@intentius/chant-lexicon-k8s 0.124.31 → 0.124.33

package/dist/components/argo-app.js

@@ -0,0 +1,51 @@
+/** True when the ref is an Argo CD Application (any argoproj.io version). */
+function isArgoApplication(ref) {
+    return ref.kind === "Application" && /^argoproj\.io(\/|$)/.test(ref.apiVersion);
+}
+/** Factory with injectable applier + waiter, so tests assert the exact
+ * delegation without a cluster — the kubectl-apply seam. Defaults resolve by
+ * dynamic import on first run, keeping the API-client chain off the build
+ * path (#1074). */
+export function createArgoAppCapability(apply, wait) {
+    return {
+        kind: "argo-app",
+        // The apply half is a server-side apply with no native undo, and Argo
+        // offers no declarative "un-sync" — same posture as kubectl-apply.
+        rollbackPolicy: "needs-opt-out",
+        async run(ctx, input) {
+            const applier = apply ?? (await import("../op/activities/kubectl.js")).applyManifest;
+            const outcome = await applier({
+                manifest: input.manifest,
+                environment: ctx.env,
+                ...(input.stack !== undefined ? { stack: input.stack } : {}),
+                ...(input.context !== undefined ? { context: input.context } : {}),
+                ...(input.delete !== undefined ? { deleteMode: input.delete } : {}),
+            });
+            // AppProject / ApplicationSet in the same manifest apply fine; the wait
+            // gates only on Applications (an ApplicationSet's generated Applications
+            // are the controller's, not declared here).
+            const apps = outcome.applied.filter(isArgoApplication);
+            if (apps.length === 0) {
+                throw new Error(`argo-app: "${input.manifest}" applied no argoproj.io Application — nothing to sync on. ` +
+                    `A plain manifest belongs on kubectl-apply.`);
+            }
+            const waiter = wait ?? (await import("../op/activities/argo.js")).waitForArgoSync;
+            const synced = [];
+            for (const app of apps) {
+                const namespace = app.namespace ?? "argocd";
+                const status = await waiter({
+                    appName: app.name,
+                    namespace,
+                    ...(input.server !== undefined ? { server: input.server } : {}),
+                    ...(input.authToken !== undefined ? { authToken: input.authToken } : {}),
+                    ...(input.insecure !== undefined ? { insecure: input.insecure } : {}),
+                    ...(input.context !== undefined ? { context: input.context } : {}),
+                    ...(input.intervalMs !== undefined ? { intervalMs: input.intervalMs } : {}),
+                });
+                synced.push({ name: app.name, namespace, health: status.health, sync: status.sync });
+            }
+            return { ...outcome, synced };
+        },
+    };
+}
+export const argoAppCapability = createArgoAppCapability();

package/dist/components/builders.js

@@ -0,0 +1,22 @@
+/**
+ * Typed step-builders for the k8s lexicon's verbs — the same ergonomic sugar
+ * the aws lexicon's `components/builders.ts` offers (#658), reusing the
+ * exported `step` projection from `@intentius/chant/components`.
+ *
+ * `kubectl-apply` is a `needs-opt-out` capability (a server-side apply keeps
+ * no previous object state, so there is nothing native to roll back to), which
+ * means COMP003 requires every step of it to carry a `noRollback: "<reason>"`,
+ * a component-level `rollback` phase, or a sibling safety step. The builder
+ * admits `noRollback` directly so the common opt-out reads as one typed call
+ * instead of a raw object literal.
+ */
+import { step } from "@intentius/chant/components";
+export const kubectlApply = step("kubectl-apply");
+// Same needs-opt-out posture, same sugar (#1548): a kustomize render in front
+// of the identical server-side apply.
+export const kustomizeApply = step("kustomize-apply");
+// GitOps verbs (#1549 piece 2): the identical server-side apply of the
+// controller's CR, then a convergence wait — Healthy+Synced for Argo, the
+// Flux readiness registry (Ready, terminal on wedge reasons) for Flux.
+export const argoApp = step("argo-app");
+export const fluxReconcile = step("flux-reconcile");

