fix(slos): rely on StripSLOServerFields to clear dash0.com/id

Upgrade to dash0-api-client-go v1.18.2, which clears dash0.com/id in
StripSLOServerFields (dash0hq/dash0-api-client-go#24). This removes the
local ClearSLOID workarounds that stood in for the missing behaviour.

Also adds the SLO case to marshalForDiff. SLO was the only asset type
absent from the type switch, so neither side of a diff was normalized and
re-applying an unchanged document rendered a spurious hunk from the
server-bumped dash0.com/updated-at and dash0.com/version instead of
reporting "no changes".

slos update -f now falls back to dash0.com/origin when no id is present,
matching notification channels and teams. SLO ids are server-assigned, so
a hand-authored document can only pin an origin — the flow the command's
own help advertises was previously impossible.

Author: nicolastakashi

go.mod

@@ -4,7 +4,7 @@ go 1.25.1
 
 require (
 	github.com/cli/browser v1.3.0
-	github.com/dash0hq/dash0-api-client-go v1.18.1
+	github.com/dash0hq/dash0-api-client-go v1.18.2
 	github.com/google/uuid v1.6.0
 	github.com/muesli/termenv v0.16.0
 	github.com/pmezard/go-difflib v1.0.0

go.sum

@@ -11,8 +11,8 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cli/browser v1.3.0 h1:LejqCrpWr+1pRqmEPDGnTZOjsMe7sehifLynZJuqJpo=
 github.com/cli/browser v1.3.0/go.mod h1:HH8s+fOAxjhQoBUAsKuPCbqUuxZDhQ2/aD+SzsEfBTk=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/dash0hq/dash0-api-client-go v1.18.1 h1:NhIt93aEj6C0YmVIWODESDbUbUTVwJ0JEFmC7qi54kw=
-github.com/dash0hq/dash0-api-client-go v1.18.1/go.mod h1:KNGbcgETrEN4m2QPGAorZ9FybTpVg/oi20UEoWGCGlE=
+github.com/dash0hq/dash0-api-client-go v1.18.2 h1:o+txjfJifmRHxIlXweZOdXJz6AzYfD4ivLFA+rjoHw8=
+github.com/dash0hq/dash0-api-client-go v1.18.2/go.mod h1:KNGbcgETrEN4m2QPGAorZ9FybTpVg/oi20UEoWGCGlE=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/asset/diff_test.go

@@ -355,6 +355,60 @@ func TestPrintDiff_SLO_ServerBumpedMetadataIsNotAChange(t *testing.T) {
 	assert.NotContains(t, buf.String(), "dash0.com/version")
 }
 
+// A hand-authored SLO document can only pin dash0.com/origin — ids are
+// server-assigned — so on `slos update -f <origin-only file>` the `before`
+// fetched from the API carries an id that the `after` never will. The id is
+// server-managed metadata, so its absence from the file must not render as a
+// deletion. Regression test for a phantom "-dash0.com/id / +labels: {}" diff.
+func TestPrintDiff_SLO_ServerAssignedIDIsNotAChange(t *testing.T) {
+	dashcolor.NoColor = true
+	defer func() { dashcolor.NoColor = false }()
+
+	// before: fetched by origin, so the server filled in id/version/dataset.
+	beforeJSON := `{
+		"apiVersion": "openslo.com/v1",
+		"kind": "SLO",
+		"metadata": {
+			"name": "checkout-availability",
+			"labels": {
+				"dash0.com/id": "slo_01kyn68gwrf22afc4vc9xjdtg5",
+				"dash0.com/version": "3",
+				"dash0.com/dataset": "default",
+				"dash0.com/origin": "manual-test-checkout-api"
+			},
+			"annotations": {
+				"dash0.com/display-name": "Checkout API availability",
+				"dash0.com/created-at": "2026-01-15T10:00:00Z"
+			}
+		},
+		"spec": {"service": "checkout", "budgetingMethod": "Occurrences"}
+	}`
+	// after: the user's file — origin only, no id, no server metadata. It does
+	// carry the client-settable display-name annotation, as a real authored
+	// document does; that keeps the comparison about the id alone.
+	afterJSON := `{
+		"apiVersion": "openslo.com/v1",
+		"kind": "SLO",
+		"metadata": {
+			"name": "checkout-availability",
+			"labels": {"dash0.com/origin": "manual-test-checkout-api"},
+			"annotations": {"dash0.com/display-name": "Checkout API availability"}
+		},
+		"spec": {"service": "checkout", "budgetingMethod": "Occurrences"}
+	}`
+
+	var before, after dash0api.SloDefinition
+	require.NoError(t, json.Unmarshal([]byte(beforeJSON), &before))
+	require.NoError(t, json.Unmarshal([]byte(afterJSON), &after))
+
+	var buf bytes.Buffer
+	require.NoError(t, PrintDiff(&buf, "SLO", "checkout-availability", &before, &after))
+
+	assert.Contains(t, buf.String(), `SLO "checkout-availability": no changes`)
+	assert.NotContains(t, buf.String(), "dash0.com/id", "the server-assigned id must not appear as a change")
+	assert.NotContains(t, buf.String(), "labels: {}", "stripping every label must not render an empty-map diff")
+}
+
 // TestPrintDiff_SLO_RealSpecChangeStillDiffs is the counterpart guard: stripping
 // server-managed metadata must not swallow a genuine change to the document.
 func TestPrintDiff_SLO_RealSpecChangeStillDiffs(t *testing.T) {

