@intentius/chant-lexicon-k8s 0.44.14 → 0.45.0

package/dist/codegen/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqHH;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4iC9E"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqHH;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB9E"}

package/dist/codegen/generate-lexicon.d.ts

@@ -3,7 +3,7 @@
  * for all Kubernetes resource and property types.
  */
 import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
-import type { K8sParseResult } from "../spec/parse.js";
+import type { K8sParseResult, CrdFieldSchema } from "../spec/parse.js";
 import type { NamingStrategy } from "./naming.js";
 export interface K8sLexiconEntry {
     resourceType: string;
@@ -13,9 +13,23 @@ export interface K8sLexiconEntry {
     gvkKind?: string;
     deprecatedProperties?: string[];
     constraints?: Record<string, PropertyConstraints>;
+    /**
+     * Field schema of a custom resource's `spec` (chant #1372). Only CRD-derived
+     * kinds carry one; built-in kinds are typed by the `.d.ts`. Consumed by the
+     * WK8501/WK8502 post-synth checks and the MCP catalog.
+     */
+    specSchema?: CrdFieldSchema;
 }
 /**
  * Generate the lexicon-k8s.json content.
  */
 export declare function generateLexiconJSON(results: K8sParseResult[], naming: NamingStrategy): string;
+/**
+ * Pretty-print the registry the way every lexicon does, but keep each
+ * `specSchema` on one line (chant #1372). A CRD schema nests deeply — an
+ * ApplicationSet or RayCluster embeds a whole PodTemplateSpec — and two-space
+ * indentation on that tree quadruples the file for no reader's benefit.
+ * Compact, the schemas add ~0.8 MB to the registry; pretty, ~3.9 MB.
+ */
+export declare function serializeWithCompactSchemas(entries: Record<string, K8sLexiconEntry>): string;
 //# sourceMappingURL=generate-lexicon.d.ts.map

package/dist/codegen/generate-lexicon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-lexicon.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-lexicon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAO/C,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EAAE,EACzB,MAAM,EAAE,cAAc,GACrB,MAAM,CAqCR"}
+{"version":3,"file":"generate-lexicon.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-lexicon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAO/C,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAClD;;;;OAIG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EAAE,EACzB,MAAM,EAAE,cAAc,GACrB,MAAM,CAwCR;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,MAAM,CAkB5F"}

package/dist/components/capability-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAWA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAMzG,eAAO,MAAM,iBAAiB;;;CAKpB,CAAC;AAEX,eAAO,MAAM,mBAAmB,EAAE,gBAgBjC,CAAC"}
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAWA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAMzG,eAAO,MAAM,iBAAiB;;;CAKpB,CAAC;AAEX,eAAO,MAAM,mBAAmB,EAAE,gBAmBjC,CAAC"}

package/dist/crd/parser.d.ts

@@ -6,7 +6,7 @@
  * main K8s swagger parser. This enables CRD-based resources to integrate
  * with the full codegen pipeline.
  */
-import type { K8sParseResult } from "../spec/parse.js";
+import type { K8sParseResult, CrdFieldSchema } from "../spec/parse.js";
 import type { CRDSpec } from "./types.js";
 /**
  * Parse a CRD YAML document string into K8sParseResult entries.
@@ -18,4 +18,31 @@ export declare function parseCRD(content: string): K8sParseResult[];
  * Extracts one result per served version with storage version preferred.
  */
 export declare function parseCRDSpec(spec: CRDSpec): K8sParseResult[];
+interface OpenAPISchema {
+    type?: string;
+    description?: string;
+    properties?: Record<string, OpenAPISchema>;
+    required?: string[];
+    items?: OpenAPISchema;
+    additionalProperties?: boolean | OpenAPISchema;
+    enum?: string[];
+    format?: string;
+    minimum?: number;
+    maximum?: number;
+    minLength?: number;
+    maxLength?: number;
+    pattern?: string;
+    default?: unknown;
+    "x-kubernetes-preserve-unknown-fields"?: boolean;
+    "x-kubernetes-int-or-string"?: boolean;
+}
+/**
+ * Reduce an `openAPIV3Schema` node to the compact {@link CrdFieldSchema} the
+ * lexicon JSON ships. Walks the whole tree; drops descriptions, formats,
+ * defaults and numeric bounds. `allOf`/`oneOf`/`anyOf` are not modelled — a
+ * node that relies on them with no `type` of its own comes out untyped, which
+ * the validators treat as "anything goes".
+ */
+export declare function toFieldSchema(node: OpenAPISchema): CrdFieldSchema;
+export {};
 //# sourceMappingURL=parser.d.ts.map

