@alchemy.run/kubernetes 0.0.0 → 2.0.0-beta.84

package/lib/internal/helm.js

@@ -0,0 +1,173 @@
+import { unwrapRedacted } from "alchemy/Util/data";
+import { collectRedactedSecrets, redactJson } from "alchemy/Util/Redaction";
+/**
+ * Internal Helm rendering for `Kubernetes.HelmChart`.
+ *
+ * Renders a chart to plain Kubernetes objects with the local `helm` CLI
+ * (`helm template` — pure local templating, no cluster connection, no
+ * in-cluster release records), so the rendered objects flow through the same
+ * server-side-apply machinery as `Kubernetes.Manifest` and the workload platforms.
+ * Mirrors the `Docker` service's local-CLI dependency: the `helm` binary
+ * must be installed on the deploying machine (`HELM_BIN` overrides the
+ * binary path).
+ */
+import * as Config from "effect/Config";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as ChildProcess from "effect/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+import * as Stream from "effect/Stream";
+import * as YAML from "yaml";
+/** A Helm invocation or render failure (bad chart ref, template error, …). */
+export class HelmError extends Data.TaggedError("HelmError") {
+}
+const HelmBin = Config.String("HELM_BIN").pipe(Effect.orElseSucceed(() => "helm"));
+/**
+ * Render a chart with `helm template --no-hooks` and parse the
+ * multi-document YAML output into object definitions. Every rendered object
+ * must carry `apiVersion`, `kind`, and `metadata.name` (server-side apply
+ * needs a name; `generateName`-only objects are rejected with a clear
+ * error). Helm lifecycle hooks are excluded from the result (see
+ * {@link isHelmHook}).
+ */
+export const renderHelmChart = Effect.fn(function* (options) {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const bin = yield* HelmBin;
+    const secrets = yield* Effect.sync(() => options.values === undefined ? [] : collectRedactedSecrets(options.values));
+    // The values file holds unwrapped credentials. Close this scope when the
+    // render finishes, including on helm or parse failure, so the file is removed.
+    return yield* Effect.scoped(Effect.gen(function* () {
+        const args = [
+            "template",
+            options.releaseName,
+            options.chart,
+            "--namespace",
+            options.namespace,
+            // Helm lifecycle hooks (`helm.sh/hook`) only make sense under Helm's own
+            // release events; HelmChart server-side applies the render and does not
+            // implement hook timing/weights/delete policies, so a hook (e.g. a
+            // pre-delete uninstall Job) must never enter the managed-object graph.
+            "--no-hooks",
+        ];
+        if (options.repo !== undefined) {
+            args.push("--repo", options.repo);
+        }
+        if (options.version !== undefined) {
+            args.push("--version", options.version);
+        }
+        if (options.includeCrds ?? true) {
+            args.push("--include-crds");
+        }
+        if (options.values !== undefined && Object.keys(options.values).length > 0) {
+            // JSON is valid YAML, so the literal values object round-trips through
+            // a temp values file without a YAML serializer.
+            const dir = yield* fs.makeTempDirectoryScoped({
+                prefix: "alchemy-helm-",
+            });
+            const valuesFile = path.join(dir, "values.json");
+            // JSON.stringify(Redacted) emits the display placeholder. Unwrap at the
+            // values file; the chart props stay wrapped for plan and state.
+            const valuesJson = yield* Effect.sync(() => JSON.stringify(unwrapRedacted(options.values)));
+            yield* fs.writeFileString(valuesFile, valuesJson);
+            args.push("--values", valuesFile);
+        }
+        const result = yield* ChildProcess.make(bin, args, {
+            stdin: "ignore",
+            stdout: "pipe",
+            stderr: "pipe",
+            detached: false,
+            extendEnv: true,
+        }).pipe(spawner.spawn, Effect.flatMap((child) => Effect.all({
+            exitCode: child.exitCode,
+            stdout: child.stdout.pipe(Stream.decodeText, Stream.mkString),
+            stderr: child.stderr.pipe(Stream.decodeText, Stream.mkString),
+        }, { concurrency: "unbounded" })), 
+        // Scope the child to this render so it isn't tied to (and killed by)
+        // an enclosing scope that closes before helm exits.
+        Effect.scoped, 
