@intentius/chant-lexicon-k8s 0.124.31 → 0.124.32

package/src/op/activities/kubectl-plan.test.ts

@@ -0,0 +1,224 @@
+/**
+ * `planManifest` (#3998): a dry-run apply of every declared document,
+ * compared with the live object, against the fake cluster.
+ *
+ * The fake API server below answers a `dryRun=All` apply the way a real one
+ * does in the respects the plan depends on: the live object merged with the
+ * applied fields, a field the server defaults filled in, and fresh
+ * bookkeeping (resource version, generation, managed fields) on every
+ * answer. Nothing it answers is persisted.
+ */
+
+import { describe, test, expect } from "vitest";
+import type { K8sObject } from "@intentius/chant-k8s-client";
+import { statusBody, type RecordedRequest } from "@intentius/chant-k8s-client/testing";
+import { fakeCluster, objectKey, ownedObject } from "../../api/fake-cluster";
+import { planManifest } from "./kubectl";
+import { diffFields, normalizeServerObject } from "./apply-diff";
+
+type Obj = Record<string, any>;
+
+function merge(base: Obj, patch: Obj): Obj {
+  const out: Obj = { ...base };
+  for (const [k, v] of Object.entries(patch)) {
+    out[k] = v && typeof v === "object" && !Array.isArray(v) && out[k] && typeof out[k] === "object" ? merge(out[k], v) : v;
+  }
+  return out;
+}
+
+/** The live objects, by API path. */
+type Live = Record<string, Obj>;
+
+/** A dry-run responder over `live`. `refuse` answers a path with a 422 instead. */
+function dryRunServer(live: Live, refuse: Record<string, string> = {}, missingNamespaces: string[] = []) {
+  return (req: RecordedRequest) => {
+    if (req.method !== "PATCH") return undefined;
+    if (req.query.dryRun !== "All") throw new Error(`a plan sent a PATCH without dryRun=All: ${req.path}`);
+    const missing = missingNamespaces.find((ns) => req.path.includes(`/namespaces/${ns}/`));
+    if (missing) return { status: 404, body: statusBody(404, "NotFound", `namespaces "${missing}" not found`) };
+    if (refuse[req.path]) return { status: 422, body: statusBody(422, "Invalid", refuse[req.path]) };
+    const body = JSON.parse(String(req.body)) as Obj;
+    const before = live[req.path];
+    const result = merge(before ?? {}, body);
+    if (result.kind === "Deployment") result.spec = { revisionHistoryLimit: 10, ...(result.spec ?? {}) };
+    const ns = req.path.match(/\/namespaces\/([^/]+)\//)?.[1];
+    result.metadata = {
+      ...result.metadata,
+      ...(ns ? { namespace: ns } : {}),
+      uid: before?.metadata?.uid ?? "uid-dry-run",
+      resourceVersion: "99",
+      generation: (before?.metadata?.generation ?? 0) + 1,
+      creationTimestamp: before?.metadata?.creationTimestamp ?? "2026-10-19T00:00:00Z",
+      managedFields: [{ manager: req.query.fieldManager, operation: "Apply" }],
+    };
+    return { body: result };
+  };
+}
+
+const DEPLOY_PATH = "/apis/apps/v1/namespaces/prod/deployments/web";
+
+const declared = (replicas: number): Obj => ({
+  apiVersion: "apps/v1",
+  kind: "Deployment",
+  metadata: { name: "web", namespace: "prod" },
+  spec: { replicas },
+});
+
+/** The live Deployment as the server holds it after chant applied `replicas`. */
+const liveWeb = (replicas: number): K8sObject =>
+  ({
+    ...ownedObject("apps/v1", "Deployment", "web", "prod", {
+      metadata: {
+        name: "web",
+        namespace: "prod",
+        labels: { "app.kubernetes.io/managed-by": "chant", "chant.intentius.io/stack": "web" },
+        generation: 4,
+        creationTimestamp: "2026-01-01T00:00:00Z",
+        managedFields: [{ manager: "chant:web", operation: "Apply" }],
+      } as never,
+    }),
+    spec: { replicas, revisionHistoryLimit: 10 },
+    status: { readyReplicas: replicas },
+  }) as K8sObject;
+
+describe("planManifest (#3998)", () => {
+  test("an object with no live counterpart plans as a create, and nothing is persisted", async () => {