package/dist/crd/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/crd/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAoD5D"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/crd/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,cAAc,EAId,cAAc,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAqB1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAyD5D;AAID,UAAU,aAAa;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,oBAAoB,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IAC/C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sCAAsC,CAAC,EAAE,OAAO,CAAC;IACjD,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAoLD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,cAAc,CA0CjE"}

package/dist/deep-observe-hooks.d.ts

@@ -22,14 +22,18 @@
  * are sets addressed by a well-known identity (containers by name, ports by
  * containerPort+protocol). None of that needs a live object in hand.
  *
- * What does *not* live here is the managed-fields prune — whether one
- * specific field on one specific live object is chant-owned, foreign-owned,
- * or contested. That is inherently per-object (it depends on *that* object's
+ * What does *not* live here is the managed-fields ownership walk — which
+ * manager owns one specific field on one specific live object. That is
+ * inherently per-object (it depends on *that* object's
  * `metadata.managedFields`, which the declared tree never carries and which
  * differs between two Deployments of the same type), so it cannot be
  * expressed as a fixed rule keyed only by entity type and path — the shape
  * every other hook in this file takes. `./deep-observe.ts` computes it once
- * per resource and layers it on top of the rules below.
+ * per resource and attaches it to the observation as `fieldOwners`. Since
+ * chant #1191 ownership no longer prunes anything: a foreign-owned field
+ * nobody declared is reported as `undeclared` drift, and the only static
+ * subtraction for foreign writes is `K8S_SYSTEM_METADATA_PRUNE_PATTERNS`
+ * (core's `managed-fields`), applied below.
  *
  * The *entity-type-agnostic* half of these rules — which fields every
  * Kubernetes API object carries regardless of kind, and the well-known
@@ -73,6 +77,57 @@ export declare const K8S_SERVICE_DEFAULTS: Record<string, Record<string, unknown
  * is still compared, only the purely server-filled appearance is noise.
  */
 export declare const K8S_SERVER_ASSIGNED_PATTERNS: Record<string, ReadonlySet<string>>;
+/**
+ * The k8s lexicon's static noise rules: the generic Kubernetes object
+ * envelope (unconditional, by pattern, `@intentius/chant/managed-fields`) and
+ * Kubernetes-defaulted fields (gated on `counterpart === "absent"`), plus the
+ * array orderings.
+ *
+ * The orderings are now taken from the spec itself (chant #1441): codegen
+ * carries `x-kubernetes-list-type`/`x-kubernetes-list-map-keys` through into
+ * `./generated/list-map-keys.json`, and {@link schemaListMapOrderKey} reads
+ * it. The hand-written conventions in
+ * `@intentius/chant/managed-fields`'s `k8sListMapOrderKey` — containers by
+ * `name`, `env` by `name`, `volumes` by `name`, container/service `ports` by
+ * `containerPort`/`port` + `protocol` — remain as the fallback for lists the
+ * spec does not annotate, and for readers that have no generated table at all
+ * (GCP's Config Connector hooks).
+ *
+ * This is the object `k8sPlugin.deepNormalizationHooks` is. It is also what
+ * `./deep-observe.ts` layers its per-resource managed-fields prune on top of,
+ * so the two normalization passes (the reader's own, and core's later
+ * re-normalization of both the declared and the already-normalized live tree
+ * — see `packages/core/src/lifecycle/deep-observe.ts`) apply the identical
+ * entityType-keyed rules either way.
+ */
+/** Property name → candidate key-field sets, generated from the spec (chant #1441). */
+type ListMapKeyTable = Record<string, string[][]>;
+/**
+ * Where the generated table lives: next to this module, resolved from
+ * `import.meta.url`. This module ships as ESM (tsx strips types from src/
+ * directly), where a bare `require` is not defined — the #1441 regression
+ * crashed `lifecycle diff --live` with `require is not defined` on every
+ * estate with a Deployment, and azure's apiVersion registry hit the same
+ * class of bug in #1581. A plain fs read has no module-system dependency.
+ */
+export declare function listMapKeyTablePath(): string;
+/**
+ * Load the spec-derived table once. A missing or unreadable file degrades to
+ * an EMPTY table, which routes every list through `k8sListMapOrderKey`'s
+ * hand-written conventions — the same fallback an unlisted property already
+ * takes. The empty table is cached by the caller too, so an absent artifact
+ * costs one failed read and one warning, not one per array element
+ * (chant #1476).
+ *
+ * Degrading is the right call here, unlike azure's apiVersion registry
+ * (#1581) where a silent fallback bypasses correctness-bearing pins. Without
+ * the table, drift detection narrows back to the six hardcoded properties:
+ * less coverage, never wrong answers. The warning names the regen command so
+ * the narrowing is not silent.
+ */
+export declare function loadListMapKeyTable(path?: string): ListMapKeyTable;
+/** Test hook: replace (or drop) the cached table so the next lookup reloads it. */
+export declare function resetListMapKeyTableCache(table?: ListMapKeyTable): void;
 /**
  * Order an associative list's element by the identity the SPEC declares for it
  * (chant #1441), falling back to `@intentius/chant/managed-fields`'s hand-written
@@ -88,4 +143,5 @@ export declare const K8S_SERVER_ASSIGNED_PATTERNS: Record<string, ReadonlySet<st
  */
 export declare function schemaListMapOrderKey(element: DeepArrayElement): string | undefined;
 export declare const k8sDeepNormalizationHooks: DeepNormalizationHooks;
+export {};
 //# sourceMappingURL=deep-observe-hooks.d.ts.map

