@intentius/chant-lexicon-k8s 0.41.18 → 0.41.20

package/dist/components/builders.d.ts

@@ -11,7 +11,11 @@
  * instead of a raw object literal.
  */
 import type { KubectlApplyInput } from "./kubectl-apply.js";
+import type { KustomizeApplyInput } from "./kustomize-apply.js";
 export declare const kubectlApply: (input: KubectlApplyInput & {
     noRollback?: string;
 }) => import("@intentius/chant/components").Step;
+export declare const kustomizeApply: (input: KustomizeApplyInput & {
+    noRollback?: string;
+}) => import("@intentius/chant/components").Step;
 //# sourceMappingURL=builders.d.ts.map

package/dist/components/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/components/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,eAAO,MAAM,YAAY;iBAA2C,MAAM;gDAAoB,CAAC"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/components/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,eAAO,MAAM,YAAY;iBAA2C,MAAM;gDAAoB,CAAC;AAI/F,eAAO,MAAM,cAAc;iBAA6C,MAAM;gDAAsB,CAAC"}

package/dist/components/capability-plugin.d.ts

@@ -1,6 +1,6 @@
 import { type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
 export declare const K8S_VERB_FAMILIES: {
-    readonly apply: readonly ["kubectl-apply"];
+    readonly apply: readonly ["kubectl-apply", "kustomize-apply"];
 };
 export declare const k8sCapabilityPlugin: CapabilityPlugin;
 //# sourceMappingURL=capability-plugin.d.ts.map

package/dist/components/capability-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAWA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAGzG,eAAO,MAAM,iBAAiB;;CAEpB,CAAC;AAEX,eAAO,MAAM,mBAAmB,EAAE,gBAWjC,CAAC"}
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAWA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAIzG,eAAO,MAAM,iBAAiB;;CAEpB,CAAC;AAEX,eAAO,MAAM,mBAAmB,EAAE,gBAWjC,CAAC"}

package/dist/components/index.d.ts

@@ -13,4 +13,5 @@
 export { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./capability-plugin.js";
 export * from "./builders.js";
 export { kubectlApplyCapability, createKubectlApplyCapability, type KubectlApplyInput, type KubectlApplyOutcome, } from "./kubectl-apply.js";
+export { kustomizeApplyCapability, createKustomizeApplyCapability, renderCommand, type KustomizeApplyInput, type KustomizeApplyOutcome, } from "./kustomize-apply.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/components/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC"}

package/dist/components/kustomize-apply.d.ts

@@ -0,0 +1,48 @@
+import type { Capability } from "@intentius/chant/components/capability";
+/** Injectable shell runner — the helm-upgrade seam, same buffer bound. */
+export type KustomizeRunner = (command: string) => Promise<{
+    stdout: string;
+}>;
+/** Structural mirrors of the activity module's shapes (see the module doc). */
+interface AppliedRef {
+    apiVersion: string;
+    kind: string;
+    name: string;
+    namespace?: string;
+}
+export interface KustomizeApplyOutcome {
+    fieldManager: string;
+    applied: AppliedRef[];
+    pruned: AppliedRef[];
+}
+interface ApplierArgs {
+    manifest: string;
+    documents?: Array<Record<string, unknown>>;
+    environment?: string;
+    stack?: string;
+    context?: string;
+    deleteMode?: "never" | "owned-only" | "gated";
+}
+type Applier = (args: ApplierArgs) => Promise<KustomizeApplyOutcome>;
+export interface KustomizeApplyInput {
+    /** The kustomization directory (holds `kustomization.yaml`) — an overlay or a base. */
+    dir: string;
+    /**
+     * The deploy unit / ownership stack — same double duty as kubectl-apply's.
+     * Omitted derives from the project's `ownership.stack`, but then the unit is
+     * invisible to `components status --live`. Name it.
+     */
+    stack?: string;
+    /** kubectl context. Omitted resolves `k8s.profiles.<ctx.env>.context`. */
+    context?: string;
+    /** Same delete vocabulary as kubectl-apply; default `never`. */
+    delete?: "never" | "owned-only";
+}
+/** The exact render command, standalone binary first. Pure; exported for tests. */
+export declare function renderCommand(dir: string, tool?: "kustomize" | "kubectl"): string;
+/** Factory with injectable renderer + applier, so tests assert the render
+ * command and the exact applier delegation without kustomize or a cluster. */
+export declare function createKustomizeApplyCapability(run?: KustomizeRunner, apply?: Applier): Capability<KustomizeApplyInput, KustomizeApplyOutcome>;
+export declare const kustomizeApplyCapability: Capability<KustomizeApplyInput, KustomizeApplyOutcome>;
+export {};
+//# sourceMappingURL=kustomize-apply.d.ts.map

package/dist/components/kustomize-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kustomize-apply.d.ts","sourceRoot":"","sources":["../../src/components/kustomize-apply.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,wCAAwC,CAAC;AAIxF,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAQ/E,+EAA+E;AAC/E,UAAU,UAAU;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,UAAU,WAAW;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;CAC/C;AAED,KAAK,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAErE,MAAM,WAAW,mBAAmB;IAClC,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC;CACjC;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAW,GAAG,SAAuB,GAAG,MAAM,CAE9F;AAoBD;8EAC8E;AAC9E,wBAAgB,8BAA8B,CAC5C,GAAG,GAAE,eAA+B,EACpC,KAAK,CAAC,EAAE,OAAO,GACd,UAAU,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAmBxD;AAED,eAAO,MAAM,wBAAwB,wDAAmC,CAAC"}

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAGtG,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAmBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA0BvD;AAgED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAetE;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAmI5B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAGtG,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAmBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA2CvD;AA4FD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAetE;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAmI5B"}

