@intentius/chant-lexicon-k8s 0.46.0 → 0.50.0

package/src/teardown.test.ts

@@ -188,6 +188,42 @@ describe("executeTeardown — typed deletes, namespaces last", () => {
     expect(execution.outcomes[0].detail).toContain("RBAC says no");
   });
 
+  test("a generated-once secret survives the env sweep with a retained row; a plain owned secret still deletes (#1830)", async () => {
+    const cluster = fakeCluster({
+      objects: {
+        [objectKey("v1", "Secret", "master-key", "prod-ns")]: ownedObject("v1", "Secret", "master-key", "prod-ns", {
+          metadata: {
+            labels: {
+              ...markerLabels("shop", "dev"),
+              "chant.intentius.io/generated-once": "true",
+            },
+          },
+        }),
+        [objectKey("v1", "Secret", "plain", "prod-ns")]: ownedObject("v1", "Secret", "plain", "prod-ns", {
+          metadata: { labels: markerLabels("shop", "dev") },
+        }),
+      },
+    });
+
+    // Both are owned by this env, so both enumerate — the retained row is the
+    // execution's loud answer, not a silent hole in the plan.
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, cluster.connector);
+    expect(enumeration.candidates.map((c) => c.name).sort()).toEqual(["prod-ns/master-key", "prod-ns/plain"]);
+
+    const execution = await executeTeardown(
+      { environment: "dev", marker: MARKER, candidates: enumeration.candidates },
+      cluster.connector,
+    );
+    const byName = new Map(execution.outcomes.map((o) => [o.name, o]));
+    expect(byName.get("prod-ns/master-key")!.outcome).toBe("retained");
+    expect(byName.get("prod-ns/master-key")!.detail).toContain("generated-once");
+    expect(byName.get("prod-ns/plain")!.outcome).toBe("deleted");
+
+    // Never deleted: the only DELETE is the plain secret's.
+    const deletes = cluster.layer.requests.filter((r) => r.method === "DELETE").map((r) => r.path);
+    expect(deletes).toEqual(["/api/v1/namespaces/prod-ns/secrets/plain"]);
+  });
+
   test("a candidate of an unmapped type is not-prunable, not a crash", async () => {
     const cluster = fakeCluster({ objects: {} });
     const execution = await executeTeardown(

package/src/teardown.ts

@@ -42,6 +42,7 @@ import type { K8sClient } from "@intentius/chant-k8s-client";
 import { DEFAULT_IMPORT_TYPES } from "./api/sweep-types";
 import { operationFor } from "./api/operation-surface";
 import { defaultK8sConnector, type K8sConnector } from "./api/connect";
+import { isGeneratedOnce } from "./secret-labels";
 
 const NAMESPACE_TYPE = "K8s::Core::Namespace";
 
@@ -215,6 +216,19 @@ async function deleteCandidate(
       detail: "the live object no longer carries the requested marker identity",
     };
   }
+  // A generated-once Secret survives every sweep, env teardown included
+  // (#1830, epic #1365 decision 5): the stored bytes are the only copy of
+  // material chant never held. `retained` is the loud keep — the row says the
+  // env is not clean and why. Deletion is an explicit act (`kubectl delete
+  // secret <name>`, or a future gated op), never a teardown's.
+  if (operation.kind === "Secret" && isGeneratedOnce(live.metadata?.labels)) {
+    return {
+      ...base,
+      outcome: "retained",
+      detail:
+        "generated-once secret — deliberately kept, never swept; delete it explicitly (kubectl delete) if you mean to",
+    };
+  }
 
   try {
     await client.delete(ref);

package/src/testdata/sops/db-credentials.sops.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: db-credentials
+    namespace: apps
+type: Opaque
+stringData:
+    POSTGRES_USER: ENC[AES256_GCM,data:U2FsdGVkX18=,iv:kX9mQ2p7rT4vB1nZ8cLdE6hJ0sYwG3aF5uV7iO9kPqM=,tag:Rj4tKq9wL2xN6bV8cH1zPg==,type:str]
+    POSTGRES_PASSWORD: ENC[AES256_GCM,data:bXlwYXNzd29yZA==,iv:tY2nB7vC4xZ1qW8eR5uI3oP6aS9dF0gH2jK4lM6nO8Q=,tag:Wq2eR5tY7uI9oP1aS3dF4g==,type:str]
+sops:
+    age:
+        - recipient: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGVUZmZ2hJak
+            tMbW5PcFFyU3RVdld4WXpBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZ
+            WmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OQotLS
+            0gRlVGZmdoSWpLTG1uT3BRclN0VXZXeFl6QUJDREVGR0hJSktMTU5P
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-25T14:02:11Z"
+    mac: ENC[AES256_GCM,data:cUw3ZlZ4TXAyUXJTdFV2V3hZeg==,iv:zX8cV5bN2mQ7wE4rT1yU6iO3pA9sD0fG5hJ8kL2nB4M=,tag:Nb6vC3xZ9qW1eR4tY7uI2o==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4