP.html @@ -315,11 +315,11 @@

    General

    E_ADD_INVALID_DEP

    Add

    -

    What happened

    Error code emitted by the akua CLI: E_ADD_INVALID_DEP.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_ADD_INVALID_DEP.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_API_REQUEST.html b/site/errors/E_API_REQUEST.html index f39ba6a..8aa408d 100644 --- a/site/errors/E_API_REQUEST.html +++ b/site/errors/E_API_REQUEST.html @@ -315,11 +315,11 @@

    General

    E_API_REQUEST

    Hosted API

    -

    What happened

    Hosted Akua API request failed before a structured response was available.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Hosted Akua API request failed before a structured response was available.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_AUTH_INVALID.html b/site/errors/E_AUTH_INVALID.html index f8da474..78a5a81 100644 --- a/site/errors/E_AUTH_INVALID.html +++ b/site/errors/E_AUTH_INVALID.html @@ -315,11 +315,11 @@

    General

    E_AUTH_INVALID

    Hosted API

    -

    What happened

    Hosted Akua API token was rejected as invalid or expired.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Hosted Akua API token was rejected as invalid or expired.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_AUTH_PARSE.html b/site/errors/E_AUTH_PARSE.html index 808ffb6..ff40322 100644 --- a/site/errors/E_AUTH_PARSE.html +++ b/site/errors/E_AUTH_PARSE.html @@ -318,7 +318,7 @@

    E_AUTH_PARSE

    E_AUTH_PARSE — credential input is malformed

    What happened

    A CLI --auth flag value, or the contents of an --auth-file TOML payload, didn't parse into a (prefix, username, password) triple. Akua rejects the input before it reaches the resolver — credentials that round-trip through a malformed parser are a class of bug we don't want to ship into the lockfile or HTTP transport.

    -

    This is distinct from E_INVALID_FLAG: that code covers structural CLI errors (--timeout=5min); E_AUTH_PARSE is specifically for credential-shape errors so agents can branch on it.

    +

    This is distinct from E_INVALID_FLAG: that code covers structural CLI errors (--timeout=5min); E_AUTH_PARSE is specifically for credential-shape errors so agents can branch on it.

    Common causes

    --auth value missing the = separator

    akuapkg vendor add upstream --auth github.com:alice:ghp_xyz   # no `=`
    @@ -359,13 +359,13 @@

    Combining file and flag

    --auth-file ./auth.toml \ --auth github.com/myco=alice:$ROTATED_TOKEN # overrides the file entry

    Why akua doesn't auto-load ~/.netrc / ~/.docker/config.json

    -

    See E_MANIFEST_GIT_USERINFO for the rationale. Short version: multi-tenant SDK consumers can't safely inherit ambient credentials, and the same explicit-input stance that keeps akuapkg render deterministic applies to credentials.

    +

    See E_MANIFEST_GIT_USERINFO for the rationale. Short version: multi-tenant SDK consumers can't safely inherit ambient credentials, and the same explicit-input stance that keeps akuapkg render deterministic applies to credentials.

    - + diff --git a/site/errors/E_AUTH_REQUIRED.html b/site/errors/E_AUTH_REQUIRED.html index 44fb33f..3c916e0 100644 --- a/site/errors/E_AUTH_REQUIRED.html +++ b/site/errors/E_AUTH_REQUIRED.html @@ -315,11 +315,11 @@

    General

    E_AUTH_REQUIRED

    Hosted API

    -

    What happened

    Hosted Akua API auth token is required but was not provided.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Hosted Akua API auth token is required but was not provided.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_CHECK_FAIL.html b/site/errors/E_CHECK_FAIL.html index d844aba..8eda514 100644 --- a/site/errors/E_CHECK_FAIL.html +++ b/site/errors/E_CHECK_FAIL.html @@ -315,11 +315,11 @@

    General

    E_CHECK_FAIL

    Check

    -

    What happened

    Error code emitted by the akua CLI: E_CHECK_FAIL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_CHECK_FAIL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_COSIGN_SIG_MISSING.html b/site/errors/E_COSIGN_SIG_MISSING.html index 3176de4..e31eb31 100644 --- a/site/errors/E_COSIGN_SIG_MISSING.html +++ b/site/errors/E_COSIGN_SIG_MISSING.html @@ -315,11 +315,11 @@

    General

    E_COSIGN_SIG_MISSING

    Render

    -

    What happened

    A cosign public key was configured but the registry has no .sig sidecar (or it's malformed). Publisher-side signal — actionable by the artifact's author, not the consumer.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    A cosign public key was configured but the registry has no .sig sidecar (or it's malformed). Publisher-side signal — actionable by the artifact's author, not the consumer.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_COSIGN_VERIFY.html b/site/errors/E_COSIGN_VERIFY.html index f726061..c98b3f6 100644 --- a/site/errors/E_COSIGN_VERIFY.html +++ b/site/errors/E_COSIGN_VERIFY.html @@ -315,11 +315,11 @@

    General

    E_COSIGN_VERIFY

    Render

    -

    What happened

    Cosign signature failed cryptographic verification, or the payload disagrees with the fetched digest. Attacker-side signal — someone served bytes the configured key didn't approve.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Cosign signature failed cryptographic verification, or the payload disagrees with the fetched digest. Attacker-side signal — someone served bytes the configured key didn't approve.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_DEP_KIND_MISMATCH.html b/site/errors/E_DEP_KIND_MISMATCH.html index e977563..6be81ff 100644 --- a/site/errors/E_DEP_KIND_MISMATCH.html +++ b/site/errors/E_DEP_KIND_MISMATCH.html @@ -315,11 +315,11 @@

    General

    E_DEP_KIND_MISMATCH

    Lockfile / manifest

    -

    What happened

    A dep alias referenced by import <alias> (or pkg.render({package = "<alias>"})) in package.k resolves to a kind that's unreachable from KCL. Most common case: an Akua/KCL-module dep was misclassified as a Helm chart by the resolver, or the user declared a Helm chart alias they then tried to import. akua lock catches this before akua check later fails with the opaque CannotFindModule from KCL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    A dep alias referenced by import <alias> (or pkg.render({package = "<alias>"})) in package.k resolves to a kind that's unreachable from KCL. Most common case: an Akua/KCL-module dep was misclassified as a Helm chart by the resolver, or the user declared a Helm chart alias they then tried to import. akua lock catches this before akua check later fails with the opaque CannotFindModule from KCL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_DEP_RESOLVE.html b/site/errors/E_DEP_RESOLVE.html index 917a576..4b97576 100644 --- a/site/errors/E_DEP_RESOLVE.html +++ b/site/errors/E_DEP_RESOLVE.html @@ -315,11 +315,11 @@

    General

    E_DEP_RESOLVE

    Render

    -

    What happened

    A dep in akua.toml failed to resolve (missing path, not-a-directory, OCI/git fetch failure, lockfile mismatch). Covers all dep kinds — path / oci / git / vendor — not chart-specific. See chart_resolver and vendor.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    A dep in akua.toml failed to resolve (missing path, not-a-directory, OCI/git fetch failure, lockfile mismatch). Covers all dep kinds — path / oci / git / vendor — not chart-specific. See chart_resolver and vendor.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_DIFF_FOUND.html b/site/errors/E_DIFF_FOUND.html index bfaa4f8..4bbad4b 100644 --- a/site/errors/E_DIFF_FOUND.html +++ b/site/errors/E_DIFF_FOUND.html @@ -315,11 +315,11 @@

