@intentius/chant-lexicon-k8s 0.45.0 → 0.46.0

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAwD,MAAM,0BAA0B,CAAC;AAGxH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAmBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA2CvD;AA4FD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAuBtE;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzC,GAAG,EAAE,SAAS,GACb,MAAM,GAAG,SAAS,CAIpB;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAgK5B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAwD,MAAM,0BAA0B,CAAC;AAGxH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAmBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA2CvD;AA4FD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAuBtE;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzC,GAAG,EAAE,SAAS,GACb,MAAM,GAAG,SAAS,CAIpB;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAmK5B"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "d494ac9907d9da8ddb4456e697be2efe6e5d238df855db3c62abeb7d7036f406",
+    "manifest.json": "0640b884facfca510e23b1d775b4973fa6644a3d502678e3a8f04c303148be03",
     "meta.json": "6ec9419aa1aed8402b7957955f2a67e8c641861cfd3650886fb0898db5df14f6",
     "types/index.d.ts": "ef2c9df6a4d1ebfbe33f96c094fbbe3fc7909522ea38e086666fbf3c8ac477fd",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -57,5 +57,5 @@
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5",
     "skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
   },
-  "composite": "1594ddb769d445bb1e070ee0e591c94da0716f03f2a4681c6284992981cf616a"
+  "composite": "4021f2a6439bc3da4d7659b7318d997d0d1c8ff70a813c7240094b4bf16e9605"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA2BjG,eAAO,MAAM,SAAS,EAAE,aAqqBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AA2BjG,eAAO,MAAM,SAAS,EAAE,aAkrBvB,CAAC"}

package/dist/teardown.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Env teardown for the k8s lexicon (chant #1222) — both halves of the
+ * `teardownOwned` / `executeTeardown` capability pair.
+ *
+ * Selection is the prune's marker selector (op/activities/kubectl.ts) with the
+ * env dimension added: `app.kubernetes.io/managed-by=chant` +
+ * `chant.intentius.io/stack=<stack>` + `chant.intentius.io/env=<env>`, sent to
+ * the server as a label selector and re-checked object by object with
+ * `readOwnership` — the server-side filter narrows the read, the client-side
+ * re-check is the one that matters, because a delete is not undoable.
+ *
+ * Swept kinds are chant's default sweep set (`DEFAULT_IMPORT_TYPES`, the same
+ * list the ownership-scoped prune unions in), listed cluster-wide: env
+ * teardown has no apply set to scope namespaces by, and the marker selector is
+ * the scope. A kind the cluster's discovery does not serve cannot hold a
+ * marked object and is skipped; a kind that resolves but fails to list is a
+ * hole (#1089) — unknown, never absent.
+ *
+ * Execution deletes the handed-over candidates through the typed client's own
+ * `delete()` — the identical delete the prune and `chant kube delete` use —
+ * with namespaces last, so a namespace's own members get individual outcomes
+ * before the cascade would have swallowed them. Before each delete the live
+ * object is re-read and its marker re-verified; an object that vanished is
+ * `deleted` (teardown is idempotent), one whose identity no longer matches is
+ * `not-prunable`, never deleted.
+ */
+import type { TeardownCandidate, TeardownEnumeration, TeardownExecution } from "@intentius/chant/lexicon";
+import { type OwnershipMarker } from "@intentius/chant/ownership";
+import { type K8sConnector } from "./api/connect.js";
+export interface K8sTeardownOptions {
+    environment: string;
+    marker: OwnershipMarker;
+}
+/**
+ * Enumerate the cluster's marker-matching objects — the k8s half of
+ * `chant lifecycle teardown <env>` planning.
+ */
+export declare function teardownOwned(options: K8sTeardownOptions, connect?: K8sConnector): Promise<TeardownEnumeration>;
+/**
+ * Delete the handed-over candidates, namespaces last. One outcome per
+ * candidate, always.
+ */
+export declare function executeTeardown(options: K8sTeardownOptions & {
+    candidates: TeardownCandidate[];
+}, connect?: K8sConnector): Promise<TeardownExecution>;
+//# sourceMappingURL=teardown.d.ts.map