+        // A spawn failure (almost always ENOENT) means the helm CLI itself is
+        // missing — a machine-setup problem, not a resource error.
+        Effect.catchCause((cause) => Effect.die(new Error(`Failed to run '${bin}': ${String(cause)}. Kubernetes.HelmChart renders charts with the local helm CLI; if it isn't installed, install it (https://helm.sh/docs/intro/install/) or point HELM_BIN at the binary.`))));
+        if (result.exitCode !== 0) {
+            const detail = `helm ${args.join(" ")} exited with code ${String(result.exitCode)}: ` +
+                result.stderr.trim();
+            return yield* Effect.failSync(() => new HelmError({ message: redactJson(detail, secrets) }));
+        }
+        return yield* parseRenderedManifests(options.chart, result.stdout, secrets);
+    }));
+});
+/**
+ * Whether a rendered object is a Helm lifecycle hook (`helm.sh/hook`
+ * annotation). Hooks are executed by Helm at release events (pre-install,
+ * pre-delete, test, …); HelmChart has no release and no hook lifecycle, so
+ * they are filtered out rather than applied as ordinary objects.
+ */
+export const isHelmHook = (object) => typeof object.metadata.annotations?.["helm.sh/hook"] === "string";
+const causeText = (cause) => cause instanceof Error ? cause.message : String(cause);
+/**
+ * Parse `helm template` output (multi-document YAML) into definitions.
+ * Hook-annotated objects are dropped — `renderHelmChart` already passes
+ * `--no-hooks`, but the parser enforces the invariant independently of the
+ * helm CLI's behavior.
+ *
+ * `secrets` scrubs credentials out of parser and validation diagnostics.
+ * Parsed objects stay plain; callers pass the same list to the request
+ * scrubber.
+ */
+export const parseRenderedManifests = (chart, rendered, secrets = []) => Effect.try({
+    try: () => parseRenderedManifestsSync(chart, rendered, secrets),
+    catch: (cause) => cause instanceof HelmError
+        ? cause
+        : new HelmError({
+            message: redactJson(`Failed to parse rendered manifests from chart '${chart}': ${causeText(cause)}`, secrets),
+        }),
+});
+const parseRenderedManifestsSync = (chart, rendered, secrets) => {
+    const fail = (message) => {
+        throw new HelmError({ message: redactJson(message, secrets) });
+    };
+    // Helm 4 writes OCI pull metadata to stdout before the rendered YAML.
+    // Strip only that exact leading preamble; chart output remains subject to
+    // the same strict Kubernetes object validation below.
+    const manifests = chart.startsWith("oci://")
+        ? rendered.replace(/^Pulled: [^\r\n]+\r?\nDigest: [^\r\n]+\r?\n(?=---(?:\r?\n|$))/, "")
+        : rendered;
+    const documents = YAML.parseAllDocuments(manifests);
+    const objects = [];
+    for (const document of documents) {
+        // parseAllDocuments records syntax errors on the document instead of
+        // throwing. toJS() can still throw (unresolved aliases, alias cycles).
+        if (document.errors.length > 0) {
+            const detail = document.errors.map((error) => error.message).join("\n");
+            fail(`Failed to parse rendered manifests from chart '${chart}': ${detail}`);
+        }
+        const value = document.toJS();
+        // helm renders empty documents for templates that produce no output
+        // (conditionals, whitespace) — skip them.
+        if (value === null || value === undefined)
+            continue;
+        if (typeof value !== "object" || Array.isArray(value)) {
+            fail(`Chart '${chart}' rendered a non-object YAML document: ${JSON.stringify(value)}`);
+        }
+        const object = value;
+        if (typeof object.apiVersion !== "string" || typeof object.kind !== "string") {
+            // Scrub the full JSON before truncating so a secret that crosses the
+            // 200-character boundary is removed entirely.
+            const snippet = redactJson(JSON.stringify(value), secrets).slice(0, 200);
+            fail(`Chart '${chart}' rendered an object without apiVersion/kind: ${snippet}`);
+        }
+        if (typeof object.metadata?.name !== "string") {
+            fail(`Chart '${chart}' rendered a ${object.apiVersion}/${object.kind} without metadata.name — server-side apply requires a concrete name (generateName is not supported)`);
+        }
+        const definition = object;
+        if (isHelmHook(definition))
+            continue;
+        objects.push(definition);
+    }
+    return objects;
+};
+//# sourceMappingURL=helm.js.map