    General

    E_DIFF_FOUND

    Diff

    -

    What happened

    Error code emitted by the akua CLI: E_DIFF_FOUND.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_DIFF_FOUND.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_DIFF_NOT_DIR.html b/site/errors/E_DIFF_NOT_DIR.html index a91a385..9aa6295 100644 --- a/site/errors/E_DIFF_NOT_DIR.html +++ b/site/errors/E_DIFF_NOT_DIR.html @@ -315,11 +315,11 @@

    General

    E_DIFF_NOT_DIR

    Diff

    -

    What happened

    Error code emitted by the akua CLI: E_DIFF_NOT_DIR.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_DIFF_NOT_DIR.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_ENGINE_NOT_AVAILABLE.html b/site/errors/E_ENGINE_NOT_AVAILABLE.html index 7149eaa..ab71db7 100644 --- a/site/errors/E_ENGINE_NOT_AVAILABLE.html +++ b/site/errors/E_ENGINE_NOT_AVAILABLE.html @@ -315,11 +315,11 @@

    General

    E_ENGINE_NOT_AVAILABLE

    Render

    -

    What happened

    Package called an engine plugin whose WASM backend hasn't shipped yet (docs/roadmap.md tracks the blocked features). Shell-out is not an option — see CLAUDE.md "No shell-out, ever."

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Package called an engine plugin whose WASM backend hasn't shipped yet (docs/roadmap.md tracks the blocked features). Shell-out is not an option — see CLAUDE.md "No shell-out, ever."

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_FMT_CHANGED.html b/site/errors/E_FMT_CHANGED.html index 0e58aa9..64fc7d9 100644 --- a/site/errors/E_FMT_CHANGED.html +++ b/site/errors/E_FMT_CHANGED.html @@ -315,11 +315,11 @@

    General

    E_FMT_CHANGED

    Fmt

    -

    What happened

    Error code emitted by the akua CLI: E_FMT_CHANGED.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_FMT_CHANGED.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_FMT_KCL.html b/site/errors/E_FMT_KCL.html index d0a79b2..ba510cc 100644 --- a/site/errors/E_FMT_KCL.html +++ b/site/errors/E_FMT_KCL.html @@ -315,11 +315,11 @@

    General

    E_FMT_KCL

    Fmt

    -

    What happened

    Error code emitted by the akua CLI: E_FMT_KCL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_FMT_KCL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_FORBIDDEN.html b/site/errors/E_FORBIDDEN.html index 6bab3a4..46b6114 100644 --- a/site/errors/E_FORBIDDEN.html +++ b/site/errors/E_FORBIDDEN.html @@ -315,11 +315,11 @@

    General

    E_FORBIDDEN

    Hosted API

    -

    What happened

    Hosted Akua API token is valid but lacks permission for the request.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Hosted Akua API token is valid but lacks permission for the request.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_INIT_EMPTY_NAME.html b/site/errors/E_INIT_EMPTY_NAME.html index 5b94742..1249cae 100644 --- a/site/errors/E_INIT_EMPTY_NAME.html +++ b/site/errors/E_INIT_EMPTY_NAME.html @@ -315,11 +315,11 @@

    General

    E_INIT_EMPTY_NAME

    Init

    -

    What happened

    Error code emitted by the akua CLI: E_INIT_EMPTY_NAME.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_INIT_EMPTY_NAME.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_INIT_EXISTS.html b/site/errors/E_INIT_EXISTS.html index ffaf4f2..a409bf2 100644 --- a/site/errors/E_INIT_EXISTS.html +++ b/site/errors/E_INIT_EXISTS.html @@ -315,11 +315,11 @@

    General

    E_INIT_EXISTS

    Init

    -

    What happened

    Error code emitted by the akua CLI: E_INIT_EXISTS.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_INIT_EXISTS.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_INPUTS_MISSING.html b/site/errors/E_INPUTS_MISSING.html index a57969a..136885e 100644 --- a/site/errors/E_INPUTS_MISSING.html +++ b/site/errors/E_INPUTS_MISSING.html @@ -315,11 +315,11 @@

    General

    E_INPUTS_MISSING

    Render

    -

    What happened

    Error code emitted by the akua CLI: E_INPUTS_MISSING.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_INPUTS_MISSING.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_INPUTS_PARSE.html b/site/errors/E_INPUTS_PARSE.html index e27ac7a..76ce729 100644 --- a/site/errors/E_INPUTS_PARSE.html +++ b/site/errors/E_INPUTS_PARSE.html @@ -315,11 +315,11 @@

    General

    E_INPUTS_PARSE

    Render

    -

    What happened

    Error code emitted by the akua CLI: E_INPUTS_PARSE.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_INPUTS_PARSE.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_INSPECT_FAIL.html b/site/errors/E_INSPECT_FAIL.html index 7e76840..c53a4aa 100644 --- a/site/errors/E_INSPECT_FAIL.html +++ b/site/errors/E_INSPECT_FAIL.html @@ -315,11 +315,11 @@

    General

    E_INSPECT_FAIL

    Inspect

    -

    What happened

    Error code emitted by the akua CLI: E_INSPECT_FAIL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_INSPECT_FAIL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_INVALID_FLAG.html b/site/errors/E_INVALID_FLAG.html index 2a816d3..3f688de 100644 --- a/site/errors/E_INVALID_FLAG.html +++ b/site/errors/E_INVALID_FLAG.html @@ -315,11 +315,11 @@

    General

    E_INVALID_FLAG

    Render

    -

    What happened

    CLI-level flag value didn't parse — --timeout=5min, --max-depth=foo, etc. Distinct from E_INPUTS_PARSE (which covers inputs.yaml content) so agents can branch on the right thing.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    CLI-level flag value didn't parse — --timeout=5min, --max-depth=foo, etc. Distinct from E_INPUTS_PARSE (which covers inputs.yaml content) so agents can branch on the right thing.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_IO.html b/site/errors/E_IO.html index 03e2407..08677a2 100644 --- a/site/errors/E_IO.html +++ b/site/errors/E_IO.html @@ -315,11 +315,11 @@

    General

    E_IO

    General

    -

    What happened

    Error code emitted by the akua CLI: E_IO.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_IO.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_LINT_FAIL.html b/site/errors/E_LINT_FAIL.html index 264fc5e..cd82ad4 100644 --- a/site/errors/E_LINT_FAIL.html +++ b/site/errors/E_LINT_FAIL.html @@ -315,11 +315,11 @@

    General

    E_LINT_FAIL

    Lint

    -

    What happened

    Error code emitted by the akua CLI: E_LINT_FAIL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_LINT_FAIL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_LOCK_DRIFT.html b/site/errors/E_LOCK_DRIFT.html index e7aed07..b8a0b87 100644 --- a/site/errors/E_LOCK_DRIFT.html +++ b/site/errors/E_LOCK_DRIFT.html @@ -315,11 +315,11 @@