package/dist/teardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../src/teardown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAGlB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAIvE,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAoBD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CA4D9B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAAG;IAAE,UAAU,EAAE,iBAAiB,EAAE,CAAA;CAAE,EACjE,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAe5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,7 +76,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "optionalDependencies": {
-    "@intentius/chant-k8s-client": "^0.45.0"
+    "@intentius/chant-k8s-client": "^0.46.0"
   },
   "devDependencies": {
     "@intentius/chant": "*",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.45.0",
+    "@intentius/chant": "^0.46.0",
     "typescript": "^5.9.3"
   }
 }

package/src/describe-resources.ts

@@ -56,7 +56,7 @@
 
 import type { ObservationResult, ResourceMetadata, UnobservedEntity, UnobservedReason } from "@intentius/chant/lexicon";
 import { observation, unobservedAll } from "@intentius/chant/observation";
-import { hasOwnershipMarker, classifyOwnership, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+import { hasOwnershipMarker, classifyOwnership, readOwnership, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import type { K8sClient, K8sObject } from "@intentius/chant-k8s-client";
 import { defaultK8sConnector, type K8sConnector } from "./api/connect";
 import {
@@ -472,6 +472,9 @@ export async function describeResources(
         status: statusFromObject(obj),
         lastUpdated: obj.metadata?.creationTimestamp,
         ownership: classifyOwnership(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS),
+        // Marker identity (#1222): the stack/env labels stamped at synthesis,
+        // read back verbatim. Undefined when the managed-by label is absent.
+        marker: readOwnership(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS),
         attributes: pruneUndefined({
           namespace: obj.metadata?.namespace,
           labels: obj.metadata?.labels,
@@ -774,6 +777,8 @@ async function addRuntimeChildren(
         status: statusFromObject(obj),
         lastUpdated: obj.metadata?.creationTimestamp,
         ownership: classifyOwnership(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS),
+        // Marker identity (#1222), same rule as the declared-entity read above.
+        marker: readOwnership(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS),
         ownerChain,
         attributes: pruneUndefined({
           namespace,

package/src/lifecycle-integration.test.ts

@@ -279,5 +279,47 @@ describeObservationConformance({
         });
       },
     },
+    {
+      name: "a marker-stamped object surfaces its stack/env identity; a foreign one surfaces none (#1222)",
+      declared: ["web", "legacy"],
+      expectPresent: ["web", "legacy"],
+      expectMarker: { web: { stack: "shop", env: "prod" } },
+      expectNoMarker: ["legacy"],
+      run: () => {
+        clusterState.fail = undefined;
+        clusterState.objects = {
+          [objectKey("apps/v1", "Deployment", "web", "default")]: {
+            apiVersion: "apps/v1",
+            kind: "Deployment",
+            metadata: {
+              name: "web",
+              namespace: "default",
+              uid: "uid-1",
+              labels: {
+                "app.kubernetes.io/managed-by": "chant",
+                "chant.intentius.io/stack": "shop",
+                "chant.intentius.io/env": "prod",
+              },
+            },
+            status: { readyReplicas: 1, replicas: 1 },
+          },
+          [objectKey("apps/v1", "Deployment", "legacy", "default")]: {
+            apiVersion: "apps/v1",
+            kind: "Deployment",
+            metadata: { name: "legacy", namespace: "default", uid: "uid-2" },
+            status: { readyReplicas: 1, replicas: 1 },
+          },
+        };
+        return k8sPlugin.describeResources!({
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["web", "legacy"],
+          entities: new Map([
+            ["web", { entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web" } } }],
+            ["legacy", { entityType: "K8s::Apps::Deployment", props: { metadata: { name: "legacy" } } }],
+          ]),
+        });
+      },
+    },
   ],
 });

package/src/plugin.ts

@@ -678,6 +678,19 @@ const { deployment, service, serviceMonitor, prometheusRule } = MonitoredService
     return describeResources(options);
   },
 
