@intentius/chant-lexicon-k8s 0.41.16 → 0.41.18

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "528b5cb5e20dcb4ab991f8ab6d98da91f361d833b65d8e40bdb62867498ddc0e",
+    "manifest.json": "c2f3553d27f37ccedf78b608acf76ee427dcd03bdc832f0a9ffbb4da78ff9bd9",
     "meta.json": "c0b141b882c51483c1d1aead748a0eb171aceca7432edd2a0404b062bf6d7831",
     "types/index.d.ts": "3be2af7494aca94adfa16269cb9c4e7a155529872207a3d70b0c4d39914f9eec",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "f895a3588933ce1fa536eeceb58265524ea731115d96b1ca7b3a93df9c19d1e1"
+  "composite": "719807c3da16afea57ea7a7709cc29007e28cd3c8d7ab094c273794fa95fbb9e"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.41.16",
+  "version": "0.41.18",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/op/activities/kubectl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAI3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AA0ED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAoD9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAI3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAqHD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAkE9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.41.16",
+  "version": "0.41.18",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.41.16",
+    "@intentius/chant": "^0.41.18",
     "typescript": "^5.9.3"
   }
 }

package/src/op/activities/kubectl.test.ts

@@ -164,6 +164,109 @@ describe("kubectlApply", () => {
     expect(bodies[1].metadata?.labels?.["chant.intentius.io/env"]).toBeUndefined();
   });
 
+  test("a conflict owned entirely by chant's own managers is retaken with force — the stack-label migration path", async () => {
+    // An estate applied before its components named per-unit stacks has every
+    // object's labels owned by `chant:<ownership.stack>`. The re-stamp under
+    // the unit's manager conflicts — with chant itself. Refusing that forever
+    // would strand the estate with no non-force path (the capability exposes
+    // no force flag), so chant retakes its OWN fields, once, per document.
+    const file = join(dir, "k8s.yaml");
+    writeFileSync(file, deploymentYaml);
+    let patches = 0;
+    const cluster = fakeCluster({
+      respond: (req) => {
+        if (req.method !== "PATCH") return undefined;
+        patches++;
+        const forced = req.query.force === "true";
+        if (forced) return { body: JSON.parse(String(req.body)) };
+        return {
+          status: 409,
+          body: {
+            ...statusBody(409, "Conflict", 'Apply failed with 1 conflict: conflict with "chant:kubemicrovm-ops"'),
+            details: {
+              causes: [
+                {
+                  type: "FieldManagerConflict",
+                  message: 'conflict with "chant:kubemicrovm-ops"',
+                  field: ".metadata.labels.chant.intentius.io/stack",
+                },
+              ],
+            },
+          },
+        };
+      },
+    });
+
+    const result = await applyManifest({ manifest: file, stack: "kmv-workload" }, undefined, cluster.connector);
+    expect(result.applied).toHaveLength(2);
+    // Each of the two documents: one refused apply + one forced retake.
+    expect(patches).toBe(4);
+    const requests = cluster.layer.requests.filter((r) => r.method === "PATCH");
+    expect(requests.map((r) => r.query.force)).toEqual(["false", "true", "false", "true"]);
+  });
+
+  test("a controller echoing chant's marker label is retaken too — chant owns its reserved channel", async () => {
+    // An operator that reconciles whole objects becomes SSA owner of labels it
+    // merely echoed (observed live: kubemicrovm's microvmimagereconciler
+    // owning .metadata.labels.chant.intentius.io/stack). It never chose that
+    // value; the marker namespace is chant's.
+    const file = join(dir, "k8s.yaml");
+    writeFileSync(file, deploymentYaml);
+    const cluster = fakeCluster({
+      respond: (req) => {
+        if (req.method !== "PATCH") return undefined;
+        if (req.query.force === "true") return { body: JSON.parse(String(req.body)) };
+        return {
+          status: 409,
+          body: {
+            ...statusBody(409, "Conflict", 'Apply failed with 1 conflict: conflict with "microvmimagereconciler"'),
+            details: {
+              causes: [
+                {
+                  type: "FieldManagerConflict",
+                  message: 'conflict with "microvmimagereconciler"',
+                  field: ".metadata.labels.chant.intentius.io/stack",
+                },
+              ],
+            },
+          },
+        };
+      },
+    });
+
+    const result = await applyManifest({ manifest: file, stack: "kmv-workload" }, undefined, cluster.connector);
+    expect(result.applied).toHaveLength(2);
+  });
+
+  test("a conflict involving any FOREIGN manager still refuses — self-retake never widens", async () => {
+    const file = join(dir, "k8s.yaml");
+    writeFileSync(file, deploymentYaml);
+    const cluster = fakeCluster({
+      respond: (req) =>
+        req.method === "PATCH"
+          ? {
+              status: 409,
+              body: {
+                ...statusBody(409, "Conflict", "Apply failed with 2 conflicts"),
+                details: {
+                  causes: [
+                    { type: "FieldManagerConflict", message: 'conflict with "chant:old"', field: ".metadata.labels.chant.intentius.io/stack" },
+                    { type: "FieldManagerConflict", message: 'conflict with "helm"', field: ".spec.replicas" },
+                  ],
+                },
+              },
+            }
+          : undefined,
+    });
+
+    const err = (await applyManifest({ manifest: file, stack: "kmv-workload" }, undefined, cluster.connector).catch(
+      (e: unknown) => e,
+    )) as Error;
+    expect(err.name).toBe("FieldManagerConflictError");
+    // No forced retry was attempted.
+    expect(cluster.layer.requests.filter((r) => r.method === "PATCH" && r.query.force === "true")).toHaveLength(0);
+  });
+
   test("no resolvable stack applies the documents verbatim — no marker invented", async () => {
     const file = join(dir, "k8s.yaml");
     writeFileSync(file, deploymentYaml);