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { k8sSerializer } from "./serializer.js";
 export { k8sPlugin } from "./plugin.js";
 export { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./components/capability-plugin.js";
 export { kubectlApplyCapability, createKubectlApplyCapability, type KubectlApplyInput } from "./components/kubectl-apply.js";
+export { kustomizeApplyCapability, createKustomizeApplyCapability, type KustomizeApplyInput } from "./components/kustomize-apply.js";
 export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels.js";
 export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels.js";
 export { K8sLabels, K8sAnnotations } from "./variables.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAKrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAG1H,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,GAC9E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,GACpD,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAKrC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1H,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGlI,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGxD,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAI/D,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EACzF,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EACxF,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EACjH,aAAa,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,sBAAsB,EAC3H,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EACtD,UAAU,EAAE,MAAM,EAAE,UAAU,EAC9B,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EACrD,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAChF,iCAAiC,EACjC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,GAC9E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrG,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAClF,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EACtE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAC1E,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAChG,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,gBAAgB,EACpF,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EACxF,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EACxF,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,EAAE,mBAAmB,EACvC,mCAAmC,EAAE,oCAAoC,EACzE,sBAAsB,EAAE,uBAAuB,EAC/C,0BAA0B,EAAE,2BAA2B,EACvD,eAAe,EAAE,gBAAgB,EACjC,2BAA2B,EAAE,4BAA4B,EACzD,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EACpF,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAC1F,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAC/F,WAAW,EAAE,YAAY,EACzB,eAAe,EAAE,gBAAgB,EACjC,eAAe,EAAE,cAAc,EAC/B,iBAAiB,EAAE,gBAAgB,EACnC,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EACzE,0BAA0B,EAAE,yBAAyB,EACrD,gBAAgB,EAAE,iBAAiB,EACnC,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,0BAA0B,EAAE,2BAA2B,EACvD,sCAAsC,EAAE,uCAAuC,EAC/E,sBAAsB,EAAE,uBAAuB,EAC/C,qBAAqB,EAAE,sBAAsB,EAC7C,wBAAwB,EAAE,yBAAyB,EACnD,wBAAwB,EAAE,yBAAyB,GACpD,MAAM,oBAAoB,CAAC;AAG5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG1D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "c2f3553d27f37ccedf78b608acf76ee427dcd03bdc832f0a9ffbb4da78ff9bd9",
+    "manifest.json": "5dc7c047316cefafc266f579d7a266cfed2d3682a197bef9dbcb0f27c70af2df",
     "meta.json": "c0b141b882c51483c1d1aead748a0eb171aceca7432edd2a0404b062bf6d7831",
     "types/index.d.ts": "3be2af7494aca94adfa16269cb9c4e7a155529872207a3d70b0c4d39914f9eec",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "719807c3da16afea57ea7a7709cc29007e28cd3c8d7ab094c273794fa95fbb9e"
+  "composite": "624054fff650a57fd0f5c234a26aa362e45fed534780e98405f4ebae4c2470d0"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.41.18",
+  "version": "0.41.20",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/op/activities/kubectl.d.ts

@@ -30,6 +30,7 @@
  * - **Documents apply in file order**, as `kubectl apply -f` does, and a
  *   directory's files are read in sorted order.
  */
+import type { K8sObject } from "@intentius/chant-k8s-client";
 import { type K8sConnector } from "../../api/connect.js";
 /**
  * How the apply treats chant-owned objects that are no longer declared. The
@@ -39,8 +40,21 @@ import { type K8sConnector } from "../../api/connect.js";
  */
 export type ApplyDeleteMode = "never" | "owned-only" | "gated";
 export interface KubectlApplyArgs {
-    /** Path to a manifest file, or a directory of them. */
+    /**
+     * Path to a manifest file, or a directory of them. With `documents` given,
+     * this becomes only the human-facing label the heartbeats and logs carry
+     * (e.g. `kustomize:<dir>`), and nothing is read from disk.
+     */
     manifest: string;
+    /**
+     * Already-parsed documents to apply INSTEAD of reading `manifest` (#1548):
+     * a renderer that produced the objects in memory — kustomize-apply's
+     * `kustomize build` — hands them straight in rather than round-tripping
+     * through a temp file. Everything downstream (ownership stamping, the
+     * marker-scoped prune, the self-conflict retake) is document-driven and
+     * behaves identically.
+     */
+    documents?: K8sObject[];
     /**
      * kubectl context name. Uses the ambient context if omitted. To target the
      * same cluster the read path (`describeResources`) resolved for an

package/dist/op/activities/kubectl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAI3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAqHD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAkE9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAYH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAI3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAqHD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAkE9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/op/activities/wait-for-ready.d.ts

@@ -32,7 +32,22 @@ export interface PathMatch {
     /** Holds when the value is one of these. */
     oneOf?: Array<string | number>;
 }
-export type ReadinessMatch = ConditionMatch | PathMatch;
+/**
+ * Match a `status.conditions[]` entry by `type` AND its `reason` (#1549).
+ * The dot-path walk can't index into a conditions array, and the Flux
+ * toolkit's failure signal is exactly `conditions[type=Ready].reason` — a
+ * wedge like `BuildFailed` keeps `Ready=False` forever while the generic
+ * poll waits out its whole timeout. `status` defaults to "False": a reason
+ * on a True condition is progress vocabulary, not a wedge.
+ */
+export interface ConditionReasonMatch {
+    conditionType: string;
+    /** Required `status` of the condition (default "False"). */
+    status?: string;
+    /** Holds when the condition's `reason` is one of these. */
+    reasonOneOf: string[];
+}
+export type ReadinessMatch = ConditionMatch | PathMatch | ConditionReasonMatch;
 export interface ReadinessSpec {
     /** All must hold for the resource to be ready. */
     ready: ReadinessMatch[];
@@ -50,11 +65,6 @@ export interface ReadinessSpec {
  * and the CockroachDB operator.
  */
 export declare const DEFAULT_READINESS: ReadinessSpec;
-/**
- * Per-resource overrides keyed by `"<group>/<kind>"`. Argo's `Application`
- * reports `health`/`sync`, not a `Ready` condition — the case that proves the
- * override is necessary (#365).
- */
 export declare const READINESS_OVERRIDES: Record<string, ReadinessSpec>;
 /** Resolve the readiness spec for a resource: registry override, else default. */
 export declare function readinessFor(group: string | undefined, kind: string): ReadinessSpec;

package/dist/op/activities/wait-for-ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wait-for-ready.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait-for-ready.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AAIH,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACnC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAEhC;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAS7D,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnF;AAwCD,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAE3F;AAID,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,YAAkC,GAAG,eAAe,CAmC/F;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAAsE,CAAC;AAE5G;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,eAAsC,GAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuBlC"}
+{"version":3,"file":"wait-for-ready.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait-for-ready.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AAIH,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACnC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAEhC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AAoBF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAyC7D,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnF;AAyDD,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAE3F;AAID,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,YAAkC,GAAG,eAAe,CAmC/F;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAAsE,CAAC;AAE5G;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,eAAsC,GAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuBlC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.41.18",
+  "version": "0.41.20",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.41.18",
+    "@intentius/chant": "^0.41.20",
     "typescript": "^5.9.3"
   }
 }

package/src/components/builders.ts

@@ -13,5 +13,10 @@
 
 import { step } from "@intentius/chant/components";
 import type { KubectlApplyInput } from "./kubectl-apply";
+import type { KustomizeApplyInput } from "./kustomize-apply";
 
 export const kubectlApply = step<KubectlApplyInput & { noRollback?: string }>("kubectl-apply");
+
+// Same needs-opt-out posture, same sugar (#1548): a kustomize render in front
+// of the identical server-side apply.
+export const kustomizeApply = step<KustomizeApplyInput & { noRollback?: string }>("kustomize-apply");