+  // Env teardown (#1222): enumeration + execution over the marker label
+  // selector (managed-by + stack + env), through the same typed client the
+  // prune uses. Execution deletes namespaces last. See ./teardown.ts.
+  async teardownOwned(options) {
+    const { teardownOwned } = await import("./teardown");
+    return teardownOwned(options);
+  },
+
+  async executeTeardown(options) {
+    const { executeTeardown } = await import("./teardown");
+    return executeTeardown(options);
+  },
+
   /**
    * Deploy-unit presence + health for `chant components status --live`
    * (#1495 piece 3): a Kubernetes deploy unit is the label selector chant's

package/src/teardown.test.ts

@@ -0,0 +1,204 @@
+/**
+ * Env teardown over the fake cluster (chant #1222) — the k8s halves of the
+ * teardownOwned / executeTeardown capability pair, mirroring the typed-prune
+ * tests in op/activities/kubectl.test.ts: a real client over a fake request
+ * layer, so discovery, path construction, and the delete path all run for
+ * real.
+ */
+
+import { describe, test, expect } from "vitest";
+import { LABEL_OWNERSHIP_KEYS, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
+import { statusBody } from "@intentius/chant-k8s-client/testing";
+import { fakeCluster, objectKey, ownedObject } from "./api/fake-cluster";
+import { teardownOwned, executeTeardown } from "./teardown";
+
+const MARKER = { stack: "shop", env: "dev" };
+
+function markerLabels(stack: string, env?: string): Record<string, string> {
+  return {
+    [LABEL_OWNERSHIP_KEYS.managedBy]: OWNERSHIP_MANAGED_BY_VALUE,
+    [LABEL_OWNERSHIP_KEYS.stack]: stack,
+    ...(env ? { [LABEL_OWNERSHIP_KEYS.env]: env } : {}),
+  };
+}
+
+/** A cluster holding this env's estate plus every kind of near-miss. */
+function estateCluster(overrides: Parameters<typeof fakeCluster>[0] = {}) {
+  return fakeCluster({
+    objects: {
+      // Mine: full marker, this stack, this env.
+      [objectKey("apps/v1", "Deployment", "web", "prod-ns")]: ownedObject("apps/v1", "Deployment", "web", "prod-ns", {
+        metadata: { labels: markerLabels("shop", "dev") },
+      }),
+      [objectKey("v1", "Service", "cache", "prod-ns")]: ownedObject("v1", "Service", "cache", "prod-ns", {
+        metadata: { labels: markerLabels("shop", "dev") },
+      }),
+      [objectKey("v1", "Namespace", "dev-ns")]: ownedObject("v1", "Namespace", "dev-ns", undefined, {
+        metadata: { labels: markerLabels("shop", "dev") },
+      }),
+      // Near-misses: foreign stack, foreign env, env-less marker, unmarked.
+      [objectKey("apps/v1", "Deployment", "their-web", "prod-ns")]: ownedObject("apps/v1", "Deployment", "their-web", "prod-ns", {
+        metadata: { labels: markerLabels("blog", "dev") },
+      }),
+      [objectKey("apps/v1", "Deployment", "prod-twin", "prod-ns")]: ownedObject("apps/v1", "Deployment", "prod-twin", "prod-ns", {
+        metadata: { labels: markerLabels("shop", "prod") },
+      }),
+      [objectKey("apps/v1", "Deployment", "no-env", "prod-ns")]: ownedObject("apps/v1", "Deployment", "no-env", "prod-ns", {
+        metadata: { labels: markerLabels("shop") },
+      }),
+      [objectKey("apps/v1", "Deployment", "handmade", "prod-ns")]: {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { name: "handmade", namespace: "prod-ns", labels: { app: "handmade" } },
