@alchemy.run/kubernetes 0.0.0 → 2.0.0-beta.84

package/lib/Client.js

@@ -0,0 +1,296 @@
+import * as https from "node:https";
+import { isPlainObject, unwrapRedacted } from "alchemy/Util/data";
+import { collectRedactedSecrets, redactJson } from "alchemy/Util/Redaction";
+/**
+ * Internal Kubernetes API client: transport-agnostic server-side apply and
+ * kind discovery for arbitrary (CRD) manifests. Powers
+ * `Kubernetes.Manifest`, `Kubernetes.Deployment`, `Kubernetes.Job`,
+ * `Kubernetes.HelmChart`, and the `AWS.EKS.Cluster` kubernetes-object
+ * binding channel. Not exported from the Kubernetes index.
+ *
+ * Authentication is delegated to the connection's {@link ClusterAdapter}:
+ * every request mints headers through the resolved
+ * {@link ClusterTransport}, so short-lived tokens (EKS SigV4 presigns,
+ * exec-plugin credentials) stay fresh.
+ */
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { ClusterNotFoundError, findClusterAdapter, } from "./ClusterAdapter.js";
+import { driftMask, hashDriftSelection } from "./internal/declared.js";
+import { buildKubernetesObjectPathWithSpec, chunkByApplyRank, DEFAULT_APPLY_RANK, kubernetesObjectKey, lookupKubernetesKindSpec, sortRefsForDelete, toKubernetesObjectRef, } from "./Objects.js";
+export class KubernetesApiError extends Data.TaggedError("KubernetesApiError") {
+    get message() {
+        return `${this.method} ${this.path} responded ${this.statusCode}: ${this.body.length > 0 ? this.body.slice(0, 1000) : "(empty body)"}`;
+    }
+}
+const fieldManager = "alchemy";
+/** Deadline for auth-header minting and for each HTTP attempt. */
+const requestTimeout = "10 seconds";
+/**
+ * Resolve the {@link ClusterTransport} for a connection through its
+ * registered adapter.
+ */
+export const connectCluster = (connection) => findClusterAdapter(connection.auth.kind).pipe(Effect.flatMap((adapter) => adapter.connect(connection)));
+/** 404 from the apiserver, including a removed CRD's discovery 404. */
+export class KubernetesNotFound extends Data.TaggedError("KubernetesNotFound") {
+    get message() {
+        return `${this.method} ${this.path} responded 404: ${this.body.length > 0 ? this.body.slice(0, 1000) : "(empty body)"}`;
+    }
+}
+/**
+ * The effect's result when the cluster exists. `ClusterNotFoundError`
+ * becomes `undefined`; auth and HTTP failures stay failures.
+ */
+export const ifClusterExists = (effect) => effect.pipe(Effect.catchTag("Kubernetes.ClusterNotFoundError", () => Effect.succeed(undefined)));
+const requestJson = Effect.fn(function* ({ transport, method, path, body, redactions = [], }) {
+    // Outside the attempt retry: a hung token mint must not be retried as
+    // if it were a refused connection.
+    const headers = yield* transport.headers.pipe(Effect.timeout(requestTimeout));
+    const url = new URL(path, transport.endpoint);
+    // JSON.stringify(Redacted) emits the display placeholder. Unwrap only at
+    // the wire so plans and state keep the wrapper.