package/src/components/capability-plugin.ts

@@ -11,9 +11,10 @@
 import type { Capability } from "@intentius/chant/components/capability";
 import { ownPackageVersion, type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
 import { kubectlApplyCapability } from "./kubectl-apply";
+import { kustomizeApplyCapability } from "./kustomize-apply";
 
 export const K8S_VERB_FAMILIES = {
-  apply: ["kubectl-apply"],
+  apply: ["kubectl-apply", "kustomize-apply"],
 } as const;
 
 export const k8sCapabilityPlugin: CapabilityPlugin = {
@@ -22,7 +23,7 @@ export const k8sCapabilityPlugin: CapabilityPlugin = {
   // a literal here was stale one release after it was written.
   version: ownPackageVersion(import.meta.url),
   capabilities(): Array<Capability<never, unknown>> {
-    return [kubectlApplyCapability as Capability<never, unknown>];
+    return [kubectlApplyCapability as Capability<never, unknown>, kustomizeApplyCapability as Capability<never, unknown>];
   },
   families(): Record<string, readonly string[]> {
     return K8S_VERB_FAMILIES;

package/src/components/index.ts

@@ -19,3 +19,10 @@ export {
   type KubectlApplyInput,
   type KubectlApplyOutcome,
 } from "./kubectl-apply";
+export {
+  kustomizeApplyCapability,
+  createKustomizeApplyCapability,
+  renderCommand,
+  type KustomizeApplyInput,
+  type KustomizeApplyOutcome,
+} from "./kustomize-apply";

package/src/components/kustomize-apply.test.ts

@@ -0,0 +1,98 @@
+/**
+ * `kustomize-apply` (#1548) — the render-then-apply leaf. What must hold:
+ * the capability registers under its kind with the lexicon's own version
+ * (#1505), the render command is exact and falls back to kubectl's vendored
+ * kustomize, the rendered documents reach the applier INLINE (no temp file)
+ * with the deploy-unit stack, and the rollback posture matches kubectl-apply
+ * (server-side apply has no native undo).
+ */
+import { describe, test, expect } from "vitest";
+import { createKustomizeApplyCapability, kustomizeApplyCapability, renderCommand, type KustomizeApplyInput } from "./kustomize-apply";
+import { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./capability-plugin";
+import { isCapabilityPlugin } from "@intentius/chant/components/capability-plugin";
+import type { DeployContext } from "@intentius/chant/components/capability";
+
+const ctx = { env: "dev" } as DeployContext;
+
+const RENDERED = `apiVersion: v1
+kind: Namespace
+metadata:
+  name: web
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+  namespace: web
+spec:
+  replicas: 1
+`;
+
+describe("kustomize-apply capability (#1548)", () => {
+  test("registers on the k8s plugin, in the apply family, at the package's own version", () => {
+    expect(isCapabilityPlugin(k8sCapabilityPlugin)).toBe(true);
+    expect(k8sCapabilityPlugin.capabilities().map((c) => c.kind)).toContain("kustomize-apply");
+    expect(K8S_VERB_FAMILIES.apply).toContain("kustomize-apply");
+    // #1505 — never a stale literal.
+    const { version } = JSON.parse(
+      // eslint-disable-next-line @typescript-eslint/no-var-requires
+      require("node:fs").readFileSync(new URL("../../package.json", import.meta.url), "utf8"),
+    ) as { version: string };
+    expect(k8sCapabilityPlugin.version).toBe(version);
+  });
+
+  test("rollback is needs-opt-out — a server-side apply keeps no previous state", () => {
+    expect(kustomizeApplyCapability.rollbackPolicy).toBe("needs-opt-out");
+  });
+
+  test("renders with kustomize build and hands the parsed documents to the applier inline", async () => {
+    const commands: string[] = [];
+    const applierArgs: unknown[] = [];
+    const cap = createKustomizeApplyCapability(
+      async (command) => {
+        commands.push(command);
+        return { stdout: RENDERED };
+      },
+      async (args) => {
+        applierArgs.push(args);
+        return { fieldManager: "chant:web", applied: [], pruned: [] };
+      },
+    );
+
+    await cap.run(ctx, { dir: "overlays/dev", stack: "web", delete: "owned-only" } as KustomizeApplyInput as never);
+
+    expect(commands).toEqual(["kustomize build 'overlays/dev'"]);
+    expect(applierArgs).toHaveLength(1);
+    const args = applierArgs[0] as { manifest: string; documents: unknown[]; environment: string; stack: string; deleteMode: string };
+    expect(args.manifest).toBe("kustomize:overlays/dev"); // a label, not a path
+    expect(args.documents).toHaveLength(2);
+    expect((args.documents[1] as { kind: string }).kind).toBe("Deployment");
+    expect(args.environment).toBe("dev");
+    expect(args.stack).toBe("web");
+    expect(args.deleteMode).toBe("owned-only");
+  });
+
+  test("falls back to kubectl's vendored kustomize when the binary is missing", async () => {
+    const commands: string[] = [];
+    const cap = createKustomizeApplyCapability(
+      async (command) => {
+        commands.push(command);
+        if (command.startsWith("kustomize ")) throw new Error("spawn kustomize ENOENT");
+        return { stdout: RENDERED };
+      },
+      async () => ({ fieldManager: "chant", applied: [], pruned: [] }),
+    );
+    await cap.run(ctx, { dir: "overlays/dev" } as KustomizeApplyInput as never);
+    expect(commands).toEqual([renderCommand("overlays/dev", "kustomize"), renderCommand("overlays/dev", "kubectl")]);
+  });
+
+  test("a render failure that is NOT a missing binary propagates — a broken overlay is not silently retried", async () => {
+    const cap = createKustomizeApplyCapability(
+      async () => {
+        throw new Error("accumulating resources: missing base ../common");
+      },
+      async () => ({ fieldManager: "chant", applied: [], pruned: [] }),
+    );
+    await expect(cap.run(ctx, { dir: "overlays/dev" } as KustomizeApplyInput as never)).rejects.toThrow("missing base");
+  });
+});

