@intentius/chant-lexicon-k8s 0.41.0 → 0.41.1

package/dist/components/builders.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Typed step-builders for the k8s lexicon's verbs — the same ergonomic sugar
+ * the aws lexicon's `components/builders.ts` offers (#658), reusing the
+ * exported `step` projection from `@intentius/chant/components`.
+ *
+ * `kubectl-apply` is a `needs-opt-out` capability (a server-side apply keeps
+ * no previous object state, so there is nothing native to roll back to), which
+ * means COMP003 requires every step of it to carry a `noRollback: "<reason>"`,
+ * a component-level `rollback` phase, or a sibling safety step. The builder
+ * admits `noRollback` directly so the common opt-out reads as one typed call
+ * instead of a raw object literal.
+ */
+import type { KubectlApplyInput } from "./kubectl-apply.js";
+export declare const kubectlApply: (input: KubectlApplyInput & {
+    noRollback?: string;
+}) => import("@intentius/chant/components").Step;
+//# sourceMappingURL=builders.d.ts.map

package/dist/components/builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/components/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,eAAO,MAAM,YAAY;iBAA2C,MAAM;gDAAoB,CAAC"}

package/dist/components/capability-plugin.d.ts

@@ -0,0 +1,6 @@
+import type { CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
+export declare const K8S_VERB_FAMILIES: {
+    readonly apply: readonly ["kubectl-apply"];
+};
+export declare const k8sCapabilityPlugin: CapabilityPlugin;
+//# sourceMappingURL=capability-plugin.d.ts.map

package/dist/components/capability-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAGtF,eAAO,MAAM,iBAAiB;;CAEpB,CAAC;AAEX,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC"}

package/dist/components/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The k8s lexicon's component/release surface: the `kubectl-apply` capability,
+ * its typed step-builder, and the `k8sCapabilityPlugin` core loads when a
+ * project declares `lexicons: ["k8s"]` (#1495). Component authors import the
+ * builders from here (`@intentius/chant-lexicon-k8s/components`), the way AWS
+ * verbs come from `@intentius/chant-lexicon-aws/components`.
+ *
+ * Everything exported here is on the build path (#1074): nothing may
+ * statically import the Kubernetes API client chain (`../op/activities/*`,
+ * `../kube/*`) — `kubectl-apply.ts` reaches its applier by dynamic import
+ * inside `run()`, and this module must stay that clean.
+ */
+export { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./capability-plugin.js";
+export * from "./builders.js";
+export { kubectlApplyCapability, createKubectlApplyCapability, type KubectlApplyInput, type KubectlApplyOutcome, } from "./kubectl-apply.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/components/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC"}

package/dist/components/kubectl-apply.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `kubectl-apply` — the Kubernetes apply leaf for the component model
+ * (#1495 piece 2).
+ *
+ * The apply itself already exists: chant's server-side apply as the field
+ * manager `chant:<stack>` with the marker-scoped owned-only prune (#1075),
+ * reachable from Ops and from `ApplyOp({ target: "kubectl" })`. What was
+ * missing is a *capability*, so a component whose deploy is a Kubernetes
+ * manifest had nothing to compose but a `shell` step — and, downstream, no
+ * deploy unit for `chant components status --live` to observe (the walk asks
+ * the step's `stack`, and a shell step has none to name).
+ *
+ * `stack` doubles as both the ownership identity the apply stamps
+ * (`chant:<stack>`, the prune selector) and the deploy unit the status walk
+ * reads (core `components/deploy-units.ts`) — one name, both jobs, the same
+ * pairing `cfn-deploy` has with its stack.
+ */
+import type { Capability } from "@intentius/chant/components/capability";
+/**
+ * Structural mirrors of the activity module's argument/result shapes.
+ *
+ * Deliberately NOT imported from ../op/activities/kubectl — not even as
+ * `import type`: the #1074 boundary test walks type-only imports too, and a
+ * static reference here would put the API-client chain on the build path this
+ * module is loaded from (the lexicon entry point). The applier is reached by
+ * dynamic import inside run(), the same mechanism plugin.ts and the kube verb
+ * modules use; TypeScript checks these shapes against the real ones at the
+ * call site, so drift is a compile error there, not a silent mismatch.
+ */
+interface AppliedRef {
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+}
+/** What the apply did — the activity's own result shape. */
+export interface KubectlApplyOutcome {
+    /** The field manager every object was applied as. */
+    fieldManager: string;
+    applied: AppliedRef[];
+    /** Objects deleted because they carried chant's marker and are no longer declared. */
+    pruned: AppliedRef[];
+}
+interface ApplierArgs {
+    manifest: string;
+    environment?: string;
+    stack?: string;
+    context?: string;
+    deleteMode?: "never" | "owned-only" | "gated";
+}
+type Applier = (args: ApplierArgs) => Promise<KubectlApplyOutcome>;
+export interface KubectlApplyInput {
+    /** Path to a manifest file, or a directory of them. */
+    manifest: string;
+    /**
+     * The deploy unit / ownership stack. Optional: omitted derives the field
+     * manager from the project's `ownership.stack` as the Op activity does —
+     * but then the unit is invisible to `components status --live`, which only
+     * reads a literal on the step. Name it.
+     */
+    stack?: string;
+    /** kubectl context. Omitted resolves `k8s.profiles.<ctx.env>.context`. */
+    context?: string;
+    /**
+     * What happens to chant-owned objects no longer in the manifest — the same
+     * vocabulary the Op activity and `ApplyOp` use. Default `never`; the prune
+     * is always marker-scoped, so an object chant did not stamp is never a
+     * candidate.
+     */
+    delete?: "never" | "owned-only";
+}
+/** Factory with an injectable applier, so tests assert the delegation without
+ * a cluster — the same seam `createGenerateSbomCapability` uses. The default
+ * applier is resolved by dynamic import on first run, keeping the API-client
+ * chain off the build path (#1074). */
+export declare function createKubectlApplyCapability(apply?: Applier): Capability<KubectlApplyInput, KubectlApplyOutcome>;
+export declare const kubectlApplyCapability: Capability<KubectlApplyInput, KubectlApplyOutcome>;
+export {};
+//# sourceMappingURL=kubectl-apply.d.ts.map