package/lib/internal/helm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm.js","sourceRoot":"","sources":["../../src/internal/helm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC5E;;;;;;;;;;GAUG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,YAAY,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAG7B,8EAA8E;AAC9E,MAAM,OAAO,SAAU,SAAQ,IAAI,CAAC,WAAW,CAAC,WAAW,CAEzD;CAAG;AAEL,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AA0BnF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAA+B;IACjF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACtC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,CAC3E,CAAC;IAEF,yEAAyE;IACzE,+EAA+E;IAC/E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,IAAI,GAAG;YACX,UAAU;YACV,OAAO,CAAC,WAAW;YACnB,OAAO,CAAC,KAAK;YACb,aAAa;YACb,OAAO,CAAC,SAAS;YACjB,yEAAyE;YACzE,wEAAwE;YACxE,mEAAmE;YACnE,uEAAuE;YACvE,YAAY;SACb,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3E,uEAAuE;YACvE,gDAAgD;YAChD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC;gBAC5C,MAAM,EAAE,eAAe;aACxB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YACjD,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5F,KAAK,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;YACjD,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC,IAAI,CACL,OAAO,CAAC,KAAK,EACb,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,MAAM,CAAC,GAAG,CACR;YACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC7D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;SAC9D,EACD,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CACF;QACD,qEAAqE;QACrE,oDAAoD;QACpD,MAAM,CAAC,MAAM;QACb,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CAAC,GAAG,CACR,IAAI,KAAK,CACP,kBAAkB,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,yKAAyK,CAClN,CACF,CACF,CACF,CAAC;QAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GACV,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;gBACtE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAC3B,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAC9D,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAkC,EAAW,EAAE,CACxE,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC;AAEpE,MAAM,SAAS,GAAG,CAAC,KAAc,EAAU,EAAE,CAC3C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAAa,EACb,QAAgB,EAChB,OAAO,GAAsB,EAAE,EAC8B,EAAE,CAC/D,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE,CAAC,0BAA0B,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;IAC/D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,YAAY,SAAS;QACxB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,UAAU,CACjB,kDAAkD,KAAK,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,EAC/E,OAAO,CACR;SACF,CAAC;CACT,CAAC,CAAC;AAEL,MAAM,0BAA0B,GAAG,CACjC,KAAa,EACb,QAAgB,EAChB,OAA0B,EACS,EAAE;IACrC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE;QACtC,MAAM,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;IACF,sEAAsE;IACtE,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,+DAA+D,EAAE,EAAE,CAAC;QACvF,CAAC,CAAC,QAAQ,CAAC;IACb,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,OAAO,GAAsC,EAAE,CAAC;IACtD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxE,IAAI,CAAC,kDAAkD,KAAK,MAAM,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,KAAK,GAAY,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,oEAAoE;QACpE,0CAA0C;QAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,UAAU,KAAK,0CAA0C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,KAA4C,CAAC;QAC5D,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7E,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU,KAAK,iDAAiD,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,IAAI,CACF,UAAU,KAAK,gBAAgB,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,qGAAqG,CACrK,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAoC,CAAC;QACxD,IAAI,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QACrC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}