package/src/components/kustomize-apply.ts

@@ -0,0 +1,133 @@
+/**
+ * `kustomize-apply` — the kustomize leaf for the component model (#1548).
+ *
+ * Kustomize is a RENDERER, not a substrate: `kustomize build <dir>` emits
+ * exactly the Kubernetes manifests the existing apply pipeline was built for.
+ * So this capability is a render step in front of `kubectl-apply`'s machinery
+ * — the rendered documents go straight to the same server-side applier
+ * (inline, no temp file), which stamps the deploy-unit stack (#1539), prunes
+ * marker-scoped, retakes chant's own field conflicts (#1541/#1542), and is
+ * observed by the same `describeStackStatus` label sweep. An estate that
+ * keeps its overlay tree gets components-status honesty without adopting a
+ * single typed manifest.
+ *
+ * `stack` doubles as the ownership identity and the deploy unit, exactly as
+ * `kubectl-apply` — one name, both jobs.
+ *
+ * Renderer resolution: `kustomize build`, falling back to
+ * `kubectl kustomize` (the same renderer vendored into kubectl) when the
+ * standalone binary is absent. Both run through an injectable runner so tests
+ * assert the exact command without either binary installed. The 64MiB
+ * maxBuffer mirrors helm-upgrade's — a big overlay renders megabytes.
+ *
+ * The #1074 boundary applies as it does to kubectl-apply: nothing exported
+ * from the lexicon entry point may statically import the API-client chain, so
+ * the applier is reached by dynamic import inside `run()` and its argument
+ * shape is a structural mirror.
+ */
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { loadAll } from "js-yaml";
+import type { Capability, DeployContext } from "@intentius/chant/components/capability";
+
+const execAsync = promisify(exec);
+
+/** Injectable shell runner — the helm-upgrade seam, same buffer bound. */
+export type KustomizeRunner = (command: string) => Promise<{ stdout: string }>;
+const defaultRunner: KustomizeRunner = (command) => execAsync(command, { maxBuffer: 64 * 1024 * 1024 });
+
+/** Single-quote shell escaping, as helm-upgrade quotes its argv. */
+function q(v: string): string {
+  return `'${v.replace(/'/g, "'\\''")}'`;
+}
+
+/** Structural mirrors of the activity module's shapes (see the module doc). */
+interface AppliedRef {
+  apiVersion: string;
+  kind: string;
+  name: string;
+  namespace?: string;
+}
+
+export interface KustomizeApplyOutcome {
+  fieldManager: string;
+  applied: AppliedRef[];
+  pruned: AppliedRef[];
+}
+
+interface ApplierArgs {
+  manifest: string;
+  documents?: Array<Record<string, unknown>>;
+  environment?: string;
+  stack?: string;
+  context?: string;
+  deleteMode?: "never" | "owned-only" | "gated";
+}
+
+type Applier = (args: ApplierArgs) => Promise<KustomizeApplyOutcome>;
+
+export interface KustomizeApplyInput {
+  /** The kustomization directory (holds `kustomization.yaml`) — an overlay or a base. */
+  dir: string;
+  /**
+   * The deploy unit / ownership stack — same double duty as kubectl-apply's.
+   * Omitted derives from the project's `ownership.stack`, but then the unit is
+   * invisible to `components status --live`. Name it.
+   */
+  stack?: string;
+  /** kubectl context. Omitted resolves `k8s.profiles.<ctx.env>.context`. */
+  context?: string;
+  /** Same delete vocabulary as kubectl-apply; default `never`. */
+  delete?: "never" | "owned-only";
+}
+
+/** The exact render command, standalone binary first. Pure; exported for tests. */
+export function renderCommand(dir: string, tool: "kustomize" | "kubectl" = "kustomize"): string {
+  return tool === "kustomize" ? `kustomize build ${q(dir)}` : `kubectl kustomize ${q(dir)}`;
+}
+
+/** Render the overlay, falling back to kubectl's vendored kustomize when the
+ * standalone binary is missing (ENOENT/127), and parse the emitted YAML. */
+async function renderDocuments(dir: string, run: KustomizeRunner): Promise<Array<Record<string, unknown>>> {
+  let stdout: string;
+  try {
+    ({ stdout } = await run(renderCommand(dir, "kustomize")));
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/ENOENT|not found|command not found|127/.test(message)) throw err;
+    ({ stdout } = await run(renderCommand(dir, "kubectl")));
+  }
+  const documents: Array<Record<string, unknown>> = [];
+  for (const doc of loadAll(stdout)) {
+    if (doc && typeof doc === "object" && !Array.isArray(doc)) documents.push(doc as Record<string, unknown>);
+  }
+  return documents;
+}
+
+/** Factory with injectable renderer + applier, so tests assert the render
+ * command and the exact applier delegation without kustomize or a cluster. */
+export function createKustomizeApplyCapability(
+  run: KustomizeRunner = defaultRunner,
+  apply?: Applier,
+): Capability<KustomizeApplyInput, KustomizeApplyOutcome> {
+  return {
+    kind: "kustomize-apply",
+    // Server-side apply keeps no previous object state, and kustomize adds no
+    // undo of its own — same posture as kubectl-apply.
+    rollbackPolicy: "needs-opt-out",
+    async run(ctx: DeployContext, input: KustomizeApplyInput): Promise<KustomizeApplyOutcome> {
+      const documents = await renderDocuments(input.dir, run);
+      const applier: Applier = apply ?? ((await import("../op/activities/kubectl")).applyManifest as unknown as Applier);
+      return applier({
+        manifest: `kustomize:${input.dir}`,
+        documents,
+        environment: ctx.env,
+        ...(input.stack !== undefined ? { stack: input.stack } : {}),
+        ...(input.context !== undefined ? { context: input.context } : {}),
+        ...(input.delete !== undefined ? { deleteMode: input.delete } : {}),
+      });
+    },
+  };
+}
+
+export const kustomizeApplyCapability = createKustomizeApplyCapability();

package/src/describe-resources.test.ts

@@ -573,6 +573,135 @@ describe("k8s describeResources", () => {
       expect(result.resources["prod/hand-made"]).toBeUndefined();
     });
 