package/dist/components/kubectl-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubectl-apply.d.ts","sourceRoot":"","sources":["../../src/components/kubectl-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,wCAAwC,CAAC;AAExF;;;;;;;;;;GAUG;AACH,UAAU,UAAU;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,UAAU,WAAW;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;CAC/C;AAED,KAAK,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAEnE,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC;CACjC;AAED;;;uCAGuC;AACvC,wBAAgB,4BAA4B,CAC1C,KAAK,CAAC,EAAE,OAAO,GACd,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAkBpD;AAED,eAAO,MAAM,sBAAsB,oDAAiC,CAAC"}

package/dist/describe-stack-status.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Deploy-unit status for Kubernetes (#1495 piece 3).
+ *
+ * A Kubernetes deploy unit *is* a label selector: every object chant applies
+ * carries its stack identity in the labels the serializer stamps
+ * (`app.kubernetes.io/managed-by=chant`, `chant.intentius.io/stack=<stack>` —
+ * see core's ownership marking). So "is this unit present" is one selector
+ * query, and "is it healthy" is whether every matching workload its controller
+ * reports on is Ready. No new identity concept — this reads back exactly what
+ * `kubectl-apply` (piece 2) and the serializer already write.
+ *
+ * The selector deliberately omits `chant.intentius.io/env`: `ownership.env` is
+ * a config identity stamped at synthesis, not necessarily the environment name
+ * a caller observes with, and a mismatch would read a deployed unit as absent
+ * — the failure mode the tri-state exists to prevent.
+ *
+ * The sweep is bounded to the kinds chant's own k8s surface deploys as
+ * stack-scoped objects (workloads + the service/config plumbing around them).
+ * A CRD-only unit is out of this bound and reports absent rather than null —
+ * a real limit, stated here rather than papered over; widening the sweep to
+ * discovery-driven kinds is a follow-up, not a silent claim.
+ */
+import type { StackStatusObservation } from "@intentius/chant/lexicon";
+import { type K8sConnector } from "./api/connect.js";
+export declare function describeStackStatus(options: {
+    environment: string;
+    stack: string;
+}, connect?: K8sConnector): Promise<StackStatusObservation | null>;
+//# sourceMappingURL=describe-stack-status.d.ts.map

package/dist/describe-stack-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-stack-status.d.ts","sourceRoot":"","sources":["../src/describe-stack-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGvE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAgCvE,wBAAsB,mBAAmB,CACvC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAC/C,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAuCxC"}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export { k8sSerializer } from "./serializer.js";
 export { k8sPlugin } from "./plugin.js";
+export { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./components/capability-plugin.js";
+export { kubectlApplyCapability, createKubectlApplyCapability, type KubectlApplyInput } from "./components/kubectl-apply.js";
 export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels.js";
 export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels.js";
 export { K8sLabels, K8sAnnotations } from "./variables.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,GAC9E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,GACpD,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAKrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAG1H,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,GAC9E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,GACpD,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4c4e0afb787bdb40c3ecae9bcb1018002a85bcd41dcbf5ac12478d1ba092c3d6",
+    "manifest.json": "df06efa4031426355eb12f159a646012593f5bc9d4b4df424b453dde81aab0be",
     "meta.json": "c0b141b882c51483c1d1aead748a0eb171aceca7432edd2a0404b062bf6d7831",
     "types/index.d.ts": "3be2af7494aca94adfa16269cb9c4e7a155529872207a3d70b0c4d39914f9eec",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "5f8423c25fc4a50e91f0e7f2a8a8064fc8cc36b150f4b0c630a6cc56e0924995"
+  "composite": "58171232438afe93a43c83a5685856c5992179242282773d1cc41bea86ee7c41"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.41.0",
+  "version": "0.41.1",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAwBjG,eAAO,MAAM,SAAS,EAAE,aA6mBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAwBjG,eAAO,MAAM,SAAS,EAAE,aAynBvB,CAAC"}

