@intentius/chant-lexicon-k8s 0.41.1 → 0.41.3

package/dist/api/connect.d.ts

@@ -1,23 +1,20 @@
 /**
  * Getting from a chant environment to a live API client — chant #1074.
  *
- * The cluster binding (chant #1100, landed in #1155) is unchanged by the move
- * off `kubectl`, and deliberately so: `resolveClusterTarget` in core stays the
- * single resolver, shared with the GCP lexicon's Config Connector observation,
- * and the refusal it throws on a bound-but-mismatched context still aborts
- * before any resource is touched. What changes is only *how the ambient
- * context is read*: the typed client parses the kubeconfig it is about to use
- * rather than shelling `kubectl config current-context`, so a worker image with
- * no `kubectl` in it can still check the binding. Same question, same three
+ * The cluster binding (chant #1100/#1155, revised by #1488):
+ * `resolveClusterTarget` in core stays the single resolver, and a declared
+ * binding is now *used*, never policed against the ambient context. Two
  * outcomes:
  *
- * - **Bound and ambient agrees** — the bound context is passed explicitly to
- *   the client, never left to the ambient default.
- * - **Bound and ambient disagrees** — `ClusterBindingMismatchError`, thrown
- *   before the first request. Core turns the throw into NOT-OBSERVED for every
- *   declared entity (chant #1089), which is what stops a wrong-cluster read
- *   becoming a confident list of creates.
- * - **Unbound** — the kubeconfig's own current-context, with the same visible
+ * - **Bound** — the bound context is passed explicitly to the client,
+ *   regardless of what `kubectl` is ambiently pointed at. A binding that
+ *   names a context the kubeconfig does not have fails in the client with an
+ *   error naming both the context and the `k8s.profiles.<env>.context`
+ *   binding — never by falling back to ambient. (#1488: the old
+ *   ambient-mismatch refusal meant any other project's k3d cluster stealing
+ *   the current-context turned a healthy estate grey with `read-failed` as
+ *   the only explanation.)
+ * - **Unbound** — the kubeconfig's own current-context, with a visible
  *   warning naming the environment and the missing binding.
  */
 import { type ResolvedClusterTarget } from "@intentius/chant/kubectl-context";

package/dist/api/connect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/api/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAG/E;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,YAwCjC,CAAC"}
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/api/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAG/E;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,YAiCjC,CAAC"}

package/dist/components/capability-plugin.d.ts

@@ -1,4 +1,4 @@
-import type { CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
+import { type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
 export declare const K8S_VERB_FAMILIES: {
     readonly apply: readonly ["kubectl-apply"];
 };

package/dist/components/capability-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAGtF,eAAO,MAAM,iBAAiB;;CAEpB,CAAC;AAEX,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC"}
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAWA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAGzG,eAAO,MAAM,iBAAiB;;CAEpB,CAAC;AAEX,eAAO,MAAM,mBAAmB,EAAE,gBAWjC,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "df06efa4031426355eb12f159a646012593f5bc9d4b4df424b453dde81aab0be",
+    "manifest.json": "39d19df8745aba927066c7eb32a493c8e8dfb2d65ff250646d8d0631f3bfdb9b",
     "meta.json": "c0b141b882c51483c1d1aead748a0eb171aceca7432edd2a0404b062bf6d7831",
     "types/index.d.ts": "3be2af7494aca94adfa16269cb9c4e7a155529872207a3d70b0c4d39914f9eec",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "58171232438afe93a43c83a5685856c5992179242282773d1cc41bea86ee7c41"
+  "composite": "8bbc540152a360b1ddbe2ee903691becafd0bf4d4be8719f5523e5e3c1cb68fb"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.41.1",
+  "version": "0.41.3",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.41.1",
+  "version": "0.41.3",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.41.1",
+    "@intentius/chant": "^0.41.3",
     "typescript": "^5.9.3"
   }
 }

package/src/api/connect.ts

@@ -1,23 +1,20 @@
 /**
  * Getting from a chant environment to a live API client — chant #1074.
  *
- * The cluster binding (chant #1100, landed in #1155) is unchanged by the move
- * off `kubectl`, and deliberately so: `resolveClusterTarget` in core stays the
- * single resolver, shared with the GCP lexicon's Config Connector observation,
- * and the refusal it throws on a bound-but-mismatched context still aborts
- * before any resource is touched. What changes is only *how the ambient
- * context is read*: the typed client parses the kubeconfig it is about to use
- * rather than shelling `kubectl config current-context`, so a worker image with
- * no `kubectl` in it can still check the binding. Same question, same three
+ * The cluster binding (chant #1100/#1155, revised by #1488):
+ * `resolveClusterTarget` in core stays the single resolver, and a declared
+ * binding is now *used*, never policed against the ambient context. Two
  * outcomes:
  *
- * - **Bound and ambient agrees** — the bound context is passed explicitly to
- *   the client, never left to the ambient default.
- * - **Bound and ambient disagrees** — `ClusterBindingMismatchError`, thrown
- *   before the first request. Core turns the throw into NOT-OBSERVED for every
- *   declared entity (chant #1089), which is what stops a wrong-cluster read
- *   becoming a confident list of creates.
- * - **Unbound** — the kubeconfig's own current-context, with the same visible
+ * - **Bound** — the bound context is passed explicitly to the client,
+ *   regardless of what `kubectl` is ambiently pointed at. A binding that
+ *   names a context the kubeconfig does not have fails in the client with an
+ *   error naming both the context and the `k8s.profiles.<env>.context`
+ *   binding — never by falling back to ambient. (#1488: the old
+ *   ambient-mismatch refusal meant any other project's k3d cluster stealing
+ *   the current-context turned a healthy estate grey with `read-failed` as
+ *   the only explanation.)
+ * - **Unbound** — the kubeconfig's own current-context, with a visible
  *   warning naming the environment and the missing binding.
  */
 
