@intentius/chant-k8s-client 0.31.0 → 0.32.0

package/README.md

@@ -0,0 +1,24 @@
+# @intentius/chant-k8s-client
+
+The typed Kubernetes API client behind [chant](https://www.npmjs.com/package/@intentius/chant)'s live-cluster surfaces: `chant lifecycle diff --live`, `chant lifecycle plan`, `chant kube`, the `kubectlApply`/`waitForReady` Op activities, and [behold](https://github.com/INTENTIUS/behold)'s overlay.
+
+You normally don't install this directly — the k8s lexicon declares it as an **optional dependency**:
+
+```sh
+npm install @intentius/chant-lexicon-k8s
+```
+
+Without it installed, chant's build/synthesis path is completely unaffected (this package is never importable from it — enforced by test); live observation reports honest "not observed" holes instead of failing.
+
+## What it does
+
+- **Any kind the cluster serves** — the operation surface is generated from the same OpenAPI/CRD pass that produces the lexicon's resource types (they cannot skew), then confirmed against the cluster's own API discovery. CRDs included; no hand-maintained kind map.
+- **Server-side apply as `chant:<stack>`** — a stable field-manager identity per stack, with 409 conflicts surfaced as typed errors naming the competing manager and contested field paths. Force is per-call only, never a default.
+- **managedFields primitives** — per-manager field-set parsing that powers chant's derived (not hand-maintained) property-level drift.
+- **Cluster binding honored** — `k8s.profiles.<env>.context` from `chant.config.ts` is enforced; a mismatch with the ambient context is a refusal, not a read of the wrong cluster.
+- Transport and auth are rented from [`@kubernetes/client-node`](https://github.com/kubernetes-client/javascript) (kubeconfig, exec credential plugins, token refresh).
+
+## Documentation
+
+- [The API client](https://intentius.io/chant/lexicons/k8s/api-client/) — coverage, concurrency, credentials, and why this is a separate package
+- [`chant kube`](https://intentius.io/chant/lexicons/k8s/kube/) — the terminal surface over this client

