@intentius/chant-lexicon-k8s 0.41.15 → 0.41.17

package/dist/deep-observe-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAY,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGnG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcxE,CAAC;AA+EF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAYnF;AAMD,eAAO,MAAM,yBAAyB,EAAE,sBAWvC,CAAC"}
+{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAY,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAYnG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcxE,CAAC;AA+EF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAYnF;AAMD,eAAO,MAAM,yBAAyB,EAAE,sBAWvC,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "de51ffb566f7b4346cfb33021dbca84d7e7d7a3d0c096640dbe1d38f831187ee",
+    "manifest.json": "579bf4095e47e58c245aa6e2531cabeaf1b6b558a25a5e1090810d9bf31f2675",
     "meta.json": "c0b141b882c51483c1d1aead748a0eb171aceca7432edd2a0404b062bf6d7831",
     "types/index.d.ts": "3be2af7494aca94adfa16269cb9c4e7a155529872207a3d70b0c4d39914f9eec",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "2a0b689bdb3e0a2d672e703b751bf91685ee52070385d52fb03c997cc06afb36"
+  "composite": "d2f25a5b946a9065204fc9c38ac8a5c39417015120bbdaeee93c12c2597dc397"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.41.15",
+  "version": "0.41.17",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/op/activities/kubectl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAI3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAoCD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAoD9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAI3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAmGD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAkE9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.41.15",
+  "version": "0.41.17",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.41.15",
+    "@intentius/chant": "^0.41.17",
     "typescript": "^5.9.3"
   }
 }

package/src/deep-observe-hooks.ts

@@ -41,9 +41,19 @@
  * keyed by chant's own k8s entityType catalog.
  */
 
+import { createRequire } from "module";
 import type { DeepArrayElement, DeepNode, DeepNormalizationHooks } from "@intentius/chant/lexicon";
 import { K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS, k8sListMapOrderKey } from "@intentius/chant/managed-fields";
 
+// This module ships as ESM (tsx strips types from src/ directly), where a bare
+// `require` is not defined — the same reason serializer.ts and the LSP modules
+// already build one. The bug only surfaced on a LIVE deep read that meets an
+// associative list (every k8s estate does: a Deployment's containers), so
+// `lifecycle diff --live` crashed with `require is not defined` on exactly the
+// estates the generated table exists for (#1441 regression, found on
+// kubemicrovm-ops).
+const require = createRequire(import.meta.url);
+
 /**
  * Kubernetes-defaulted fields, per entity type, as index-erased property
  * paths. Subtracted only where source never declared the property

package/src/op/activities/kubectl.test.ts

@@ -132,6 +132,122 @@ describe("kubectlApply", () => {
     }
   });
 