package/dist/deep-observe-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAY,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAanG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoCxE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAE5E,CAAC;AAiGF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAYnF;AAMD,eAAO,MAAM,yBAAyB,EAAE,sBAmBvC,CAAC"}
+{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAY,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAQnG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoCxE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAE5E,CAAC;AA+BF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,uFAAuF;AACvF,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAIlD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAA8B,GAAG,eAAe,CAWzF;AAeD,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,IAAI,CAEvE;AAmCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAYnF;AAMD,eAAO,MAAM,yBAAyB,EAAE,sBA4BvC,CAAC"}

package/dist/deep-observe.d.ts

@@ -7,8 +7,7 @@
  * rather than the hand-maintained `ignoreDifferences` list every Argo user
  * keeps.
  *
- * ## Why this is not "the AWS reader, with `kubectl get` instead of Cloud
- * Control"
+ * ## What managedFields decides, and what it does not
  *
  * AWS, Azure and Temporal's rows all prune by a **static, entityType-keyed**
  * table: an ARN always looks like an ARN, `provisioningState` is always
@@ -17,65 +16,43 @@
  * what `./deep-observe-hooks.ts`'s `k8sDeepNormalizationHooks` is, and it
  * covers Kubernetes' *equivalent* static noise (`status`,
  * `metadata.{uid,resourceVersion,generation,creationTimestamp}`, a handful of
- * server-defaulted pod-spec fields).
+ * server-defaulted pod-spec fields, and the annotations and labels
+ * Kubernetes' own controllers stamp on every object of a kind —
+ * `K8S_SYSTEM_METADATA_PRUNE_PATTERNS` in `@intentius/chant/managed-fields`).
  *
- * managedFields is not that kind of rule. Whether `spec.replicas` is noise on
- * *this* Deployment depends on whether *this* Deployment's
- * `metadata.managedFields` says a controller owns it — a fact that differs
- * between two Deployments of the same type, and that the declared tree never
- * carries at all (chant's source has no `managedFields` key to normalize).
- * `DeepNormalizationHooks.prune` cannot see the object it is walking, only a
- * path and a value, so this cannot be expressed as a fixed hook the way the
- * other three rows' entire contribution is. It has to be computed once per
- * resource, here, and layered on top of the static rules before the tree is
- * normalized.
+ * managedFields is a different kind of fact. Which manager owns
+ * `spec.replicas` on *this* Deployment differs between two Deployments of
+ * the same type, and the declared tree never carries it at all (chant's
+ * source has no `managedFields` key to normalize). It has to be resolved once
+ * per resource, here, against the object in hand.
  *
- * ## The contested-field rule, precisely
+ * Until chant #1191 that resolution *pruned*: a foreign-owned path nobody
+ * declared was dropped before the tree reached core, on the theory that it
+ * was controller noise. It silenced exactly the case the deep read exists
+ * for — `kubectl label deploy web team=platform` is foreign-owned
+ * (`kubectl-edit`) and undeclared, and never appeared in fieldDrift. The
+ * policy now (recorded on #1202) is:
  *
- * For every path on the live tree, three questions, each independent:
+ * 1. **Chant-owned** (`chant`, `chant:<stack>` — chant #1075, matched on the
+ *    family so a stack rename does not stop recognizing its own history) is
+ *    always diffable.
+ * 2. **Declared, whoever owns it live** (a contested field) is always
+ *    diffable: chant's source is a statement of intent independent of which
+ *    write currently holds the field, and a foreign write that overrides a
+ *    value chant's manifest asks for is the thing `lifecycle diff --live`
+ *    exists to surface. It reports as `changed`.
+ * 3. **Foreign-owned and undeclared** is reported as `undeclared` drift,
+ *    unless the accepted baseline already carries it at that value. The
+ *    baseline (`--update-baseline`) is the noise valve: an HPA that owns
+ *    `spec.replicas` on a Deployment whose source is silent about replicas