package/dist/client.d.ts

@@ -64,18 +64,53 @@ export interface ReadOptions {
 }
 /** Options for {@link K8sClient.apply}. */
 export interface ApplyOptions {
-    /** Field manager recorded on the objects this apply owns. Default `chant`. */
+    /**
+     * Field manager recorded on the fields this apply owns. Defaults to the bare
+     * `chant`; the k8s lexicon passes the stack-qualified `chant:<stack>` derived
+     * by {@link import("./field-manager.js").fieldManagerFor} (chant #1075).
+     */
     fieldManager?: string;
     /**
      * Take ownership of fields another manager owns instead of failing with a
-     * 409. Default false — chant #1075 is where the conflict surface proper
-     * lives; here a conflict simply arrives as a typed {@link K8sApiError}.
+     * {@link import("./conflict.js").FieldManagerConflictError}. **Default false,
+     * and nothing in chant sets it for you** — transferring ownership of a live
+     * field is a decision, not a retry (chant #1075).
      */
     force?: boolean;
     /** Server-side dry run — validates and returns the result, persists nothing. */
     dryRun?: boolean;
     signal?: AbortSignal;
 }
+/** Options for {@link K8sClient.delete}. */
+export interface DeleteOptions {
+    /** `Foreground`, `Background` or `Orphan`. Omitted leaves the server's default. */
+    propagationPolicy?: "Foreground" | "Background" | "Orphan";
+    /** Server-side dry run — validates, deletes nothing. */
+    dryRun?: boolean;
+    signal?: AbortSignal;
+}
+/** Options for {@link K8sClient.list}. */
+export interface ListOptions {
+    /** Restrict to one namespace. Omitted lists across all of them. */
+    namespace?: string;
+    /** A label selector, e.g. `app.kubernetes.io/managed-by=chant`. */
+    labelSelector?: string;
+    signal?: AbortSignal;
+}
+/** Options for {@link K8sClient.readLog} (chant #1079). */
+export interface ReadLogOptions {
+    /** Container name. Required by the API server when a Pod has more than one. */
+    container?: string;
+    /** Read the previous (crashed/restarted) container instance's log. */
+    previous?: boolean;
+    /** Only the last N lines. */
+    tailLines?: number;
+    /** Only entries from the last N seconds. */
+    sinceSeconds?: number;
+    /** Prefix each line with its RFC3339 timestamp. */
+    timestamps?: boolean;
+    signal?: AbortSignal;
+}
 /** The client surface the k8s lexicon consumes. */
 export interface K8sClient {
     /** Where this client is pointed and what authorized it. */
@@ -92,13 +127,22 @@ export interface K8sClient {
     read(ref: ObjectRef, options?: ReadOptions): Promise<K8sObject>;
     /** GET one object, returning undefined instead of throwing on a 404. */
     readIfPresent(ref: ObjectRef, options?: ReadOptions): Promise<K8sObject | undefined>;
-    /** LIST a kind, optionally namespaced. Follows `continue` tokens. */
-    list(selector: ResourceSelector, options?: {
-        namespace?: string;
-        signal?: AbortSignal;
-    }): Promise<K8sObject[]>;
+    /** LIST a kind, optionally namespaced and label-filtered. Follows `continue` tokens. */
+    list(selector: ResourceSelector, options?: ListOptions): Promise<K8sObject[]>;
+    /**
+     * GET a Pod's `/log` subresource — plain text, not JSON, which is why this
+     * is its own method rather than a `read` variant. A snapshot only: the
+     * server's log endpoint supports `follow` as a chunked stream, but this
+     * client's transport seam (`ResponseContextLike.body.text()`) reads a
+     * response to completion rather than exposing it as a stream, so `--follow`
+     * is out of reach without widening that seam — chant #1079 leaves it there
+     * deliberately rather than half-implementing it.
+     */
+    readLog(ref: ObjectRef, options?: ReadLogOptions): Promise<string>;
     /** Server-side apply one object. Creates it when absent. */
     apply(object: K8sObject, options?: ApplyOptions): Promise<K8sObject>;
+    /** DELETE one object. Throws {@link K8sApiError} with `notFound` when absent. */
+    delete(ref: ObjectRef, options?: DeleteOptions): Promise<void>;
     /** Run `fn` over `items` with this client's concurrency ceiling. */
     concurrently<T, R>(items: readonly T[], fn: (item: T, index: number) => Promise<R>): Promise<R[]>;
     /** The API resource lists discovery has been asked for so far, for tests and diagnostics. */

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAYH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,SAAS,EAET,gBAAgB,EAEjB,MAAM,SAAS,CAAC;AAEjB,KAAK,UAAU,GAAG,cAAc,yBAAyB,CAAC,CAAC;AAI3D;;;;;;;GAOG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,CAQ1D;AAED,yEAAyE;AACzE,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO7D;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,gBAAgB,CAAM,GACpE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW7B;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,kDAAkD;IAClD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAChG,8EAA8E;IAC9E,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChE,wEAAwE;IACxE,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACrF,qEAAqE;IACrE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/G,4DAA4D;IAC5D,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,oEAAoE;IACpE,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,6FAA6F;IAC7F,kBAAkB,IAAI,MAAM,EAAE,CAAC;CAChC;AAcD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC,CA8WxF;AAED,qDAAqD;AACrD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAGpF;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAM/D;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAE9C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAcH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,SAAS,EAET,gBAAgB,EAEjB,MAAM,SAAS,CAAC;AAEjB,KAAK,UAAU,GAAG,cAAc,yBAAyB,CAAC,CAAC;AAI3D;;;;;;;GAOG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,CAQ1D;AAED,yEAAyE;AACzE,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO7D;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,gBAAgB,CAAM,GACpE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW7B;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC3D,wDAAwD;IACxD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,kDAAkD;IAClD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAChG,8EAA8E;IAC9E,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChE,wEAAwE;IACxE,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACrF,wFAAwF;IACxF,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9E;;;;;;;;OAQG;IACH,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,4DAA4D;IAC5D,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,oEAAoE;IACpE,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,6FAA6F;IAC7F,kBAAkB,IAAI,MAAM,EAAE,CAAC;CAChC;AAcD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC,CA4ZxF;AAED,qDAAqD;AACrD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAGpF;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAM/D;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAE9C"}

