Use one command to identify a supported OCI package, resolve its immutable digest, and report what is actually inside it:
npm run oci:inspect -- OCI_REFERENCEThe command distinguishes source packages from literal Kubernetes configuration. For a literal bundle it pulls the layers, parses the Kubernetes objects, counts CRDs, hooks, Jobs, and Secrets, checks duplicate identities, and flags common unfinished values. For a cub installer source package, add --render to select a preset config and inspect the objects without applying them.
Checked examples
| Example | Package kind | Objects | Result | Report |
|---|---|---|---|---|
| AICR literal Kubernetes configuration | literal Kubernetes configuration | 17 | pass | JSON |
| Kubara literal Kubernetes configuration | literal Kubernetes configuration | 77 | pass | JSON |
| AICR Helm source package | Helm chart source package | 0 | pass | JSON |
| Public cub installer package rendered with its default config | cub installer source package | 6 | pass | JSON |
The AICR and Kubara examples are committed local OCI image layouts and are re-read by npm run oci:inspect:verify. The NGINX report was produced from the public package at its immutable digest; the network-free verifier checks it against the publication receipt, package definition, and checked render. Use npm run oci:inspect:verify-live to pull and render that public package again.
Keep the package roles separate
| Package role | What the report can inspect |
|---|---|
| Helm chart source | Chart metadata and layers. Render it before expecting Kubernetes objects. |
| cub installer source package | Preset configs, package files, and requirements; use --render for the selected objects. |
| Literal Kubernetes configuration | Exact objects, object kinds, obvious lifecycle work, companion records, and basic checks. |
| Unknown OCI package | Manifest and layer metadata, plus any readable YAML or JSON objects found. |
This report is deliberately narrower than a deployment proof. It does not claim that Kubernetes admitted the objects, a controller reconciled them, or the workload became healthy.