    General

    E_LOCK_DRIFT

    Lockfile / manifest

    -

    What happened

    akua.lock is out of sync with akua.toml — akua lock --check found drift. Re-run akua lock without --check to refresh.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    akua.lock is out of sync with akua.toml — akua lock --check found drift. Re-run akua lock without --check to refresh.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_LOCK_MISSING.html b/site/errors/E_LOCK_MISSING.html index 3fcfe7d..9a7ca19 100644 --- a/site/errors/E_LOCK_MISSING.html +++ b/site/errors/E_LOCK_MISSING.html @@ -315,11 +315,11 @@

    General

    E_LOCK_MISSING

    Lockfile / manifest

    -

    What happened

    Error code emitted by the akua CLI: E_LOCK_MISSING.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_LOCK_MISSING.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_LOCK_PARSE.html b/site/errors/E_LOCK_PARSE.html index d38b1b3..bf43a26 100644 --- a/site/errors/E_LOCK_PARSE.html +++ b/site/errors/E_LOCK_PARSE.html @@ -315,11 +315,11 @@

    General

    E_LOCK_PARSE

    Lockfile / manifest

    -

    What happened

    Error code emitted by the akua CLI: E_LOCK_PARSE.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_LOCK_PARSE.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_MANIFEST_GIT_USERINFO.html b/site/errors/E_MANIFEST_GIT_USERINFO.html index cd929e6..091b178 100644 --- a/site/errors/E_MANIFEST_GIT_USERINFO.html +++ b/site/errors/E_MANIFEST_GIT_USERINFO.html @@ -327,7 +327,7 @@

    What happened

    Why akua refuses

    akua.toml lives in version control. So does akua.lock, which records the canonical source URL of every resolved dep. If the manifest URL contained credentials, those credentials would be persisted into the lockfile, the git history of the project, and any artifact akua publishes — for the lifetime of the repository. Even rotating the token after the fact doesn't fully undo the leak (commit history, mirror clones, attacker forks).

    Akua's rule: credentials never appear in any file akua writes or reads as input. The same principle that bans secrets in kubectl apply -f'd manifests applies to akua's dependency declarations.

    -

    The lockfile field source (see lockfile-format.md) canonicalizes URLs by stripping userinfo, default ports, and .git suffix — so even if a malformed call ever reached the lockfile-write path, the credential would not survive. This validation is the first line of defense; the canonicalization is the second.

    +

    The lockfile field source (see lockfile-format.md) canonicalizes URLs by stripping userinfo, default ports, and .git suffix — so even if a malformed call ever reached the lockfile-write path, the credential would not survive. This validation is the first line of defense; the canonicalization is the second.

    How to fix it

    Pass credentials at the call site, never in akua.toml.

    From the SDK

    @@ -336,7 +336,7 @@

    From the SDK

    'github.com/myco/private': { username: 'alice', password: process.env.GH_TOKEN! } } }); -

    The auth map is keyed by URL prefix (longest-prefix wins, same rule git's credential helper / .npmrc URL keys use). See sdk.md → Credentials for the full resolution rules.

    +

    The auth map is keyed by URL prefix (longest-prefix wins, same rule git's credential helper / .npmrc URL keys use). See sdk.md → Credentials for the full resolution rules.

    From the CLI

    akuapkg vendor add upstream --auth github.com/myco/private=alice:$GH_TOKEN

    Repeat --auth for multiple hosts. For environments where flags are awkward (CI, scripts), pass --auth-file <path> pointing at a TOML file you explicitly named:

    @@ -357,11 +357,11 @@

    Why no ~/.netrc /

    Akua deliberately does not auto-load ambient credential files. Two reasons:

    • Multi-tenant SDK consumers. A server-side process embedding @akua-dev/sdk may handle requests from multiple tenants. Credentials that "happen to be on disk" can cross-contaminate between tenants. Explicit-only auth means each call carries exactly the credentials authorized for that call's principal.
    • Sandbox parity. akuapkg render runs Packages in a wasmtime sandbox with strict capability scoping. Extending the same "no implicit input" stance to credentials is a coherent invariant — the SDK and CLI surface are the only places credentials enter the system.

    - + diff --git a/site/errors/E_MANIFEST_HELM_CHART_INVALID.html b/site/errors/E_MANIFEST_HELM_CHART_INVALID.html index 6aaacf4..f369abc 100644 --- a/site/errors/E_MANIFEST_HELM_CHART_INVALID.html +++ b/site/errors/E_MANIFEST_HELM_CHART_INVALID.html @@ -315,11 +315,11 @@

    General

    E_MANIFEST_HELM_CHART_INVALID

    Lockfile / manifest

    -

    What happened

    akua.toml declares a repo dep whose chart value contains path separators (/, \) or .. — a chart name must be a plain single-component name. Rejected at parse time to prevent path confusion in the chart cache.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    akua.toml declares a repo dep whose chart value contains path separators (/, \) or .. — a chart name must be a plain single-component name. Rejected at parse time to prevent path confusion in the chart cache.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_MANIFEST_HELM_MISSING_CHART.html b/site/errors/E_MANIFEST_HELM_MISSING_CHART.html index 9554ff7..85620b7 100644 --- a/site/errors/E_MANIFEST_HELM_MISSING_CHART.html +++ b/site/errors/E_MANIFEST_HELM_MISSING_CHART.html @@ -315,11 +315,11 @@

    General

    E_MANIFEST_HELM_MISSING_CHART

    Lockfile / manifest

    -

    What happened

    akua.toml declares a repo (HTTPS Helm repository) dep that is missing the required chart field.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    akua.toml declares a repo (HTTPS Helm repository) dep that is missing the required chart field.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_MANIFEST_HELM_MISSING_VERSION.html b/site/errors/E_MANIFEST_HELM_MISSING_VERSION.html index 3607dd9..0696e7a 100644 --- a/site/errors/E_MANIFEST_HELM_MISSING_VERSION.html +++ b/site/errors/E_MANIFEST_HELM_MISSING_VERSION.html @@ -315,11 +315,11 @@

    General

    E_MANIFEST_HELM_MISSING_VERSION

    Lockfile / manifest

    -

    What happened

    akua.toml declares a repo dep that is missing the required version field (a semver constraint is mandatory for reproducibility).

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    akua.toml declares a repo dep that is missing the required version field (a semver constraint is mandatory for reproducibility).