package/dist/components/capability-plugin.js

@@ -0,0 +1,31 @@
+import { ownPackageVersion } from "@intentius/chant/components/capability-plugin";
+import { kubectlApplyCapability } from "./kubectl-apply.js";
+import { kustomizeApplyCapability } from "./kustomize-apply.js";
+import { argoAppCapability } from "./argo-app.js";
+import { fluxReconcileCapability } from "./flux-reconcile.js";
+export const K8S_VERB_FAMILIES = {
+    apply: ["kubectl-apply", "kustomize-apply"],
+    // GitOps verbs (#1549 piece 2): apply the controller's CR through the same
+    // stack-labelled pipeline, then wait for the controller to converge.
+    gitops: ["argo-app", "flux-reconcile"],
+};
+export const k8sCapabilityPlugin = {
+    name: "k8s",
+    // The lexicon package's own version (#1505) — lockstep releases bump it, so
+    // a literal here was stale one release after it was written. A getter, so
+    // the package.json read happens on first access rather than at import time.
+    get version() {
+        return ownPackageVersion(import.meta.url);
+    },
+    capabilities() {
+        return [
+            kubectlApplyCapability,
+            kustomizeApplyCapability,
+            argoAppCapability,
+            fluxReconcileCapability,
+        ];
+    },
+    families() {
+        return K8S_VERB_FAMILIES;
+    },
+};

package/dist/components/flux-reconcile.js

@@ -0,0 +1,61 @@
+/** The API group of a ref, "" for the core group. */
+function groupOf(ref) {
+    const slash = ref.apiVersion.indexOf("/");
+    return slash === -1 ? "" : ref.apiVersion.slice(0, slash);
+}
+/**
+ * True for any Flux CR: the toolkit groups (`source.` / `kustomize.` /
+ * `helm.` / `image.` / `notification.toolkit.fluxcd.io`) plus the flux-operator
+ * group (`fluxcd.controlplane.io`, `FluxInstance`). Kinds without a registry
+ * entry still wait correctly — the toolkit is kstatus-conformant, so the
+ * generic `Ready=True` default covers them; the #1554 entries add fail-fast.
+ */
+function isFluxRef(ref) {
+    const group = groupOf(ref);
+    return /(^|\.)toolkit\.fluxcd\.io$/.test(group) || group === "fluxcd.controlplane.io";
+}
+/** Factory with injectable applier + waiter — the argo-app seam. Defaults
+ * resolve by dynamic import on first run (#1074). */
+export function createFluxReconcileCapability(apply, wait) {
+    return {
+        kind: "flux-reconcile",
+        // Server-side apply keeps no previous object state, and the controller
+        // reconciles forward only — same posture as kubectl-apply.
+        rollbackPolicy: "needs-opt-out",
+        async run(ctx, input) {
+            const applier = apply ?? (await import("../op/activities/kubectl.js")).applyManifest;
+            const outcome = await applier({
+                manifest: input.manifest,
+                environment: ctx.env,
+                ...(input.stack !== undefined ? { stack: input.stack } : {}),
+                ...(input.context !== undefined ? { context: input.context } : {}),
+                ...(input.delete !== undefined ? { deleteMode: input.delete } : {}),
+            });
+            // Namespaces/ConfigMaps alongside the CRs apply fine; the wait gates
+            // only on the Flux objects. Sources first — see the module doc.
+            const flux = outcome.applied.filter(isFluxRef);
+            if (flux.length === 0) {
+                throw new Error(`flux-reconcile: "${input.manifest}" applied no Flux CR (toolkit.fluxcd.io / fluxcd.controlplane.io) — ` +
+                    `nothing to reconcile on. A plain manifest belongs on kubectl-apply.`);
+            }
+            const sources = flux.filter((r) => groupOf(r) === "source.toolkit.fluxcd.io");
+            const rest = flux.filter((r) => groupOf(r) !== "source.toolkit.fluxcd.io");
+            const waiter = wait ?? (await import("../op/activities/wait-for-ready.js")).waitForReady;
+            const ready = [];
+            for (const ref of [...sources, ...rest]) {
+                await waiter({
+                    kind: ref.kind,
+                    name: ref.name,
+                    group: groupOf(ref),
+                    environment: ctx.env,
+                    ...(ref.namespace !== undefined ? { namespace: ref.namespace } : {}),
+                    ...(input.context !== undefined ? { context: input.context } : {}),
+                    ...(input.intervalMs !== undefined ? { intervalMs: input.intervalMs } : {}),
+                });
+                ready.push(ref);
+            }
+            return { ...outcome, ready };
+        },
+    };
+}
+export const fluxReconcileCapability = createFluxReconcileCapability();