+    const cluster = fakeCluster({ respond: dryRunServer({}) });
+    const plan = await planManifest({ manifest: "k8s.yaml", documents: [declared(3)], stack: "web" }, undefined, cluster.connector);
+    expect(plan.fieldManager).toBe("chant:web");
+    expect(plan.objects).toHaveLength(1);
+    expect(plan.objects[0]).toMatchObject({
+      ref: { apiVersion: "apps/v1", kind: "Deployment", name: "web", namespace: "prod" },
+      action: "create",
+      changes: [],
+    });
+    expect(plan.objects[0].object?.metadata).toMatchObject({ labels: { "chant.intentius.io/stack": "web" } });
+    const patches = cluster.layer.requests.filter((r) => r.method === "PATCH");
+    expect(patches.map((p) => p.query)).toEqual([{ fieldManager: "chant:web", force: "false", dryRun: "All" }]);
+    expect(cluster.layer.requests.some((r) => r.method === "DELETE" || r.method === "POST" || r.method === "PUT")).toBe(false);
+  });
+
+  test("a manifest whose dry run equals the live object plans as no change, bookkeeping and defaults ignored", async () => {
+    const live = liveWeb(3);
+    const cluster = fakeCluster({
+      objects: { [objectKey("apps/v1", "Deployment", "web", "prod")]: live },
+      respond: dryRunServer({ [DEPLOY_PATH]: live as Obj }),
+    });
+    const plan = await planManifest({ manifest: "k8s.yaml", documents: [declared(3)], stack: "web" }, undefined, cluster.connector);
+    expect(plan.objects.map((o) => [o.action, o.changes])).toEqual([["no-op", []]]);
+  });
+
+  test("a changed field plans as an update naming the field, before and after", async () => {
+    const live = liveWeb(3);
+    const cluster = fakeCluster({
+      objects: { [objectKey("apps/v1", "Deployment", "web", "prod")]: live },
+      respond: dryRunServer({ [DEPLOY_PATH]: live as Obj }),
+    });
+    const plan = await planManifest({ manifest: "k8s.yaml", documents: [declared(5)], stack: "web" }, undefined, cluster.connector);
+    expect(plan.objects[0].action).toBe("update");
+    expect(plan.objects[0].changes).toEqual([{ path: "spec.replicas", before: 3, after: 5 }]);
+  });
+
+  test("a change the server refuses as immutable plans as an update carrying the refusal", async () => {
+    const live = liveWeb(3);
+    const message = 'Deployment.apps "web" is invalid: spec.selector: Invalid value: field is immutable';
+    const cluster = fakeCluster({
+      objects: { [objectKey("apps/v1", "Deployment", "web", "prod")]: live },
+      respond: dryRunServer({ [DEPLOY_PATH]: live as Obj }, { [DEPLOY_PATH]: message }),
+    });
+    const plan = await planManifest({ manifest: "k8s.yaml", documents: [declared(3)], stack: "web" }, undefined, cluster.connector);
+    expect(plan.objects[0]).toMatchObject({ action: "update", changes: [], refused: message });
+  });
+
+  test("any other refusal fails the plan, as it would fail the apply", async () => {
+    const cluster = fakeCluster({ respond: dryRunServer({}, { [DEPLOY_PATH]: "spec.replicas: Invalid value: -1" }) });
+    await expect(
+      planManifest({ manifest: "k8s.yaml", documents: [declared(-1)], stack: "web" }, undefined, cluster.connector),
+    ).rejects.toThrow(/Invalid value: -1/);
+  });
+
+  test("an object in a namespace the same plan creates plans as a create without a dry run of its own", async () => {
+    const cluster = fakeCluster({ respond: dryRunServer({}, {}, ["fresh"]) });
+    const plan = await planManifest(
+      {
+        manifest: "k8s.yaml",
+        documents: [
+          { apiVersion: "v1", kind: "Namespace", metadata: { name: "fresh" } },
+          { ...declared(1), metadata: { name: "web", namespace: "fresh" } },
+        ],
+        stack: "web",
+      },
+      undefined,
+      cluster.connector,
+    );
+    expect(plan.objects.map((o) => [o.ref.kind, o.action])).toEqual([["Namespace", "create"], ["Deployment", "create"]]);