+  test("the apply stamps its resolved stack onto every document's labels — the identity the prune and the status sweep query", async () => {
+    // The serializer bakes the PROJECT stack (`ownership.stack`) into what it
+    // emits, but a component's kubectl-apply step applies under its own unit
+    // stack — and that is what both label readers select on. A manifest with
+    // the project label (or none at all: upstream CRDs) must leave the apply
+    // carrying the unit's identity, or the unit reads absent forever.
+    const file = join(dir, "k8s.yaml");
+    const labeled = deploymentYaml.replace(
+      "  name: web\n  namespace: prod\n",
+      "  name: web\n  namespace: prod\n  labels:\n    app.kubernetes.io/managed-by: chant\n    chant.intentius.io/stack: whole-project\n    chant.intentius.io/env: dev\n",
+    );
+    writeFileSync(file, labeled);
+    const cluster = fakeCluster({ respond: echoApplies });
+
+    await applyManifest({ manifest: file, stack: "kmv-workload" }, undefined, cluster.connector);
+
+    const bodies = cluster.layer.requests
+      .filter((r) => r.method === "PATCH")
+      .map((r) => JSON.parse(String(r.body)) as { metadata?: { labels?: Record<string, string> } });
+    expect(bodies).toHaveLength(2);
+    for (const body of bodies) {
+      expect(body.metadata?.labels).toMatchObject({
+        "app.kubernetes.io/managed-by": "chant",
+        "chant.intentius.io/stack": "kmv-workload",
+      });
+    }
+    // The env label is the serializer's channel — restamped never, kept as-is.
+    expect(bodies[0].metadata?.labels?.["chant.intentius.io/env"]).toBe("dev");
+    // The previously-unlabeled Service now carries the marker too.
+    expect(bodies[1].metadata?.labels?.["chant.intentius.io/env"]).toBeUndefined();
+  });
+
+  test("a conflict owned entirely by chant's own managers is retaken with force — the stack-label migration path", async () => {
+    // An estate applied before its components named per-unit stacks has every
+    // object's labels owned by `chant:<ownership.stack>`. The re-stamp under
+    // the unit's manager conflicts — with chant itself. Refusing that forever
+    // would strand the estate with no non-force path (the capability exposes
+    // no force flag), so chant retakes its OWN fields, once, per document.
+    const file = join(dir, "k8s.yaml");
+    writeFileSync(file, deploymentYaml);
+    let patches = 0;
+    const cluster = fakeCluster({
+      respond: (req) => {
+        if (req.method !== "PATCH") return undefined;
+        patches++;
+        const forced = req.query.force === "true";
+        if (forced) return { body: JSON.parse(String(req.body)) };
+        return {
+          status: 409,
+          body: {
+            ...statusBody(409, "Conflict", 'Apply failed with 1 conflict: conflict with "chant:kubemicrovm-ops"'),
+            details: {
+              causes: [
+                {
+                  type: "FieldManagerConflict",
+                  message: 'conflict with "chant:kubemicrovm-ops"',
+                  field: ".metadata.labels.chant.intentius.io/stack",
+                },
+              ],
+            },
+          },
+        };
+      },
+    });
+
+    const result = await applyManifest({ manifest: file, stack: "kmv-workload" }, undefined, cluster.connector);
+    expect(result.applied).toHaveLength(2);
+    // Each of the two documents: one refused apply + one forced retake.
+    expect(patches).toBe(4);
+    const requests = cluster.layer.requests.filter((r) => r.method === "PATCH");
+    expect(requests.map((r) => r.query.force)).toEqual(["false", "true", "false", "true"]);
+  });
+
+  test("a conflict involving any FOREIGN manager still refuses — self-retake never widens", async () => {
+    const file = join(dir, "k8s.yaml");
+    writeFileSync(file, deploymentYaml);
+    const cluster = fakeCluster({
+      respond: (req) =>
+        req.method === "PATCH"
+          ? {
+              status: 409,
+              body: {
+                ...statusBody(409, "Conflict", "Apply failed with 2 conflicts"),
+                details: {
+                  causes: [
+                    { type: "FieldManagerConflict", message: 'conflict with "chant:old"', field: ".metadata.labels.chant.intentius.io/stack" },
+                    { type: "FieldManagerConflict", message: 'conflict with "helm"', field: ".spec.replicas" },
+                  ],
+                },
+              },
+            }
+          : undefined,
+    });
+
+    const err = (await applyManifest({ manifest: file, stack: "kmv-workload" }, undefined, cluster.connector).catch(
+      (e: unknown) => e,
+    )) as Error;
+    expect(err.name).toBe("FieldManagerConflictError");
+    // No forced retry was attempted.
+    expect(cluster.layer.requests.filter((r) => r.method === "PATCH" && r.query.force === "true")).toHaveLength(0);
+  });
+
+  test("no resolvable stack applies the documents verbatim — no marker invented", async () => {
+    const file = join(dir, "k8s.yaml");
+    writeFileSync(file, deploymentYaml);
+    const cluster = fakeCluster({ respond: echoApplies });
+
+    // No stack arg, no project config: identity resolution yields none.
+    await applyManifest({ manifest: file, cwd: dir }, undefined, cluster.connector);
+
+    const body = JSON.parse(
+      String(cluster.layer.requests.find((r) => r.method === "PATCH")!.body),
+    ) as { metadata?: { labels?: Record<string, string> } };
+    expect(body.metadata?.labels).toBeUndefined();
+  });
+
   test("an explicit context is honored and skips the environment lookup entirely", async () => {
     const file = join(dir, "k8s.yaml");
     writeFileSync(file, deploymentYaml);