package/dist/components/index.d.ts

@@ -12,7 +12,7 @@
  */
 export { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./capability-plugin.js";
 export * from "./builders.js";
-export { kubectlApplyCapability, createKubectlApplyCapability, type KubectlApplyInput, type KubectlApplyOutcome, } from "./kubectl-apply.js";
+export { kubectlApplyCapability, createKubectlApplyCapability, KubectlApplyPlanMovedError, type KubectlApplyInput, type KubectlApplyOutcome, type KubectlApplyDryRun, type KubectlApplyPlanArtifact, } from "./kubectl-apply.js";
 export { kustomizeApplyCapability, createKustomizeApplyCapability, renderCommand, type KustomizeApplyInput, type KustomizeApplyOutcome, } from "./kustomize-apply.js";
 export { argoAppCapability, createArgoAppCapability, type ArgoAppInput, type ArgoAppOutcome, type ArgoAppSynced, } from "./argo-app.js";
 export { fluxReconcileCapability, createFluxReconcileCapability, type FluxReconcileInput, type FluxReconcileOutcome, } from "./flux-reconcile.js";

package/dist/components/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC"}

package/dist/components/index.js

@@ -0,0 +1,18 @@
+/**
+ * The k8s lexicon's component/release surface: the `kubectl-apply` capability,
+ * its typed step-builder, and the `k8sCapabilityPlugin` core loads when a
+ * project declares `lexicons: ["k8s"]` (#1495). Component authors import the
+ * builders from here (`@intentius/chant-lexicon-k8s/components`), the way AWS
+ * verbs come from `@intentius/chant-lexicon-aws/components`.
+ *
+ * Everything exported here is on the build path (#1074): nothing may
+ * statically import the Kubernetes API client chain (`../op/activities/*`,
+ * `../kube/*`) — `kubectl-apply.ts` reaches its applier by dynamic import
+ * inside `run()`, and this module must stay that clean.
+ */
+export { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./capability-plugin.js";
+export * from "./builders.js";
+export { kubectlApplyCapability, createKubectlApplyCapability, KubectlApplyPlanMovedError, } from "./kubectl-apply.js";
+export { kustomizeApplyCapability, createKustomizeApplyCapability, renderCommand, } from "./kustomize-apply.js";
+export { argoAppCapability, createArgoAppCapability, } from "./argo-app.js";
+export { fluxReconcileCapability, createFluxReconcileCapability, } from "./flux-reconcile.js";