+  });
+
+  test("a namespace that does not exist and is not created here fails the plan", async () => {
+    const cluster = fakeCluster({ respond: dryRunServer({}, {}, ["prod"]) });
+    await expect(
+      planManifest({ manifest: "k8s.yaml", documents: [declared(1)], stack: "web" }, undefined, cluster.connector),
+    ).rejects.toThrow(/namespaces "prod" not found/);
+  });
+
+  describe("deletes come from the apply's prune scope", () => {
+    const objects = () => ({
+      [objectKey("apps/v1", "Deployment", "web", "prod")]: liveWeb(3),
+      [objectKey("apps/v1", "Deployment", "old", "prod")]: ownedObject("apps/v1", "Deployment", "old", "prod"),
+      [objectKey("apps/v1", "Deployment", "handmade", "prod")]: {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { name: "handmade", namespace: "prod", labels: { app: "handmade" } },
+      },
+      [objectKey("apps/v1", "Deployment", "elsewhere", "staging")]: ownedObject("apps/v1", "Deployment", "elsewhere", "staging"),
+      [objectKey("v1", "Secret", "master-key", "prod")]: ownedObject("v1", "Secret", "master-key", "prod", {
+        metadata: { labels: { "app.kubernetes.io/managed-by": "chant", "chant.intentius.io/generated-once": "true" } },
+      }),
+    });
+
+    test("owned-only plans a delete for the owned, undeclared object in the touched namespace, and deletes nothing", async () => {
+      const cluster = fakeCluster({ objects: objects(), respond: dryRunServer({ [DEPLOY_PATH]: liveWeb(3) as Obj }) });
+      const plan = await planManifest(
+        { manifest: "k8s.yaml", documents: [declared(3)], stack: "web", deleteMode: "owned-only" },
+        undefined,
+        cluster.connector,
+      );
+      expect(plan.deletes).toEqual([{ apiVersion: "apps/v1", kind: "Deployment", name: "old", namespace: "prod" }]);
+      expect(plan.retained).toEqual([{ apiVersion: "v1", kind: "Secret", name: "master-key", namespace: "prod" }]);
+      expect(cluster.layer.requests.filter((r) => r.method === "DELETE")).toEqual([]);
+    });
+
+    test("never plans no deletes and lists nothing", async () => {
+      const cluster = fakeCluster({ objects: objects(), respond: dryRunServer({ [DEPLOY_PATH]: liveWeb(3) as Obj }) });
+      const plan = await planManifest({ manifest: "k8s.yaml", documents: [declared(3)], stack: "web" }, undefined, cluster.connector);
+      expect(plan.deletes).toEqual([]);
+      expect(cluster.layer.requests.filter((r) => r.method === "GET" && r.path.endsWith("/deployments"))).toEqual([]);
+    });
+  });
+});
+
+describe("apply-diff (#3998)", () => {
+  test("normalizing drops the server's bookkeeping and status, nothing else", () => {
+    const normalized = normalizeServerObject({
+      apiVersion: "v1",
+      kind: "ConfigMap",
+      metadata: { name: "c", labels: { a: "1" }, uid: "u", resourceVersion: "9", generation: 2, creationTimestamp: "t", managedFields: [] },
+      data: { k: "v" },
+      status: { phase: "x" },
+    });
+    expect(normalized).toEqual({ apiVersion: "v1", kind: "ConfigMap", metadata: { name: "c", labels: { a: "1" } }, data: { k: "v" } });
+  });
+
+  test("objects are walked to their leaves, lists compared whole, odd keys bracketed", () => {
+    const changes = diffFields(
+      { metadata: { labels: { "app.kubernetes.io/name": "a", keep: "x" } }, spec: { ports: [{ port: 80 }], gone: 1 } },
+      { metadata: { labels: { "app.kubernetes.io/name": "b", keep: "x" } }, spec: { ports: [{ port: 81 }], added: 2 } },
+    );
+    expect(changes).toEqual([
+      { path: 'metadata.labels["app.kubernetes.io/name"]', before: "a", after: "b" },
+      { path: "spec.added", after: 2 },
+      { path: "spec.gone", before: 1 },
+      { path: "spec.ports", before: [{ port: 80 }], after: [{ port: 81 }] },
+    ]);
+  });
+});

