@intentius/chant-lexicon-k8s 0.124.30 → 0.124.32

package/dist/lint/rules/flux-source-ref-pin.js

@@ -0,0 +1,44 @@
+import { findResourceLiterals, getNestedObject, getNestedString, getProp, lineCol } from "./argo-ast.js";
+/**
+ * FLUX001: GitRepository must pin spec.ref
+ *
+ * A Flux `GitRepository` with no `spec.ref` falls back to the `master` branch,
+ * which on most repos no longer exists — the source stalls with a checkout
+ * error, and every Kustomization downstream of it stalls too. Real estates pin
+ * a branch (or tag) on every source; `FluxGitSource` always emits one. Flag
+ * hand-written `GitRepository` literals whose spec carries a `url` but no
+ * `ref`.
+ *
+ * Bad:  new GitRepository({ spec: { url: "https://github.com/acme/infra" } })
+ * Good: new GitRepository({ spec: { url: "https://github.com/acme/infra", ref: { branch: "main" } } })
+ */
+export const fluxSourceRefPinRule = {
+    id: "FLUX001",
+    severity: "warning",
+    category: "correctness",
+    description: "Flux GitRepository must pin spec.ref (branch, tag, semver, or commit) — the unset default is the master branch",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        for (const { literal } of findResourceLiterals(sourceFile, new Set(["GitRepository"]))) {
+            const spec = getNestedObject(literal, ["spec"]);
+            // No spec object literal to inspect — leave it to other tooling.
+            if (!spec)
+                continue;
+            if (getProp(spec, "ref") !== undefined)
+                continue;
+            const anchor = spec;
+            const { line, column } = lineCol(sourceFile, anchor);
+            const name = getNestedString(literal, ["metadata", "name"]) ?? "(unnamed)";
+            diagnostics.push({
+                file: sourceFile.fileName,
+                line,
+                column,
+                ruleId: "FLUX001",
+                severity: "warning",
+                message: `GitRepository "${name}" has no spec.ref — Flux falls back to the master branch. Pin a branch, tag, semver range, or commit.`,
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/hardcoded-namespace.js

@@ -0,0 +1,57 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * WK8001: Hardcoded Namespace
+ *
+ * Detects hardcoded namespace strings in a Kubernetes resource's `metadata`.
+ * Namespaces should be parameterized or derived from configuration, not
+ * hardcoded as string literals.
+ *
+ * Bad:  new Deployment({ metadata: { namespace: "production" } })
+ * Good: new Deployment({ metadata: { namespace: config.namespace } })
+ */
+/**
+ * Only `metadata: { namespace }` is a Kubernetes namespace. Other `namespace`
+ * keys are another tool's setting (an OpenTelemetry connector's metric prefix,
+ * for one) and a k8s rule has no business flagging them.
+ */
+function isMetadataEntry(node) {
+    const owner = node.parent.parent;
+    return (ts.isPropertyAssignment(owner) &&
+        ts.isIdentifier(owner.name) &&
+        owner.name.text === "metadata");
+}
+export const hardcodedNamespaceRule = {
+    id: "WK8001",
+    severity: "warning",
+    category: "correctness",
+    description: "Detects hardcoded namespace strings — namespaces should be parameterized",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for property assignments like `namespace: "production"`
+            if (ts.isPropertyAssignment(node) &&
+                ts.isIdentifier(node.name) &&
+                node.name.text === "namespace" &&
+                ts.isStringLiteral(node.initializer) &&
+                isMetadataEntry(node)) {
+                const value = node.initializer.text;
+                // Skip empty strings — those are likely intentional placeholders
+                if (value !== "") {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.initializer.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "WK8001",
+                        severity: "warning",
+                        message: `Hardcoded namespace "${value}" detected. Use a variable or configuration parameter instead.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/latest-image-tag.js