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA2IlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA+I3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA6MlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA8I3B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.41.0",
+  "version": "0.41.1",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -44,6 +44,11 @@
       "types": "./dist/detect.d.ts",
       "default": "./src/detect.ts"
     },
+    "./components": {
+      "development": "./src/components/index.ts",
+      "types": "./dist/components/index.d.ts",
+      "default": "./src/components/index.ts"
+    },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
@@ -79,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.41.0",
+    "@intentius/chant": "^0.41.1",
     "typescript": "^5.9.3"
   }
 }

package/src/components/builders.ts

@@ -0,0 +1,17 @@
+/**
+ * Typed step-builders for the k8s lexicon's verbs — the same ergonomic sugar
+ * the aws lexicon's `components/builders.ts` offers (#658), reusing the
+ * exported `step` projection from `@intentius/chant/components`.
+ *
+ * `kubectl-apply` is a `needs-opt-out` capability (a server-side apply keeps
+ * no previous object state, so there is nothing native to roll back to), which
+ * means COMP003 requires every step of it to carry a `noRollback: "<reason>"`,
+ * a component-level `rollback` phase, or a sibling safety step. The builder
+ * admits `noRollback` directly so the common opt-out reads as one typed call
+ * instead of a raw object literal.
+ */
+
+import { step } from "@intentius/chant/components";
+import type { KubectlApplyInput } from "./kubectl-apply";
+
+export const kubectlApply = step<KubectlApplyInput & { noRollback?: string }>("kubectl-apply");

package/src/components/capability-plugin.ts

@@ -0,0 +1,28 @@
+/**
+ * `k8sCapabilityPlugin` — the k8s lexicon's capability plugin (#1495 piece 2).
+ *
+ * One leaf for now: `kubectl-apply`, the shared apply verb Kubernetes levels
+ * everything to (docs/components/cloud-boundary calls it the one portable
+ * apply family). Contributed through core's `CapabilityPlugin` contract the
+ * same way the aws lexicon contributes `cfn-deploy` — a project declaring
+ * `lexicons: ["k8s"]` gets the verb registered automatically when it runs
+ * components.
+ */
+import type { Capability } from "@intentius/chant/components/capability";
+import type { CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
+import { kubectlApplyCapability } from "./kubectl-apply";
+
+export const K8S_VERB_FAMILIES = {
+  apply: ["kubectl-apply"],
+} as const;
+
+export const k8sCapabilityPlugin: CapabilityPlugin = {
+  name: "k8s",
+  version: "0.41.0",
+  capabilities(): Array<Capability<never, unknown>> {
+    return [kubectlApplyCapability as Capability<never, unknown>];
+  },
+  families(): Record<string, readonly string[]> {
+    return K8S_VERB_FAMILIES;
+  },
+};

package/src/components/index.ts

@@ -0,0 +1,21 @@
+/**
+ * The k8s lexicon's component/release surface: the `kubectl-apply` capability,
+ * its typed step-builder, and the `k8sCapabilityPlugin` core loads when a
+ * project declares `lexicons: ["k8s"]` (#1495). Component authors import the
+ * builders from here (`@intentius/chant-lexicon-k8s/components`), the way AWS
+ * verbs come from `@intentius/chant-lexicon-aws/components`.
+ *
+ * Everything exported here is on the build path (#1074): nothing may
+ * statically import the Kubernetes API client chain (`../op/activities/*`,
+ * `../kube/*`) — `kubectl-apply.ts` reaches its applier by dynamic import
+ * inside `run()`, and this module must stay that clean.
+ */
+
+export { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./capability-plugin";
+export * from "./builders";
+export {
+  kubectlApplyCapability,
+  createKubectlApplyCapability,
+  type KubectlApplyInput,
+  type KubectlApplyOutcome,
+} from "./kubectl-apply";

package/src/components/kubectl-apply.test.ts

@@ -0,0 +1,33 @@
+import { describe, test, expect } from "vitest";
+import { createKubectlApplyCapability, k8sCapabilityPlugin } from "../index";
+import { isCapabilityPlugin } from "@intentius/chant/components/capability-plugin";
+
+describe("kubectl-apply capability (#1495 piece 2)", () => {
+  test("the plugin satisfies the CapabilityPlugin contract and registers the verb", () => {
+    expect(isCapabilityPlugin(k8sCapabilityPlugin)).toBe(true);
+    const kinds = k8sCapabilityPlugin.capabilities().map((c) => c.kind);
+    expect(kinds).toContain("kubectl-apply");
+  });
+
+  test("run delegates to the server-side apply with the component's env and the step's stack", async () => {
+    let seen: unknown;
+    const cap = createKubectlApplyCapability(async (args) => {
+      seen = args;
+      return { applied: [], pruned: [], fieldManager: "chant:kubemicrovm-ops" };
+    });
+    await cap.run({ env: "dev", component: "workload" }, { manifest: "k8s.yaml", stack: "kubemicrovm-ops", delete: "owned-only" });
+    expect(seen).toEqual({ manifest: "k8s.yaml", environment: "dev", stack: "kubemicrovm-ops", deleteMode: "owned-only" });
+  });
+
+  test("a mutating verb with no safe undo declares needs-opt-out for COMP003", () => {
+    expect(createKubectlApplyCapability().rollbackPolicy).toBe("needs-opt-out");
+  });
+
+  test("the stack field is the deploy unit core's status walk reads (#1495 piece 1)", async () => {
+    const { deployUnits } = await import("@intentius/chant/components/deploy-units");
+    const units = deployUnits([
+      { phase: "Apply", steps: [{ kind: "kubectl-apply", manifest: "k8s.yaml", stack: "kubemicrovm-ops" }] } as never,
+    ]);
+    expect(units).toEqual([{ unit: "kubemicrovm-ops", lexicon: "k8s" }]);
+  });
+});