package/dist/conflict.d.ts

@@ -0,0 +1,103 @@
+/**
+ * The server-side-apply conflict surface — chant #1075.
+ *
+ * When an apply touches a field another manager owns, the API server refuses
+ * with a 409 and — unlike almost every other Kubernetes failure — tells you
+ * precisely what went wrong: which fields, and who owns each one. It arrives as
+ * a `Status` whose `details.causes` is a list of `FieldManagerConflict` entries:
+ *
+ * ```json
+ * { "reason": "Conflict", "code": 409,
+ *   "message": "Apply failed with 2 conflicts: conflicts with \"kubectl\" ...",
+ *   "details": { "causes": [
+ *     { "type": "FieldManagerConflict", "message": "conflict with \"kubectl\"",
+ *       "field": ".spec.replicas" } ] } }
+ * ```
+ *
+ * chant #1074 already carried that through as a typed `K8sApiError` with
+ * `conflict === true`. What was missing is the presentation: a 409 whose
+ * message is one run-on line is not something an operator can act on, and the
+ * thing they must not do — force it because the error suggested nothing else —
+ * is exactly what a bad message invites.
+ *
+ * So this error names the competing manager, lists the contested paths under
+ * it, says what forcing would mean, and stops there. **chant never forces a
+ * conflict on its own.** Taking a field from another manager is a decision
+ * about who owns production, and a tool that makes it silently is the reason
+ * "it works on my cluster" happens. The opt-in exists (`force`), it is never
+ * the default, and nothing in chant turns it on for you.
+ */
+import { K8sApiError, type K8sStatus } from "./errors.js";
+/** One contested field: a path, and the manager that owns it. */
+export interface FieldConflict {
+    /** The manager that currently owns the field, e.g. `kubectl`, `helm`. */
+    manager: string;
+    /**
+     * The field path, in the same syntax `./managed-fields.ts` renders — e.g.
+     * `.spec.replicas`, `.spec.template.spec.containers[name="web"].image`.
+     */
+    field: string;
+    /** The apiVersion the owning entry was recorded at, when the server said. */
+    apiVersion?: string;
+}
+/**
+ * A server-side apply was refused because another field manager owns fields
+ * this apply would set.
+ *
+ * Extends {@link K8sApiError} so every existing `instanceof K8sApiError` check
+ * (and the `conflict` predicate) keeps working — this is a presentation of the
+ * 409, not a replacement for it.
+ */
+export declare class FieldManagerConflictError extends K8sApiError {
+    /** Every contested field, in the order the server reported them. */
+    readonly conflicts: FieldConflict[];
+    /** The field manager chant applied as, and which was refused. */
+    readonly fieldManager: string;
+    constructor(statusCode: number, apiMessage: string, conflicts: FieldConflict[], fieldManager: string, target?: string, status?: K8sStatus);
+    /** Contested paths grouped by the manager that owns them, managers sorted. */
+    get byManager(): Record<string, string[]>;
+    /** The competing managers, sorted. */
+    get managers(): string[];
+    /** The contested paths, sorted and deduplicated. */
+    get fields(): string[];
+}
+/** Inputs {@link renderConflictReport} needs; broken out so tests can render directly. */
+export interface ConflictReport {
+    conflicts: FieldConflict[];
+    fieldManager: string;
+    target?: string;
+    /** The server's own message, used verbatim when nothing could be parsed. */
+    apiMessage?: string;
+}
+/**
+ * The operator-facing rendering. Three things, in this order: what is
+ * contested and who holds it, what chant applied as, and what the two ways out
+ * actually mean. No recommendation between them — that is the point.
+ */
+export declare function renderConflictReport(report: ConflictReport): string;
+/**
+ * Pull the field causes out of a 409 `Status`.
+ *
+ * `details.causes` is the machine-readable form and is preferred. Not every
+ * server fills it in — an aggregated API server or an older release puts the
+ * same information only in the prose `message` — so the message is parsed as a
+ * fallback rather than the list being reported as empty.
+ */
+export declare function parseFieldConflicts(status: K8sStatus | undefined, message?: string): FieldConflict[];
+/**
+ * Parse the prose form, which the server builds as one `conflicts with "x"`
+ * clause per manager followed by that manager's fields as a `-` list:
+ *
+ * ```
+ * Apply failed with 2 conflicts: conflicts with "kubectl" using apps/v1:
+ * - .spec.replicas
+ * - .spec.template.spec.containers[name="web"].image
+ * ```
+ */
+export declare function parseConflictMessage(message: string): FieldConflict[];
+/**
+ * Turn a 409 from an apply into the presented error. Any other failure is
+ * returned unchanged — this is a narrowing, not a catch-all.
+ */
+export declare function asFieldManagerConflict(error: unknown, fieldManager: string): unknown;
+//# sourceMappingURL=conflict.d.ts.map