+      },
+    },
+    ...overrides,
+  });
+}
+
+describe("teardownOwned — marker-env-scoped enumeration", () => {
+  test("selects exactly the objects carrying this stack + env, nothing near", async () => {
+    const cluster = estateCluster();
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, cluster.connector);
+    expect(enumeration.candidates.map((c) => c.name).sort()).toEqual(["dev-ns", "prod-ns/cache", "prod-ns/web"]);
+    for (const candidate of enumeration.candidates) {
+      expect(candidate.marker).toEqual(MARKER);
+    }
+    const web = enumeration.candidates.find((c) => c.name === "prod-ns/web")!;
+    expect(web.type).toBe("K8s::Apps::Deployment");
+    expect(web.physicalId).toBe("uid-web");
+    expect(enumeration.holes ?? []).toEqual([]);
+  });
+
+  test("the selector is sent to the server: managed-by + stack + env", async () => {
+    const cluster = estateCluster();
+    await teardownOwned({ environment: "dev", marker: MARKER }, cluster.connector);
+    const listQueries = cluster.layer.requests
+      .filter((r) => r.method === "GET" && r.query.labelSelector !== undefined)
+      .map((r) => r.query.labelSelector);
+    expect(listQueries.length).toBeGreaterThan(0);
+    for (const selector of listQueries) {
+      expect(selector).toBe(
+        `${LABEL_OWNERSHIP_KEYS.managedBy}=${OWNERSHIP_MANAGED_BY_VALUE},` +
+        `${LABEL_OWNERSHIP_KEYS.stack}=shop,${LABEL_OWNERSHIP_KEYS.env}=dev`,
+      );
+    }
+  });
+
+  test("an object already terminating is not a candidate", async () => {
+    const cluster = fakeCluster({
+      objects: {
+        [objectKey("apps/v1", "Deployment", "leaving", "prod-ns")]: ownedObject("apps/v1", "Deployment", "leaving", "prod-ns", {
+          metadata: { labels: markerLabels("shop", "dev"), deletionTimestamp: "2026-08-23T00:00:00Z" } as never,
+        }),
+      },
+    });
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, cluster.connector);
+    expect(enumeration.candidates).toEqual([]);
+  });
+
+  test("a kind that fails to list is a hole, and the others still enumerate (#1089)", async () => {
+    const cluster = estateCluster({
+      respond: (req) => {
+        if (req.method === "GET" && req.path.endsWith("/deployments") && req.query.labelSelector !== undefined) {
+          return { status: 500, body: statusBody(500, "InternalError", "etcd is unhappy") };
+        }
+        return undefined;
+      },
+    });
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, cluster.connector);
+    expect(enumeration.candidates.map((c) => c.name).sort()).toEqual(["dev-ns", "prod-ns/cache"]);
+    const hole = (enumeration.holes ?? []).find((h) => h.name === "K8s::Apps::Deployment");
+    expect(hole).toBeDefined();
+    expect(hole!.reason).toBe("read-failed");
+  });
+});
+
+describe("executeTeardown — typed deletes, namespaces last", () => {
+  const candidates = [
+    { name: "dev-ns", type: "K8s::Core::Namespace", marker: MARKER },
+    { name: "prod-ns/web", type: "K8s::Apps::Deployment", physicalId: "uid-web", marker: MARKER },
+    { name: "prod-ns/cache", type: "K8s::Core::Service", marker: MARKER },
+  ];
+