+    test("a Flux-managed Deployment is attributed to its declared Kustomization by the controller's labels (#1549)", async () => {
+      // Flux stamps managed objects with name+namespace labels instead of
+      // ownerReferences, so the chain walk reaches nothing — the label
+      // channel resolves against the DECLARED CR, exactly. The workload also
+      // lives in a namespace the estate never declares an entity in: the
+      // Kustomization's own spec.targetNamespace is what puts it in scope.
+      const kustomization = {
+        apiVersion: "kustomize.toolkit.fluxcd.io/v1",
+        kind: "Kustomization",
+        metadata: { name: "apps", namespace: "flux-system", uid: "ks-uid" },
+        status: { conditions: [{ type: "Ready", status: "True" }] },
+      };
+      const managed = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: {
+          name: "web",
+          namespace: "prod",
+          uid: "dep-uid",
+          labels: { "kustomize.toolkit.fluxcd.io/name": "apps", "kustomize.toolkit.fluxcd.io/namespace": "flux-system" },
+        },
+        status: { readyReplicas: 1, replicas: 1 },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("kustomize.toolkit.fluxcd.io/v1", "Kustomization", "apps", "flux-system")]: kustomization,
+          [objectKey("apps/v1", "Deployment", "web", "prod")]: managed,
+        },
+      });
+
+      const result = await describeResources(
+        {
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["apps"],
+          entities: makeEntities([
+            {
+              name: "apps",
+              entityType: "K8s::Flux::Kustomization",
+              props: { metadata: { name: "apps", namespace: "flux-system" }, spec: { targetNamespace: "prod", sourceRef: { kind: "GitRepository", name: "infra" } } },
+            },
+          ]),
+        },
+        cluster.connector,
+      );
+
+      expect(result.resources["prod/web"]).toMatchObject({
+        type: "K8s::Apps::Deployment",
+        ownerChain: { root: "declared", entity: "apps" },
+      });
+    });
+
+    test("Argo's bare instance label claims only a UNIQUE declared Application (#1549)", async () => {
+      const app = (name: string) => ({
+        apiVersion: "argoproj.io/v1alpha1",
+        kind: "Application",
+        metadata: { name, namespace: "argocd", uid: `${name}-uid` },
+        status: { health: { status: "Healthy" }, sync: { status: "Synced" } },
+      });
+      const managed = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { name: "web", namespace: "prod", uid: "dep-uid", labels: { "app.kubernetes.io/instance": "web" } },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("argoproj.io/v1alpha1", "Application", "web", "argocd")]: app("web"),
+          [objectKey("apps/v1", "Deployment", "web", "prod")]: managed,
+        },
+      });
+
+      const result = await describeResources(
+        {
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["webApp"],
+          entities: makeEntities([
+            {
+              name: "webApp",
+              entityType: "K8s::Argo::Application",
+              props: { metadata: { name: "web", namespace: "argocd" }, spec: { destination: { namespace: "prod" } } },
+            },
+          ]),
+        },
+        cluster.connector,
+      );
+
+      expect(result.resources["prod/web"]).toMatchObject({
+        type: "K8s::Apps::Deployment",
+        ownerChain: { root: "declared", entity: "webApp" },
+      });
+    });
+
+    test("a generic instance label matching NO declared Application claims nothing — not an inventory (#1549)", async () => {
+      // `app.kubernetes.io/instance` is also what plain helm sets; on an
+      // estate declaring a Flux CR (so the widened sweep runs), a foreign
+      // helm-installed Deployment must not be attributed.
+      const kustomization = {
+        apiVersion: "kustomize.toolkit.fluxcd.io/v1",
+        kind: "Kustomization",
+        metadata: { name: "apps", namespace: "flux-system", uid: "ks-uid" },
+      };
+      const foreign = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { name: "cert-manager", namespace: "flux-system", uid: "cm-uid", labels: { "app.kubernetes.io/instance": "cert-manager" } },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("kustomize.toolkit.fluxcd.io/v1", "Kustomization", "apps", "flux-system")]: kustomization,
+          [objectKey("apps/v1", "Deployment", "cert-manager", "flux-system")]: foreign,
+        },
+      });
+
+      const result = await describeResources(
+        {
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["apps"],
+          entities: makeEntities([
+            { name: "apps", entityType: "K8s::Flux::Kustomization", props: { metadata: { name: "apps", namespace: "flux-system" } } },
+          ]),
+        },
+        cluster.connector,
+      );
+
+      expect(result.resources["flux-system/cert-manager"]).toBeUndefined();
+    });
+
     test("a core-only estate sweeps no extra groups — Pods stay the core representative", async () => {
       const svc = { apiVersion: "v1", kind: "Service", metadata: { name: "web", namespace: "prod", uid: "svc-uid" } };
       const cluster = fakeCluster({
@@ -880,6 +1009,36 @@ describe("statusFromObject — the most specific failing signal (#1397)", () =>
     expect(statusFromObject({ status: { readyReplicas: 1, replicas: 3 } } as never)).toBe("PROGRESSING(1/3)");
     expect(statusFromObject({} as never)).toBe("PRESENT");
   });
+
+  test("a conditions-first CR reads its Ready condition, not PRESENT (#1549)", () => {
+    // A wedged Flux Kustomization/HelmRelease has no phase and no replica
+    // counts, so it fell straight to PRESENT — a wedged reconciler read
+    // exactly like a healthy one.
+    expect(
+      statusFromObject({ status: { conditions: [{ type: "Ready", status: "False", reason: "BuildFailed" }] } } as never),
+    ).toBe("BuildFailed");
+    expect(
+      statusFromObject({ status: { conditions: [{ type: "Ready", status: "False" }] } } as never),
+    ).toBe("NOT-READY");
+    expect(
+      statusFromObject({ status: { conditions: [{ type: "Ready", status: "True", reason: "ReconciliationSucceeded" }] } } as never),
+    ).toBe("READY");
+  });
+
+  test("the Ready rung never changes a Pod or workload word — phase and replicas rank above it (#1549)", () => {
+    expect(
+      statusFromObject({ status: { phase: "Running", conditions: [{ type: "Ready", status: "False" }] } } as never),
+    ).toBe("Running");
+    expect(
+      statusFromObject({ status: { readyReplicas: 1, replicas: 3, conditions: [{ type: "Ready", status: "False" }] } } as never),
+    ).toBe("PROGRESSING(1/3)");
+  });
+
+  test("an Argo Application reads health/sync (#1549)", () => {
+    expect(statusFromObject({ status: { health: { status: "Degraded" }, sync: { status: "Synced" } } } as never)).toBe("Degraded");
+    expect(statusFromObject({ status: { health: { status: "Healthy" }, sync: { status: "OutOfSync" } } } as never)).toBe("OutOfSync");
+    expect(statusFromObject({ status: { health: { status: "Healthy" }, sync: { status: "Synced" } } } as never)).toBe("READY");
+  });
 });
 
 // #1401 — #1397 made the status WORD honest; this carries the part that says

package/src/describe-resources.ts

@@ -104,9 +104,54 @@ export function statusFromObject(obj: K8sObject): string {
       ? "READY"
       : `PROGRESSING(${status.readyReplicas}/${status.replicas})`;
   }
+
+  // The kstatus rung (#1549): an object with NO phase and NO replica counts —
+  // a Flux Kustomization/HelmRelease, cert-manager, any conditions-first CRD —
+  // used to fall straight to PRESENT, so a wedged reconciler read exactly like
+  // a healthy one. `Ready` is the contract those objects speak: False → its
+  // reason (`BuildFailed`, `UpgradeFailed`, …), True → READY. Deliberately
+  // BELOW the phase/replica rungs so no Pod or workload word changes — for
+  // those objects a False Ready is already visible through the rungs above.
+  const ready = readyConditionWord(status);
+  if (ready) return ready;
+
+  // Argo's Application speaks health/sync, not a Ready condition (the same
+  // split the readiness registry encodes) — `Degraded` / `OutOfSync` beats
+  // PRESENT for the one object whose whole job is convergence.
+  const argo = argoStatusWord(status);
+  if (argo) return argo;
+
   return "PRESENT";
 }
 