package/dist/conflict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conflict.d.ts","sourceRoot":"","sources":["../src/conflict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,qBAAa,yBAA0B,SAAQ,WAAW;IACxD,oEAAoE;IACpE,SAAgB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3C,iEAAiE;IACjE,SAAgB,YAAY,EAAE,MAAM,CAAC;gBAGnC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,aAAa,EAAE,EAC1B,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,SAAS;IAUpB,8EAA8E;IAC9E,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAUxC;IAED,sCAAsC;IACtC,IAAI,QAAQ,IAAI,MAAM,EAAE,CAEvB;IAED,oDAAoD;IACpD,IAAI,MAAM,IAAI,MAAM,EAAE,CAErB;CACF;AAED,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAwCnE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CAIpG;AAoCD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CA0BrE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAWpF"}

package/dist/errors.d.ts

@@ -39,7 +39,11 @@ export declare class K8sApiError extends Error {
     get forbidden(): boolean;
     /** No usable credentials for this cluster. */
     get unauthorized(): boolean;
-    /** Server-side-apply field-ownership conflict (chant #1075 surfaces these properly). */
+    /**
+     * Server-side-apply field-ownership conflict. `./conflict.ts`'s
+     * {@link import("./conflict.js").FieldManagerConflictError} is the presented
+     * form (chant #1075); this predicate still answers for both.
+     */
     get conflict(): boolean;
     /**
      * Build from a raw response body, which is a `Status` on every well-behaved
@@ -80,6 +84,15 @@ export declare class ExecCredentialNotAllowedError extends Error {
     readonly allowed: readonly string[];
     constructor(command: string, allowed: readonly string[]);
 }
+/**
+ * chant's own field-manager identity is unusable (chant #1075) — almost always
+ * because `ownership.stack` is too long or carries whitespace. Raised where the
+ * name is derived, before any request, so the config key can be named instead
+ * of the failure arriving as a 400 from a cluster.
+ */
+export declare class FieldManagerError extends Error {
+    constructor(message: string);
+}
 /** The kubeconfig could not be read, or names no usable cluster/context. */
 export declare class KubeConfigError extends Error {
     constructor(message: string);

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAElB,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE,MAAM,GAAG,SAAS;aAC1B,UAAU,EAAE,MAAM;IAClC,oEAAoE;aACpD,MAAM,CAAC,EAAE,MAAM;aACf,MAAM,CAAC,EAAE,SAAS;gBALlB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,UAAU,EAAE,MAAM;IAClC,oEAAoE;IACpD,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,MAAM,CAAC,EAAE,SAAS,YAAA;IASpC,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,4EAA4E;IAC5E,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,8CAA8C;IAC9C,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED,wFAAwF;IACxF,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW;CAapF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,MAAM,CAAC,EAAE,MAAM;gBAD/B,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EAC/B,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAMhC;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,KAAK,CAAC,EAAE,OAAO;CAS5B;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,OAAO,EAAE,MAAM;aACf,OAAO,EAAE,SAAS,MAAM,EAAE;gBAD1B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS,MAAM,EAAE;CAU7C;AAED,4EAA4E;AAC5E,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAE3B,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM,EACpC,OAAO,CAAC,EAAE,MAAM;CAKnB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAElB,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE,MAAM,GAAG,SAAS;aAC1B,UAAU,EAAE,MAAM;IAClC,oEAAoE;aACpD,MAAM,CAAC,EAAE,MAAM;aACf,MAAM,CAAC,EAAE,SAAS;gBALlB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,UAAU,EAAE,MAAM;IAClC,oEAAoE;IACpD,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,MAAM,CAAC,EAAE,SAAS,YAAA;IASpC,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,4EAA4E;IAC5E,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,8CAA8C;IAC9C,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED;;;;OAIG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW;CAapF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,MAAM,CAAC,EAAE,MAAM;gBAD/B,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EAC/B,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAMhC;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,KAAK,CAAC,EAAE,OAAO;CAS5B;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,OAAO,EAAE,MAAM;aACf,OAAO,EAAE,SAAS,MAAM,EAAE;gBAD1B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS,MAAM,EAAE;CAU7C;AAED;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,4EAA4E;AAC5E,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAE3B,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM,EACpC,OAAO,CAAC,EAAE,MAAM;CAKnB"}