package/src/op/activities/kubectl.ts

@@ -46,6 +46,7 @@ import { operationFor } from "../../api/operation-surface";
 import { DEFAULT_IMPORT_TYPES } from "../../api/sweep-types";
 import { isGeneratedOnce } from "../../secret-labels";
 import { isEffectReceiptObject } from "../../effect-receipt-row";
+import { diffFields, normalizeServerObject, type FieldChange } from "./apply-diff";
 
 /**
  * How the apply treats chant-owned objects that are no longer declared. The
@@ -362,6 +363,178 @@ export async function applyManifest(
   return { fieldManager, applied, pruned, retained };
 }
 
+/** What a dry-run apply would do to one declared object (#3998). */
+export interface PlannedObject {
+  ref: AppliedRef;
+  /** `create` when no live object exists, `no-op` when the dry run equals it, `update` otherwise. */
+  action: "create" | "update" | "no-op";
+  /**
+   * For a create, the document as the apply sends it (ownership stamped).
+   * Not the dry-run result: the server can fill in values a dry run picks
+   * afresh each time (a Service's cluster IP), which would make the plan
+   * differ from itself.
+   */
+  object?: Record<string, unknown>;
+  /** The fields an update changes, live against the dry-run result, both normalized. */
+  changes: FieldChange[];
+  /**
+   * The API server rejected the dry run of a change to a live object because
+   * it changes an immutable field. The apply does not delete and recreate,
+   * so it would fail the same way. The server's message.
+   */
+  refused?: string;
+}
+
+/** What {@link planManifest} found. */
+export interface ManifestPlanResult {
+  fieldManager: string;
+  stack?: string;
+  objects: PlannedObject[];
+  /** What the apply's prune would delete: empty unless `deleteMode` deletes. */
+  deletes: AppliedRef[];
+  /** Owned, undeclared objects the prune keeps (#1830, #2074). */
+  retained: AppliedRef[];
+}
+
+/** A 404 from the API server, matched by shape. */
+function isNotFound(err: unknown): boolean {
+  const e = err as { name?: unknown; statusCode?: unknown };
+  return !!e && e.name === "K8sApiError" && e.statusCode === 404;
+}
+
+/** A 422 from the API server whose message says a field is immutable. Matched by shape, as {@link isChantSelfConflict} is. */
+function immutableRefusal(err: unknown): string | undefined {
+  const e = err as { name?: unknown; statusCode?: unknown; apiMessage?: unknown; message?: unknown };
+  if (!e || e.name !== "K8sApiError" || e.statusCode !== 422) return undefined;
+  const message = typeof e.apiMessage === "string" && e.apiMessage !== "" ? e.apiMessage : String(e.message ?? "");
+  return /immutable/i.test(message) ? message : undefined;
+}
+
+/**
+ * Say what {@link applyManifest} would do, without changing anything (#3998).
+ *
+ * Every document is stamped and dry-run applied exactly as the apply sends
+ * it: the same field manager, `force: false`, and the same retake of a
+ * conflict chant has only with itself. The live object is read first and
+ * compared with the dry-run result through `./apply-diff.ts`, so a field the
+ * server defaults counts as unchanged when the live object already has it.
+ *
+ * An object in a namespace an earlier document of the same plan creates
+ * cannot be dry-run (the server answers 404, as the namespace was never
+ * persisted), so it plans as a create of the document as sent.
+ *
+ * Deletes come from the apply's own prune scope (`findOrphans`): marker
+ * scoped, in the namespaces the apply set touches, generated-once Secrets
+ * and effect receipts kept. They are found only when `deleteMode` is not
+ * `never`, as the apply prunes only then.
+ */
+export async function planManifest(
+  args: KubectlApplyArgs,
+  signal?: AbortSignal,
+  connect: K8sConnector = defaultK8sConnector,
+): Promise<ManifestPlanResult> {
+  const documents = args.documents ?? readManifestDocuments(args.manifest);
+  const { fieldManager, stack } = await resolveApplyIdentity(args);
+  const { client } = await connect({
+    ...(args.environment !== undefined ? { environment: args.environment } : {}),