+  test("deletes every candidate through the typed client, namespace last", async () => {
+    const cluster = estateCluster();
+    const execution = await executeTeardown({ environment: "dev", marker: MARKER, candidates }, cluster.connector);
+
+    expect(execution.outcomes.map((o) => ({ name: o.name, outcome: o.outcome }))).toEqual([
+      { name: "prod-ns/web", outcome: "deleted" },
+      { name: "prod-ns/cache", outcome: "deleted" },
+      { name: "dev-ns", outcome: "deleted" },
+    ]);
+    const deletes = cluster.layer.requests.filter((r) => r.method === "DELETE").map((r) => r.path);
+    expect(deletes).toEqual([
+      "/apis/apps/v1/namespaces/prod-ns/deployments/web",
+      "/api/v1/namespaces/prod-ns/services/cache",
+      "/api/v1/namespaces/dev-ns",
+    ]);
+  });
+
+  test("an already-absent candidate is deleted (idempotent), with no DELETE issued", async () => {
+    const cluster = fakeCluster({ objects: {} });
+    const execution = await executeTeardown(
+      { environment: "dev", marker: MARKER, candidates: [candidates[1]] },
+      cluster.connector,
+    );
+    expect(execution.outcomes).toEqual([
+      {
+        name: "prod-ns/web",
+        type: "K8s::Apps::Deployment",
+        physicalId: "uid-web",
+        outcome: "deleted",
+        detail: "already absent",
+      },
+    ]);
+    expect(cluster.layer.requests.filter((r) => r.method === "DELETE")).toEqual([]);
+  });
+
+  test("a live object whose marker changed since planning is not-prunable, never deleted", async () => {
+    const cluster = fakeCluster({
+      objects: {
+        [objectKey("apps/v1", "Deployment", "web", "prod-ns")]: ownedObject("apps/v1", "Deployment", "web", "prod-ns", {
+          metadata: { labels: markerLabels("blog", "dev") }, // re-stamped by someone else
+        }),
+      },
+    });
+    const execution = await executeTeardown(
+      { environment: "dev", marker: MARKER, candidates: [candidates[1]] },
+      cluster.connector,
+    );
+    expect(execution.outcomes[0].outcome).toBe("not-prunable");
+    expect(execution.outcomes[0].detail).toContain("marker identity");
+    expect(cluster.layer.requests.filter((r) => r.method === "DELETE")).toEqual([]);
+  });
+
+  test("a refused delete is a failed outcome with the server's message, not a throw", async () => {
+    const cluster = estateCluster({
+      respond: (req) =>
+        req.method === "DELETE"
+          ? { status: 403, body: statusBody(403, "Forbidden", "RBAC says no") }
+          : undefined,
+    });
+    const execution = await executeTeardown(
+      { environment: "dev", marker: MARKER, candidates: [candidates[1]] },
+      cluster.connector,
+    );
+    expect(execution.outcomes[0].outcome).toBe("failed");
+    expect(execution.outcomes[0].detail).toContain("RBAC says no");
+  });
+
+  test("a candidate of an unmapped type is not-prunable, not a crash", async () => {
+    const cluster = fakeCluster({ objects: {} });
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [{ name: "mystery", type: "K8s::NotAThing::Widget", marker: MARKER }],
+      },
+      cluster.connector,
+    );
+    expect(execution.outcomes[0].outcome).toBe("not-prunable");
+    expect(execution.outcomes[0].detail).toContain("no operation mapping");
+  });
+});