package/dist/field-manager.d.ts

@@ -0,0 +1,62 @@
+/**
+ * chant's field-manager identity — chant #1075.
+ *
+ * Server-side apply records, per field, the name of the manager that last
+ * wrote it. That name is chant's identity in the cluster, so it has to be
+ * *stable* (the same stack applying twice must be the same manager, or the
+ * second apply conflicts with the first) and *distinguishing* (two chant
+ * stacks sharing a cluster must not silently co-own each other's fields).
+ *
+ * The scheme is `chant` alone, or `chant:<stack>` when the project sets
+ * `ownership.stack` — the same identity the label-based ownership marker
+ * already carries (`packages/core/src/ownership.ts`). Ownership-by-label
+ * answers a binary whole-object question; the field manager is the sub-object
+ * version of the same fact, supplied by the API server rather than stamped by
+ * chant. One identity, two granularities.
+ *
+ * **`ownership.env` is deliberately not part of it.** Two environments of one
+ * stack only ever touch the same object if they share a namespace and a name,
+ * and at that point they are fighting over it. An env-qualified manager would
+ * let them each own a different half of that object without either noticing;
+ * a stack-qualified one makes the second apply conflict, which is the correct
+ * outcome and the whole point of the conflict surface.
+ *
+ * This module is plain string logic with no dependency on chant core, so the
+ * lexicon (which reads `ownership` from project config) and the client (which
+ * writes the query parameter) agree on one derivation rather than two.
+ */
+/** The unqualified manager, used when a project sets no ownership stack. */
+export declare const CHANT_FIELD_MANAGER = "chant";
+/** Separator between the `chant` prefix and the stack identity. */
+export declare const FIELD_MANAGER_SEPARATOR = ":";
+/**
+ * The API server's own ceiling on `fieldManager`
+ * (`k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager`). Exceeding it is a
+ * 400 on every apply, so it is checked here — where the name is derived and
+ * the offending config key can be named — rather than discovered in a cluster.
+ */
+export declare const FIELD_MANAGER_MAX_LENGTH = 128;
+/** The stack identity a field manager is derived from. */
+export interface FieldManagerIdentity {
+    /** `ownership.stack` from project config, when set. */
+    stack?: string;
+}
+/**
+ * Derive the field manager for a stack. `undefined`/no stack yields the bare
+ * `chant`; a stack yields `chant:<stack>`.
+ */
+export declare function fieldManagerFor(identity?: FieldManagerIdentity): string;
+/**
+ * Reject a field manager the API server would reject, naming the config key
+ * responsible. A silent truncation would be worse than a failure: it would
+ * merge two stacks' identities into one and make their applies fight.
+ */
+export declare function assertValidFieldManager(manager: string, stack?: string): void;
+/** True when `manager` is a chant field manager, qualified or not. */
+export declare function isChantFieldManager(manager: string | undefined): boolean;
+/**
+ * The stack a chant field manager names, or undefined for the unqualified
+ * `chant` and for any manager that is not chant's at all.
+ */
+export declare function chantStackOf(manager: string | undefined): string | undefined;
+//# sourceMappingURL=field-manager.d.ts.map

package/dist/field-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-manager.d.ts","sourceRoot":"","sources":["../src/field-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAMvE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAwB7E;AAED,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMxE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI5E"}