+    ...(args.context !== undefined ? { context: args.context } : {}),
+    ...(args.cwd !== undefined ? { cwd: args.cwd } : {}),
+  });
+
+  const objects: PlannedObject[] = [];
+  /** Namespaces this plan creates. A dry run cannot place an object in one, since nothing persisted it. */
+  const creating = new Set<string>();
+  for (const document of documents) {
+    const stamped = stampOwnership(document as K8sObject, stack);
+    const declaredRef = {
+      apiVersion: String(stamped.apiVersion ?? ""),
+      kind: String(stamped.kind ?? ""),
+      name: String(stamped.metadata?.name ?? ""),
+      ...(stamped.metadata?.namespace !== undefined ? { namespace: String(stamped.metadata.namespace) } : {}),
+    };
+    const live = await client.readIfPresent(declaredRef, signal ? { signal } : {});
+    let result: K8sObject;
+    try {
+      try {
+        result = await client.apply(stamped, { fieldManager, force: args.force ?? false, dryRun: true, signal });
+      } catch (err) {
+        if (!isChantSelfConflict(err)) throw err;
+        result = await client.apply(stamped, { fieldManager, force: true, dryRun: true, signal });
+      }
+    } catch (err) {
+      if (!live && declaredRef.namespace !== undefined && creating.has(declaredRef.namespace) && isNotFound(err)) {
+        objects.push({ ref: declaredRef, action: "create", object: stamped as Record<string, unknown>, changes: [] });
+        continue;
+      }
+      const refused = live ? immutableRefusal(err) : undefined;
+      if (refused === undefined) throw err;
+      objects.push({ ref: refOf(live!, document), action: "update", changes: [], refused });
+      continue;
+    }
+    const ref = refOf(result, document);
+    if (!live) {
+      if (ref.kind === "Namespace" && ref.apiVersion === "v1") creating.add(ref.name);
+      objects.push({ ref, action: "create", object: stamped as Record<string, unknown>, changes: [] });
+      continue;
+    }
+    const changes = diffFields(
+      normalizeServerObject(live as Record<string, unknown>),
+      normalizeServerObject(result as Record<string, unknown>),
+    );
+    objects.push({ ref, action: changes.length === 0 ? "no-op" : "update", changes });
+  }
+
+  const deleteMode = args.deleteMode ?? "never";
+  const { candidates, retained } =
+    deleteMode === "never"
+      ? { candidates: [], retained: [] }
+      : await findOrphans(
+          client,
+          objects.map((o) => o.ref),
+          { ...(stack !== undefined ? { stack } : {}), ...(signal ? { signal } : {}) },
+        );
+  return { fieldManager, ...(stack !== undefined ? { stack } : {}), objects, deletes: candidates, retained };
+}
+
+/** Where {@link readLiveObjects} reads, and which objects. */
+export interface ReadLiveObjectsArgs {
+  refs: AppliedRef[];
+  environment?: string;
+  context?: string;
+  cwd?: string;
+}
+
+/**
+ * Read each of `refs` as the cluster holds it now, `undefined` for one that
+ * does not exist (#3999). `kubectl-apply` reads the fields its step names as
+ * outputs from these.
+ */
+export async function readLiveObjects(
+  args: ReadLiveObjectsArgs,
+  signal?: AbortSignal,
+  connect: K8sConnector = defaultK8sConnector,
+): Promise<Array<Record<string, unknown> | undefined>> {
+  if (args.refs.length === 0) return [];
+  const { client } = await connect({
+    ...(args.environment !== undefined ? { environment: args.environment } : {}),
+    ...(args.context !== undefined ? { context: args.context } : {}),
+    ...(args.cwd !== undefined ? { cwd: args.cwd } : {}),
+  });
+  const out: Array<Record<string, unknown> | undefined> = [];
+  for (const ref of args.refs) out.push((await client.readIfPresent(ref, signal ? { signal } : {})) as Record<string, unknown> | undefined);
+  return out;
+}
+
+/** The ref an applied or dry-run object answers with, as {@link applyManifest} records it. */
+function refOf(result: K8sObject, document: Record<string, unknown>): AppliedRef {
+  return {
+    apiVersion: String(result.apiVersion ?? document.apiVersion ?? ""),
+    kind: String(result.kind ?? document.kind ?? ""),
+    name: String(result.metadata?.name ?? ""),