@@ -62,7 +59,7 @@ export interface ConnectedClient {
  * build a client honoring it.
  */
 export const defaultK8sConnector: K8sConnector = async (options) => {
-  const { createK8sClient, readAmbientContext } = await import("@intentius/chant-k8s-client");
+  const { createK8sClient } = await import("@intentius/chant-k8s-client");
 
   if (options.context !== undefined) {
     const client = await createK8sClient({
@@ -82,17 +79,10 @@ export const defaultK8sConnector: K8sConnector = async (options) => {
   const k8sConfig = (config as { k8s?: K8sChantConfig }).k8s;
   const execAllowlist = k8sConfig?.execCredentialPlugins;
 
-  // The binding check reads the kubeconfig's current-context directly. Only a
-  // context name is needed, and requiring a *usable* ambient cluster to check a
-  // binding would defeat the binding: pointing an environment at a specific
-  // context is how you recover from an ambient one that is wrong or broken.
-  const target = await resolveClusterTarget(config as Record<string, unknown>, options.environment, "k8s", {
-    ambientContext: () =>
-      readAmbientContext({
-        kubeconfig: options.client?.kubeconfig,
-        kubeconfigPath: options.client?.kubeconfigPath,
-      }),
-  });
+  // #1488 — the resolver returns the declared binding (or ambient-with-warning
+  // when unbound); it no longer reads the ambient context at all, so no reader
+  // is supplied.
+  const target = await resolveClusterTarget(config as Record<string, unknown>, options.environment, "k8s");
 
   const client = await createK8sClient({
     ...options.client,

package/src/components/capability-plugin.ts

@@ -9,7 +9,7 @@
  * components.
  */
 import type { Capability } from "@intentius/chant/components/capability";
-import type { CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
+import { ownPackageVersion, type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
 import { kubectlApplyCapability } from "./kubectl-apply";
 
 export const K8S_VERB_FAMILIES = {
@@ -18,7 +18,9 @@ export const K8S_VERB_FAMILIES = {
 
 export const k8sCapabilityPlugin: CapabilityPlugin = {
   name: "k8s",
-  version: "0.41.0",
+  // The lexicon package's own version (#1505) — lockstep releases bump it, so
+  // a literal here was stale one release after it was written.
+  version: ownPackageVersion(import.meta.url),
   capabilities(): Array<Capability<never, unknown>> {
     return [kubectlApplyCapability as Capability<never, unknown>];
   },

package/src/components/kubectl-apply.test.ts

@@ -9,6 +9,14 @@ describe("kubectl-apply capability (#1495 piece 2)", () => {
     expect(kinds).toContain("kubectl-apply");
   });
 
+  test("the plugin's version is the lexicon package's own, not a literal (#1505)", async () => {
+    const { readFileSync } = await import("node:fs");
+    const { version } = JSON.parse(
+      readFileSync(new URL("../../package.json", import.meta.url), "utf-8"),
+    ) as { version: string };
+    expect(k8sCapabilityPlugin.version).toBe(version);
+  });
+
   test("run delegates to the server-side apply with the component's env and the step's stack", async () => {
     let seen: unknown;
     const cap = createKubectlApplyCapability(async (args) => {

package/src/describe-resources.test.ts

@@ -420,8 +420,11 @@ describe("k8s describeResources", () => {
       expect(result.resources.web).toMatchObject({ type: "K8s::Apps::Deployment", physicalId: "uid-1", status: "READY" });
     });
 
-    test("bound and ambient context mismatches: refuses loudly instead of reading the wrong cluster", async () => {
+    test("bound while a different context is ambient: the binding wins and the estate observes (#1488)", async () => {
       loadChantConfigMock.mockResolvedValue({ config: { k8s: { profiles: { prod: { context: "prod-eks" } } } } });
+      // Ambient points at staging — the state any other project's k3d cluster
+      // leaves behind. Before #1488 this refused and the whole estate read
+      // grey; the declared binding must simply be used instead.
       const ambientIsStaging = fakeKubeconfig({
         contexts: [
           { name: "prod-eks", cluster: "prod", user: "prod-user" },
@@ -429,16 +432,17 @@ describe("k8s describeResources", () => {
         ],
         currentContext: "staging-eks",
       });
-      const cluster = fakeCluster({ kubeconfig: ambientIsStaging });
+      const cluster = fakeCluster({
+        kubeconfig: ambientIsStaging,
+        objects: { [objectKey("apps/v1", "Deployment", "web", "prod")]: web },
+      });
 
-      await expect(
-        describeResources({ environment: "prod", buildOutput: "", entityNames: ["web"], entities: entities() }, (o) =>
-          defaultK8sConnector({ ...o, client: { kubeconfig: ambientIsStaging, requestLayer: cluster.layer } }),
-        ),
-      ).rejects.toThrow(/environment "prod".*"prod-eks".*"staging-eks"/s);
+      const result = await describeResources(
+        { environment: "prod", buildOutput: "", entityNames: ["web"], entities: entities() },
+        (o) => defaultK8sConnector({ ...o, client: { kubeconfig: ambientIsStaging, requestLayer: cluster.layer } }),
+      );
 
-      // Refused before a single request left the process.
-      expect(cluster.layer.requests).toHaveLength(0);
+      expect(result.resources.web).toMatchObject({ type: "K8s::Apps::Deployment", physicalId: "uid-1", status: "READY" });
     });
 
     test("unbound: the kubeconfig's own context is used, and the fallback is visible", async () => {