package/lib/internal/kind.d.ts

@@ -0,0 +1,17 @@
+import type { KindClusterConfig, LocalClusterProps } from "../LocalCluster.ts";
+/**
+ * containerd patch enabling the per-registry `hosts.toml` directory that
+ * points `localhost:<registryPort>` at the local registry container. The
+ * default on kind v0.27+ node images; kept for older ones
+ * (https://kind.sigs.k8s.io/docs/user/local-registry/).
+ */
+export declare const REGISTRY_CONTAINERD_PATCH = "[plugins.\"io.containerd.grpc.v1.cri\".registry]\n  config_path = \"/etc/containerd/certs.d\"";
+/** The kind config fields of a `LocalCluster`'s props. */
+export declare const kindConfigOf: ({ nodes, networking, featureGates, runtimeConfig, kubeadmConfigPatches, kubeadmConfigPatchesJSON6902, containerdConfigPatches, containerdConfigPatchesJSON6902, }: Partial<LocalClusterProps>) => KindClusterConfig;
+/**
+ * The kind cluster config `LocalCluster` passes to `kind create cluster`:
+ * the kind fields with the kind/apiVersion header and the registry
+ * containerd patch added. kind reads YAML, and JSON is valid YAML.
+ */
+export declare const kindClusterConfig: (config: KindClusterConfig) => any;
+//# sourceMappingURL=kind.d.ts.map

package/lib/internal/kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kind.d.ts","sourceRoot":"","sources":["../../src/internal/kind.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,kGACI,CAAC;AAE3C,0DAA0D;AAC1D,eAAO,MAAM,YAAY,sKAStB,OAAO,CAAC,iBAAiB,CAAC,KAAG,iBAS9B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,WAAY,iBAAiB,QAKzD,CAAC"}