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_MANIFEST_HELM_USERINFO.html b/site/errors/E_MANIFEST_HELM_USERINFO.html index 004712b..28c6eeb 100644 --- a/site/errors/E_MANIFEST_HELM_USERINFO.html +++ b/site/errors/E_MANIFEST_HELM_USERINFO.html @@ -315,11 +315,11 @@

    General

    E_MANIFEST_HELM_USERINFO

    Lockfile / manifest

    -

    What happened

    akua.toml declares a repo dep whose URL contains embedded credentials (https://user:pass@host/...). Rejected at parse time so the credential never reaches the lockfile or git history. Pass credentials via the SDK auth parameter or --auth instead.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    akua.toml declares a repo dep whose URL contains embedded credentials (https://user:pass@host/...). Rejected at parse time so the credential never reaches the lockfile or git history. Pass credentials via the SDK auth parameter or --auth instead.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_MANIFEST_MISSING.html b/site/errors/E_MANIFEST_MISSING.html index 7af4fec..c0fb2c0 100644 --- a/site/errors/E_MANIFEST_MISSING.html +++ b/site/errors/E_MANIFEST_MISSING.html @@ -315,11 +315,11 @@

    General

    E_MANIFEST_MISSING

    Lockfile / manifest

    -

    What happened

    Error code emitted by the akua CLI: E_MANIFEST_MISSING.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_MANIFEST_MISSING.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_MANIFEST_OCI_USERINFO.html b/site/errors/E_MANIFEST_OCI_USERINFO.html index 174034c..58ef246 100644 --- a/site/errors/E_MANIFEST_OCI_USERINFO.html +++ b/site/errors/E_MANIFEST_OCI_USERINFO.html @@ -315,11 +315,11 @@

    General

    E_MANIFEST_OCI_USERINFO

    Lockfile / manifest

    -

    What happened

    akua.toml declares an oci dep whose URL contains embedded credentials (oci://user:pass@host/...). Rejected at parse time so the credential never reaches the lockfile or git history. Pass credentials via the SDK auth parameter or --auth instead.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    akua.toml declares an oci dep whose URL contains embedded credentials (oci://user:pass@host/...). Rejected at parse time so the credential never reaches the lockfile or git history. Pass credentials via the SDK auth parameter or --auth instead.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_MANIFEST_PARSE.html b/site/errors/E_MANIFEST_PARSE.html index 3998ab2..9400972 100644 --- a/site/errors/E_MANIFEST_PARSE.html +++ b/site/errors/E_MANIFEST_PARSE.html @@ -315,11 +315,11 @@

    General

    E_MANIFEST_PARSE

    Lockfile / manifest

    -

    What happened

    Error code emitted by the akua CLI: E_MANIFEST_PARSE.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_MANIFEST_PARSE.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_PACKAGE_MISSING.html b/site/errors/E_PACKAGE_MISSING.html index 758a5a5..90cabbc 100644 --- a/site/errors/E_PACKAGE_MISSING.html +++ b/site/errors/E_PACKAGE_MISSING.html @@ -315,11 +315,11 @@

    General

    E_PACKAGE_MISSING

    Render

    -

    What happened

    Error code emitted by the akua CLI: E_PACKAGE_MISSING.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_PACKAGE_MISSING.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_PACKAGE_PARSE.html b/site/errors/E_PACKAGE_PARSE.html index 913978c..df7b896 100644 --- a/site/errors/E_PACKAGE_PARSE.html +++ b/site/errors/E_PACKAGE_PARSE.html @@ -315,11 +315,11 @@

    General

    E_PACKAGE_PARSE

    Render

    -

    What happened

    Error code emitted by the akua CLI: E_PACKAGE_PARSE.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_PACKAGE_PARSE.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_PATH_ESCAPE.html b/site/errors/E_PATH_ESCAPE.html index 8e8e0fb..49beadd 100644 --- a/site/errors/E_PATH_ESCAPE.html +++ b/site/errors/E_PATH_ESCAPE.html @@ -323,7 +323,7 @@

    What happened

    which escapes the Package directory `/private/tmp/spike1/install`

    Why akua refuses

    akuapkg render runs each Package inside a wasmtime sandbox with read-only filesystem preopens scoped to the Package directory. A path that resolves outside that root is — by construction — unreachable through the sandbox's capabilities. We surface the error early instead of letting it manifest as a confusing wasmtime open-file failure deeper in the render.

    -

    See docs/security-model.md for the full threat model.

    +

    See docs/security-model.md for the full threat model.

    How to fix it

    Both correct paths declare the dependency in akua.toml and compose it by its typed alias — user code never writes a filesystem path. pkg.render accepts package = "<alias>" only; there is no path = "..." form.

    1. Vendor the dependency as a subdirectory

    @@ -364,11 +364,11 @@

    2. Declare a separatel

    What NOT to do

    • Don't pass absolute paths to plugins (/var/cache/...). The sandbox refuses anything outside its preopened roots, even if you chmod your way to readability.
    • Don't symlink your way around it. Akua canonicalizes plugin paths before the under-Package check; a ./link → ../upstream symlink resolves the same as ../upstream and gets rejected the same way.

    See also

    - + diff --git a/site/errors/E_PUBLISH_FAILED.html b/site/errors/E_PUBLISH_FAILED.html index ccbe6f5..89b9fbc 100644 --- a/site/errors/E_PUBLISH_FAILED.html +++ b/site/errors/E_PUBLISH_FAILED.html @@ -315,11 +315,11 @@

    General

    E_PUBLISH_FAILED

    Publish / Pull

    -

    What happened

    akua publish failed to upload the artifact. Wraps every registry- side failure (auth rejected, upload PUT non-2xx, manifest malformed).

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    akua publish failed to upload the artifact. Wraps every registry- side failure (auth rejected, upload PUT non-2xx, manifest malformed).

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_PULL_FAILED.html b/site/errors/E_PULL_FAILED.html index 7bd935a..f6d33f9 100644 --- a/site/errors/E_PULL_FAILED.html +++ b/site/errors/E_PULL_FAILED.html @@ -315,11 +315,11 @@

    General

    E_PULL_FAILED

    Publish / Pull

    -

    What happened

    akua pull couldn't retrieve / extract the requested artifact.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    akua pull couldn't retrieve / extract the requested artifact.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_REMOVE_NOT_FOUND.html b/site/errors/E_REMOVE_NOT_FOUND.html index a4b0589..bc332a4 100644 --- a/site/errors/E_REMOVE_NOT_FOUND.html +++ b/site/errors/E_REMOVE_NOT_FOUND.html @@ -315,11 +315,11 @@

    General

    E_REMOVE_NOT_FOUND

    Remove

    -

    What happened

    Error code emitted by the akua CLI: E_REMOVE_NOT_FOUND.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_REMOVE_NOT_FOUND.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_RENDER_BUDGET_DEADLINE.html b/site/errors/E_RENDER_BUDGET_DEADLINE.html index 5259ce5..127b269 100644 --- a/site/errors/E_RENDER_BUDGET_DEADLINE.html +++ b/site/errors/E_RENDER_BUDGET_DEADLINE.html @@ -315,11 +315,11 @@

    General

    E_RENDER_BUDGET_DEADLINE

    Render

    -

    What happened

    pkg.render was called after the wall-clock deadline the outer caller installed for the render had already expired.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    pkg.render was called after the wall-clock deadline the outer caller installed for the render had already expired.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_RENDER_BUDGET_DEPTH.html b/site/errors/E_RENDER_BUDGET_DEPTH.html index c859b57..3a8a97c 100644 --- a/site/errors/E_RENDER_BUDGET_DEPTH.html +++ b/site/errors/E_RENDER_BUDGET_DEPTH.html @@ -315,11 +315,11 @@