package/dist/components/kubectl-apply.d.ts

@@ -14,6 +14,18 @@
  * (`chant:<stack>`, the prune selector) and the deploy unit the status walk
  * reads (core `components/deploy-units.ts`) — one name, both jobs, the same
  * pairing `cfn-deploy` has with its stack.
+ *
+ * ## Outputs (#3999)
+ *
+ * A manifest has no outputs of its own, so a step names the ones a
+ * dependent reads: `outputs: { host: { object: "Service/prod/web", field:
+ * "status.loadBalancer.ingress.0.hostname" } }`, each a field of an object
+ * the manifest declares. `run` returns them as `outputs` once it applied,
+ * which is what a dependent's `stackOutput()` reads, and `outputs` reads
+ * them from the cluster without applying anything. A plan knows a field the
+ * manifest sets, since the apply writes that value, and any field of an
+ * object the plan leaves as it is; every other one is known only after
+ * apply.
  */
 import type { Capability } from "@intentius/chant/components/capability";
 /**
@@ -45,6 +57,8 @@ export interface KubectlApplyOutcome {
      * enter the prunable set. Present whenever the prune ran.
      */
     retained?: AppliedRef[];
+    /** The fields the step names as outputs (#3999), read once the apply landed. Absent when it names none. */
+    outputs?: Record<string, unknown>;
 }
 interface ApplierArgs {
     manifest: string;
@@ -57,6 +71,59 @@ interface ApplierArgs {
 }
 type Applier = (args: ApplierArgs) => Promise<KubectlApplyOutcome>;
 type ManifestReader = (path: string) => Record<string, unknown>[];
+/** One field change, the mirror of `../op/activities/apply-diff.ts`'s `FieldChange`. */
+interface FieldChangeShape {
+    path: string;
+    before?: unknown;
+    after?: unknown;
+}
+/** The mirror of the activity's `PlannedObject`. */
+interface PlannedObjectShape {
+    ref: AppliedRef;
+    action: "create" | "update" | "no-op";
+    object?: Record<string, unknown>;
+    changes: FieldChangeShape[];
+    refused?: string;
+}
+/** What a dry run found: the mirror of the activity's `ManifestPlanResult` (#3998). */
+export interface KubectlApplyDryRun {
+    fieldManager: string;
+    stack?: string;
+    objects: PlannedObjectShape[];
+    deletes: AppliedRef[];
+    retained: AppliedRef[];
+}
+type Planner = (args: ApplierArgs) => Promise<KubectlApplyDryRun>;
+/** The mirror of the activity's `ReadLiveObjectsArgs`. */
+interface LiveReaderArgs {
+    refs: AppliedRef[];
+    environment?: string;
+    context?: string;
+}
+/** Reads objects as the cluster holds them, `undefined` for one that does not exist (#3999). */
+type LiveReader = (args: LiveReaderArgs) => Promise<Array<Record<string, unknown> | undefined>>;
+/** What `plan` hands `run` through `DeployContext.plans` (#3998). */
+export interface KubectlApplyPlanArtifact {
+    kind: "kubectl-apply-plan";
+    planDigest: string;
+    /** The documents the plan dry-ran, release attributes set. `run` applies these. */
+    documents: Record<string, unknown>[];
+}
+/**
+ * `run` was handed an approved plan and a fresh dry run of the same
+ * documents gives a different digest: the cluster moved since the plan, or
+ * the plan was made against another one. Nothing is applied. `planMoved` is
+ * core's mark for a moved plan (`isPlanMovedError`), so the command that
+ * applied it exits 3. `exitCode` 3 says the same to a core that reads it.
+ */
+export declare class KubectlApplyPlanMovedError extends Error {
+    readonly member: string;
+    readonly approved: string;
+    readonly fresh: string;
+    readonly planMoved = true;
+    readonly exitCode = 3;
+    constructor(member: string, approved: string, fresh: string);
+}
 export interface KubectlApplyInput {
     /** Path to a manifest file, or a directory of them. */
     manifest: string;
@@ -76,12 +143,27 @@ export interface KubectlApplyInput {
      * candidate.
      */
     delete?: "never" | "owned-only";
+    /**
+     * The outputs the step exposes (#3999), by name: each a field of an object
+     * the manifest declares. A dependent reads them with `stackOutput()`.
+     */
+    outputs?: Record<string, KubectlApplyOutputField>;
+}
+/** One output of a `kubectl-apply` step (#3999). */
+export interface KubectlApplyOutputField {
+    /**
+     * The object, named as the manifest declares it: `Kind/namespace/name`, or
+     * `Kind/name` for a document with no namespace.
+     */
+    object: string;
+    /** The field's dot path in the object; a list index is a number, `status.loadBalancer.ingress.0.hostname`. */
+    field: string;
 }
 /** Factory with an injectable applier, so tests assert the delegation without
  * a cluster — the same seam `createGenerateSbomCapability` uses. The default
  * applier is resolved by dynamic import on first run, keeping the API-client
  * chain off the build path (#1074). */
-export declare function createKubectlApplyCapability(apply?: Applier, read?: ManifestReader): Capability<KubectlApplyInput, KubectlApplyOutcome>;
+export declare function createKubectlApplyCapability(apply?: Applier, read?: ManifestReader, dryRun?: Planner, readLive?: LiveReader): Capability<KubectlApplyInput, KubectlApplyOutcome>;
 export declare const kubectlApplyCapability: Capability<KubectlApplyInput, KubectlApplyOutcome>;
 export {};
 //# sourceMappingURL=kubectl-apply.d.ts.map