+    ...(result.metadata?.namespace !== undefined ? { namespace: String(result.metadata.namespace) } : {}),
+  };
+}
+
 /**
  * Apply every document in `args.manifest`.
  * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
@@ -405,6 +578,36 @@ async function pruneOrphans(
   applied: readonly AppliedRef[],
   options: { stack?: string; signal?: AbortSignal },
 ): Promise<{ pruned: AppliedRef[]; retained: AppliedRef[] }> {
+  const { candidates, retained } = await findOrphans(client, applied, options);
+  for (const ref of retained) {
+    console.log(
+      ref.kind === "Secret"
+        ? `${ref.apiVersion} ${ref.kind}/${ref.name} retained (generated-once — owned and no longer declared, ` +
+            `but never pruned; delete it explicitly if you mean to)`
+        : `${ref.apiVersion} ${ref.kind}/${ref.name} retained (effect receipt: owned and never declared ` +
+            `in an apply set, but never pruned; the effect() step is its sole writer)`,
+    );
+  }
+  const pruned: AppliedRef[] = [];
+  for (const ref of candidates) {
+    await client.delete(ref, { ...(options.signal ? { signal: options.signal } : {}) });
+    pruned.push(ref);
+    console.log(`${ref.apiVersion} ${ref.kind}/${ref.name} pruned (chant-owned, no longer declared)`);
+  }
+  return { pruned, retained };
+}
+
+/**
+ * The objects {@link pruneOrphans} would delete (`candidates`) and the owned,
+ * undeclared ones it keeps (`retained`), found without deleting anything. A
+ * plan (#3998) asks this for its delete entries, so the plan and the apply
+ * share one prune scope.
+ */
+async function findOrphans(
+  client: K8sClient,
+  applied: readonly AppliedRef[],
+  options: { stack?: string; signal?: AbortSignal },
+): Promise<{ candidates: AppliedRef[]; retained: AppliedRef[] }> {
   const stack = options.stack;
   const selector = [
     `${LABEL_OWNERSHIP_KEYS.managedBy}=${OWNERSHIP_MANAGED_BY_VALUE}`,
@@ -498,10 +701,6 @@ async function pruneOrphans(
     // an explicit act (`kubectl delete`, or a future gated op).
     if (target.kind === "Secret" && isGeneratedOnce(item.metadata?.labels)) {
       retained.push(ref);
-      console.log(
-        `${ref.apiVersion} ${ref.kind}/${ref.name} retained (generated-once — owned and no longer declared, ` +
-          `but never pruned; delete it explicitly if you mean to)`,
-      );
       continue;
     }
     // An effect receipt never enters the prunable set either (#2074, epic
@@ -512,22 +711,11 @@ async function pruneOrphans(
     // the estate re-running a migration on every apply.
     if (target.kind === "ConfigMap" && isEffectReceiptObject(item.metadata?.labels)) {
       retained.push(ref);
-      console.log(
-        `${ref.apiVersion} ${ref.kind}/${ref.name} retained (effect receipt: owned and never declared ` +
-          `in an apply set, but never pruned; the effect() step is its sole writer)`,
-      );
       continue;
     }
     candidates.push(ref);
   }
-
-  const pruned: AppliedRef[] = [];
-  for (const ref of candidates) {
-    await client.delete(ref, { ...(options.signal ? { signal: options.signal } : {}) });
-    pruned.push(ref);
-    console.log(`${ref.apiVersion} ${ref.kind}/${ref.name} pruned (chant-owned, no longer declared)`);
-  }
-  return { pruned, retained };
+  return { candidates, retained };
 }
 
 function refKey(ref: AppliedRef): string {

package/src/serializer.ts

@@ -6,6 +6,7 @@
  */
 
 import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
 import type { Declarable } from "@intentius/chant/declarable";
 import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
 import type { Serializer, SerializerResult, SerializeContext } from "@intentius/chant/serializer";
@@ -37,7 +38,7 @@ import { isEncryptedSecretFileEntity } from "./sops/entity";
 import { isK8sInclude } from "./include/entity";
 import { isRuleGroup, ruleGroupConfig } from "@intentius/chant-lexicon-prometheus";
 
-const require = createRequire(import.meta.url);
+const require = createRequire(moduleSourceUrl(import.meta.url));
 
 /**
  * K8s resource kinds whose properties live directly on the manifest