package/src/components/kubectl-apply.ts

@@ -0,0 +1,104 @@
+/**
+ * `kubectl-apply` — the Kubernetes apply leaf for the component model
+ * (#1495 piece 2).
+ *
+ * The apply itself already exists: chant's server-side apply as the field
+ * manager `chant:<stack>` with the marker-scoped owned-only prune (#1075),
+ * reachable from Ops and from `ApplyOp({ target: "kubectl" })`. What was
+ * missing is a *capability*, so a component whose deploy is a Kubernetes
+ * manifest had nothing to compose but a `shell` step — and, downstream, no
+ * deploy unit for `chant components status --live` to observe (the walk asks
+ * the step's `stack`, and a shell step has none to name).
+ *
+ * `stack` doubles as both the ownership identity the apply stamps
+ * (`chant:<stack>`, the prune selector) and the deploy unit the status walk
+ * reads (core `components/deploy-units.ts`) — one name, both jobs, the same
+ * pairing `cfn-deploy` has with its stack.
+ */
+import type { Capability, DeployContext } from "@intentius/chant/components/capability";
+
+/**
+ * Structural mirrors of the activity module's argument/result shapes.
+ *
+ * Deliberately NOT imported from ../op/activities/kubectl — not even as
+ * `import type`: the #1074 boundary test walks type-only imports too, and a
+ * static reference here would put the API-client chain on the build path this
+ * module is loaded from (the lexicon entry point). The applier is reached by
+ * dynamic import inside run(), the same mechanism plugin.ts and the kube verb
+ * modules use; TypeScript checks these shapes against the real ones at the
+ * call site, so drift is a compile error there, not a silent mismatch.
+ */
+interface AppliedRef {
+  apiVersion: string;
+  kind: string;
+  name: string;
+  namespace?: string;
+}
+
+/** What the apply did — the activity's own result shape. */
+export interface KubectlApplyOutcome {
+  /** The field manager every object was applied as. */
+  fieldManager: string;
+  applied: AppliedRef[];
+  /** Objects deleted because they carried chant's marker and are no longer declared. */
+  pruned: AppliedRef[];
+}
+
+interface ApplierArgs {
+  manifest: string;
+  environment?: string;
+  stack?: string;
+  context?: string;
+  deleteMode?: "never" | "owned-only" | "gated";
+}
+
+type Applier = (args: ApplierArgs) => Promise<KubectlApplyOutcome>;
+
+export interface KubectlApplyInput {
+  /** Path to a manifest file, or a directory of them. */
+  manifest: string;
+  /**
+   * The deploy unit / ownership stack. Optional: omitted derives the field
+   * manager from the project's `ownership.stack` as the Op activity does —
+   * but then the unit is invisible to `components status --live`, which only
+   * reads a literal on the step. Name it.
+   */
+  stack?: string;
+  /** kubectl context. Omitted resolves `k8s.profiles.<ctx.env>.context`. */
+  context?: string;
+  /**
+   * What happens to chant-owned objects no longer in the manifest — the same
+   * vocabulary the Op activity and `ApplyOp` use. Default `never`; the prune
+   * is always marker-scoped, so an object chant did not stamp is never a
+   * candidate.
+   */
+  delete?: "never" | "owned-only";
+}
+
+/** Factory with an injectable applier, so tests assert the delegation without
+ * a cluster — the same seam `createGenerateSbomCapability` uses. The default
+ * applier is resolved by dynamic import on first run, keeping the API-client
+ * chain off the build path (#1074). */
+export function createKubectlApplyCapability(
+  apply?: Applier,
+): Capability<KubectlApplyInput, KubectlApplyOutcome> {
+  return {
+    kind: "kubectl-apply",
+    // A server-side apply has no native undo (the previous object state is not
+    // kept by the API server), so COMP003 requires the component to acknowledge
+    // the compensation gap — the same posture as s3-sync/run-migration.
+    rollbackPolicy: "needs-opt-out",
+    async run(ctx: DeployContext, input: KubectlApplyInput): Promise<KubectlApplyOutcome> {
+      const applier: Applier = apply ?? (await import("../op/activities/kubectl")).applyManifest;
+      return applier({
+        manifest: input.manifest,
+        environment: ctx.env,
+        ...(input.stack !== undefined ? { stack: input.stack } : {}),
+        ...(input.context !== undefined ? { context: input.context } : {}),
+        ...(input.delete !== undefined ? { deleteMode: input.delete } : {}),
+      });
+    },
+  };
+}
+
+export const kubectlApplyCapability = createKubectlApplyCapability();