+ *    reports once, gets accepted, and stays quiet until the value moves.
  *
- * 1. **Does any chant field manager (`chant`, `chant:<stack>` — chant #1075,
- *    matched on the family so a stack rename does not stop recognizing its
- *    own history) own this path?** If so it is chant's business regardless of
- *    what else is true — always diffable, never pruned by this rule.
- * 2. **Does some *other* manager own this path, and chant does not?** That is
- *    controller-managed noise — HPA rewriting `spec.replicas`, a mutating
- *    webhook defaulting a field, `kubectl-client-side-apply` from a human
- *    operator — *provided* nobody declared it (next question). Prune it.
- * 3. **Does chant's own manifest *also* set this path?** — independent of
- *    who currently owns it live. This is the case the issue calls out by
- *    name: **a contested field chant declared is drift-relevant.** The
- *    reasoning: chant's source is a statement of intent regardless of
- *    whether a previous apply is what currently holds the field, and a
- *    foreign write that overrides a value chant's manifest asks for is
- *    exactly the thing `lifecycle diff --live` exists to surface — silencing
- *    it because *something else* currently owns the field would hide the one
- *    case where chant and the cluster disagree about a property chant is
- *    actively declaring. So: foreign-owned *and* declared is never pruned by
- *    this rule, whatever #2 would otherwise do.
- *
- * `counterpart: "unknown"` and why it does not help here: core's own
- * counterpart tri-state (`side === "live" && counterpart === "absent"`, what
- * {@link K8S_SERVICE_DEFAULTS} is gated on) answers "did the *declared tree*
- * carry this path at all" — which is exactly question 3, but it is computed
- * by *core*, from the raw declared and raw live trees, only on the **second**
- * normalization pass (`packages/core/src/lifecycle/deep-observe.ts`'s
- * `diffDeepObservation`). This reader's own call to
- * {@link normalizeDeepProperties} runs first, with no `counterpartPaths`
- * supplied — same as the other three rows — so `counterpart` is `"unknown"`
- * for every node here, and a rule gated on `"absent"` would never fire during
- * this read at all. That is fine for a table keyed only by entityType (AWS's
- * service defaults are subtracted on core's later pass, not this one), but it
- * is *not* fine for the managed-fields rule: if this reader left
- * `spec.replicas` in the tree waiting for core's second pass to prune it,
- * core would be normalizing with the *static* `k8sDeepNormalizationHooks`,
- * which has no managedFields for this object in hand either (this reader
- * already computed its ownership sets from data it read once and does not
- * return). So question 3 is answered **here**, directly against the declared
- * `props` this reader was handed — not via `counterpart` — and the result is
- * baked into what this reader returns: a foreign-owned, undeclared field is
- * gone from the tree before it ever reaches core, and a contested one is
- * still there for the ordinary declared-vs-live comparison to catch.
+ * So ownership decides nothing about *whether* a path is compared. What it
+ * contributes is `fieldOwners` (#1189): every reported drift names the
+ * manager that holds the field live, which is how an operator tells
+ * `hpa-controller` doing its job from somebody running `kubectl edit`. The
+ * only fields subtracted because a foreign manager wrote them are the
+ * well-known system ones on the static allowlist.
  *
  * ## Resolving a managedFields entry against a live array
  *
@@ -99,10 +76,8 @@
  * container that also sets no scalar sub-fields (unusual — a real apply
  * setting a container almost always sets `image`/`name` too) would not confer
  * ownership onto a sibling field nobody's `fieldsV1` entry lists explicitly.
- * That is the conservative direction: a path absent from every manager's
- * fields is treated as "no ownership information", which leaves it diffable
- * rather than silently pruned. Reported drift that turns out to be more
- * noise than expected is a tuning problem; drift silently dropped is not.
+ * A path absent from every manager's fields simply has no `owner` on its
+ * drift line; it is compared like any other.
  *
  * ## `buildOwnershipSets` lives in core now
  *