+    const prepared = yield* Effect.sync(() => {
+        const payload = body === undefined ? undefined : JSON.stringify(unwrapRedacted(body));
+        return {
+            payload,
+            contentLength: payload === undefined ? undefined : Buffer.byteLength(payload),
+            ca: transport.certificateAuthorityData === undefined
+                ? undefined
+                : Buffer.from(transport.certificateAuthorityData, "base64").toString("utf8"),
+            secrets: [...(body === undefined ? [] : collectRedactedSecrets(body)), ...redactions],
+        };
+    });
+    const response = yield* Effect.callback((resume, signal) => {
+        const request = https.request({
+            signal,
+            protocol: url.protocol,
+            hostname: url.hostname,
+            port: url.port || 443,
+            path: `${url.pathname}${url.search}`,
+            method,
+            headers: {
+                ...headers,
+                Accept: "application/json",
+                ...(prepared.payload === undefined
+                    ? {}
+                    : {
+                        "Content-Type": "application/apply-patch+yaml",
+                        "Content-Length": prepared.contentLength,
+                    }),
+            },
+            ...(prepared.ca === undefined ? {} : { ca: prepared.ca }),
+            ...(transport.clientCert
+                ? {
+                    cert: transport.clientCert.certificate,
+                    key: transport.clientCert.key,
+                }
+                : {}),
+            ...(transport.insecureSkipTlsVerify ? { rejectUnauthorized: false } : {}),
+        }, (incoming) => {
+            const chunks = [];
+            incoming.on("data", (chunk) => {
+                chunks.push(chunk);
+            });
+            incoming.on("error", (error) => {
+                resume(Effect.fail(error));
+            });
+            incoming.on("aborted", () => {
+                resume(Effect.fail(new Error(`Kubernetes ${method} ${path} response aborted`)));
+            });
+            incoming.on("end", () => {
+                if (incoming.complete === false) {
+                    resume(Effect.fail(new Error(`Kubernetes ${method} ${path} response ended before completion`)));
+                    return;
+                }
+                const statusCode = incoming.statusCode ?? 500;
+                resume(Effect.sync(() => ({
+                    statusCode,
+                    body: Buffer.concat(chunks).toString("utf8"),
+                })));
+            });
+        });
+        request.on("error", (error) => {
+            resume(Effect.fail(error instanceof Error ? error : new Error(String(error))));
+        });
+        if (prepared.payload !== undefined)
+            request.write(prepared.payload);
+        request.end();
+        // Bun's TLS client ignores AbortSignal. Destroying the socket releases it.
+        // Effect.callback already drops a second resume, and this finalizer runs
+        // on the same interrupt that aborts `signal`.
+        return Effect.sync(() => {
+            request.destroy();
+            request.socket?.destroy();
+        });
+    }).pipe(Effect.timeout(requestTimeout), Effect.mapError((error) => new Error(`Failed Kubernetes ${method} ${path}: ${error instanceof Error ? error.message : String(error)}`)), 
+    // Transport-level failures (ECONNREFUSED/ECONNRESET/ETIMEDOUT/DNS,
+    // the per-attempt deadline) are transient — a fresh managed endpoint's
+    // load balancer can refuse connections for a short window after the
+    // cluster reports ready. Every request here is idempotent (GET / SSA
+    // PATCH / DELETE), so retry them. HTTP status errors are classified
+    // below and are not retried here.
+    Effect.retry({
+        schedule: Schedule.max([Schedule.spaced("5 seconds"), Schedule.recurs(8)]),
+    }));
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+        // Error bodies can echo the request. Scrub only failures —
+        // a successful dry-run is the object we compare for drift.
+        const responseBody = yield* Effect.sync(() => redactJson(response.body, prepared.secrets));
+        if (response.statusCode === 404) {
+            return yield* new KubernetesNotFound({ method, path, body: responseBody });
+        }
+        return yield* new KubernetesApiError({
+            method,
+            path,
+            statusCode: response.statusCode,
+            body: responseBody,
+        });
+    }
+    if (!response.body.trim())
+        return undefined;
+    return yield* Effect.sync(() => {
+        try {
+            return JSON.parse(response.body);
+        }
+        catch {
+            return response.body;
+        }
+    });
+});
+// One resolution per (endpoint, apiVersion, kind) per process. Plain cached
+// values (no finalizers), so module scope is safe.
+const discoveredKinds = new Map();
+/**
+ * Resolve the REST mapping (plural + scope) for an arbitrary kind: static
+ * table fast path, then the Kubernetes discovery API (`/apis/{g}/{v}` or
+ * `/api/v1`). This is what lets `Kubernetes.Manifest` apply any CRD.