package/src/describe-stack-status.test.ts

@@ -0,0 +1,75 @@
+import { describe, test, expect } from "vitest";
+import { describeStackStatus } from "./describe-stack-status";
+import type { K8sConnector } from "./api/connect";
+
+/** A connector whose client answers list() from a canned map keyed by kind. */
+function fakeConnector(byKind: Record<string, unknown[]>, opts: { failKinds?: string[]; recordSelectors?: string[] } = {}): K8sConnector {
+  return (async () => ({
+    client: {
+      async list(selector: { kind: string }, listOpts?: { labelSelector?: string }) {
+        if (listOpts?.labelSelector && opts.recordSelectors) opts.recordSelectors.push(listOpts.labelSelector);
+        if (opts.failKinds?.includes(selector.kind)) throw new Error("rbac denied");
+        return byKind[selector.kind] ?? [];
+      },
+    },
+  })) as unknown as K8sConnector;
+}
+
+const readyDeployment = {
+  kind: "Deployment",
+  metadata: { name: "cc-api", labels: { "chant.intentius.io/stack": "cc" } },
+  status: { replicas: 2, readyReplicas: 2 },
+};
+const laggingDeployment = { ...readyDeployment, status: { replicas: 2, readyReplicas: 1 } };
+const service = { kind: "Service", metadata: { name: "cc-api" } };
+
+describe("k8s describeStackStatus (#1495 piece 3)", () => {
+  test("selects on the labels chant's serializer stamps", async () => {
+    const selectors: string[] = [];
+    await describeStackStatus({ environment: "local", stack: "kubemicrovm-ops" }, fakeConnector({}, { recordSelectors: selectors }));
+    expect(selectors[0]).toBe("app.kubernetes.io/managed-by=chant,chant.intentius.io/stack=kubemicrovm-ops");
+  });
+
+  test("present + healthy when every matching workload is ready", async () => {
+    const out = await describeStackStatus({ environment: "local", stack: "cc" }, fakeConnector({ Deployment: [readyDeployment], Service: [service] }));
+    expect(out).toEqual({ stack: "cc", present: true, status: "1/1 workloads ready", healthy: true });
+  });
+
+  test("present but unhealthy when a workload lags its replica count", async () => {
+    const out = await describeStackStatus({ environment: "local", stack: "cc" }, fakeConnector({ Deployment: [laggingDeployment] }));
+    expect(out).toMatchObject({ present: true, healthy: false });
+  });
+
+  test("presence-only objects report present and assert nothing about health", async () => {
+    const out = await describeStackStatus({ environment: "local", stack: "cc" }, fakeConnector({ Service: [service] }));
+    expect(out).toEqual({ stack: "cc", present: true, status: "1 objects present", healthy: true });
+  });
+
+  test("zero matches is the pre-first-apply state — absent, not indeterminate", async () => {
+    const out = await describeStackStatus({ environment: "local", stack: "cc" }, fakeConnector({}));
+    expect(out).toEqual({ stack: "cc", present: false });
+  });
+
+  test("one kind's read failing does not fail the sweep", async () => {
+    const out = await describeStackStatus(
+      { environment: "local", stack: "cc" },
+      fakeConnector({ Deployment: [readyDeployment] }, { failKinds: ["Ingress", "CronJob"] }),
+    );
+    expect(out).toMatchObject({ present: true, healthy: true });
+  });
+
+  test("no cluster binding is indeterminate — null, never a confident absence", async () => {
+    const broken: K8sConnector = (async () => {
+      throw new Error("no context bound for env");
+    }) as unknown as K8sConnector;
+    expect(await describeStackStatus({ environment: "local", stack: "cc" }, broken)).toBeNull();
+  });
+
+  test("every read failing is indeterminate too", async () => {
+    const out = await describeStackStatus(
+      { environment: "local", stack: "cc" },
+      fakeConnector({}, { failKinds: ["Deployment", "StatefulSet", "DaemonSet", "Service", "ConfigMap", "Secret", "ServiceAccount", "Namespace", "Ingress", "PodDisruptionBudget", "HorizontalPodAutoscaler", "CronJob"] }),
+    );
+    expect(out).toBeNull();
+  });
+});