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqHG;AAGH,OAAO,KAAK,EAEV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAoB,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC3G,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AASjE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAuBD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAiHhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACzF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AASjE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAQD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAgHhC"}

package/dist/integrity.json

@@ -1,8 +1,8 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "5793f99bc43b1e32a3b9c58246e7c3e7781efb03ad8e13e05a5c6d980b8d61fd",
-    "meta.json": "f568fb8a0cbd4adf041baccaa3e1164c2e3c5c0090186236f887f0084f5521a8",
+    "manifest.json": "d494ac9907d9da8ddb4456e697be2efe6e5d238df855db3c62abeb7d7036f406",
+    "meta.json": "6ec9419aa1aed8402b7957955f2a67e8c641861cfd3650886fb0898db5df14f6",
     "types/index.d.ts": "ef2c9df6a4d1ebfbe33f96c094fbbe3fc7909522ea38e086666fbf3c8ac477fd",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
     "rules/argo-ast.ts": "f57b7d84fef9c9cd326a7cad0dff290914e01299415d64bdab48e2f6eb4181c3",
@@ -15,6 +15,7 @@
     "rules/argo002.ts": "d2f07daabfc7a4624d3d60ea151fd2380d43f1578dd6a17825f6f6e0ebc610ba",
     "rules/argo003.ts": "a61024fbd3db772eface6b2e4fee618a5818f12a1050faea8e358e0fdc992396",
     "rules/argo005.ts": "611ea489e005e3ead925013e636f0d7c6899fd0ce68c59a97541fc6fe4e8d25c",
+    "rules/crd-schema-helpers.ts": "62e8d3d3557f6046ead90cce7198aa1f59838acc7b4229c5dda0cf2a2893fec9",
     "rules/flux002.ts": "4269ce13121bc5b28c02aad06765dc85085a1c9ebcc936ae958663b85de07bc6",
     "rules/flux003.ts": "a174af9941bd2491a9bbf72039ab2fc4d4f4de388b2884ddf7123f05594d9d4e",
     "rules/k8s-helpers.ts": "d7d5020bc9b47bfb1827e8c8cb13ad1d406890d08a964a521c9fbcb93b230827",
@@ -44,6 +45,8 @@
     "rules/wk8401.ts": "860e5104d53158ebea790f5acc3d34b82d666c4808d8ee5de44b68c1c602af77",
     "rules/wk8402.ts": "91c58dc146c6aa44b93f167fd5ed8c16cb5dc95e9d99f40685d9d0acdf7eb474",
     "rules/wk8403.ts": "abf42e48d9539768856d71d365b5e6cbb9d4800b9f890809b70d181641a86b98",
+    "rules/wk8501.ts": "7de8c368ae0b0a2678441a97ec6bed8172f1f127bad6a8441b39ea8d1d4f1dd3",
+    "rules/wk8502.ts": "c13813543b4ec42b9b87d2ebfe20bae3e6e954a8d7c4e9387581a753484aa778",
     "skills/chant-k8s.md": "222268f9e6b19912ece4b066d8897f009b90a3fe6f14e9c5059d0717e7ee0f82",
     "skills/chant-k8s-patterns.md": "683148e9f0f9da6879bd65d97c82cc29dbff897e31bc11b3c1de654cd6baeea3",
     "skills/chant-k8s-deployment-strategies.md": "c4cc93cba064230567baa755b5a3493dc69bfc6e74a62e1990d12039ffaaf5f8",
@@ -54,5 +57,5 @@
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5",
     "skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
   },
-  "composite": "24d9f9ce05e0ea1994936c42632aea832968d17455afc5f041e40836771ce212"
+  "composite": "1594ddb769d445bb1e070ee0e591c94da0716f03f2a4681c6284992981cf616a"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAgCpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAkCpD,CAAC"}