+/** The `Ready` condition rendered as a status word: False → its reason (or
+ * NOT-READY when the controller gave none), True → READY, absent → nothing. */
+function readyConditionWord(status: K8sObject["status"]): string | undefined {
+  const conditions = (status as { conditions?: unknown } | undefined)?.conditions;
+  if (!Array.isArray(conditions)) return undefined;
+  for (const c of conditions) {
+    const cond = c as { type?: unknown; status?: unknown; reason?: unknown };
+    if (cond.type !== "Ready") continue;
+    if (cond.status === "True") return "READY";
+    if (cond.status === "False") {
+      return typeof cond.reason === "string" && cond.reason.length > 0 ? cond.reason : "NOT-READY";
+    }
+  }
+  return undefined;
+}
+
+/** Argo Application health/sync as a status word: anything but the happy pair
+ * surfaces the unhappy half; Healthy+Synced reads as READY. */
+function argoStatusWord(status: K8sObject["status"]): string | undefined {
+  const s = status as { health?: { status?: unknown }; sync?: { status?: unknown } } | undefined;
+  const health = typeof s?.health?.status === "string" ? s.health.status : undefined;
+  const sync = typeof s?.sync?.status === "string" ? s.sync.status : undefined;
+  if (!health && !sync) return undefined;
+  if (health && health !== "Healthy") return health;
+  if (sync && sync !== "Synced") return sync;
+  return "READY";
+}
+
 /**
  * The reason a container is stuck, if one is — `CrashLoopBackOff`,
  * `ImagePullBackOff`, `CreateContainerConfigError`.
@@ -333,7 +378,7 @@ export async function describeResources(
     if (op && op.apiVersion.includes("/")) runtimeGroupVersions.add(op.apiVersion);
   }
 
-  await addRuntimeChildren(client, resources, options.owned, runtimeGroupVersions);
+  await addRuntimeChildren(client, resources, options.owned, runtimeGroupVersions, declared);
 
   return observation(resources, unobserved);
 }
@@ -360,22 +405,99 @@ export async function describeResources(
  * axis for them to report against, the same way an out-of-band AWS child
  * resource has none either.
  */
+/** The declared GitOps CRs, indexed the way their controllers' labels can be
+ * resolved (#1549). `byRef` keys are `type\0namespace\0name` (Flux — exact);
+ * `argoByName` maps an Application's name to its declared entity, or null
+ * when two declared Applications share the name (ambiguous → no claim). */
+interface GitopsIndex {
+  present: boolean;
+  byRef: Map<string, string>;
+  argoByName: Map<string, string | null>;
+  targetNamespaces: Set<string>;
+}
+
+function gitopsIndex(declared: readonly Declared[]): GitopsIndex {
+  const byRef = new Map<string, string>();
+  const argoByName = new Map<string, string | null>();
+  const targetNamespaces = new Set<string>();
+  let present = false;
+  for (const { entityName, entityType, props } of declared) {
+    const isArgo = entityType === "K8s::Argo::Application";
+    const isFlux = entityType === "K8s::Flux::Kustomization" || entityType === "K8s::Flux::HelmRelease";
+    if (!isArgo && !isFlux) continue;
+    present = true;
+    const meta = props.metadata as { name?: string; namespace?: string } | undefined;
+    const spec = props.spec as { targetNamespace?: unknown; destination?: { namespace?: unknown } } | undefined;
+    const name = meta?.name;
+    if (!name) continue;
+    if (isFlux) {
+      byRef.set(`${entityType}\0${meta?.namespace ?? "default"}\0${name}`, entityName);
+      if (typeof spec?.targetNamespace === "string") targetNamespaces.add(spec.targetNamespace);
+    } else {
+      argoByName.set(name, argoByName.has(name) ? null : entityName);
+      if (typeof spec?.destination?.namespace === "string") targetNamespaces.add(spec.destination.namespace);
+    }
+  }
+  return { present, byRef, argoByName, targetNamespaces };
+}
+
+/** The declared GitOps CR a swept object's controller labels resolve to, or
+ * undefined. Flux's label pairs are exact; Argo's bare instance label claims
+ * only a UNIQUE declared Application. */
+function gitopsOwner(labels: Record<string, string> | undefined, gitops: GitopsIndex): string | undefined {
+  if (!labels || !gitops.present) return undefined;
+  const ksName = labels["kustomize.toolkit.fluxcd.io/name"];
+  const ksNs = labels["kustomize.toolkit.fluxcd.io/namespace"];
+  if (ksName && ksNs) {
+    const hit = gitops.byRef.get(`K8s::Flux::Kustomization\0${ksNs}\0${ksName}`);
+    if (hit) return hit;
+  }
+  const hrName = labels["helm.toolkit.fluxcd.io/name"];
+  const hrNs = labels["helm.toolkit.fluxcd.io/namespace"];
+  if (hrName && hrNs) {
+    const hit = gitops.byRef.get(`K8s::Flux::HelmRelease\0${hrNs}\0${hrName}`);
+    if (hit) return hit;
+  }
+  const instance = labels["app.kubernetes.io/instance"];
+  if (instance) {
+    const hit = gitops.argoByName.get(instance);
+    if (hit) return hit; // null (ambiguous) and undefined both decline
+  }
+  return undefined;
+}
+
 async function addRuntimeChildren(
   client: K8sClient,
   resources: Record<string, ResourceMetadata>,
   owned: boolean | undefined,
   groupVersions: ReadonlySet<string> = new Set(),
+  declared: readonly Declared[] = [],
 ): Promise<void> {
   const declaredByUid = new Map<string, string>();
   for (const [entityName, meta] of Object.entries(resources)) {
     if (meta.physicalId) declaredByUid.set(meta.physicalId, entityName);
   }
 
+  // GitOps attribution (#1549): Argo and Flux stamp their managed objects with
+  // labels, not ownerReferences, so the chain walk never reaches a declared
+  // entity for them. The label channel resolves against the DECLARED CRs by
+  // (type, namespace, name) — exact for Flux (its labels carry both halves) —
+  // and by unique name for Argo (its instance label carries no namespace, and
+  // it doubles as a generic Helm label, so anything ambiguous resolves to
+  // nothing: the module's standing conservatism).
+  const gitops = gitopsIndex(declared);
+
   const namespaces = new Set<string>();
   for (const meta of Object.values(resources)) {
     const namespace = (meta.attributes as { namespace?: string } | undefined)?.namespace;
     if (namespace) namespaces.add(namespace);
   }
+  // The namespaces a declared GitOps CR TARGETS are declared literals too
+  // (Argo `spec.destination.namespace`, Flux `spec.targetNamespace`) — the
+  // controller puts the workloads there, so the scan must look there, and
+  // reading it off the declaration keeps this bounded by the estate, never a
+  // cluster-wide sweep.
+  for (const ns of gitops.targetNamespaces) namespaces.add(ns);
   if (namespaces.size === 0) return;
 