package/src/teardown.ts

@@ -0,0 +1,225 @@
+/**
+ * Env teardown for the k8s lexicon (chant #1222) — both halves of the
+ * `teardownOwned` / `executeTeardown` capability pair.
+ *
+ * Selection is the prune's marker selector (op/activities/kubectl.ts) with the
+ * env dimension added: `app.kubernetes.io/managed-by=chant` +
+ * `chant.intentius.io/stack=<stack>` + `chant.intentius.io/env=<env>`, sent to
+ * the server as a label selector and re-checked object by object with
+ * `readOwnership` — the server-side filter narrows the read, the client-side
+ * re-check is the one that matters, because a delete is not undoable.
+ *
+ * Swept kinds are chant's default sweep set (`DEFAULT_IMPORT_TYPES`, the same
+ * list the ownership-scoped prune unions in), listed cluster-wide: env
+ * teardown has no apply set to scope namespaces by, and the marker selector is
+ * the scope. A kind the cluster's discovery does not serve cannot hold a
+ * marked object and is skipped; a kind that resolves but fails to list is a
+ * hole (#1089) — unknown, never absent.
+ *
+ * Execution deletes the handed-over candidates through the typed client's own
+ * `delete()` — the identical delete the prune and `chant kube delete` use —
+ * with namespaces last, so a namespace's own members get individual outcomes
+ * before the cascade would have swallowed them. Before each delete the live
+ * object is re-read and its marker re-verified; an object that vanished is
+ * `deleted` (teardown is idempotent), one whose identity no longer matches is
+ * `not-prunable`, never deleted.
+ */
+
+import type {
+  TeardownCandidate,
+  TeardownEnumeration,
+  TeardownExecution,
+  TeardownHole,
+  TeardownOutcome,
+} from "@intentius/chant/lexicon";
+import {
+  LABEL_OWNERSHIP_KEYS,
+  OWNERSHIP_MANAGED_BY_VALUE,
+  readOwnership,
+  type OwnershipMarker,
+} from "@intentius/chant/ownership";
+import type { K8sClient } from "@intentius/chant-k8s-client";
+import { DEFAULT_IMPORT_TYPES } from "./api/sweep-types";
+import { operationFor } from "./api/operation-surface";
+import { defaultK8sConnector, type K8sConnector } from "./api/connect";
+
+const NAMESPACE_TYPE = "K8s::Core::Namespace";
+
+export interface K8sTeardownOptions {
+  environment: string;
+  marker: OwnershipMarker;
+}
+
+/** The label selector that scopes everything here: managed-by + stack + env. */
+function markerSelector(marker: OwnershipMarker): string {
+  return [
+    `${LABEL_OWNERSHIP_KEYS.managedBy}=${OWNERSHIP_MANAGED_BY_VALUE}`,
+    `${LABEL_OWNERSHIP_KEYS.stack}=${marker.stack}`,
+    ...(marker.env ? [`${LABEL_OWNERSHIP_KEYS.env}=${marker.env}`] : []),
+  ].join(",");
+}
+
+/** True when a live object's own labels carry exactly the requested identity. */
+function matchesMarker(
+  labels: Record<string, string> | undefined,
+  marker: OwnershipMarker,
+): boolean {
+  const read = readOwnership(labels, LABEL_OWNERSHIP_KEYS);
+  return read !== undefined && read.stack === marker.stack && read.env === marker.env;
+}
+
+/**
+ * Enumerate the cluster's marker-matching objects — the k8s half of
+ * `chant lifecycle teardown <env>` planning.
+ */
+export async function teardownOwned(
+  options: K8sTeardownOptions,
+  connect: K8sConnector = defaultK8sConnector,
+): Promise<TeardownEnumeration> {
+  const { client } = await connect({ environment: options.environment });
+  const selector = markerSelector(options.marker);
+
+  const candidates: TeardownCandidate[] = [];
+  const holes: TeardownHole[] = [];
+
+  for (const entityType of DEFAULT_IMPORT_TYPES) {
+    const operation = operationFor(entityType);
+    if (!operation) continue;
+    const ref = { apiVersion: operation.apiVersion, kind: operation.kind };
+
+    let served: boolean;
+    try {
+      served = (await client.resolve(ref)) !== undefined;
+    } catch (err) {
+      holes.push({
+        name: entityType,
+        type: entityType,
+        reason: "read-failed",
+        detail: err instanceof Error ? err.message : String(err),
+      });
+      continue;
+    }
+    // A kind this cluster's discovery does not serve cannot hold a marked