package/dist/components/kubectl-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl-apply.d.ts","sourceRoot":"","sources":["../../src/components/kubectl-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,wCAAwC,CAAC;AAIxF;;;;;;;;;;GAUG;AACH,UAAU,UAAU;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;CACzB;AAED,UAAU,WAAW;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,yGAAyG;IACzG,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;CAC/C;AAED,KAAK,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACnE,KAAK,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AAElE,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC;CACjC;AAED;;;uCAGuC;AACvC,wBAAgB,4BAA4B,CAC1C,KAAK,CAAC,EAAE,OAAO,EACf,IAAI,CAAC,EAAE,cAAc,GACpB,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CA4BpD;AAED,eAAO,MAAM,sBAAsB,oDAAiC,CAAC"}
+{"version":3,"file":"kubectl-apply.d.ts","sourceRoot":"","sources":["../../src/components/kubectl-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAiD,MAAM,wCAAwC,CAAC;AAOxH;;;;;;;;;;GAUG;AACH,UAAU,UAAU;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB,2GAA2G;IAC3G,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,UAAU,WAAW;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,yGAAyG;IACzG,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;CAC/C;AAED,KAAK,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACnE,KAAK,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AAElE,wFAAwF;AACxF,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,oDAAoD;AACpD,UAAU,kBAAkB;IAC1B,GAAG,EAAE,UAAU,CAAC;IAChB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED,KAAK,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElE,0DAA0D;AAC1D,UAAU,cAAc;IACtB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gGAAgG;AAChG,KAAK,UAAU,GAAG,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;AAEhG,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACtC;AAOD;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;aAIjC,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,MAAM;aAChB,KAAK,EAAE,MAAM;IAL/B,QAAQ,CAAC,SAAS,QAAQ;IAC1B,QAAQ,CAAC,QAAQ,KAAK;IACtB,YACkB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAO9B;CACF;AA2GD,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;CACnD;AAED,oDAAoD;AACpD,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,8GAA8G;IAC9G,KAAK,EAAE,MAAM,CAAC;CACf;AA4CD;;;uCAGuC;AACvC,wBAAgB,4BAA4B,CAC1C,KAAK,CAAC,EAAE,OAAO,EACf,IAAI,CAAC,EAAE,cAAc,EACrB,MAAM,CAAC,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,UAAU,GACpB,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAsGpD;AAED,eAAO,MAAM,sBAAsB,oDAAiC,CAAC"}