package/src/describe-stack-status.ts

@@ -0,0 +1,100 @@
+/**
+ * Deploy-unit status for Kubernetes (#1495 piece 3).
+ *
+ * A Kubernetes deploy unit *is* a label selector: every object chant applies
+ * carries its stack identity in the labels the serializer stamps
+ * (`app.kubernetes.io/managed-by=chant`, `chant.intentius.io/stack=<stack>` —
+ * see core's ownership marking). So "is this unit present" is one selector
+ * query, and "is it healthy" is whether every matching workload its controller
+ * reports on is Ready. No new identity concept — this reads back exactly what
+ * `kubectl-apply` (piece 2) and the serializer already write.
+ *
+ * The selector deliberately omits `chant.intentius.io/env`: `ownership.env` is
+ * a config identity stamped at synthesis, not necessarily the environment name
+ * a caller observes with, and a mismatch would read a deployed unit as absent
+ * — the failure mode the tri-state exists to prevent.
+ *
+ * The sweep is bounded to the kinds chant's own k8s surface deploys as
+ * stack-scoped objects (workloads + the service/config plumbing around them).
+ * A CRD-only unit is out of this bound and reports absent rather than null —
+ * a real limit, stated here rather than papered over; widening the sweep to
+ * discovery-driven kinds is a follow-up, not a silent claim.
+ */
+import type { StackStatusObservation } from "@intentius/chant/lexicon";
+import { LABEL_OWNERSHIP_KEYS, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
+import type { K8sObject } from "@intentius/chant-k8s-client";
+import { defaultK8sConnector, type K8sConnector } from "./api/connect";
+
+/** The kinds a chant-applied stack's objects land as — the sweep's bound. */
+const SWEEP_KINDS: ReadonlyArray<{ apiVersion: string; kind: string }> = [
+  { apiVersion: "apps/v1", kind: "Deployment" },
+  { apiVersion: "apps/v1", kind: "StatefulSet" },
+  { apiVersion: "apps/v1", kind: "DaemonSet" },
+  { apiVersion: "v1", kind: "Service" },
+  { apiVersion: "v1", kind: "ConfigMap" },
+  { apiVersion: "v1", kind: "Secret" },
+  { apiVersion: "v1", kind: "ServiceAccount" },
+  { apiVersion: "v1", kind: "Namespace" },
+  { apiVersion: "networking.k8s.io/v1", kind: "Ingress" },
+  { apiVersion: "policy/v1", kind: "PodDisruptionBudget" },
+  { apiVersion: "autoscaling/v2", kind: "HorizontalPodAutoscaler" },
+  { apiVersion: "batch/v1", kind: "CronJob" },
+];
+
+/** A workload is healthy when its controller reports every replica ready; a
+ * kind with no readiness story (a ConfigMap, a Service) asserts nothing. */
+function objectHealthy(obj: K8sObject): boolean | undefined {
+  const status = obj.status as { replicas?: unknown; readyReplicas?: unknown; desiredNumberScheduled?: unknown; numberReady?: unknown } | undefined;
+  if (!status) return undefined;
+  if (typeof status.replicas === "number") {
+    return (typeof status.readyReplicas === "number" ? status.readyReplicas : 0) >= status.replicas;
+  }
+  if (typeof status.desiredNumberScheduled === "number") {
+    return (typeof status.numberReady === "number" ? status.numberReady : 0) >= status.desiredNumberScheduled;
+  }
+  return undefined;
+}
+
+export async function describeStackStatus(
+  options: { environment: string; stack: string },
+  connect: K8sConnector = defaultK8sConnector,
+): Promise<StackStatusObservation | null> {
+  const selector =
+    `${LABEL_OWNERSHIP_KEYS.managedBy}=${OWNERSHIP_MANAGED_BY_VALUE},` +
+    `${LABEL_OWNERSHIP_KEYS.stack}=${options.stack}`;
+
+  let client;
+  try {
+    ({ client } = await connect({ environment: options.environment }));
+  } catch {
+    // No cluster binding / unreadable kubeconfig — indeterminate, never a
+    // confident "not there".
+    return null;
+  }
+
+  const matched: K8sObject[] = [];
+  let anyRead = false;
+  for (const target of SWEEP_KINDS) {
+    try {
+      const items = await client.list(target, { labelSelector: selector });
+      anyRead = true;
+      matched.push(...items);
+    } catch {
+      // One kind's list failing (RBAC, an aggregated API down) proves nothing
+      // about the others; keep sweeping.
+    }
+  }
+  if (!anyRead) return null; // every read failed — indeterminate
+
+  if (matched.length === 0) return { stack: options.stack, present: false };
+
+  const verdicts = matched.map(objectHealthy).filter((v): v is boolean => v !== undefined);
+  const healthy = verdicts.length > 0 ? verdicts.every(Boolean) : true;
+  const ready = verdicts.filter(Boolean).length;
+  return {
+    stack: options.stack,
+    present: true,
+    status: verdicts.length > 0 ? `${ready}/${verdicts.length} workloads ready` : `${matched.length} objects present`,
+    healthy,
+  };
+}

package/src/index.ts

@@ -4,6 +4,12 @@ export { k8sSerializer } from "./serializer";
 // Plugin
 export { k8sPlugin } from "./plugin";
 