package/dist/index.d.ts

@@ -12,9 +12,15 @@
  * it stays that way.
  */
 export { createK8sClient, readAmbientContext, loadClientNode, isK8sClientAvailable, apiVersionPath, splitApiVersion, selectorText, refText, } from "./client.js";
-export type { K8sClient, ReadOptions, ApplyOptions } from "./client.js";
-export { K8sApiError, K8sTransportError, K8sClientUnavailableError, ExecCredentialNotAllowedError, KubeConfigError, UnknownResourceError, } from "./errors.js";
+export type { K8sClient, ReadOptions, ApplyOptions, DeleteOptions, ListOptions, ReadLogOptions } from "./client.js";
+export { K8sApiError, K8sTransportError, K8sClientUnavailableError, ExecCredentialNotAllowedError, FieldManagerError, KubeConfigError, UnknownResourceError, } from "./errors.js";
 export type { K8sStatus } from "./errors.js";
+export { CHANT_FIELD_MANAGER, FIELD_MANAGER_SEPARATOR, FIELD_MANAGER_MAX_LENGTH, fieldManagerFor, assertValidFieldManager, isChantFieldManager, chantStackOf, } from "./field-manager.js";
+export type { FieldManagerIdentity } from "./field-manager.js";
+export { FieldManagerConflictError, asFieldManagerConflict, parseFieldConflicts, parseConflictMessage, renderConflictReport, } from "./conflict.js";
+export type { FieldConflict, ConflictReport } from "./conflict.js";
+export { managedFieldsOf, fieldSetsOf, managersOf, fieldsOwnedBy, chantOwnedFields, fieldOwners, fieldPathsOf, renderSegment, } from "./managed-fields.js";
+export type { ManagedFieldsEntry, ManagerFieldSet } from "./managed-fields.js";
 export { DEFAULT_EXEC_ALLOWLIST, assertExecCredentialAllowed, credentialPathOf, execConfigOf, execCommandName, } from "./credentials.js";
 export type { ExecConfig, KubeConfigUser } from "./credentials.js";
 export { mapConcurrent, DEFAULT_CONCURRENCY } from "./concurrency.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,OAAO,GACR,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAErE,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,eAAe,EACf,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEnE,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,OAAO,GACR,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEjH,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGhE,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEnE,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,SAAS,CAAC"}