package/lib/internal/kind.js

@@ -0,0 +1,31 @@
+/**
+ * containerd patch enabling the per-registry `hosts.toml` directory that
+ * points `localhost:<registryPort>` at the local registry container. The
+ * default on kind v0.27+ node images; kept for older ones
+ * (https://kind.sigs.k8s.io/docs/user/local-registry/).
+ */
+export const REGISTRY_CONTAINERD_PATCH = `[plugins."io.containerd.grpc.v1.cri".registry]
+  config_path = "/etc/containerd/certs.d"`;
+/** The kind config fields of a `LocalCluster`'s props. */
+export const kindConfigOf = ({ nodes, networking, featureGates, runtimeConfig, kubeadmConfigPatches, kubeadmConfigPatchesJSON6902, containerdConfigPatches, containerdConfigPatchesJSON6902, }) => ({
+    nodes,
+    networking,
+    featureGates,
+    runtimeConfig,
+    kubeadmConfigPatches,
+    kubeadmConfigPatchesJSON6902,
+    containerdConfigPatches,
+    containerdConfigPatchesJSON6902,
+});
+/**
+ * The kind cluster config `LocalCluster` passes to `kind create cluster`:
+ * the kind fields with the kind/apiVersion header and the registry
+ * containerd patch added. kind reads YAML, and JSON is valid YAML.
+ */
+export const kindClusterConfig = (config) => ({
+    kind: "Cluster",
+    apiVersion: "kind.x-k8s.io/v1alpha4",
+    ...JSON.parse(JSON.stringify(config)),
+    containerdConfigPatches: [...(config.containerdConfigPatches ?? []), REGISTRY_CONTAINERD_PATCH],
+});
+//# sourceMappingURL=kind.js.map

package/lib/internal/kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kind.js","sourceRoot":"","sources":["../../src/internal/kind.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;0CACC,CAAC;AAE3C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAC3B,KAAK,EACL,UAAU,EACV,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,4BAA4B,EAC5B,uBAAuB,EACvB,+BAA+B,GACJ,EAAqB,EAAE,CAAC,CAAC;IACpD,KAAK;IACL,UAAU;IACV,YAAY;IACZ,aAAa;IACb,oBAAoB;IACpB,4BAA4B;IAC5B,uBAAuB;IACvB,+BAA+B;CAChC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAyB,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,EAAE,SAAS;IACf,UAAU,EAAE,wBAAwB;IACpC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,uBAAuB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC,EAAE,yBAAyB,CAAC;CAChG,CAAC,CAAC"}

package/lib/internal/kubeconfig.d.ts

@@ -0,0 +1,79 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+declare const KubeConfigError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Kubernetes.KubeConfigError";
+} & Readonly<A>;
+/** A kubeconfig file could not be read, parsed, or resolved. */
+export declare class KubeConfigError extends KubeConfigError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+declare const ExecCredentialError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Kubernetes.ExecCredentialError";
+} & Readonly<A>;
+/** An exec credential plugin invocation failed or answered malformed. */
+export declare class ExecCredentialError extends ExecCredentialError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+interface KubeConfigUser {
+    token?: string;
+    tokenFile?: string;
+    "client-certificate"?: string;
+    "client-certificate-data"?: string;
+    "client-key"?: string;
+    "client-key-data"?: string;
+    exec?: {
+        command?: string;
+        args?: string[];
+        env?: {
+            name?: string;
+            value?: string;
+        }[];
+        apiVersion?: string;
+    };
+}
+/** The resolved connection material for one kubeconfig context. */
+export interface ResolvedKubeContext {
+    endpoint: string;
+    certificateAuthorityData?: string;
+    insecureSkipTlsVerify?: boolean;
+    user: KubeConfigUser;
+}
+/** Resolve the kubeconfig file path: explicit → `$KUBECONFIG` → default. */
+export declare const resolveKubeConfigPath: (explicit: string | undefined) => Effect.Effect<string, KubeConfigError, Path.Path>;
+/** Load a kubeconfig file and resolve one context to its cluster + user. */
+export declare const resolveKubeContext: (options: {
+    path?: string;
+    context?: string;
+}) => Effect.Effect<{
+    endpoint: string;
+    certificateAuthorityData: string | undefined;
+    insecureSkipTlsVerify: boolean | undefined;
+    user: KubeConfigUser;
+}, KubeConfigError, FileSystem.FileSystem | Path.Path>;
+/** Credentials minted by a user's auth stanza for one request. */
+export interface MintedCredentials {
+    token?: string;
+    clientCert?: {
+        certificate: string;
+        key: string;
+    };
+}
+/**
+ * Run a kubeconfig-style exec credential plugin and parse its
+ * ExecCredential response.
+ */
+export declare const runExecCredential: (options: {
+    command: string;
+    args?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+}) => Effect.Effect<MintedCredentials, ExecCredentialError, ChildProcessSpawner.ChildProcessSpawner>;
+/** Mint request credentials from a kubeconfig user's auth stanza. */
+export declare const mintUserCredentials: (user: KubeConfigUser) => Effect.Effect<MintedCredentials, ExecCredentialError | KubeConfigError, ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem | Path.Path>;
+export {};
+//# sourceMappingURL=kubeconfig.d.ts.map