package/dist/components/kubectl-apply.js

@@ -0,0 +1,274 @@
+import { computePlanDigest } from "@intentius/chant/lifecycle/plan-digest";
+import { releaseAttributesSuffix } from "@intentius/chant/telemetry-attribution";
+import { annotateRelease } from "../telemetry-release.js";
+import { diffFields, normalizeServerObject } from "../op/activities/apply-diff.js";
+function isPlanArtifact(value) {
+    const v = value;
+    return !!v && v.kind === "kubectl-apply-plan" && typeof v.planDigest === "string" && Array.isArray(v.documents);
+}
+/**
+ * `run` was handed an approved plan and a fresh dry run of the same
+ * documents gives a different digest: the cluster moved since the plan, or
+ * the plan was made against another one. Nothing is applied. `planMoved` is
+ * core's mark for a moved plan (`isPlanMovedError`), so the command that
+ * applied it exits 3. `exitCode` 3 says the same to a core that reads it.
+ */
+export class KubectlApplyPlanMovedError extends Error {
+    constructor(member, approved, fresh) {
+        super(`kubectl-apply "${member}": the plan moved since it was approved (approved ${approved}, now ${fresh}); ` +
+            `nothing was applied. Plan and approve again.`);
+        this.member = member;
+        this.approved = approved;
+        this.fresh = fresh;
+        this.planMoved = true;
+        this.exitCode = 3;
+        this.name = "KubectlApplyPlanMovedError";
+    }
+}
+/** Kinds whose pod template change rolls their pods. */
+const ROLLING_KINDS = new Set(["Deployment", "StatefulSet", "DaemonSet", "ReplicaSet"]);
+/** `Deployment/prod/web`, or `ClusterRole/admin` for a cluster-scoped object. */
+function addressOf(ref) {
+    return ref.namespace ? `${ref.kind}/${ref.namespace}/${ref.name}` : `${ref.kind}/${ref.name}`;
+}
+const typeOf = (ref) => `${ref.apiVersion}/${ref.kind}`;
+/** A Secret's `data` and `stringData` values are never carried into the change set. */
+function isSensitive(ref, path) {
+    return ref.kind === "Secret" && /^(data|stringData)\b/.test(path);
+}
+function attribute(ref, change) {
+    if (isSensitive(ref, change.path))
+        return { path: change.path, sensitive: true };
+    return {
+        path: change.path,
+        ...("before" in change ? { before: change.before } : {}),
+        ...("after" in change ? { after: change.after } : {}),
+    };
+}
+/**
+ * The member's change-set part: one entry per declared object (`no-op`
+ * included, as the terraform adapter reports them) and one `delete` per
+ * object the prune would remove. A change the API server refuses as
+ * immutable is an `update` with disruption `unknown`, plus a hole that says
+ * the apply would fail.
+ */
+function changeSetPartOf(member, planDigest, dryRun) {
+    const base = { member, lexicon: "k8s", planner: "chant" };
+    const entries = [];
+    const holes = [];
+    for (const o of dryRun.objects) {
+        const head = { ...base, address: addressOf(o.ref), type: typeOf(o.ref), name: o.ref.name };
+        if (o.refused !== undefined) {
+            entries.push({ ...head, action: "update", disruption: "unknown", attributes: [] });
+            holes.push({
+                address: head.address,
+                type: head.type,
+                reason: `the API server refuses the change: ${o.refused}. The apply does not delete and recreate ` +
+                    `the object, so it fails the same way until the object is deleted`,
+            });
+            continue;
+        }
+        if (o.action === "create") {
+            const declared = normalizeServerObject(o.object ?? {});
+            delete declared.apiVersion;
+            delete declared.kind;
+            entries.push({ ...head, action: "create", attributes: diffFields({}, declared).map((c) => attribute(o.ref, c)) });
+            continue;
+        }
+        if (o.action === "no-op") {
+            entries.push({ ...head, action: "no-op", attributes: [] });
+            continue;
+        }
+        const rolling = ROLLING_KINDS.has(o.ref.kind) && o.changes.some((c) => c.path.startsWith("spec.template"));
+        entries.push({
+            ...head,
+            action: "update",
+            disruption: rolling ? "rolling" : "in-place",
+            attributes: o.changes.map((c) => attribute(o.ref, c)),
+        });
+    }
+    for (const ref of dryRun.deletes) {
+        entries.push({ ...base, address: addressOf(ref), type: typeOf(ref), name: ref.name, action: "delete", disruption: "destroy", attributes: [] });
+    }
+    return { member: { ...base, status: "planned", planDigest, holes }, entries };
+}
+/**
+ * What a gate on this member binds: where it applies, as whom, the documents
+ * sent, and what the dry run says each does. For an object it changes, the
+ * changed paths and their new values, so a field another manager moves
+ * between plan and apply refuses the apply only when it is one chant's
+ * apply changes. Server bookkeeping never reaches it (`apply-diff.ts`).
+ */
+function dryRunDigest(ctx, member, input, documents, dryRun) {
+    return computePlanDigest("kubectl-apply-plan", {
+        env: ctx.env,
+        member,
+        context: input.context ?? null,
+        delete: input.delete ?? "never",
+        fieldManager: dryRun.fieldManager,
+        documents,
+        objects: dryRun.objects.map((o) => ({
+            address: addressOf(o.ref),
+            type: typeOf(o.ref),
+            action: o.action,
+            changes: o.changes.map((c) => ("after" in c ? { path: c.path, after: c.after } : { path: c.path, removed: true })),
+            ...(o.refused !== undefined ? { refused: o.refused } : {}),
+        })),
+        deletes: dryRun.deletes.map((r) => `${typeOf(r)}/${r.namespace ?? ""}/${r.name}`).sort(),
+    });
+}
+/** The value at a dot path, or `undefined`. */
+function fieldAt(object, path) {
+    return path.split(".").reduce((acc, key) => (acc !== null && typeof acc === "object" ? acc[key] : undefined), object);
+}
+/** The declared ref of each output's object, keyed by output name. Throws for an object the manifest does not declare. */
+function outputRefs(member, input, documents) {
+    const declared = new Map();
+    for (const doc of documents) {
+        const metadata = (doc.metadata ?? {});
+        const ref = {
+            apiVersion: String(doc.apiVersion ?? ""),
+            kind: String(doc.kind ?? ""),
+            name: String(metadata.name ?? ""),
+            ...(metadata.namespace !== undefined ? { namespace: String(metadata.namespace) } : {}),
+        };
+        declared.set(addressOf(ref), ref);
+    }
+    const out = new Map();
+    for (const [name, spec] of Object.entries(input.outputs ?? {})) {
+        const ref = declared.get(spec.object);
+        if (!ref) {
+            throw new Error(`kubectl-apply "${member}": output "${name}" names ${spec.object}, which ${input.manifest} does not declare (it declares ${[...declared.keys()].join(", ") || "nothing"})`);
+        }
+        out.set(name, ref);
+    }
+    return out;
+}
+/** Each output's field as `objects` hold it, one object per distinct ref; an output with no value is left out. */
+async function readOutputs(read, refs, input, where) {
+    const distinct = [...new Map([...refs.values()].map((r) => [addressOf(r), r])).values()];
+    const live = await read({ refs: distinct, ...where });