package/src/op/activities/kubectl.ts

@@ -191,6 +191,69 @@ async function resolveApplyIdentity(
   };
 }
 
+/**
+ * Structural mirror of the client's `FieldManagerConflictError` surface —
+ * matched by `name` + shape, NOT `instanceof`, because a static value import
+ * of `@intentius/chant-k8s-client` here would put the API-client chain on the
+ * build path (the #1074 boundary; same reason the applier itself is reached
+ * by dynamic import).
+ */
+interface ConflictErrorLike {
+  name: string;
+  conflicts?: Array<{ manager?: unknown }>;
+}
+
+/**
+ * Is every contested field in this conflict owned by chant itself (under any
+ * of its field managers — `chant` bare or `chant:<stack>`)? True means the
+ * conflict is a self-migration, never a dispute with another tool.
+ */
+function isChantSelfConflict(err: unknown): boolean {
+  const e = err as ConflictErrorLike;
+  if (!e || e.name !== "FieldManagerConflictError" || !Array.isArray(e.conflicts) || e.conflicts.length === 0) return false;
+  return e.conflicts.every(
+    (c) => typeof c.manager === "string" && (c.manager === "chant" || c.manager.startsWith("chant:")),
+  );
+}
+
+/**
+ * Stamp the apply's own stack identity onto a document's labels.
+ *
+ * The serializer bakes `ownership.stack` — the *project* identity from
+ * `chant.config.ts` — into every manifest it emits. But the apply's identity
+ * is the *stack argument it resolved* (a component's `kubectl-apply` step
+ * names its own deploy unit, e.g. `kmv-workload`), and that is the value both
+ * consumers of the label query for: the owned-only prune's selector and
+ * `describeStackStatus`'s presence sweep. Applying the manifest verbatim left
+ * the label saying `kubemicrovm-ops` while both readers asked for
+ * `kmv-workload` — the prune silently matched nothing and every kubectl-apply
+ * unit read absent in `components status --live` (a green estate painted
+ * dead). A manifest chant never serialized (upstream CRDs pinned into a
+ * `crds` unit) carried no marker at all, with the same two failures.
+ *
+ * So the apply now re-stamps what it applies: `managed-by=chant` plus the
+ * resolved stack. The ownership *verdict* keys on `managed-by` alone
+ * (core/ownership.ts `hasOwnershipMarker`), so overlay classification is
+ * unchanged; the env label is the serializer's to write and is left as-is.
+ * No stack resolved (no explicit arg, no project ownership) applies verbatim,
+ * exactly as before.
+ */
+function stampOwnership(document: K8sObject, stack: string | undefined): K8sObject {
+  if (stack === undefined) return document;
+  const metadata = (document.metadata ?? {}) as { labels?: Record<string, string> };
+  return {
+    ...document,
+    metadata: {
+      ...metadata,
+      labels: {
+        ...(metadata.labels ?? {}),
+        [LABEL_OWNERSHIP_KEYS.managedBy]: OWNERSHIP_MANAGED_BY_VALUE,
+        [LABEL_OWNERSHIP_KEYS.stack]: stack,
+      },
+    },
+  } as K8sObject;
+}
+
 /**
  * Apply every document in `args.manifest`, then prune when asked.
  *
@@ -219,12 +282,26 @@ export async function applyManifest(
 
     const applied: AppliedRef[] = [];
     for (const document of documents) {
-      const result = await client.apply(document as K8sObject, {
-        fieldManager,
-        force: args.force ?? false,
-        dryRun: args.dryRun,
-        signal,
-      });
+      const stamped = stampOwnership(document as K8sObject, stack);
+      let result: K8sObject;
+      try {
+        result = await client.apply(stamped, {
+          fieldManager,
+          force: args.force ?? false,
+          dryRun: args.dryRun,
+          signal,
+        });
+      } catch (err) {
+        // "chant never forces a conflict on its own" is about taking fields
+        // from ANOTHER tool. A conflict where every contested field is owned
+        // by another `chant:*` manager is chant contesting itself — the
+        // ownership-stack → unit-stack label migration, or a renamed deploy
+        // unit — and refusing that forever would strand every estate applied
+        // before the rename with no non-force path back. Retake those fields
+        // deliberately, once, and only when no foreign manager is involved.
+        if (!isChantSelfConflict(err)) throw err;
+        result = await client.apply(stamped, { fieldManager, force: true, dryRun: args.dryRun, signal });
+      }
       const ref: AppliedRef = {
         apiVersion: String(result.apiVersion ?? document.apiVersion ?? ""),
         kind: String(result.kind ?? document.kind ?? ""),