@@ -0,0 +1,103 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * WK8002: Latest Image Tag
+ *
+ * Detects when a K8s workload resource uses the `:latest` image tag or no tag
+ * at all in a container image string literal. Untagged or `:latest` images are
+ * non-deterministic and can cause unexpected rollouts.
+ *
+ * Bad:  new Deployment({ spec: { template: { spec: { containers: [{ image: "nginx:latest" }] } } } })
+ * Bad:  new Deployment({ spec: { template: { spec: { containers: [{ image: "nginx" }] } } } })
+ * Good: new Deployment({ spec: { template: { spec: { containers: [{ image: "nginx:1.25" }] } } } })
+ */
+const WORKLOAD_KINDS = new Set([
+    "Deployment",
+    "StatefulSet",
+    "DaemonSet",
+    "CronJob",
+    "Job",
+    "ReplicaSet",
+    "Pod",
+]);
+/**
+ * Returns true if the string looks like a container image reference that is
+ * either untagged or using `:latest`.
+ *
+ * A string is considered a container image if it:
+ * - Contains at least one alphabetic character
+ * - Does not contain spaces
+ * - Is not a simple keyword like "true", "false", etc.
+ */
+function isProblematicImage(value) {
+    if (!value || value.includes(" ") || value.length === 0)
+        return false;
+    // Skip values that are clearly not images
+    const nonImagePatterns = [
+        /^(true|false|null|undefined|yes|no)$/i,
+        /^\d+$/, // pure numbers
+        /^[.\/]/, // relative/absolute paths without image-like structure
+    ];
+    for (const pat of nonImagePatterns) {
+        if (pat.test(value))
+            return false;
+    }
+    // Check for :latest explicitly
+    if (value.endsWith(":latest"))
+        return true;
+    // Check for untagged image: no colon at all, but looks like an image name
+    // Images contain alphanumeric chars and may have / for registry prefix
+    // Must have at least one alpha char and match image naming conventions
+    if (!value.includes(":") && !value.includes("@") && /^[a-zA-Z0-9._\-\/]+$/.test(value) && /[a-zA-Z]/.test(value)) {
+        return true;
+    }
+    return false;
+}
+export const latestImageTagRule = {
+    id: "WK8002",
+    severity: "warning",
+    category: "security",
+    description: "Detects :latest or untagged container images — use explicit version tags for reproducibility",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function isInsideWorkloadConstructor(node) {
+            let current = node.parent;
+            while (current) {
+                if (ts.isNewExpression(current) &&
+                    ts.isIdentifier(current.expression) &&
+                    WORKLOAD_KINDS.has(current.expression.text)) {
+                    return true;
+                }
+                current = current.parent;
+            }
+            return false;
+        }
+        function visit(node) {
+            // Look for property assignments like `image: "nginx:latest"` or `image: "nginx"`
+            if (ts.isPropertyAssignment(node) &&
+                ts.isIdentifier(node.name) &&
+                node.name.text === "image" &&
+                ts.isStringLiteral(node.initializer) &&
+                isInsideWorkloadConstructor(node)) {
+                const value = node.initializer.text;
+                if (isProblematicImage(value)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.initializer.getStart());
+                    const isLatest = value.endsWith(":latest");
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "WK8002",
+                        severity: "warning",
+                        message: isLatest
+                            ? `Container image "${value}" uses the :latest tag. Pin to a specific version for reproducibility.`
+                            : `Container image "${value}" has no tag. Pin to a specific version for reproducibility.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/missing-resource-limits.js