+    const byAddress = new Map(distinct.map((r, i) => [addressOf(r), live[i]]));
+    const out = {};
+    for (const [name, ref] of refs) {
+        const value = fieldAt(byAddress.get(addressOf(ref)), input.outputs[name].field);
+        if (value !== undefined)
+            out[name] = value;
+    }
+    return out;
+}
+/** Factory with an injectable applier, so tests assert the delegation without
+ * a cluster — the same seam `createGenerateSbomCapability` uses. The default
+ * applier is resolved by dynamic import on first run, keeping the API-client
+ * chain off the build path (#1074). */
+export function createKubectlApplyCapability(apply, read, dryRun, readLive) {
+    const activities = () => import("../op/activities/kubectl.js");
+    const target = (ctx, input) => ({
+        environment: ctx.env,
+        ...(input.stack !== undefined ? { stack: input.stack } : {}),
+        ...(input.context !== undefined ? { context: input.context } : {}),
+        ...(input.delete !== undefined ? { deleteMode: input.delete } : {}),
+    });
+    /** Dry-run `documents` and digest the result. */
+    const dryRunOf = async (ctx, input, member, documents) => {
+        const planner = dryRun ?? (await activities()).planManifest;
+        const result = await planner({ manifest: input.manifest, documents, ...target(ctx, input) });
+        return { result, planDigest: dryRunDigest(ctx, member, input, documents, result) };
+    };
+    const liveReader = async () => readLive ?? (await activities()).readLiveObjects;
+    const where = (ctx, input) => ({
+        environment: ctx.env,
+        ...(input.context !== undefined ? { context: input.context } : {}),
+    });
+    /** The outputs the step names, read from the cluster now. */
+    const liveOutputs = async (ctx, input, documents) => readOutputs(await liveReader(), outputRefs(input.stack ?? ctx.component, input, documents), input, where(ctx, input));
+    /**
+     * What the plan knows of each output: a field the manifest sets, and any
+     * field of an object the dry run leaves unchanged, read from the cluster.
+     */
+    const plannedOutputs = async (ctx, input, member, documents, dry) => {
+        const refs = outputRefs(member, input, documents);
+        const declared = new Map(documents.map((d) => [addressOf({ apiVersion: "", kind: String(d.kind ?? ""), name: String(d.metadata?.name ?? ""), ...(d.metadata?.namespace !== undefined ? { namespace: String(d.metadata.namespace) } : {}) }), d]));
+        const unchanged = new Set(dry.objects.filter((o) => o.action === "no-op").map((o) => addressOf(o.ref)));
+        const fromLive = new Map([...refs].filter(([, ref]) => unchanged.has(addressOf(ref))));
+        const live = fromLive.size > 0 ? await readOutputs(await liveReader(), fromLive, input, where(ctx, input)) : {};
+        const known = {};
+        const unknown = [];
+        for (const [name, ref] of refs) {
+            const set = fieldAt(declared.get(addressOf(ref)), input.outputs[name].field);
+            if (set !== undefined)
+                known[name] = set;
+            else if (name in live)
+                known[name] = live[name];
+            else
+                unknown.push(name);
+        }
+        return { known, unknown: unknown.sort() };
+    };
+    return {
+        kind: "kubectl-apply",
+        // A server-side apply has no native undo (the previous object state is not
+        // kept by the API server), so COMP003 requires the component to acknowledge
+        // the compensation gap — the same posture as s3-sync/run-migration.
+        rollbackPolicy: "needs-opt-out",
+        /**
+         * Dry-run the manifest against the cluster (#3998): the documents `run`
+         * would apply, release attributes set, server-side applied with
+         * `dryRun=All` as the same field manager, each compared with its live
+         * object. The member is the step's `stack`, or the component.
+         */
+        async plan(ctx, input) {
+            const member = input.stack ?? ctx.component;
+            const documents = (read ?? (await activities()).readManifestDocuments)(input.manifest);
+            const suffix = releaseAttributesSuffix(ctx.release);
+            if (suffix !== "")
+                annotateRelease(documents, suffix);
+            const { result, planDigest } = await dryRunOf(ctx, input, member, documents);
+            const artifact = { kind: "kubectl-apply-plan", planDigest, documents };
+            const outputs = input.outputs ? await plannedOutputs(ctx, input, member, documents, result) : undefined;
+            return { member, planDigest, artifact, changeSet: changeSetPartOf(member, planDigest, result), ...(outputs ? { outputs } : {}) };
+        },
+        /**
+         * The fields the step names as outputs, as the cluster holds them now
+         * (#3999). A step that names none has none; an object not made yet
+         * leaves its outputs out.
+         */
+        async outputs(ctx, input) {
+            if (!input.outputs || Object.keys(input.outputs).length === 0)
+                return {};
+            const documents = (read ?? (await activities()).readManifestDocuments)(input.manifest);
+            return liveOutputs(ctx, input, documents);
+        },
+        async run(ctx, input) {
+            const member = input.stack ?? ctx.component;
+            const approved = ctx.plans?.[member];
+            if (isPlanArtifact(approved)) {
+                // Apply the documents the approver saw, and only while a fresh dry
+                // run of them still says what the approved one said.
+                const { planDigest } = await dryRunOf(ctx, input, member, approved.documents);
+                if (planDigest !== approved.planDigest)
+                    throw new KubectlApplyPlanMovedError(member, approved.planDigest, planDigest);
+                const applier = apply ?? (await activities()).applyManifest;
+                const outcome = await applier({ manifest: input.manifest, documents: approved.documents, ...target(ctx, input) });
+                return input.outputs ? { ...outcome, outputs: await liveOutputs(ctx, input, approved.documents) } : outcome;
+            }
+            const loaded = apply && read ? undefined : await activities();
+            const applier = apply ?? loaded.applyManifest;
+            // A release run (#3061, ws-081) sets the release attributes on the pod template of each
+            // workload the build stamped, in what it applies; the committed manifest is not touched.
+            const suffix = releaseAttributesSuffix(ctx.release);
+            let documents;
+            if (suffix !== "") {
+                documents = (read ?? loaded.readManifestDocuments)(input.manifest);
+                if (annotateRelease(documents, suffix) === 0)
+                    documents = undefined;
+            }
+            const outcome = await applier({ manifest: input.manifest, ...(documents ? { documents } : {}), ...target(ctx, input) });
+            if (!input.outputs)
+                return outcome;
+            const declared = documents ?? (read ?? (await activities()).readManifestDocuments)(input.manifest);
+            return { ...outcome, outputs: await liveOutputs(ctx, input, declared) };
+        },
+    };
+}
+export const kubectlApplyCapability = createKubectlApplyCapability();