+// The capability plugin core's loader discovers on this package (#1495 piece 2)
+// — the kubectl-apply leaf a component composes, the way aws contributes
+// cfn-deploy.
+export { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./components/capability-plugin";
+export { kubectlApplyCapability, createKubectlApplyCapability, type KubectlApplyInput } from "./components/kubectl-apply";
+
 // Default labels & annotations
 export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels";
 export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels";

package/src/plugin.ts

@@ -631,6 +631,18 @@ const { deployment, service, serviceMonitor, prometheusRule } = MonitoredService
     return describeResources(options);
   },
 
+  /**
+   * Deploy-unit presence + health for `chant components status --live`
+   * (#1495 piece 3): a Kubernetes deploy unit is the label selector chant's
+   * own serializer stamps, so this reads back
+   * `app.kubernetes.io/managed-by=chant, chant.intentius.io/stack=<stack>`
+   * and rolls readiness up from the matching workloads' controllers.
+   */
+  async describeStackStatus(options) {
+    const { describeStackStatus } = await import("./describe-stack-status");
+    return describeStackStatus(options);
+  },
+
   async exportResources(options) {
     const { exportResources } = await import("./export-resources");
     return exportResources(options);

package/src/serializer.test.ts

@@ -510,3 +510,105 @@ describe("k8sSerializer", () => {
     expect(result).not.toMatch(/^spec:\s*\n\s+rules:/m);
   });
 });
+
+// ── Cross-resource references (#1493) ────────────────────────────────
+//
+// Kubernetes YAML has no deploy-time reference mechanism, so a reference has
+// to be resolved before serialization or it means nothing. These used to
+// serialize to the *logical* name, so a Deployment referencing its PVC emitted
+// `claimName: pgClaim` and named a resource that does not exist — it applied
+// cleanly and failed on the cluster.
+
+function mockAttrRef(attribute: string, logicalName: string): any {
+  // Shape isAttrRefLike() checks for: parent object, string attribute, and
+  // _setLogicalName. Without the last one the walker treats it as a plain
+  // object and the test silently asserts nothing.
+  return {
+    attribute,
+    parent: { deref: () => undefined },
+    _setLogicalName: () => {},
+    getLogicalName: () => logicalName,
+  };
+}
+
+describe("cross-resource references resolve at build time (#1493)", () => {
+  test(".name resolves to the referenced resource's metadata.name", () => {
+    const claim = mockResource("K8s::Core::PersistentVolumeClaim", {
+      metadata: { name: "fountain-postgres", namespace: "fountain" },
+      spec: { accessModes: ["ReadWriteOnce"] },
+    });
+    const dep = mockResource("K8s::Apps::Deployment", {
+      metadata: { name: "fountain-postgres", namespace: "fountain" },
+      spec: {
+        template: {
+          spec: {
+            volumes: [
+              { name: "data", persistentVolumeClaim: { claimName: mockAttrRef("name", "pgClaim") } },
+            ],
+          },
+        },
+      },
+    });
+    const yaml = k8sSerializer.serialize(new Map([["pgClaim", claim], ["pgDeployment", dep]]));
+    expect(yaml).toContain("claimName: fountain-postgres");
+    expect(yaml).not.toContain("claimName: pgClaim");
+  });
+
+  // A resource that declares no name gets one derived from its logical name.
+  // A reference to it has to derive the SAME one or the two silently disagree.
+  test(".name matches the derived name when the target declares none", () => {
+    const claim = mockResource("K8s::Core::PersistentVolumeClaim", {
+      spec: { accessModes: ["ReadWriteOnce"] },
+    });
+    const dep = mockResource("K8s::Apps::Deployment", {
+      spec: { template: { spec: { volumes: [{ claimName: mockAttrRef("name", "pgClaim") }] } } },
+    });
+    const yaml = k8sSerializer.serialize(new Map([["pgClaim", claim], ["dep", dep]]));
+    expect(yaml).toContain("name: pg-claim");
+    expect(yaml).toContain("claimName: pg-claim");
+  });
+
+  test(".namespace resolves to the declared namespace", () => {
+    const svc = mockResource("K8s::Core::Service", {
+      metadata: { name: "fountain", namespace: "fountain" },
+    });
+    const dep = mockResource("K8s::Apps::Deployment", {
+      metadata: { name: "app" },
+      spec: { host: mockAttrRef("namespace", "service") },
+    });
+    const yaml = k8sSerializer.serialize(new Map([["service", svc], ["dep", dep]]));
+    expect(yaml).toContain("host: fountain");
+  });
+
+  // A UID is assigned by the API server at admission, so emitting any
+  // build-time string for it would be a fabrication.
+  test(".uid is refused rather than fabricated", () => {
+    const svc = mockResource("K8s::Core::Service", { metadata: { name: "fountain" } });
+    const dep = mockResource("K8s::Apps::Deployment", {
+      spec: { ownerRef: mockAttrRef("uid", "service") },
+    });
+    expect(() => k8sSerializer.serialize(new Map([["service", svc], ["dep", dep]]))).toThrow(
+      /assigned by the API server/,
+    );
+  });
+
+  test("an unresolvable namespace says what to set rather than emitting a wrong one", () => {
+    const svc = mockResource("K8s::Core::Service", { metadata: { name: "fountain" } });
+    const dep = mockResource("K8s::Apps::Deployment", {
+      spec: { ns: mockAttrRef("namespace", "service") },
+    });
+    expect(() => k8sSerializer.serialize(new Map([["service", svc], ["dep", dep]]))).toThrow(
+      /declares no metadata.namespace/,
+    );
+  });
+
+  test("an attribute k8s cannot express is refused with the reason", () => {
+    const svc = mockResource("K8s::Core::Service", { metadata: { name: "fountain" } });
+    const dep = mockResource("K8s::Apps::Deployment", {
+      spec: { x: mockAttrRef("clusterIP", "service") },
+    });
+    expect(() => k8sSerializer.serialize(new Map([["service", svc], ["dep", dep]]))).toThrow(
+      /resolves .name and .namespace/,
+    );
+  });
+});