package/lib/internal/kubeconfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubeconfig.d.ts","sourceRoot":"","sources":["../../src/internal/kubeconfig.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAEpC,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;;;;AAI1E,gEAAgE;AAChE,qBAAa,eAAgB,SAAQ,qBAA+C;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;;;;AAEL,yEAAyE;AACzE,qBAAa,mBAAoB,SAAQ,yBAAmD;IAC1F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAuBL,UAAU,cAAc;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,IAAI,EAAE,cAAc,CAAC;CACtB;AAgBD,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,qFAQhC,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB;WACtB,MAAM;cACH,MAAM;;;;;;sDAoEhB,CAAC;AASH,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAOD;;;GAGG;AACH,eAAO,MAAM,iBAAiB;aACnB,MAAM;WACR,MAAM,EAAE,GAAG,SAAS;UACrB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS;oGAoFxC,CAAC;AAEH,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,gLA+E9B,CAAC"}

package/lib/internal/kubeconfig.js

@@ -0,0 +1,222 @@
+/**
+ * Internal kubeconfig resolution for the built-in cluster adapters: parse a
+ * kubeconfig file, resolve a context to (cluster, user), and turn its auth
+ * stanza — static token, client certificate, or `exec` credential plugin —
+ * into a {@link ClusterTransport}. This is the "anything kubectl can reach"
+ * path: AKS/GKE/EKS CLI-managed contexts work through their exec plugins
+ * (`kubelogin`, `gke-gcloud-auth-plugin`, `aws eks get-token`).
+ */
+import * as Config from "effect/Config";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as ChildProcess from "effect/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+import * as Stream from "effect/Stream";
+import * as YAML from "yaml";
+/** A kubeconfig file could not be read, parsed, or resolved. */
+export class KubeConfigError extends Data.TaggedError("Kubernetes.KubeConfigError") {
+}
+/** An exec credential plugin invocation failed or answered malformed. */
+export class ExecCredentialError extends Data.TaggedError("Kubernetes.ExecCredentialError") {
+}
+const decodeBase64 = (value) => Buffer.from(value, "base64").toString("utf8");
+const expandHome = Effect.fn(function* (input) {
+    if (!input.startsWith("~"))
+        return input;
+    const home = yield* Effect.sync(() => process.env.HOME ?? process.env.USERPROFILE);
+    if (!home) {
+        return yield* new KubeConfigError({
+            message: `Cannot expand '${input}': no HOME environment variable`,
+        });
+    }
+    const path = yield* Path.Path;
+    return path.join(home, input.slice(1));
+});
+/** Resolve the kubeconfig file path: explicit → `$KUBECONFIG` → default. */
+export const resolveKubeConfigPath = Effect.fn(function* (explicit) {
+    if (explicit)
+        return yield* expandHome(explicit);
+    const fromEnv = yield* Config.String("KUBECONFIG").pipe(Effect.orElseSucceed(() => undefined));
+    // $KUBECONFIG may be a path list; use the first entry like kubectl's
+    // effective-config merge order.
+    const candidate = fromEnv?.split(":")[0];
+    if (candidate)
+        return yield* expandHome(candidate);
+    return yield* expandHome("~/.kube/config");
+});
+/** Load a kubeconfig file and resolve one context to its cluster + user. */
+export const resolveKubeContext = Effect.fn(function* (options) {
+    const fs = yield* FileSystem.FileSystem;
+    const configPath = yield* resolveKubeConfigPath(options.path);
+    const raw = yield* fs.readFileString(configPath).pipe(Effect.mapError((cause) => new KubeConfigError({
+        message: `Failed to read kubeconfig at '${configPath}'`,
+        cause,
+    })));
+    const parsed = yield* Effect.try({
+        try: () => YAML.parse(raw),
+        catch: (cause) => new KubeConfigError({
+            message: `Failed to parse kubeconfig at '${configPath}'`,
+            cause,
+        }),
+    });
+    const contextName = options.context ?? parsed["current-context"];
+    if (!contextName) {
+        return yield* new KubeConfigError({
+            message: `Kubeconfig '${configPath}' has no current-context — pass an explicit context`,
+        });
+    }
+    const context = parsed.contexts?.find((entry) => entry.name === contextName)?.context;
+    if (!context?.cluster) {
+        return yield* new KubeConfigError({
+            message: `Context '${contextName}' not found in kubeconfig '${configPath}'`,
+        });
+    }
+    const cluster = parsed.clusters?.find((entry) => entry.name === context.cluster)?.cluster;
+    if (!cluster?.server) {
+        return yield* new KubeConfigError({
+            message: `Cluster '${context.cluster}' (context '${contextName}') has no server in kubeconfig '${configPath}'`,
+        });
+    }
+    const user = parsed.users?.find((entry) => entry.name === context.user)?.user ?? {};
+    let certificateAuthorityData = cluster["certificate-authority-data"];
+    if (!certificateAuthorityData && cluster["certificate-authority"]) {
+        const caPath = yield* expandHome(cluster["certificate-authority"]);
+        const pem = yield* fs.readFileString(caPath).pipe(Effect.mapError((cause) => new KubeConfigError({
+            message: `Failed to read certificate authority file '${caPath}'`,
+            cause,
+        })));
+        certificateAuthorityData = Buffer.from(pem, "utf8").toString("base64");
+    }
+    return {
+        endpoint: cluster.server,
+        certificateAuthorityData,