    General

    E_RENDER_BUDGET_DEPTH

    Render

    -

    What happened

    pkg.render exceeded the render-stack depth cap. Default is generous (16); hitting it usually means runaway composition through fresh Packages, which cycle detection alone can't catch.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    pkg.render exceeded the render-stack depth cap. Default is generous (16); hitting it usually means runaway composition through fresh Packages, which cycle detection alone can't catch.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_RENDER_CYCLE.html b/site/errors/E_RENDER_CYCLE.html index fc4bd53..e8e8bf3 100644 --- a/site/errors/E_RENDER_CYCLE.html +++ b/site/errors/E_RENDER_CYCLE.html @@ -315,11 +315,11 @@

    General

    E_RENDER_CYCLE

    Render

    -

    What happened

    pkg.render re-entered a Package already on the render stack — composition cycle. Caught before the inner load to bound recursion; covers both direct and transitive cycles.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    pkg.render re-entered a Package already on the render stack — composition cycle. Caught before the inner load to bound recursion; covers both direct and transitive cycles.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_RENDER_KCL.html b/site/errors/E_RENDER_KCL.html index bafc398..998245b 100644 --- a/site/errors/E_RENDER_KCL.html +++ b/site/errors/E_RENDER_KCL.html @@ -315,11 +315,11 @@

    General

    E_RENDER_KCL

    Render

    -

    What happened

    Error code emitted by the akua CLI: E_RENDER_KCL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_RENDER_KCL.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_RENDER_OUTPUT_TOO_LARGE.html b/site/errors/E_RENDER_OUTPUT_TOO_LARGE.html index bdcc0a5..36f6587 100644 --- a/site/errors/E_RENDER_OUTPUT_TOO_LARGE.html +++ b/site/errors/E_RENDER_OUTPUT_TOO_LARGE.html @@ -315,11 +315,11 @@

    General

    E_RENDER_OUTPUT_TOO_LARGE

    Render

    -

    What happened

    A render produced more output than the host is willing to buffer from the sandboxed worker (the per-render stdout ceiling — a DoS bound on shared hosts). The Package renders, but its manifest set is too large to deliver. Distinct from E_RENDER_KCL so agents don't mistake an over-large-but-valid render for a program error.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    A render produced more output than the host is willing to buffer from the sandboxed worker (the per-render stdout ceiling — a DoS bound on shared hosts). The Package renders, but its manifest set is too large to deliver. Distinct from E_RENDER_KCL so agents don't mistake an over-large-but-valid render for a program error.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_RENDER_YAML.html b/site/errors/E_RENDER_YAML.html index e068a55..2407cb2 100644 --- a/site/errors/E_RENDER_YAML.html +++ b/site/errors/E_RENDER_YAML.html @@ -315,11 +315,11 @@

    General

    E_RENDER_YAML

    Render

    -

    What happened

    Error code emitted by the akua CLI: E_RENDER_YAML.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_RENDER_YAML.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_STRICT_UNTYPED_CHART.html b/site/errors/E_STRICT_UNTYPED_CHART.html index 455f051..8e0c84b 100644 --- a/site/errors/E_STRICT_UNTYPED_CHART.html +++ b/site/errors/E_STRICT_UNTYPED_CHART.html @@ -315,11 +315,11 @@

    General

    E_STRICT_UNTYPED_CHART

    Render

    -

    What happened

    akua render --strict: a plugin was handed a raw-string chart path instead of a typed charts.* import. Surfaces the Package authoring site that needs to migrate.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    akua render --strict: a plugin was handed a raw-string chart path instead of a typed charts.* import. Surfaces the Package authoring site that needs to migrate.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_UNSUPPORTED.html b/site/errors/E_UNSUPPORTED.html index d7b9b4e..cb16a98 100644 --- a/site/errors/E_UNSUPPORTED.html +++ b/site/errors/E_UNSUPPORTED.html @@ -315,11 +315,11 @@

    General

    E_UNSUPPORTED

    Hosted API

    -

    What happened

    Requested CLI option or hosted API bridge feature is not implemented.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Requested CLI option or hosted API bridge feature is not implemented.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_VENDOR_DEP_MISSING.html b/site/errors/E_VENDOR_DEP_MISSING.html index f894f6d..402d929 100644 --- a/site/errors/E_VENDOR_DEP_MISSING.html +++ b/site/errors/E_VENDOR_DEP_MISSING.html @@ -315,11 +315,11 @@

    General

    E_VENDOR_DEP_MISSING

    Vendor

    -

    What happened

    Error code emitted by the akua CLI: E_VENDOR_DEP_MISSING.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_VENDOR_DEP_MISSING.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/E_VENDOR_DRIFT.html b/site/errors/E_VENDOR_DRIFT.html index efa6e98..e0a463b 100644 --- a/site/errors/E_VENDOR_DRIFT.html +++ b/site/errors/E_VENDOR_DRIFT.html @@ -315,11 +315,11 @@

    General

    E_VENDOR_DRIFT

    Vendor

    -

    What happened

    Error code emitted by the akua CLI: E_VENDOR_DRIFT.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    +

    What happened

    Error code emitted by the akua CLI: E_VENDOR_DRIFT.

    How to fix it

    This error doesn't have an extended remediation guide yet — track issues on GitHub or open one with your --json output if the message above wasn't enough.

    diff --git a/site/errors/index.html b/site/errors/index.html index 068bd00..ec2d004 100644 --- a/site/errors/index.html +++ b/site/errors/index.html @@ -501,7 +501,7 @@

    Error codes

    diff --git a/site/examples/00-helm-hello.html b/site/examples/00-helm-hello.html index 0223054..2e2ea49 100644 --- a/site/examples/00-helm-hello.html +++ b/site/examples/00-helm-hello.html @@ -301,7 +301,7 @@

    00-helm-hello

    The smallest Package that exercises akua's `helm.template` engine callable end-to-end.

    -
    Renders end-to-end via the embedded helm-engine-wasm. No helm binary on $PATH needed or consulted. All template rendering happens inside a wasmtime WASI sandbox. See docs/security-model.md + docs/roadmap.md Phase 1.
    +
    Renders end-to-end via the embedded helm-engine-wasm. No helm binary on $PATH needed or consulted. All template rendering happens inside a wasmtime WASI sandbox. See docs/security-model.md + docs/roadmap.md Phase 1.

    The smallest Package that exercises akua's helm.template engine callable end-to-end.

    What's here

    filepurpose
    package.kKCL Package; imports akua.helm, calls helm.template, wires the result into resources = ….
    akua.tomlManifest — no external deps.
    inputs.example.yamlAuto-discovered by akuapkg render when --inputs is omitted.
    chart/A tiny in-tree Helm chart (one ConfigMap template).
    @@ -313,10 +313,10 @@

    Render

    akuapkg render --package examples/00-helm-hello/package.k --out ./rendered

    The rendered ConfigMap lands at ./rendered/000-configmap-hello-greeting.yaml — already checked in alongside the example so you can eyeball the output without running anything.

    What's happening

    -

    package.k imports akua.helm — the bundled akua KCL stdlib, a thin typed wrapper over kcl_plugin.helm — and calls helm.template(helm.Template { ... }). Under the hood, akua's plugin dispatcher routes the call to a Rust handler that tars the chart directory, hands it to a Go program compiled to wasm32-wasip1 hosted via wasmtime (see crates/helm-engine-wasm/), parses the multi-document YAML output back into resources, and splats them into resources.