package/src/op/activities/kubectl.ts

@@ -191,6 +191,49 @@ async function resolveApplyIdentity(
   };
 }
 
+/**
+ * Structural mirror of the client's `FieldManagerConflictError` surface —
+ * matched by `name` + shape, NOT `instanceof`, because a static value import
+ * of `@intentius/chant-k8s-client` here would put the API-client chain on the
+ * build path (the #1074 boundary; same reason the applier itself is reached
+ * by dynamic import).
+ */
+interface ConflictErrorLike {
+  name: string;
+  conflicts?: Array<{ manager?: unknown; field?: unknown }>;
+}
+
+/** chant's reserved label channel — the `chant.intentius.io/*` keys the
+ * ownership marker lives under, as a conflict-cause field-path prefix. */
+const MARKER_FIELD_PREFIX = `.metadata.labels.${LABEL_OWNERSHIP_KEYS.stack.split("/")[0]}/`;
+
+/**
+ * Is this conflict one chant may retake without a human? Two shapes qualify,
+ * per contested field:
+ *
+ * - the owning manager is chant itself (`chant` bare or `chant:<stack>`) —
+ *   the ownership-stack → unit-stack migration, or a renamed deploy unit; or
+ * - the field lives in chant's OWN reserved label channel
+ *   (`chant.intentius.io/*`). A controller that reconciles whole objects
+ *   echoes existing labels and becomes their SSA owner as a side effect
+ *   (observed live: kubemicrovm's `microvmimagereconciler` owning
+ *   `.metadata.labels.chant.intentius.io/stack`) — it never chose that value,
+ *   and chant is the authority for its marker namespace no matter who last
+ *   echoed it.
+ *
+ * Any contested field outside both shapes — a spec field, an app label —
+ * keeps the presented refusal: that IS a dispute with another tool.
+ */
+function isChantSelfConflict(err: unknown): boolean {
+  const e = err as ConflictErrorLike;
+  if (!e || e.name !== "FieldManagerConflictError" || !Array.isArray(e.conflicts) || e.conflicts.length === 0) return false;
+  return e.conflicts.every((c) => {
+    const chantManager = typeof c.manager === "string" && (c.manager === "chant" || c.manager.startsWith("chant:"));
+    const markerField = typeof c.field === "string" && c.field.startsWith(MARKER_FIELD_PREFIX);
+    return chantManager || markerField;
+  });
+}
+
 /**
  * Stamp the apply's own stack identity onto a document's labels.
  *
@@ -257,12 +300,26 @@ export async function applyManifest(
 
     const applied: AppliedRef[] = [];
     for (const document of documents) {
-      const result = await client.apply(stampOwnership(document as K8sObject, stack), {
-        fieldManager,
-        force: args.force ?? false,
-        dryRun: args.dryRun,
-        signal,
-      });
+      const stamped = stampOwnership(document as K8sObject, stack);
+      let result: K8sObject;
+      try {
+        result = await client.apply(stamped, {
+          fieldManager,
+          force: args.force ?? false,
+          dryRun: args.dryRun,
+          signal,
+        });
+      } catch (err) {
+        // "chant never forces a conflict on its own" is about taking fields
+        // from ANOTHER tool. A conflict where every contested field is owned
+        // by another `chant:*` manager is chant contesting itself — the
+        // ownership-stack → unit-stack label migration, or a renamed deploy
+        // unit — and refusing that forever would strand every estate applied
+        // before the rename with no non-force path back. Retake those fields
+        // deliberately, once, and only when no foreign manager is involved.
+        if (!isChantSelfConflict(err)) throw err;
+        result = await client.apply(stamped, { fieldManager, force: true, dryRun: args.dryRun, signal });
+      }
       const ref: AppliedRef = {
         apiVersion: String(result.apiVersion ?? document.apiVersion ?? ""),
         kind: String(result.kind ?? document.kind ?? ""),