   // The kinds to scan: Pods, plus each declared groupVersion's namespaced,
@@ -384,6 +506,18 @@ async function addRuntimeChildren(
   const kinds: Array<{ apiVersion: string; kind: string; typeName: string }> = [
     { apiVersion: "v1", kind: "Pod", typeName: "K8s::Core::Pod" },
   ];
+  // A GitOps estate's managed WORKLOADS live in groups the estate itself never
+  // declares (a pure Argo/Flux estate declares only the CRs), so without this
+  // the label channel could only ever fire on Pods (#1549).
+  if (gitops.present) {
+    kinds.push(
+      { apiVersion: "apps/v1", kind: "Deployment", typeName: "K8s::Apps::Deployment" },
+      { apiVersion: "apps/v1", kind: "StatefulSet", typeName: "K8s::Apps::StatefulSet" },
+      { apiVersion: "apps/v1", kind: "DaemonSet", typeName: "K8s::Apps::DaemonSet" },
+      { apiVersion: "v1", kind: "Service", typeName: "K8s::Core::Service" },
+      { apiVersion: "v1", kind: "ConfigMap", typeName: "K8s::Core::ConfigMap" },
+    );
+  }
   for (const gv of [...groupVersions].sort()) {
     let infos;
     try {
@@ -413,7 +547,13 @@ async function addRuntimeChildren(
         if (!uid || !name || declaredByUid.has(uid)) return; // declared directly, or unaddressable
         if (resources[`${namespace}/${name}`]) return; // already reported by an earlier kind
 
-        const ownerChain = await resolveK8sOwnerChain(obj, { declaredByUid, reader: client, namespace });
+        let ownerChain = await resolveK8sOwnerChain(obj, { declaredByUid, reader: client, namespace });
+        // The label channel (#1549) — only when the chain itself said nothing:
+        // a verdict the walk DID reach is never overridden.
+        if (ownerChain.root !== "declared") {
+          const entity = gitopsOwner(obj.metadata?.labels, gitops);
+          if (entity) ownerChain = { root: "declared", entity };
+        }
 
         // `--owned`: withhold an object that is neither a runtime child of a
         // declared entity nor carrying chant's own marker — the same rule the

package/src/index.ts

@@ -9,6 +9,7 @@ export { k8sPlugin } from "./plugin";
 // cfn-deploy.
 export { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./components/capability-plugin";
 export { kubectlApplyCapability, createKubectlApplyCapability, type KubectlApplyInput } from "./components/kubectl-apply";
+export { kustomizeApplyCapability, createKustomizeApplyCapability, type KustomizeApplyInput } from "./components/kustomize-apply";
 
 // Default labels & annotations
 export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels";

package/src/op/activities/kubectl.test.ts

@@ -281,6 +281,28 @@ describe("kubectlApply", () => {
     expect(body.metadata?.labels).toBeUndefined();
   });
 
+  test("inline documents bypass the filesystem — the kustomize-apply seam (#1548)", async () => {
+    const cluster = fakeCluster({ respond: echoApplies });
+    const result = await applyManifest(
+      {
+        manifest: "kustomize:overlays/dev", // a label; nothing at this path
+        documents: [
+          { apiVersion: "v1", kind: "Namespace", metadata: { name: "web" } },
+          { apiVersion: "apps/v1", kind: "Deployment", metadata: { name: "app", namespace: "web" } },
+        ],
+        stack: "web",
+      },
+      undefined,
+      cluster.connector,
+    );
+    expect(result.applied.map((r) => r.kind)).toEqual(["Namespace", "Deployment"]);
+    // The documents were stamped like any read-from-disk manifest.
+    const body = JSON.parse(String(cluster.layer.requests.find((r) => r.method === "PATCH")!.body)) as {
+      metadata?: { labels?: Record<string, string> };
+    };
+    expect(body.metadata?.labels?.["chant.intentius.io/stack"]).toBe("web");
+  });
+
   test("an explicit context is honored and skips the environment lookup entirely", async () => {
     const file = join(dir, "k8s.yaml");
     writeFileSync(file, deploymentYaml);

package/src/op/activities/kubectl.ts

@@ -55,8 +55,21 @@ import { DEFAULT_IMPORT_TYPES } from "../../api/sweep-types";
 export type ApplyDeleteMode = "never" | "owned-only" | "gated";
 
 export interface KubectlApplyArgs {
-  /** Path to a manifest file, or a directory of them. */
+  /**
+   * Path to a manifest file, or a directory of them. With `documents` given,
+   * this becomes only the human-facing label the heartbeats and logs carry
+   * (e.g. `kustomize:<dir>`), and nothing is read from disk.
+   */
   manifest: string;
+  /**
+   * Already-parsed documents to apply INSTEAD of reading `manifest` (#1548):
+   * a renderer that produced the objects in memory — kustomize-apply's
+   * `kustomize build` — hands them straight in rather than round-tripping
+   * through a temp file. Everything downstream (ownership stamping, the
+   * marker-scoped prune, the self-conflict retake) is document-driven and
+   * behaves identically.
+   */
+  documents?: K8sObject[];
   /**
    * kubectl context name. Uses the ambient context if omitted. To target the
    * same cluster the read path (`describeResources`) resolved for an
@@ -285,7 +298,7 @@ export async function applyManifest(
   signal?: AbortSignal,
   connect: K8sConnector = defaultK8sConnector,
 ): Promise<ApplyManifestResult> {
-  const documents = readManifestDocuments(args.manifest);
+  const documents = args.documents ?? readManifestDocuments(args.manifest);
   const { fieldManager, stack } = await resolveApplyIdentity(args);
   const heartbeatInterval = setInterval(() => {
     safeHeartbeat({ step: "kubectl apply", manifest: args.manifest });

package/src/op/activities/wait-for-ready.test.ts

@@ -49,6 +49,33 @@ describe("readiness model", () => {
     expect(isReady(obj, DEFAULT_READINESS)).toBe(true);
   });
 
+  test("Flux overrides fail fast on Ready=False wedge reasons, wait on ordinary progress (#1549)", () => {
+    // A Flux wedge (bad build, failed upgrade, unreachable source) keeps
+    // Ready=False forever — before these entries the generic poll waited out
+    // its whole timeout. The ready half is still the kstatus default.
+    const spec = readinessFor("kustomize.toolkit.fluxcd.io", "Kustomization");
+    expect(spec).not.toBe(DEFAULT_READINESS);
+    expect(isReady(ready([{ type: "Ready", status: "True" }]), spec)).toBe(true);
+
+    const wedged = ready([{ type: "Ready", status: "False", reason: "BuildFailed" } as never]);
+    expect(isReady(wedged, spec)).toBe(false);
+    expect(firstTerminal(wedged, spec)).toBeDefined();
+
+    // Ready=False with a PROGRESS reason (a reconcile in flight) is not a
+    // wedge — keep polling.
+    const progressing = ready([{ type: "Ready", status: "False", reason: "Progressing" } as never]);
+    expect(firstTerminal(progressing, spec)).toBeUndefined();
+
+    // A reason on a TRUE condition is vocabulary, never terminal.
+    const healthyWithReason = ready([{ type: "Ready", status: "True", reason: "ReconciliationSucceeded" } as never]);
+    expect(firstTerminal(healthyWithReason, spec)).toBeUndefined();
+
+    const hr = readinessFor("helm.toolkit.fluxcd.io", "HelmRelease");
+    expect(firstTerminal(ready([{ type: "Ready", status: "False", reason: "UpgradeFailed" } as never]), hr)).toBeDefined();
+    const git = readinessFor("source.toolkit.fluxcd.io", "GitRepository");
+    expect(firstTerminal(ready([{ type: "Ready", status: "False", reason: "AuthenticationFailed" } as never]), git)).toBeDefined();
+  });
+
   test("Argo override uses health/sync, not a Ready condition", () => {
     const spec = readinessFor("argoproj.io", "Application");
     expect(spec).not.toBe(DEFAULT_READINESS);