+        insecureSkipTlsVerify: cluster["insecure-skip-tls-verify"],
+        user,
+    };
+});
+// Exec plugin invocations are cached per (command, args) until their
+// expirationTimestamp (or briefly, when the plugin doesn't declare one).
+// Plain cached values, no finalizers — module scope is safe.
+const execCache = new Map();
+/**
+ * Run a kubeconfig-style exec credential plugin and parse its
+ * ExecCredential response.
+ */
+export const runExecCredential = Effect.fn(function* (options) {
+    const cacheKey = JSON.stringify([options.command, options.args ?? [], options.env ?? {}]);
+    const cached = execCache.get(cacheKey);
+    const now = yield* Effect.sync(() => Date.now());
+    if (cached && cached.expiresAt > now) {
+        return cached.credentials;
+    }
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    // The child process is scoped to this invocation: spawn, drain stdio,
+    // and close the scope when the plugin exits.
+    const result = yield* ChildProcess.make(options.command, options.args ?? [], {
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "pipe",
+        detached: false,
+        extendEnv: true,
+        env: options.env,
+    }).pipe(spawner.spawn, Effect.flatMap((child) => Effect.all({
+        exitCode: child.exitCode,
+        stdout: child.stdout.pipe(Stream.decodeText, Stream.mkString),
+        stderr: child.stderr.pipe(Stream.decodeText, Stream.mkString),
+    }, { concurrency: "unbounded" })), Effect.scoped, Effect.catchCause((cause) => Effect.fail(new ExecCredentialError({
+        message: `Failed to run exec credential plugin '${options.command}': ${String(cause)}`,
+    }))));
+    if (result.exitCode !== 0) {
+        return yield* new ExecCredentialError({
+            message: `Exec credential plugin '${options.command} ${(options.args ?? []).join(" ")}' ` +
+                `exited with code ${String(result.exitCode)}: ${result.stderr.trim()}`,
+        });
+    }
+    const status = yield* Effect.try({
+        try: () => JSON.parse(result.stdout).status,
+        catch: (cause) => new ExecCredentialError({
+            message: `Exec credential plugin '${options.command}' answered malformed JSON`,
+            cause,
+        }),
+    });
+    if (!status || (!status.token && !(status.clientCertificateData && status.clientKeyData))) {
+        return yield* new ExecCredentialError({
+            message: `Exec credential plugin '${options.command}' returned no token or client certificate`,
+        });
+    }
+    const credentials = {
+        token: status.token,
+        clientCert: status.clientCertificateData && status.clientKeyData
+            ? {
+                certificate: status.clientCertificateData,
+                key: status.clientKeyData,
+            }
+            : undefined,
+    };
+    const expiresAt = status.expirationTimestamp
+        ? // Re-mint 30s before the declared expiry.
+            new Date(status.expirationTimestamp).getTime() - 30_000
+        : // No declared expiry: cache briefly so bursts of requests share one
+            // plugin invocation without holding a stale credential for long.
+            now + 60_000;
+    execCache.set(cacheKey, { credentials, expiresAt });
+    return credentials;
+});
+/** Mint request credentials from a kubeconfig user's auth stanza. */
+export const mintUserCredentials = Effect.fn(function* (user) {
+    if (user.exec?.command) {
+        return yield* runExecCredential({
+            command: user.exec.command,
+            args: user.exec.args,
+            env: user.exec.env
+                ? Object.fromEntries(user.exec.env
+                    .filter((entry) => typeof entry.name === "string" && typeof entry.value === "string")
+                    .map((entry) => [entry.name, entry.value]))
+                : undefined,
+        });
+    }
+    if (user.token) {
+        return { token: user.token };
+    }
+    if (user.tokenFile) {
+        const fs = yield* FileSystem.FileSystem;
+        const tokenPath = yield* expandHome(user.tokenFile);
+        const token = yield* fs.readFileString(tokenPath).pipe(Effect.mapError((cause) => new KubeConfigError({
+            message: `Failed to read token file '${tokenPath}'`,
+            cause,
+        })));
+        return { token: token.trim() };
+    }
+    const certData = user["client-certificate-data"];
+    const keyData = user["client-key-data"];
+    if (certData && keyData) {
+        return {
+            clientCert: {
+                certificate: decodeBase64(certData),
+                key: decodeBase64(keyData),
+            },
+        };
+    }
+    const certPath = user["client-certificate"];
+    const keyPath = user["client-key"];
+    if (certPath && keyPath) {
+        const fs = yield* FileSystem.FileSystem;
+        const readPem = (file) => expandHome(file).pipe(Effect.flatMap((resolved) => fs.readFileString(resolved).pipe(Effect.mapError((cause) => new KubeConfigError({
+            message: `Failed to read credential file '${resolved}'`,
+            cause,
+        })))));
+        return {
+            clientCert: {
+                certificate: yield* readPem(certPath),
+                key: yield* readPem(keyPath),
+            },
+        };
+    }
+    return yield* new KubeConfigError({
+        message: "Kubeconfig user has no supported auth stanza (token, tokenFile, " +
+            "client certificate, or exec credential plugin)",
+    });
+});
+//# sourceMappingURL=kubeconfig.js.map