    +

    package.k imports akua.helm — the bundled akua KCL stdlib, a thin typed wrapper over kcl_plugin.helm — and calls helm.template(helm.Template { ... }). Under the hood, akua's plugin dispatcher routes the call to a Rust handler that tars the chart directory, hands it to a Go program compiled to wasm32-wasip1 hosted via wasmtime (see crates/helm-engine-wasm/), parses the multi-document YAML output back into resources, and splats them into resources.

    No helm binary touched. No subprocess. No $PATH. The entire render path lives inside a WASI sandbox. Per CLAUDE.md: "No shell-out, ever."

    Spec

    -

    See docs/package-format.md §5 for the outputs shape and docs/cli.md akuapkg render.

    +

    See docs/package-format.md §5 for the outputs shape and docs/cli.md akuapkg render.

    package.k

    # Minimal Package that exercises the `helm.template` plugin callable.
 #
 # Renders the adjacent `./chart/` (a tiny ConfigMap template) through
@@ -377,12 +377,12 @@ 
    Rendered output
    000-configmap-hello-greeting.yaml
    
 
    
-  Source: examples/00-helm-hello/
+  Source: examples/00-helm-hello/
 
    
 
 
 
diff --git a/site/examples/01-hello-webapp.html b/site/examples/01-hello-webapp.html
index a05e721..78ea3d6 100644
--- a/site/examples/01-hello-webapp.html
+++ b/site/examples/01-hello-webapp.html
@@ -337,7 +337,7 @@ 
    Local fork override
    
 
    nginx = { oci = "oci://registry-1.docker.io/bitnamicharts/nginx", version = "18.2.0", replace = { path = "../nginx-fork" } }
    
 
    akua.lock still records the oci:// digest; files resolve from ../nginx-fork. Drop the replace clause to switch back.
    
 
    See also
    
-
+
 
    package.k
    # Example 01 — hello-webapp
 #
 # Smallest useful akua Package. One local-path chart dep, a few public
@@ -425,12 +425,12 @@ 
    001-service-hello.yaml
    apiVersion: v1
   type: ClusterIP
 
    
 
    
-  Source: examples/01-hello-webapp/
+  Source: examples/01-hello-webapp/
 
    
 
 
 
diff --git a/site/examples/02-webapp-postgres.html b/site/examples/02-webapp-postgres.html
index be55199..ce74282 100644
--- a/site/examples/02-webapp-postgres.html
+++ b/site/examples/02-webapp-postgres.html
@@ -327,9 +327,9 @@ 
    The cross-source convention pattern
 }]
    
 
    If CNPG ever changed its naming convention, this is the one place we'd update — still at CI time, still deterministic. No cluster.get() runtime call ever needed.
    
 
    What's disallowed
    
-
    • Source A cannot reference Source B's output. Both derive from input; cross-source late-binding is the RGD case. If you genuinely need it, route that source to a ResourceGraphDefinition output and let kro reconcile. See 06-multi-engine/ for the pattern.
    • No runtime cluster reads from KCL. Determinism is load-bearing (design-notes.md §2.2).
    
+
    • Source A cannot reference Source B's output. Both derive from input; cross-source late-binding is the RGD case. If you genuinely need it, route that source to a ResourceGraphDefinition output and let kro reconcile. See 06-multi-engine/ for the pattern.
    • No runtime cluster reads from KCL. Determinism is load-bearing (design-notes.md §2.2).
    
 
    See also
    
-
+
 
    package.k
    # Example 02 — webapp-postgres
 #
 # Cross-source wiring. A webapp consumes a Postgres connection URL from a
@@ -409,12 +409,12 @@ 
    package.k
    # Example 02 — webapp-postgres
 
    
 
 
    
-  Source: examples/02-webapp-postgres/
+  Source: examples/02-webapp-postgres/
 
    
 
 
 
diff --git a/site/examples/03-multi-env-app.html b/site/examples/03-multi-env-app.html
index 4373120..af95b3e 100644
--- a/site/examples/03-multi-env-app.html
+++ b/site/examples/03-multi-env-app.html
@@ -354,16 +354,16 @@ 
    Flow for a change
    
 
    Why this design
    
 
    • "Substrate, not content." akua provides the typed authoring language (KCL), the signed distribution (Package + OCI), the deterministic pipeline, the policy host. Workspace concepts (App, Environment, whatever else) are workspace territory. That's what the CLAUDE.md invariant means in practice.
    • Enterprise reality. Every org's deployment shape is subtly different — additional approver rules, per-env secret stores, SLO targets, blue/green weights, regulatory fields. A ship-your-own-Environment-kind approach would pick one shape and lose the rest. Letting users define their own schemas means nobody is forced through a shape that misses a field they need.
    • akua Cloud carries its own concepts. If the commercial Cloud offering needs "Workspace", "Tenant", cross-workspace "Environment" — those are Convex schemas in the Cloud backend, not OSS KRMs. Keep the OSS surface small.
    
 
    See also
    
-
+
 
 
 
    
-  Source: examples/03-multi-env-app/
+  Source: examples/03-multi-env-app/
 
    
 
 
 
diff --git a/site/examples/04-policy-tier.html b/site/examples/04-policy-tier.html
index e7bcc8d..a26f000 100644
--- a/site/examples/04-policy-tier.html
+++ b/site/examples/04-policy-tier.html
@@ -303,7 +303,7 @@ 
    Example 04 — policy tier
    
 
 
    A workspace policy gate. Shows the policy stack end-to-end:
    
 
    • Authoring a Rego policy on top of an imported signed tier
    • Bringing in Kyverno rules via compile-resolved import (not runtime string lookup)
    • Running akua policy check against passing + failing fixtures
    • A *_test.rego file showing the test shape
    
-
    This is the smallest example that exercises every part of the policy architecture described in policy-format.md.
    
+
    This is the smallest example that exercises every part of the policy architecture described in policy-format.md.
    
 
    akua does not ship a PolicySet kind. Composition happens as plain Rego file layout: local .rego files import tiers as compile-resolved data.* via akua.toml. The workspace's policy layout is the workspace's concern.
    
 
    Layout
    
 
    04-policy-tier/
@@ -357,16 +357,16 @@ 
    The shape of a deny response
    
 }
    
 
    Line + field precision. Agent-parseable. No stderr surprises.
    
 
    See also
    
-
+
 
 
 
    
-  Source: examples/04-policy-tier/
+  Source: examples/04-policy-tier/
 
    
 
 
 
diff --git a/site/examples/05-tests-and-golden.html b/site/examples/05-tests-and-golden.html
index 226c45d..e77abff 100644
--- a/site/examples/05-tests-and-golden.html
+++ b/site/examples/05-tests-and-golden.html
@@ -362,7 +362,7 @@ 
    Golden tests
    
 
    When to add what
    
 
    • Writing a Package for the first time → test_*.k for schema + defaults.
    • Landing non-trivial rendering logic → add a golden fixture.
    • Authoring a policy → always write *_test.rego alongside.
    • Bumping an engine version (e.g. Helm v4 → v4.1) → run akuapkg test --golden first; expect some drift, review it, update if sound.
    