package/src/op/activities/wait-for-ready.ts

@@ -40,7 +40,23 @@ export interface PathMatch {
   // With neither `equals` nor `oneOf`, holds when the value is present (non-null).
 }
 
-export type ReadinessMatch = ConditionMatch | PathMatch;
+/**
+ * Match a `status.conditions[]` entry by `type` AND its `reason` (#1549).
+ * The dot-path walk can't index into a conditions array, and the Flux
+ * toolkit's failure signal is exactly `conditions[type=Ready].reason` — a
+ * wedge like `BuildFailed` keeps `Ready=False` forever while the generic
+ * poll waits out its whole timeout. `status` defaults to "False": a reason
+ * on a True condition is progress vocabulary, not a wedge.
+ */
+export interface ConditionReasonMatch {
+  conditionType: string;
+  /** Required `status` of the condition (default "False"). */
+  status?: string;
+  /** Holds when the condition's `reason` is one of these. */
+  reasonOneOf: string[];
+}
+
+export type ReadinessMatch = ConditionMatch | PathMatch | ConditionReasonMatch;
 
 export interface ReadinessSpec {
   /** All must hold for the resource to be ready. */
@@ -69,6 +85,19 @@ export const DEFAULT_READINESS: ReadinessSpec = {
  * reports `health`/`sync`, not a `Ready` condition — the case that proves the
  * override is necessary (#365).
  */
+/**
+ * Flux toolkit wedge reasons (#1549): a `Ready=False` with one of these
+ * `reason`s does not heal by waiting — a bad build, a failed install, an
+ * unreachable or invalid source. The toolkit is kstatus-conformant, so the
+ * READY half of every entry below is just the default; the value added is
+ * failing fast instead of polling out the full timeout.
+ */
+const FLUX_TERMINAL = (reasons: string[]): ReadinessSpec => ({
+  ready: [{ conditionType: "Ready", status: "True" }],
+  terminal: [{ conditionType: "Ready", reasonOneOf: reasons }],
+  observedGeneration: true,
+});
+
 export const READINESS_OVERRIDES: Record<string, ReadinessSpec> = {
   "argoproj.io/Application": {
     ready: [
@@ -78,6 +107,38 @@ export const READINESS_OVERRIDES: Record<string, ReadinessSpec> = {
     terminal: [{ path: "status.health.status", oneOf: ["Degraded", "Missing"] }],
     observedGeneration: false,
   },
+  "kustomize.toolkit.fluxcd.io/Kustomization": FLUX_TERMINAL([
+    "BuildFailed",
+    "HealthCheckFailed",
+    "ReconciliationFailed",
+    "ArtifactFailed",
+    "PruneFailed",
+  ]),
+  "helm.toolkit.fluxcd.io/HelmRelease": FLUX_TERMINAL([
+    "InstallFailed",
+    "UpgradeFailed",
+    "RollbackFailed",
+    "UninstallFailed",
+    "ArtifactFailed",
+    "ChartPullError",
+  ]),
+  "source.toolkit.fluxcd.io/GitRepository": FLUX_TERMINAL([
+    "AuthenticationFailed",
+    "GitOperationFailed",
+    "URLInvalid",
+    "StorageOperationFailed",
+  ]),
+  "source.toolkit.fluxcd.io/OCIRepository": FLUX_TERMINAL([
+    "AuthenticationFailed",
+    "OCIPullFailed",
+    "URLInvalid",
+    "StorageOperationFailed",
+  ]),
+  "source.toolkit.fluxcd.io/HelmChart": FLUX_TERMINAL([
+    "ChartPullError",
+    "ChartPackageError",
+    "StorageOperationFailed",
+  ]),
 };
 
 /** Resolve the readiness spec for a resource: registry override, else default. */
@@ -94,15 +155,31 @@ function getPath(obj: unknown, path: string): unknown {
   );
 }
 
+function isConditionReason(m: ReadinessMatch): m is ConditionReasonMatch {
+  return (m as ConditionReasonMatch).reasonOneOf !== undefined;
+}
+
 function isCondition(m: ReadinessMatch): m is ConditionMatch {
-  return (m as ConditionMatch).conditionType !== undefined;
+  return (m as ConditionMatch).conditionType !== undefined && !isConditionReason(m);
 }
 
-function matchCondition(obj: unknown, m: ConditionMatch): boolean {
+function findCondition(obj: unknown, conditionType: string): Record<string, unknown> | undefined {
   const conds = getPath(obj, "status.conditions");
-  if (!Array.isArray(conds)) return false;
-  const c = conds.find((x) => x && typeof x === "object" && (x as Record<string, unknown>).type === m.conditionType);
-  return !!c && String((c as Record<string, unknown>).status) === (m.status ?? "True");
+  if (!Array.isArray(conds)) return undefined;
+  return conds.find((x) => x && typeof x === "object" && (x as Record<string, unknown>).type === conditionType) as
+    | Record<string, unknown>
+    | undefined;
+}
+
+function matchCondition(obj: unknown, m: ConditionMatch): boolean {
+  const c = findCondition(obj, m.conditionType);
+  return !!c && String(c.status) === (m.status ?? "True");
+}
+
+function matchConditionReason(obj: unknown, m: ConditionReasonMatch): boolean {
+  const c = findCondition(obj, m.conditionType);
+  if (!c || String(c.status) !== (m.status ?? "False")) return false;
+  return typeof c.reason === "string" && m.reasonOneOf.includes(c.reason);
 }
 
 function matchPath(obj: unknown, m: PathMatch): boolean {
@@ -113,6 +190,7 @@ function matchPath(obj: unknown, m: PathMatch): boolean {
 }
 
 function matches(obj: unknown, m: ReadinessMatch): boolean {
+  if (isConditionReason(m)) return matchConditionReason(obj, m);
   return isCondition(m) ? matchCondition(obj, m) : matchPath(obj, m);
 }