package/dist/lint/post-synth/crd-schema-helpers.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Shared helpers for the custom-resource spec checks (WK8501, WK8502) — chant #1372.
+ *
+ * A CRD's constructor takes `spec: Record<string, unknown>`, so a misspelled
+ * or wrong-typed field type-checks, serializes, and is accepted by the API
+ * server (which prunes what the structural schema does not know) — the
+ * controller then runs with a default nobody chose. The generated lexicon JSON
+ * carries each CRD's `spec` field schema (`specSchema`); these helpers walk a
+ * synthesized manifest against it and report what the schema would reject.
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter.
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { CrdFieldSchema } from "../../spec/parse.js";
+import { type K8sManifest } from "./k8s-helpers.js";
+export type { CrdFieldSchema };
+/**
+ * Spec schemas of every CRD the lexicon ships, keyed by `apiVersion/kind`.
+ * Built-in kinds carry no `specSchema` and are never in the map.
+ */
+export declare function getCrdSchemaRegistry(): Map<string, CrdFieldSchema>;
+/** Test seam: replace the registry (pass `null` to reload from the lexicon JSON). */
+export declare function setCrdSchemaRegistry(registry: Map<string, CrdFieldSchema> | null): void;
+/** The schema for a manifest's `apiVersion`/`kind`, if the lexicon ships one. */
+export declare function specSchemaFor(manifest: K8sManifest): CrdFieldSchema | undefined;
+/** Every manifest in the build that has a shipped spec schema, with that schema. */
+export declare function customResources(ctx: PostSynthContext): Array<{
+    manifest: K8sManifest;
+    schema: CrdFieldSchema;
+}>;
+export interface SpecFinding {
+    kind: "unknown-field" | "type-mismatch";
+    /** Dotted path under `spec`, e.g. `spec.source.s3bucket`. Array elements use `[i]`. */
+    path: string;
+    message: string;
+}
+/**
+ * Walk `value` against `schema` and report every field the schema does not
+ * list (unless the enclosing object is `open`) and every scalar whose type or
+ * enum membership the schema rejects. Untyped nodes pass anything.
+ */
+export declare function validateSpec(value: unknown, schema: CrdFieldSchema, path?: string): SpecFinding[];
+/** Levenshtein distance between two strings. */
+export declare function levenshtein(a: string, b: string): number;
+/** Closest known field within Levenshtein distance 3 (case-insensitive), if any. */
+export declare function suggestField(unknown: string, known: string[]): string | undefined;
+/** `metadata.name` or the kind, for diagnostics. */
+export declare function resourceLabel(manifest: K8sManifest): string;
+//# sourceMappingURL=crd-schema-helpers.d.ts.map

package/dist/lint/post-synth/crd-schema-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crd-schema-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/crd-schema-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAuC,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAEtF,YAAY,EAAE,cAAc,EAAE,CAAC;AAgB/B;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAkBlE;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,GAAG,IAAI,CAEvF;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAG/E;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,KAAK,CAAC;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC,CAS/G;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,GAAG,eAAe,CAAC;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,SAAS,GAAG,WAAW,EAAE,CAIjG;AAgGD,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAcxD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAWjF;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAE3D"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAiCvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAgC3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAmCvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAkC3C,CAAC"}

package/dist/lint/post-synth/wk8501.d.ts

@@ -0,0 +1,14 @@
+/**
+ * WK8501: Custom resource spec has a field its CRD schema does not declare
+ *
+ * A generated CRD class takes `spec: Record<string, unknown>`, so a misspelled
+ * field (`classname` for `className`) type-checks and serializes. The API
+ * server accepts the object and prunes the unknown field, the controller
+ * never sees it, and the resource runs with a default nobody chose. The
+ * lexicon ships each CRD's `spec` schema (chant #1372); this check flags any
+ * field that schema does not list, unless the enclosing object declares
+ * `x-kubernetes-preserve-unknown-fields` or `additionalProperties`.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8501: PostSynthCheck;
+//# sourceMappingURL=wk8501.d.ts.map

package/dist/lint/post-synth/wk8501.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8501.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8501.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/lint/post-synth/wk8502.d.ts

@@ -0,0 +1,13 @@
+/**
+ * WK8502: Custom resource spec field has the wrong type or an invalid enum value
+ *
+ * With `spec: Record<string, unknown>` on every generated CRD class, nothing
+ * at compile time stops `replicas: "2"` or `desiredState: "Runing"`. The API
+ * server rejects the first at apply and the controller ignores the second.
+ * The lexicon ships each CRD's `spec` schema (chant #1372); this check
+ * compares every scalar against its declared type and enum before apply.
+ * `x-kubernetes-int-or-string` and untyped nodes accept anything.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wk8502: PostSynthCheck;
+//# sourceMappingURL=wk8502.d.ts.map

package/dist/lint/post-synth/wk8502.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wk8502.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wk8502.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.44.14",
+  "version": "0.45.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],