package/dist/managed-fields.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Reading `metadata.managedFields` — chant #1075, consumed by #1076.
+ *
+ * The API server records, per object, one entry per manager that has written
+ * to it, and inside each entry a *set* of the field paths that manager owns.
+ * That set is encoded as `fieldsV1`, a nested object whose keys carry a
+ * one-or-two-character prefix rather than being plain field names:
+ *
+ * ```json
+ * { "f:spec": { "f:template": { "f:spec": {
+ *     "f:containers": { "k:{\"name\":\"web\"}": { ".": {}, "f:image": {} } } } } } }
+ * ```
+ *
+ * | prefix | means                                    | rendered as     |
+ * |--------|------------------------------------------|-----------------|
+ * | `f:`   | a field of a map                         | `.image`        |
+ * | `k:`   | a list item, addressed by its key fields | `[name="web"]`  |
+ * | `v:`   | a set item, addressed by its value       | `[="blue"]`     |
+ * | `i:`   | a list item, addressed by its index      | `[0]`           |
+ * | `.`    | the containing element itself            | (the prefix)    |
+ *
+ * The rendering above is not invented here: it is what
+ * `sigs.k8s.io/structured-merge-diff`'s `fieldpath.Path.String()` produces,
+ * which is the same syntax the API server uses for the `field` of a conflict
+ * cause (`./conflict.ts`). Both halves of #1076's question — *which fields
+ * does chant own* and *which fields is something else fighting over* — have to
+ * be comparable as strings, so there is exactly one renderer.
+ *
+ * This module reads. It does not decide what a difference means; that is
+ * #1076's job. What it owes #1076 is the primitive: an object in, per-manager
+ * field sets out.
+ */
+import type { K8sObject } from "./types.js";
+/** One `metadata.managedFields` entry, as the API server writes it. */
+export interface ManagedFieldsEntry {
+    manager?: string;
+    /** `Apply` for a server-side apply, `Update` for anything else. */
+    operation?: string;
+    apiVersion?: string;
+    fieldsType?: string;
+    fieldsV1?: Record<string, unknown>;
+    /** Set when the entry describes a subresource write, e.g. `status`. */
+    subresource?: string;
+    time?: string;
+}
+/** One manager's ownership of one object, with `fieldsV1` decoded. */
+export interface ManagerFieldSet {
+    /** The manager's name, e.g. `chant:web`, `kubectl-client-side-apply`. */
+    manager: string;
+    /** `Apply` (server-side apply) or `Update` (everything else). */
+    operation: string;
+    /** The apiVersion the entry was recorded at. */
+    apiVersion?: string;
+    /** Set when this entry covers a subresource (`status`, `scale`). */
+    subresource?: string;
+    /** When the write happened, as the server recorded it. */
+    time?: string;
+    /** Field paths this entry owns, rendered and sorted. */
+    fields: string[];
+}
+/** `metadata.managedFields`, or an empty list when the object carries none. */
+export declare function managedFieldsOf(object: K8sObject | undefined): ManagedFieldsEntry[];
+/**
+ * Decode every `managedFields` entry into a manager and its owned paths.
+ *
+ * Entries are kept separate rather than merged by manager name: a manager can
+ * legitimately hold two entries for one object — one for the main resource and
+ * one for a subresource, or two at different apiVersions — and collapsing them
+ * would lose the distinction #1076 needs when deciding whether a `status`
+ * write is chant's business (it is not).
+ */
+export declare function fieldSetsOf(object: K8sObject | undefined): ManagerFieldSet[];
+/** Every manager named on the object, in `managedFields` order, deduplicated. */
+export declare function managersOf(object: K8sObject | undefined): string[];
+/**
+ * The paths owned by managers matching `manager` — a literal name, or a
+ * predicate for the fuzzier questions (#1076 asks "which fields does *any*
+ * chant manager own", since a stack rename changes the name).
+ *
+ * Subresource entries are excluded by default: a controller writing `status`
+ * is not competing for the spec chant declared.
+ */
+export declare function fieldsOwnedBy(object: K8sObject | undefined, manager: string | ((manager: string) => boolean), options?: {
+    includeSubresources?: boolean;
+}): string[];
+/** The paths owned by any chant field manager — {@link isChantFieldManager}. */
+export declare function chantOwnedFields(object: K8sObject | undefined, options?: {
+    includeSubresources?: boolean;
+}): string[];
+/**
+ * path → the managers that own it. A path with two owners is not an error:
+ * server-side apply lets several appliers co-own a field when they set it to
+ * the same value, and an `Update` entry can overlap an `Apply` one.
+ */
+export declare function fieldOwners(object: K8sObject | undefined, options?: {
+    includeSubresources?: boolean;
+}): Map<string, string[]>;
+/**
+ * Render one `fieldsV1` tree to sorted, dotted paths.
+ *
+ * Exported because a caller with an entry already in hand (a watch event, a
+ * stored snapshot) should not have to reassemble a whole object to decode it.
+ */
+export declare function fieldPathsOf(fieldsV1: unknown, prefix?: string): string[];
+/**
+ * One `fieldsV1` key to one path segment, or undefined for a key with no
+ * recognised prefix (a future encoding chant should skip rather than mangle).
+ */
+export declare function renderSegment(key: string): string | undefined;
+//# sourceMappingURL=managed-fields.d.ts.map

package/dist/managed-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-fields.d.ts","sourceRoot":"","sources":["../src/managed-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,kBAAkB,EAAE,CAMnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,eAAe,EAAE,CAW5E;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,EAAE,CAMlE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,EAChD,OAAO,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9C,MAAM,EAAE,CASV;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,OAAO,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9C,MAAM,EAAE,CAEV;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,OAAO,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9C,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAWvB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAK,GAAG,MAAM,EAAE,CAErE;AAmBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM7D"}

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@intentius/chant-k8s-client",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "Typed Kubernetes API client for chant — the read/write path of the k8s lexicon, kept out of the build path",
   "license": "Apache-2.0",
-  "homepage": "https://intentius.io/chant",
+  "homepage": "https://intentius.io/chant/lexicons/k8s/api-client/",
   "repository": {
     "type": "git",
     "url": "https://github.com/INTENTIUS/chant.git",