@@ -0,0 +1,85 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * WK8003: Missing Resource Limits
+ *
+ * Detects when a container in a Deployment/StatefulSet spec doesn't have
+ * resource limits or requests. Without resource limits, a container can
+ * consume unbounded cluster resources and cause noisy-neighbour issues.
+ *
+ * Bad:  new Deployment({ spec: { template: { spec: { containers: [{ name: "app", image: "app:1.0" }] } } } })
+ * Good: new Deployment({ spec: { template: { spec: { containers: [{ name: "app", image: "app:1.0", resources: { limits: { cpu: "500m", memory: "256Mi" } } }] } } } })
+ */
+const WORKLOAD_KINDS = new Set([
+    "Deployment",
+    "StatefulSet",
+    "DaemonSet",
+    "CronJob",
+    "Job",
+    "ReplicaSet",
+]);
+export const missingResourceLimitsRule = {
+    id: "WK8003",
+    severity: "warning",
+    category: "correctness",
+    description: "Detects containers without resource limits/requests — always set resource constraints",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function isInsideWorkloadConstructor(node) {
+            let current = node.parent;
+            while (current) {
+                if (ts.isNewExpression(current) &&
+                    ts.isIdentifier(current.expression) &&
+                    WORKLOAD_KINDS.has(current.expression.text)) {
+                    return true;
+                }
+                current = current.parent;
+            }
+            return false;
+        }
+        function objectLiteralHasProperty(obj, name) {
+            return obj.properties.some((p) => ts.isPropertyAssignment(p) &&
+                ts.isIdentifier(p.name) &&
+                p.name.text === name);
+        }
+        function visit(node) {
+            // Look for object literals inside arrays that represent container specs.
+            // A container object literal typically has "name" and "image" properties.
+            // We flag it if it lacks a "resources" property.
+            if (ts.isObjectLiteralExpression(node) &&
+                isInsideWorkloadConstructor(node)) {
+                const hasName = objectLiteralHasProperty(node, "name");
+                const hasImage = objectLiteralHasProperty(node, "image");
+                const hasResources = objectLiteralHasProperty(node, "resources");
+                if (hasName && hasImage && !hasResources) {
+                    // Confirm we're inside an array literal (containers array)
+                    if (node.parent && ts.isArrayLiteralExpression(node.parent)) {
+                        const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                        // Try to extract the container name for a better message
+                        let containerName = "unknown";
+                        for (const prop of node.properties) {
+                            if (ts.isPropertyAssignment(prop) &&
+                                ts.isIdentifier(prop.name) &&
+                                prop.name.text === "name" &&
+                                ts.isStringLiteral(prop.initializer)) {
+                                containerName = prop.initializer.text;
+                                break;
+                            }
+                        }
+                        diagnostics.push({
+                            file: sourceFile.fileName,
+                            line: line + 1,
+                            column: character + 1,
+                            ruleId: "WK8003",
+                            severity: "warning",
+                            message: `Container "${containerName}" is missing resource limits/requests. Set resources.limits and resources.requests to prevent unbounded resource consumption.`,
+                        });
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lsp/completions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEvE"}
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEvE"}

package/dist/lsp/completions.js

@@ -0,0 +1,18 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconCompletions } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-k8s.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Provide Kubernetes resource completions based on context.
+ */
+export function k8sCompletions(ctx) {
+    return lexiconCompletions(ctx, getIndex(), "Kubernetes resource");
+}

package/dist/lsp/hover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa1E;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEjE"}
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa1E;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEjE"}

package/dist/lsp/hover.js

@@ -0,0 +1,57 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconHover } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-k8s.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Provide hover information for Kubernetes resource types.
+ */
+export function k8sHover(ctx) {
+    return lexiconHover(ctx, getIndex(), resourceHover);
+}
+function resourceHover(className, entry) {
+    const lines = [];
+    lines.push(`**${className}**`);
+    lines.push("");
+    lines.push(`K8s resource type: \`${entry.resourceType}\``);
+    // Show apiVersion if stored in attrs
+    const apiVersion = entry.attrs?.apiVersion;
+    if (apiVersion) {
+        lines.push(`apiVersion: \`${apiVersion}\``);
+    }
+    // Show GVK kind if stored in attrs
+    const gvkKind = entry.attrs?.gvkKind;
+    if (gvkKind) {
+        lines.push(`kind: \`${gvkKind}\``);
+    }
+    if (entry.kind === "resource") {
+        lines.push("");
+        lines.push("*Resource — serialized as a top-level Kubernetes object*");
+    }
+    else {
+        lines.push("");
+        lines.push("*Property — used as a nested value in resource specs*");
+    }
+    if (entry.attrs && Object.keys(entry.attrs).length > 0) {
+        const displayAttrs = Object.entries(entry.attrs).filter(([k]) => k !== "apiVersion" && k !== "gvkKind");
+        if (displayAttrs.length > 0) {
+            lines.push("");
+            lines.push("**Attributes:**");
+            for (const [key, value] of displayAttrs) {
+                lines.push(`- \`${key}\` \u2192 \`${value}\``);
+            }
+        }
+    }
+    if (entry.primaryIdentifier && entry.primaryIdentifier.length > 0) {
+        lines.push("");
+        lines.push(`**Primary identifier:** ${entry.primaryIdentifier.map((p) => `\`${p}\``).join(", ")}`);
+    }
+    return { contents: lines.join("\n") };
+}