 
    See also
    
-
+
 
    package.k
    import akua.ctx
 import charts.nginx as nginx
 
@@ -393,12 +393,12 @@ 
    package.k
    import akua.ctx
 
    
 
 
    
-  Source: examples/05-tests-and-golden/
+  Source: examples/05-tests-and-golden/
 
    
 
 
 
diff --git a/site/examples/06-multi-engine.html b/site/examples/06-multi-engine.html
index de28466..93e0337 100644
--- a/site/examples/06-multi-engine.html
+++ b/site/examples/06-multi-engine.html
@@ -344,7 +344,7 @@ 
    Render
    
 ├── 005-networkpolicy-webapp.yaml       # from inline KCL
 └── 006-resourcegraphdefinition-glue.yaml  # from kro.rgd — kro reconciles it
    
 
    See also
    
-
+
 
    package.k
    # Example 06 — multi-engine
 #
 # One Package, four sources, one render output (raw YAML):
@@ -440,12 +440,12 @@ 
    package.k
    # Example 06 — multi-engine
 
    
 
 
    
-  Source: examples/06-multi-engine/
+  Source: examples/06-multi-engine/
 
    
 
 
 
diff --git a/site/examples/07-package-reuse.html b/site/examples/07-package-reuse.html
index 16f6dea..1d166e5 100644
--- a/site/examples/07-package-reuse.html
+++ b/site/examples/07-package-reuse.html
@@ -302,7 +302,7 @@ 
    Example 07 — package reuse (cross-package composition)
    
   
    One akua Package composing another. The reuser pins the base Package by OCI digest in `akua.toml`, imports its `Input` schema into its own schema (as a nested field), and renders the base's...
    
 
 
    One akua Package composing another. The reuser pins the base Package by OCI digest in akua.toml, imports its Input schema into its own schema (as a nested field), and renders the base's resources inline alongside its own additions.
    
-
    This is what cross-package composition looks like when the full spec lands — the shape this axis is settling into. Masterplan §18 and design-notes.md §6 still list this as an open question for the final API surface. Use this example as the north-star shape; expect minor signature tweaks as the spec locks in.
    
+
    This is what cross-package composition looks like when the full spec lands — the shape this axis is settling into. Masterplan §18 and design-notes.md §6 still list this as an open question for the final API surface. Use this example as the north-star shape; expect minor signature tweaks as the spec locks in.
    
 
    The pattern
    
 
    ┌──────────────────────────────────────────────────────────────┐
 │ platform-base                                                 │  (separate repo, OCI-published)
@@ -370,9 +370,9 @@ 
    When to reuse vs fork
    
 
    Fork when you need base-level invariants that don't exist yet. Forking means copying the base's Package.k into your workspace and editing it. You lose the upgrade path; you own the full surface.
    
 
    Don't reuse to avoid learning KCL. If the base's author didn't anticipate your override, reuse leads to a pile of postRenderer hacks that are harder to maintain than a fork.
    
 
    Open-question addendum
    
-
    This axis is specced to the shape shown above but the exact signature of pkg.render(Package, inputs) vs alternatives (base.render(input.base), auto-unwrapping imports, etc.) may iterate before the spec locks in. See masterplan §18 open question 6 and design-notes.md §6. Consumers of this example: don't hard-code the exact callable name in skills or training material yet.
    
+
    This axis is specced to the shape shown above but the exact signature of pkg.render(Package, inputs) vs alternatives (base.render(input.base), auto-unwrapping imports, etc.) may iterate before the spec locks in. See masterplan §18 open question 6 and design-notes.md §6. Consumers of this example: don't hard-code the exact callable name in skills or training material yet.
    
 
    See also
    
-
+
 
    package.k
    # Example 07 — package reuse
 #
 # Composes a base Package (pinned by OCI digest in akua.toml) and adds local
@@ -481,12 +481,12 @@ 
    package.k
    # Example 07 — package reuse
 
    
 
 
    
-  Source: examples/07-package-reuse/
+  Source: examples/07-package-reuse/
 
    
 
 
 
diff --git a/site/examples/08-pkg-compose.html b/site/examples/08-pkg-compose.html
index 9dc4563..168d7a5 100644
--- a/site/examples/08-pkg-compose.html
+++ b/site/examples/08-pkg-compose.html
@@ -388,12 +388,12 @@ 
    001-configmap-backend.yaml
    apiVersion: v1
   LOG_LEVEL: info
 
    
 
    
-  Source: examples/08-pkg-compose/
+  Source: examples/08-pkg-compose/
 
    
 
 
 
diff --git a/site/examples/09-kustomize-hello.html b/site/examples/09-kustomize-hello.html
index 268660f..f0a7001 100644
--- a/site/examples/09-kustomize-hello.html
+++ b/site/examples/09-kustomize-hello.html
@@ -301,7 +301,7 @@
   
    09-kustomize-hello
    
   
    Smallest Package that exercises akua's `kustomize.build` engine callable end-to-end.
    
 
-
    Renders end-to-end via the embedded kustomize-engine-wasm. No kustomize binary on $PATH needed or consulted. Kustomize runs inside a wasmtime WASI sandbox against an in-memory filesystem unpacked from a tar.gz sent over the WASM ABI. See docs/security-model.md + docs/roadmap.md Phase 3.
    
+
    Renders end-to-end via the embedded kustomize-engine-wasm. No kustomize binary on $PATH needed or consulted. Kustomize runs inside a wasmtime WASI sandbox against an in-memory filesystem unpacked from a tar.gz sent over the WASM ABI. See docs/security-model.md + docs/roadmap.md Phase 3.
    
 
    Smallest Package that exercises akua's kustomize.build engine callable end-to-end.
    
 
    What's here
    
 
    filepurpose
    package.kKCL Package; imports akua.kustomize, calls kustomize.build("./overlay"), wires the result into resources.
    akua.tomlManifest — no external deps.
    base/Base layer — a single ConfigMap.
    overlay/Overlay — adds a namePrefix + commonLabels.
    
@@ -310,7 +310,7 @@ 
    Render
    
 akuapkg render --package examples/09-kustomize-hello/package.k --out ./rendered
    
 
    The rendered ConfigMap lands at ./rendered/000-configmap-prod-hello.yaml — named prod-hello with the overlay's env: prod label applied. Checked in alongside the example so you can eyeball the output without running anything.
    
 
    Spec
    
-
    See docs/package-format.md for the Package shape and docs/cli.md akuapkg render.
    