internal/asset/slo.go

@@ -27,12 +27,12 @@ import (
 //   - Otherwise, POST is used and the server assigns both id and origin.
 //
 // PUT is create-or-replace, so upserting on either key is idempotent across
-// repeated applies. The origin and id labels are captured before
-// StripSLOServerFields runs because that helper clears dash0.com/origin.
+// repeated applies. Both labels are captured before StripSLOServerFields runs,
+// because that helper clears dash0.com/origin and dash0.com/id.
 func ImportSLO(ctx context.Context, apiClient dash0api.Client, slo *dash0api.SloDefinition, dataset *string) (ImportResult, error) {
-	// Capture identifiers before stripping — StripSLOServerFields clears the
-	// dash0.com/origin label, so origin- and id-based routing must observe the
-	// input first.
+	// Capture identifiers before stripping — StripSLOServerFields clears both
+	// the dash0.com/origin and dash0.com/id labels, so origin- and id-based
+	// routing must observe the input first.
 	origin := ""
 	if slo.Metadata.Labels != nil && slo.Metadata.Labels.Dash0Comorigin != nil {
 		origin = *slo.Metadata.Labels.Dash0Comorigin
@@ -74,12 +74,9 @@ func ImportSLO(ctx context.Context, apiClient dash0api.Client, slo *dash0api.Slo
 	if upsertKey != "" {
 		result, err = apiClient.UpdateSLO(ctx, upsertKey, slo, dataset)
 	} else {
-		// StripSLOServerFields does not touch dash0.com/id, so on the
-		// preflight-404 fallback the body would still carry the id that belongs
-		// to the *source* organization. The server assigns SLO ids on create, so
-		// send the document without one rather than asking it to ignore a
-		// foreign identifier.
-		dash0api.ClearSLOID(slo)
+		// No explicit ClearSLOID here: StripSLOServerFields above already
+		// removed dash0.com/id, so the cross-environment POST fallback cannot
+		// carry an identifier belonging to the source organization.
 		result, err = apiClient.CreateSLO(ctx, slo, dataset)
 	}
 	if err != nil {

internal/slos/integration_test.go

@@ -766,9 +766,10 @@ func TestCreateSLOFromFile_UpsertByID_FallsBackToPOSTWhenNotFound(t *testing.T)
 	assertPOSTPath(t, server.Requests(), apiPathSLOs, "expected POST fallback after GET 404")
 
 	// The POST body must not carry the source organization's id. SLO ids are
-	// assigned by the server on create, and StripSLOServerFields does not clear
-	// dash0.com/id (only version, origin, dataset, source, and timestamps), so
-	// ImportSLO calls ClearSLOID explicitly on this path.
+	// assigned by the server on create, and StripSLOServerFields clears
+	// dash0.com/id along with version, origin, dataset, source, and the
+	// timestamps — so the cross-environment fallback cannot leak a foreign
+	// identifier. This assertion pins that guarantee at the wire level.
 	post := findRecordedRequest(server.Requests(), http.MethodPost, apiPathSLOs)
 	require.NotNil(t, post, "expected a recorded POST to %s", apiPathSLOs)
 	var body struct {

internal/slos/update.go

@@ -49,15 +49,25 @@ func runUpdate(ctx context.Context, args []string, flags *asset.FileInputFlags)
 
 	var id string
 	fileID := dash0api.GetSLOID(&slo)
+	// Fall back to dash0.com/origin when the document carries no id. SLO ids are
+	// server-assigned (`slo_<ulid>`), so a hand-authored document can only ever
+	// pin an origin — without this fallback the `update -f <file>` form this
+	// command advertises is impossible for any SLO that was not first exported.
+	// GET/PUT accept an origin-or-id path segment, so routing on origin works.
+	// There is no GetSLOOrigin helper in the API client, so the label is read
+	// directly (as ImportSLO and apply's parseDocumentHeader do).
+	if fileID == "" && slo.Metadata.Labels != nil && slo.Metadata.Labels.Dash0Comorigin != nil {
+		fileID = *slo.Metadata.Labels.Dash0Comorigin
+	}
 	if len(args) == 1 {
 		id = args[0]
 		if fileID != "" && fileID != id {
-			return fmt.Errorf("the ID argument %q does not match the ID in the file %q", id, fileID)
+			return fmt.Errorf("the ID argument %q does not match the ID or origin in the file %q", id, fileID)
 		}
 	} else {
 		id = fileID
 		if id == "" {
-			return fmt.Errorf("no SLO ID provided as argument, and the file does not contain an ID")
+			return fmt.Errorf("no SLO ID provided as argument, and the file contains neither an ID nor a dash0.com/origin label")
 		}
 	}