package/dist/manifest-entity.js

@@ -0,0 +1,71 @@
+/**
+ * A complete Kubernetes manifest carried into a build as a chant entity.
+ *
+ * Two callers produce one: a kustomize build root, whose output is a set of
+ * finished documents rather than typed chant source (#1548), and `chant carve
+ * emit` adopting a Terraform `kubernetes_manifest` (#999), whose whole content
+ * is a manifest body read out of state. In both cases the document already
+ * decided every field, so `props` IS the manifest: the serializer emits it
+ * as-is — plus the default-label / ownership merge every discovered resource
+ * gets — instead of running the spec-inference heuristics built for typed
+ * declarables, which would re-nest a top-level field that is not `spec`
+ * (`rules` on a ClusterRole, `webhooks` on a webhook config).
+ *
+ * The marker is what tells the serializer to take that path — `Symbol.for`, so
+ * a lexicon built against a separate copy of core still matches (the #1137
+ * lesson).
+ *
+ * `entityType` comes from `gvkToTypeName`, the one group→namespace rule
+ * (`./group-namespace`), so a manifest declared this way is typed exactly as a
+ * generated class would be and `lifecycle diff --live` observes it through the
+ * reader a declared resource uses. A kind the generated operation surface does
+ * not know reports NOT-OBSERVED with the existing "no generated operation
+ * surface" reason — the honest verdict, not a silent hole.
+ */
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+import { gvkToTypeName } from "./spec/parse.js";
+/** Marks an entity whose `props` are a complete, render-final manifest. */
+export const RENDERED_MANIFEST_MARKER = Symbol.for("chant.k8s.renderedManifest");
+export function isRenderedManifestEntity(entity) {
+    return entity[RENDERED_MANIFEST_MARKER] === true;
+}
+/**
+ * Wrap one manifest. Returns null when the document has no string
+ * `apiVersion`/`kind` — not a Kubernetes object, nothing to declare.
+ */
+export function manifestEntity(doc) {
+    const apiVersion = doc.apiVersion;
+    const kind = doc.kind;
+    if (typeof apiVersion !== "string" || typeof kind !== "string" || !apiVersion || !kind)
+        return null;
+    const slash = apiVersion.indexOf("/");
+    const group = slash === -1 ? "" : apiVersion.slice(0, slash);
+    const version = slash === -1 ? apiVersion : apiVersion.slice(slash + 1);
+    return {
+        lexicon: "k8s",
+        entityType: gvkToTypeName({ group, version, kind }),
+        kind: "resource",
+        props: { ...doc },
+        [DECLARABLE_MARKER]: true,
+        [RENDERED_MANIFEST_MARKER]: true,
+    };
+}
+/**
+ * Declare an arbitrary Kubernetes object from its manifest — the escape hatch
+ * for a kind the lexicon ships no generated class for, and what `chant carve
+ * emit` writes when it adopts a `kubernetes_manifest` (#999). The typed
+ * constructors cannot serve either case: their props are the kind's own schema,
+ * so an unknown CRD has no class at all and a known one rejects an
+ * `apiVersion`/`kind` pair that differs from the generated default.
+ *
+ * Throws on a document without a string `apiVersion` and `kind`: those two
+ * fields are what makes it addressable, and a silently dropped resource is the
+ * failure this is guarding against.
+ */
+export function k8sManifest(doc) {
+    const entity = manifestEntity(doc);
+    if (!entity) {
+        throw new Error("k8sManifest requires a document with string `apiVersion` and `kind` fields.");
+    }
+    return entity;
+}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.124.30",
+  "version": "0.124.32",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/micro-time.js