package/lib/internal/kubeconfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubeconfig.js","sourceRoot":"","sources":["../../src/internal/kubeconfig.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,YAAY,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,gEAAgE;AAChE,MAAM,OAAO,eAAgB,SAAQ,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAGhF;CAAG;AAEL,yEAAyE;AACzE,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CAAC,gCAAgC,CAGxF;CAAG;AA8CL,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAEtF,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAa;IACnD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC;YAChC,OAAO,EAAE,kBAAkB,KAAK,iCAAiC;SAClE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAA4B;IACpF,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/F,qEAAqE;IACrE,gCAAgC;IAChC,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAGtD;IACC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,eAAe,CAAC;QAClB,OAAO,EAAE,iCAAiC,UAAU,GAAG;QACvD,KAAK;KACN,CAAC,CACL,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB;QAC5C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,eAAe,CAAC;YAClB,OAAO,EAAE,kCAAkC,UAAU,GAAG;YACxD,KAAK;SACN,CAAC;KACL,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACjE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC;YAChC,OAAO,EAAE,eAAe,UAAU,qDAAqD;SACxF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,OAAO,CAAC;IACtF,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC;YAChC,OAAO,EAAE,YAAY,WAAW,8BAA8B,UAAU,GAAG;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC1F,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC;YAChC,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,eAAe,WAAW,mCAAmC,UAAU,GAAG;SAC/G,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IAEpF,IAAI,wBAAwB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACrE,IAAI,CAAC,wBAAwB,IAAI,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,eAAe,CAAC;YAClB,OAAO,EAAE,8CAA8C,MAAM,GAAG;YAChE,KAAK;SACN,CAAC,CACL,CACF,CAAC;QACF,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,wBAAwB;QACxB,qBAAqB,EAAE,OAAO,CAAC,0BAA0B,CAAC;QAC1D,IAAI;KACyB,CAAC;AAClC,CAAC,CAAC,CAAC;AAeH,qEAAqE;AACrE,yEAAyE;AACzE,6DAA6D;AAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiE,CAAC;AAE3F;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAIrD;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;IAC/D,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE;QAC3E,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,IAAI;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC,IAAI,CACL,OAAO,CAAC,KAAK,EACb,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,MAAM,CAAC,GAAG,CACR;QACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;KAC9D,EACD,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CACF,EACD,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CAAC,IAAI,CACT,IAAI,mBAAmB,CAAC;QACtB,OAAO,EAAE,yCAAyC,OAAO,CAAC,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE;KACvF,CAAC,CACH,CACF,CACF,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC;YACpC,OAAO,EACL,2BAA2B,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;gBAChF,oBAAoB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SACzE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/B,GAAG,EAAE,GAAG,EAAE,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAuC,CAAC,MAAM;QAClF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,mBAAmB,CAAC;YACtB,OAAO,EAAE,2BAA2B,OAAO,CAAC,OAAO,2BAA2B;YAC9E,KAAK;SACN,CAAC;KACL,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC1F,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC;YACpC,OAAO,EAAE,2BAA2B,OAAO,CAAC,OAAO,2CAA2C;SAC/F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAsB;QACrC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EACR,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,aAAa;YAClD,CAAC,CAAC;gBACE,WAAW,EAAE,MAAM,CAAC,qBAAqB;gBACzC,GAAG,EAAE,MAAM,CAAC,aAAa;aAC1B;YACH,CAAC,CAAC,SAAS;KAChB,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,mBAAmB;QAC1C,CAAC,CAAC,0CAA0C;YAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM;QACzD,CAAC,CAAC,oEAAoE;YACpE,iEAAiE;YACjE,GAAG,GAAG,MAAM,CAAC;IACjB,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IAEpD,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAoB;IAC1E,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,CAAC,iBAAiB,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;gBAChB,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,IAAI,CAAC,IAAI,CAAC,GAAG;qBACV,MAAM,CACL,CAAC,KAAK,EAA4C,EAAE,CAClD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CACpE;qBACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAC7C;gBACH,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAA8B,CAAC;IAC3D,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,eAAe,CAAC;YAClB,OAAO,EAAE,8BAA8B,SAAS,GAAG;YACnD,KAAK;SACN,CAAC,CACL,CACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAA8B,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACxC,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO;YACL,UAAU,EAAE;gBACV,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC;gBACnC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC;aAC3B;SAC0B,CAAC;IAChC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACnC,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAC/B,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CACnB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC9B,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,eAAe,CAAC;YAClB,OAAO,EAAE,mCAAmC,QAAQ,GAAG;YACvD,KAAK;SACN,CAAC,CACL,CACF,CACF,CACF,CAAC;QACJ,OAAO;YACL,UAAU,EAAE;gBACV,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACrC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;aAC7B;SAC0B,CAAC;IAChC,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC;QAChC,OAAO,EACL,kEAAkE;YAClE,gDAAgD;KACnD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/lib/internal/registry.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Image publishing for connections that declare a
+ * {@link Connection.registry}: `main` programs and `context` Dockerfiles are
+ * built on the deploying machine and pushed to `<server>/<name>:<hash>`,
+ * where the cluster's nodes pull them. Used when the cluster's platform
+ * adapter has no managed registry of its own (EKS pushes to ECR instead).
+ */
+import * as Effect from "effect/Effect";
+import type { WorkloadImageSource } from "../ClusterAdapter.ts";
+import type { ContainerRegistry } from "../Connection.ts";
+export declare const makeConnectionRegistry: Effect.Effect<{
+    resolve: (options: {
+        id: string;
+        registry: ContainerRegistry;
+        source: WorkloadImageSource;
+        platform: string;
+        port?: number | undefined;
+        isExternal?: boolean | undefined;
+        bootstrap: (importPath: string) => string;
+        state: Record<string, unknown> | undefined;
+        session: {
+            note: (message: string) => Effect.Effect<void>;
+        };
+    }) => Effect.Effect<{
+        imageUri: string;
+        codeHash: string;
+        state: {
+            kind: "registry";
+            server: string;
+            repository: string;
+        };
+    }, any, import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("alchemy/ResourceContext").ResourceContext | import("alchemy/Stack").Stack | import("alchemy/Stage").Stage>;
+    hash: (options: {
+        source: WorkloadImageSource;
+        platform: string;
+        port?: number | undefined;
+        isExternal?: boolean | undefined;
+        bootstrap: (importPath: string) => string;
+    }) => Effect.Effect<string | undefined, import("alchemy/Bundle/Bundle").BundleError | import("effect/PlatformError").PlatformError, import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
+}, never, import("alchemy/AlchemyContext").AlchemyContext | import("@alchemy.run/docker/Docker").Docker | import("effect/Path").Path>;
+/** The publisher returned by {@link makeConnectionRegistry}. */
+export interface ConnectionRegistry extends Effect.Success<typeof makeConnectionRegistry> {
+}
+//# sourceMappingURL=registry.d.ts.map

package/lib/internal/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/internal/registry.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAiB,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAe1D,eAAO,MAAM,sBAAsB;;YAI3B,MAAM;kBACA,iBAAiB;gBACnB,mBAAmB;kBACjB,MAAM;eACT,MAAM,GAAG,SAAS;qBACZ,OAAO,GAAG,SAAS;mBACrB,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM;eAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;iBACjC;YAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;SAAE;;;;;kBAuCjD,UAAU;;;;;oBAOC;QACrB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACjC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;KAC3C;qIAUD,CAAC;AAEH,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,MAAM,CAAC,OAAO,CAAC,OAAO,sBAAsB,CAAC;CAAG"}