+    // object — absence of the kind is knowledge, not a hole.
+    if (!served) continue;
+
+    let items;
+    try {
+      items = await client.list(ref, { labelSelector: selector });
+    } catch (err) {
+      holes.push({
+        name: entityType,
+        type: entityType,
+        reason: "read-failed",
+        detail: err instanceof Error ? err.message : String(err),
+      });
+      continue;
+    }
+
+    for (const item of items) {
+      const name = item.metadata?.name;
+      if (!name) continue;
+      // The re-check that matters: a server (or fake) that ignored the label
+      // selector must not widen the set past the requested identity.
+      if (!matchesMarker(item.metadata?.labels, options.marker)) continue;
+      // Already terminating — deleting again is noise, not progress.
+      if (item.metadata?.deletionTimestamp !== undefined) continue;
+      const namespace = item.metadata?.namespace;
+      candidates.push({
+        name: namespace ? `${namespace}/${name}` : name,
+        type: entityType,
+        ...(item.metadata?.uid ? { physicalId: String(item.metadata.uid) } : {}),
+        marker: readOwnership(item.metadata?.labels, LABEL_OWNERSHIP_KEYS)!,
+      });
+    }
+  }
+
+  return { candidates, ...(holes.length > 0 ? { holes } : {}) };
+}
+
+/**
+ * Delete the handed-over candidates, namespaces last. One outcome per
+ * candidate, always.
+ */
+export async function executeTeardown(
+  options: K8sTeardownOptions & { candidates: TeardownCandidate[] },
+  connect: K8sConnector = defaultK8sConnector,
+): Promise<TeardownExecution> {
+  const { client } = await connect({ environment: options.environment });
+
+  // Namespaces last: their members get individual deletes (and individual
+  // outcomes) before the namespace cascade sweeps whatever is left.
+  const ordered = [
+    ...options.candidates.filter((c) => c.type !== NAMESPACE_TYPE),
+    ...options.candidates.filter((c) => c.type === NAMESPACE_TYPE),
+  ];
+
+  const outcomes: TeardownOutcome[] = [];
+  for (const candidate of ordered) {
+    outcomes.push(await deleteCandidate(client, candidate, options.marker));
+  }
+  return { outcomes };
+}
+
+async function deleteCandidate(
+  client: K8sClient,
+  candidate: TeardownCandidate,
+  marker: OwnershipMarker,
+): Promise<TeardownOutcome> {
+  const base = {
+    name: candidate.name,
+    type: candidate.type,
+    ...(candidate.physicalId ? { physicalId: candidate.physicalId } : {}),
+  };
+
+  const operation = operationFor(candidate.type);
+  if (!operation) {
+    return { ...base, outcome: "not-prunable", detail: `no operation mapping for type ${candidate.type}` };
+  }
+
+  let info;
+  try {
+    info = await client.resolve({ apiVersion: operation.apiVersion, kind: operation.kind });
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+  if (!info) {
+    return { ...base, outcome: "not-prunable", detail: `the cluster does not serve ${operation.kind}` };
+  }
+
+  const slash = candidate.name.indexOf("/");
+  const namespace = info.namespaced && slash > 0 ? candidate.name.slice(0, slash) : undefined;
+  const name = info.namespaced && slash > 0 ? candidate.name.slice(slash + 1) : candidate.name;
+  const ref = {
+    apiVersion: operation.apiVersion,
+    kind: operation.kind,
+    name,
+    ...(namespace !== undefined ? { namespace } : {}),
+  };
+
+  // Re-read and re-verify the identity right before deleting: the enumeration
+  // is a moment old at best, and a delete is not undoable.
+  let live;
+  try {
+    live = await client.readIfPresent(ref);
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+  if (live === undefined) {
+    return { ...base, outcome: "deleted", detail: "already absent" };
+  }
+  if (!matchesMarker(live.metadata?.labels, marker)) {
+    return {
+      ...base,
+      outcome: "not-prunable",
+      detail: "the live object no longer carries the requested marker identity",
+    };
+  }
+
+  try {
+    await client.delete(ref);
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+  return { ...base, outcome: "deleted" };
+}