@@ -0,0 +1,49 @@
+/**
+ * Helpers for K8s `MicroTime` fields.
+ *
+ * The K8s API server validates fields like `coordination.k8s.io/v1.Lease.spec.renewTime`
+ * (kind: MicroTime) with the exact format `2006-01-02T15:04:05.000000Z07:00`
+ * — microsecond precision, always 6 fractional digits, UTC offset.
+ *
+ * The naive JS `Date.toISOString()` (millisecond precision, 3 fractional
+ * digits) is accepted by the API server too — the schema is more permissive
+ * than the documented format string — but `time.RFC3339Nano`-style strings
+ * with nanosecond precision (9 fractional digits) are rejected as
+ * `422 Unprocessable Entity` with:
+ *
+ *   parsing time "...754Z" as "2006-01-02T15:04:05.000000Z07:00":
+ *     cannot parse "754Z" as "Z07:00"
+ *
+ * Pass a JS Date through `microTime()` to get a string the API server
+ * always accepts. This is the canonical way to populate MicroTime fields
+ * when authoring chant resources by hand.
+ */
+/**
+ * Format a Date as a K8s MicroTime string (UTC, exactly 6 fractional digits).
+ *
+ * @example
+ *   import { Lease } from "@intentius/chant-lexicon-k8s";
+ *   import { microTime } from "@intentius/chant-lexicon-k8s/micro-time";
+ *
+ *   new Lease({
+ *     metadata: { name: "my-lease", namespace: "default" },
+ *     spec: {
+ *       holderIdentity: "node-1",
+ *       leaseDurationSeconds: 15,
+ *       renewTime: microTime(new Date()),
+ *     },
+ *   });
+ */
+export function microTime(date = new Date()) {
+    const iso = date.toISOString(); // "2026-05-11T21:25:36.495Z" (3 digits)
+    // Replace the millisecond fragment with a 6-digit microsecond fragment.
+    // toISOString() always produces ms precision; pad to 6 by appending 3 zeros.
+    return iso.replace(/\.(\d{3})Z$/, ".$1000Z");
+}
+/**
+ * Returns true if `value` is a string in the K8s MicroTime canonical format
+ * (UTC, microsecond precision). Useful in lint/validation contexts.
+ */
+export function isMicroTimeFormatted(value) {
+    return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}Z$/.test(value);
+}

package/dist/op/activities/apply-diff.d.ts

@@ -0,0 +1,31 @@
+/**
+ * What a server-side apply would change in one object (#3998): the live
+ * object against the result of a dry-run apply of the declared one.
+ *
+ * Both sides come from the API server, so a field the server defaults or
+ * fills in appears on both with the same value and drops out of the diff.
+ * What is left out before comparing is the bookkeeping the server writes on
+ * every request and that says nothing about the declared state: managed
+ * fields, the resource version, the uid, the creation timestamp, the
+ * generation (a dry run of a spec change bumps it) and `status`.
+ *
+ * Pure functions only, with no client import, so the capability module can
+ * share them without reaching the API-client chain (#1074).
+ */
+/** One field whose value the apply would change. `before` is absent on an added field, `after` on a removed one. */
+export interface FieldChange {
+    path: string;
+    before?: unknown;
+    after?: unknown;
+}
+/** A copy of `object` without the fields the server writes on every request. */
+export declare function normalizeServerObject(object: Record<string, unknown>): Record<string, unknown>;
+/** Deep equality over JSON values. */
+export declare function jsonEqual(a: unknown, b: unknown): boolean;
+/**
+ * The fields that differ between `live` and `next`, both normalized. Objects
+ * are walked to their leaves; a list is compared whole and reported at its
+ * own path, since a list's items have no stable address in general.
+ */
+export declare function diffFields(live: Record<string, unknown>, next: Record<string, unknown>, prefix?: string): FieldChange[];
+//# sourceMappingURL=apply-diff.d.ts.map