+
    See docs/package-format.md for the Package shape and docs/cli.md akuapkg render.
    
 
    package.k
    # Minimal Package that exercises the `kustomize.build` plugin callable.
 #
 # Wraps the adjacent `./overlay/` (which layers a namePrefix + labels
@@ -342,12 +342,12 @@ 
    Rendered output
    000-configmap-prod-hello.yaml
    
-  Source: examples/09-kustomize-hello/
+  Source: examples/09-kustomize-hello/
 
    
 
 
 
diff --git a/site/examples/10-kcl-ecosystem.html b/site/examples/10-kcl-ecosystem.html
index 078dce1..12a8448 100644
--- a/site/examples/10-kcl-ecosystem.html
+++ b/site/examples/10-kcl-ecosystem.html
@@ -376,12 +376,12 @@ 
    Rendered output
    000-deployment-hello.yaml
    
-  Source: examples/10-kcl-ecosystem/
+  Source: examples/10-kcl-ecosystem/
 
    
 
 
 
diff --git a/site/examples/11-install-as-package.html b/site/examples/11-install-as-package.html
index f9d9b38..4034fb6 100644
--- a/site/examples/11-install-as-package.html
+++ b/site/examples/11-install-as-package.html
@@ -321,7 +321,7 @@ 
    The install pattern
    
 _extras = [{apiVersion = "v1", kind = "ConfigMap", ...}]
 
 resources = _filtered + _extras
    
-
    The import lands a synthesized stub that owns a render lambda and re-exports upstream's schemas — KCL type-checks upstream.Input{...} at the call site (typos surface as compile errors, not as runtime worker traps). The mechanism mirrors import charts.<name> for Helm charts; see docs/package-format.md for the full shape.
    
+
    The import lands a synthesized stub that owns a render lambda and re-exports upstream's schemas — KCL type-checks upstream.Input{...} at the call site (typos surface as compile errors, not as runtime worker traps). The mechanism mirrors import charts.<name> for Helm charts; see docs/package-format.md for the full shape.
    
 
    package.k
    import akua.ctx
 import pkgs.upstream as upstream
 
@@ -415,12 +415,12 @@ 
    002-configmap-webapp-install-meta.yaml
    apiV
   upstreamApp: webapp
 
    
 
    
-  Source: examples/11-install-as-package/
+  Source: examples/11-install-as-package/
 
    
 
 
 
diff --git a/site/examples/12-vendor-offline.html b/site/examples/12-vendor-offline.html
index 8b519f9..73f89e6 100644
--- a/site/examples/12-vendor-offline.html
+++ b/site/examples/12-vendor-offline.html
@@ -395,12 +395,12 @@ 
    Rendered output
    000-configmap-vendored-vendored.yaml
    
 
    
-  Source: examples/12-vendor-offline/
+  Source: examples/12-vendor-offline/
 
    
 
 
 
diff --git a/site/examples/13-subpackage-helm.html b/site/examples/13-subpackage-helm.html
index 182cd57..5591caa 100644
--- a/site/examples/13-subpackage-helm.html
+++ b/site/examples/13-subpackage-helm.html
@@ -357,12 +357,12 @@ 
    Rendered output
    000-deployment-web-nginx.yaml
    
-  Source: examples/13-subpackage-helm/
+  Source: examples/13-subpackage-helm/
 
    
 
 
 
diff --git a/site/examples/14-helm-repo-dep.html b/site/examples/14-helm-repo-dep.html
index 03f8da0..53ff330 100644
--- a/site/examples/14-helm-repo-dep.html
+++ b/site/examples/14-helm-repo-dep.html
@@ -334,12 +334,12 @@ 
    package.k
    # Package that pulls podinfo from
 
    
 
 
    
-  Source: examples/14-helm-repo-dep/
+  Source: examples/14-helm-repo-dep/
 
    
 
 
 
diff --git a/site/examples/index.html b/site/examples/index.html
index 8230a5e..41cfc7d 100644
--- a/site/examples/index.html
+++ b/site/examples/index.html
@@ -363,7 +363,7 @@ 
    Examples
    
 
 
 
diff --git a/site/index.html b/site/index.html
index 3670bba..426a683 100644
--- a/site/index.html
+++ b/site/index.html
@@ -309,7 +309,7 @@ 
    Install (Windows)
    
 
    > irm https://cli.akua.dev/install.ps1 | iex
    
 
 
    From source
    
-
    $ cargo install --git https://github.com/akua-dev/akua akuapkg-cli
    
+
    $ cargo install --git https://github.com/akua-dev/akuapkg akuapkg-cli
    
 
 
    SDK
    
 
    $ npm install @akua-dev/sdk
    
@@ -323,8 +323,8 @@ 
    Docs
    
   
  • Concepts
    • 
   
  • Examples
    • 
   
  • Errors
    • 
-  
  • GitHub
    • 
-  
  • Releases
    • 
+  
  • GitHub
    • 
+  
  • Releases
    • 
 
 
 
    
@@ -332,7 +332,7 @@ 
    Docs
    
 
    
 
 
diff --git a/site/start/index.html b/site/start/index.html
index c476e74..0436b70 100644
--- a/site/start/index.html
+++ b/site/start/index.html
@@ -297,10 +297,10 @@
   
    Get started
    
   
    Install akua, render your first Package, and ship a signed artifact — in five minutes.
    
 
-
    Pre-alpha. The path below works end-to-end on macOS / Linux. If you hit a wall, the error code reference and the verb's CLI page are the next stops.
    
+
    Pre-alpha. The path below works end-to-end on macOS / Linux. If you hit a wall, the error code reference and the verb's CLI page are the next stops.
    
 
    1. Install
    
 
    $ curl -fsSL https://cli.akua.dev/install | sh
    
-
    Or grab a pinned binary from Releases. Windows: irm https://cli.akua.dev/install.ps1 | iex.
    
+
    Or grab a pinned binary from Releases. Windows: irm https://cli.akua.dev/install.ps1 | iex.
    
 
    Verify the install:
    
 
    $ akuapkg version
 akua 0.8.7
    
@@ -335,13 +335,13 @@ 
    5. Verify + sign + publish
    
 
    $ akuapkg verify         # akua.toml ↔ akua.lock integrity + cosign signatures
 $ akua sign           # cosign-sign the artifact
 $ akuapkg publish        # push the signed OCI artifact + SLSA attestation
    
-
    By default publish refuses unless the lockfile is clean and a cosign key is configured. See Concepts → Security model for the threat model and what strict_signing enforces.
    
+
    By default publish refuses unless the lockfile is clean and a cosign key is configured. See Concepts → Security model for the threat model and what strict_signing enforces.
    
 
    What's next
    
-
    • Walk through the runnable examples — every one has package.k, inputs, and the rendered output side-by-side.
    • Read Concepts → Package format for the authoring shape.
    • Skim the CLI reference to see every verb at a glance — twenty-seven shipped, more in flight.
    • The SDK wraps the same surface for TypeScript / Bun / Deno consumers.
    
+
    • Walk through the runnable examples — every one has package.k, inputs, and the rendered output side-by-side.
    • Read Concepts → Package format for the authoring shape.
    • Skim the CLI reference to see every verb at a glance — twenty-seven shipped, more in flight.
    • The SDK wraps the same surface for TypeScript / Bun / Deno consumers.
    
 
 
 
diff --git a/skills/README.md b/skills/README.md
index f014780..48455f6 100644
--- a/skills/README.md
+++ b/skills/README.md
@@ -47,7 +47,7 @@ These skills install wherever the Agent Skills Specification is supported. Use w
 **With `npx skills` (Vercel Labs skill manager):**
 
 ```sh
-npx skills install github:akua-dev/akua/skills
+npx skills install github:akua-dev/akuapkg/skills
 ```
 
 **With Claude Code:**