package/dist/components/kustomize-apply.js

@@ -0,0 +1,25 @@
+import { defaultKustomizeRunner, renderCommand, renderKustomizeDocuments, } from "../kustomize/render.js";
+export { renderCommand };
+/** Factory with injectable renderer + applier, so tests assert the render
+ * command and the exact applier delegation without kustomize or a cluster. */
+export function createKustomizeApplyCapability(run = defaultKustomizeRunner, apply) {
+    return {
+        kind: "kustomize-apply",
+        // Server-side apply keeps no previous object state, and kustomize adds no
+        // undo of its own — same posture as kubectl-apply.
+        rollbackPolicy: "needs-opt-out",
+        async run(ctx, input) {
+            const documents = await renderKustomizeDocuments(input.dir, run);
+            const applier = apply ?? (await import("../op/activities/kubectl.js")).applyManifest;
+            return applier({
+                manifest: `kustomize:${input.dir}`,
+                documents,
+                environment: ctx.env,
+                ...(input.stack !== undefined ? { stack: input.stack } : {}),
+                ...(input.context !== undefined ? { context: input.context } : {}),
+                ...(input.delete !== undefined ? { deleteMode: input.delete } : {}),
+            });
+        },
+    };
+}
+export const kustomizeApplyCapability = createKustomizeApplyCapability();