package/dist/op/activities/apply-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-diff.d.ts","sourceRoot":"","sources":["../../../src/op/activities/apply-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,oHAAoH;AACpH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAKD,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS9F;AAKD,sCAAsC;AACtC,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CASzD;AAQD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,SAAK,GAAG,WAAW,EAAE,CAuBnH"}

package/dist/op/activities/apply-diff.js

@@ -0,0 +1,79 @@
+/**
+ * What a server-side apply would change in one object (#3998): the live
+ * object against the result of a dry-run apply of the declared one.
+ *
+ * Both sides come from the API server, so a field the server defaults or
+ * fills in appears on both with the same value and drops out of the diff.
+ * What is left out before comparing is the bookkeeping the server writes on
+ * every request and that says nothing about the declared state: managed
+ * fields, the resource version, the uid, the creation timestamp, the
+ * generation (a dry run of a spec change bumps it) and `status`.
+ *
+ * Pure functions only, with no client import, so the capability module can
+ * share them without reaching the API-client chain (#1074).
+ */
+/** The `metadata` keys the server writes on every request. */
+const SERVER_METADATA = ["managedFields", "resourceVersion", "uid", "creationTimestamp", "generation", "selfLink"];
+/** A copy of `object` without the fields the server writes on every request. */
+export function normalizeServerObject(object) {
+    const { status: _status, ...rest } = object;
+    const metadata = rest.metadata;
+    if (metadata && typeof metadata === "object" && !Array.isArray(metadata)) {
+        const copy = { ...metadata };
+        for (const key of SERVER_METADATA)
+            delete copy[key];
+        rest.metadata = copy;
+    }
+    return rest;
+}
+const isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+/** Deep equality over JSON values. */
+export function jsonEqual(a, b) {
+    if (a === b)
+        return true;
+    if (Array.isArray(a) && Array.isArray(b))
+        return a.length === b.length && a.every((v, i) => jsonEqual(v, b[i]));
+    if (isPlainObject(a) && isPlainObject(b)) {
+        const ka = Object.keys(a);
+        if (ka.length !== Object.keys(b).length)
+            return false;
+        return ka.every((k) => Object.prototype.hasOwnProperty.call(b, k) && jsonEqual(a[k], b[k]));
+    }
+    return false;
+}
+/** `spec.replicas`, or `metadata.labels["app.kubernetes.io/name"]` for a key that is not a plain identifier. */
+function joinPath(prefix, key) {
+    if (/^[A-Za-z_$][\w$-]*$/.test(key))
+        return prefix ? `${prefix}.${key}` : key;
+    return `${prefix}[${JSON.stringify(key)}]`;
+}
+/**
+ * The fields that differ between `live` and `next`, both normalized. Objects
+ * are walked to their leaves; a list is compared whole and reported at its
+ * own path, since a list's items have no stable address in general.
+ */
+export function diffFields(live, next, prefix = "") {
+    const changes = [];
+    const keys = [...new Set([...Object.keys(live), ...Object.keys(next)])].sort();
+    for (const key of keys) {
+        const path = joinPath(prefix, key);
+        const hasBefore = Object.prototype.hasOwnProperty.call(live, key);
+        const hasAfter = Object.prototype.hasOwnProperty.call(next, key);
+        const before = live[key];
+        const after = next[key];
+        // An object on both sides, or added or removed whole, is walked to its
+        // leaves. An empty object added or removed has none, so it stands as itself.
+        const walkable = (has, v) => !has || isPlainObject(v);
+        if ((isPlainObject(before) || isPlainObject(after)) && walkable(hasBefore, before) && walkable(hasAfter, after)) {
+            const inner = diffFields(hasBefore ? before : {}, hasAfter ? after : {}, path);
+            if (inner.length > 0 || hasBefore === hasAfter) {
+                changes.push(...inner);
+                continue;
+            }
+        }
+        if (hasBefore && hasAfter && jsonEqual(before, after))
+            continue;
+        changes.push({ path, ...(hasBefore ? { before } : {}), ...(hasAfter ? { after } : {}) });
+    }
+    return changes;
+}