package/src/serializer.ts

@@ -113,16 +113,82 @@ function deriveGVKFromType(entityType: string): { apiVersion: string; kind: stri
   return { apiVersion, kind };
 }
 
+/**
+ * The name a resource gets when it does not declare one: the logical name,
+ * kebab-cased. Shared with the manifest builder below so a reference and the
+ * thing it references cannot derive different names (#1493).
+ */
+function derivedName(logicalName: string): string {
+  return logicalName.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+
+/**
+ * What a cross-resource reference resolves to on this substrate (#1493).
+ *
+ * Kubernetes YAML has no deploy-time reference mechanism — no `!Ref`, no
+ * `Fn::GetAtt`. Whatever a reference is going to mean has to be resolved here,
+ * before serialization, or it means nothing at all.
+ *
+ * This used to return the *logical* name for every attribute, so
+ * `claimName: pgClaim.name` emitted `claimName: pgClaim` and the manifest
+ * named a resource that does not exist. It applied cleanly and failed on the
+ * cluster, which is the failure this whole system exists to remove. The
+ * lexicon's own plugin comment already described the intended behaviour —
+ * "resolves to metadata.name" — so this brings the code to the documentation
+ * rather than the other way round.
+ *
+ * `uid` is refused rather than resolved: a UID is assigned by the API server
+ * at admission, so no build-time value exists and any string emitted here
+ * would be a fabrication.
+ */
+function resolveK8sAttr(entity: Declarable | undefined, logicalName: string, attr: string): unknown {
+  if (attr === "uid") {
+    throw new Error(
+      `Cannot reference "${logicalName}.uid": a Kubernetes UID is assigned by the API server at ` +
+        `admission, so it has no build-time value. Reference .name, or carry the UID at runtime ` +
+        `with fieldRef: { fieldPath: "metadata.uid" }.`,
+    );
+  }
+
+  const metadata =
+    entity && isResourceDeclarable(entity) && typeof entity.props === "object" && entity.props !== null
+      ? ((entity.props as Record<string, unknown>).metadata as Record<string, unknown> | undefined)
+      : undefined;
+
+  if (attr === "name") {
+    // Same fallback the manifest builder applies, so a reference to a resource
+    // that declares no name still resolves to the name it will actually get.
+    const declared = metadata?.name;
+    return typeof declared === "string" && declared.length > 0 ? declared : derivedName(logicalName);
+  }
+
+  if (attr === "namespace") {
+    const ns = metadata?.namespace;
+    if (typeof ns === "string" && ns.length > 0) return ns;
+    throw new Error(
+      `Cannot reference "${logicalName}.namespace": it declares no metadata.namespace, and the ` +
+        `namespace a manifest lands in is decided at apply time (kubectl -n, or the context's ` +
+        `default). Set metadata.namespace on "${logicalName}" if the reference needs to be stable.`,
+    );
+  }
+
+  throw new Error(
+    `Cannot reference "${logicalName}.${attr}": the k8s lexicon resolves .name and .namespace at ` +
+      `build time, and Kubernetes YAML has no way to express any other attribute reference.`,
+  );
+}
+
 /**
  * K8s visitor for the generic serializer walker.
  */
 function k8sVisitor(entityNames: Map<Declarable, string>): SerializerVisitor {
+  // name → entity, so an AttrRef can reach the resource it points at. The
+  // walker hands the visitor a logical name, not the Declarable.
+  const byName = new Map<string, Declarable>();
+  for (const [entity, name] of entityNames) byName.set(name, entity);
+
   return {
-    attrRef: (name, attr) => {
-      // For K8s, attribute references typically resolve to metadata.name
-      if (attr === "name") return name;
-      return name;
-    },
+    attrRef: (name, attr) => resolveK8sAttr(byName.get(name), name, attr),
     resourceRef: (name) => name,
     propertyDeclarable: (entity, walk) => {
       if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
@@ -209,8 +275,7 @@ export const k8sSerializer: Serializer = {
       // Build metadata
       const metadata: Record<string, unknown> = props.metadata as Record<string, unknown> ?? {};
       if (!metadata.name) {
-        // Use the logical name as the resource name (kebab-case)
-        metadata.name = name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+        metadata.name = derivedName(name);
       }
 
       // Merge default labels