+ */
+export const resolveKindSpec = Effect.fn(function* ({ transport, input, }) {
+    const staticSpec = lookupKubernetesKindSpec(input);
+    if (staticSpec)
+        return staticSpec;
+    const cacheKey = `${transport.endpoint}|${input.apiVersion}|${input.kind}`;
+    const cached = discoveredKinds.get(cacheKey);
+    if (cached)
+        return cached;
+    const discoveryPath = input.apiVersion.includes("/")
+        ? `/apis/${input.apiVersion}`
+        : `/api/${input.apiVersion}`;
+    const listed = (yield* requestJson({
+        transport,
+        method: "GET",
+        path: discoveryPath,
+    }));
+    const resource = listed.resources?.find((candidate) => candidate.kind === input.kind &&
+        typeof candidate.name === "string" &&
+        !candidate.name.includes("/"));
+    if (!resource?.name) {
+        return yield* new KubernetesNotFound({
+            method: "GET",
+            path: discoveryPath,
+            body: `Kind '${input.kind}' not found in API group '${input.apiVersion}'`,
+        });
+    }
+    const spec = {
+        plural: resource.name,
+        scope: resource.namespaced ? "Namespaced" : "Cluster",
+        applyRank: DEFAULT_APPLY_RANK,
+    };
+    discoveredKinds.set(cacheKey, spec);
+    return spec;
+});
+const buildPath = Effect.fn(function* ({ transport, object, }) {
+    const spec = yield* resolveKindSpec({ transport, input: object });
+    return yield* Effect.try({
+        try: () => buildKubernetesObjectPathWithSpec(object, spec),
+        catch: (error) => (error instanceof Error ? error : new Error(String(error))),
+    });
+});
+// ─────────────────────────────────────────────────────────── object ops ──
+export const readObject = Effect.fn(function* ({ transport, object, }) {
+    return yield* requestJson({
+        transport,
+        method: "GET",
+        path: yield* buildPath({ transport, object }),
+    }).pipe(
+    // Drift reads a whole Helm release at once. A 429 is the apiserver
+    // asking for a pause, not a failed object.
+    Effect.retry({
+        while: (error) => error instanceof KubernetesApiError && error.statusCode === 429,
+        schedule: Schedule.max([Schedule.spaced("1 second"), Schedule.recurs(4)]),
+    }));
+});
+export const applyObject = Effect.fn(function* ({ transport, object, redactions, }) {
+    const basePath = yield* buildPath({
+        transport,
+        object: toKubernetesObjectRef(object),
+    });
+    const path = `${basePath}?fieldManager=${fieldManager}&force=true`;
+    // A freshly provisioned cluster's API server briefly 5xxes while warming
+    // up, and the creator's bootstrap access can propagate asynchronously
+    // (401/403 in the first minute).
+    return yield* requestJson({
+        transport,
+        method: "PATCH",
+        path,
+        body: object,
+        redactions,
+    }).pipe(Effect.retry({
+        while: (e) => e instanceof KubernetesApiError &&
+            (e.statusCode >= 500 ||
+                e.statusCode === 429 ||
+                e.statusCode === 401 ||
+                e.statusCode === 403),
+        schedule: Schedule.max([Schedule.spaced("6 seconds"), Schedule.recurs(10)]),
+    }));
+});
+export const deleteObject = Effect.fn(function* ({ transport, object, }) {
+    yield* buildPath({ transport, object }).pipe(Effect.flatMap((path) => requestJson({
+        transport,
+        method: "DELETE",
+        // batch/v1 Jobs orphan their pods on DELETE unless a propagation
+        // policy is set; Background matches kubectl's default.
+        path: `${path}?propagationPolicy=Background`,
+    })), Effect.catchTag("KubernetesNotFound", () => Effect.void));
+});
+export const reconcileObjects = Effect.fn(function* ({ transport, previousObjects, desiredObjects, redactions, }) {
+    const desiredRefs = desiredObjects.map(toKubernetesObjectRef);
+    const desiredKeys = new Set(desiredRefs.map(kubernetesObjectKey));
+    const removedObjects = previousObjects.filter((object) => !desiredKeys.has(kubernetesObjectKey(object)));
+    for (const object of sortRefsForDelete(removedObjects)) {
+        yield* deleteObject({
+            transport,
+            object,
+        });
+    }
+    const baselines = new Map();
+    for (const chunk of chunkByApplyRank(desiredObjects)) {
+        yield* Effect.forEach(chunk, (object) => Effect.gen(function* () {
+            const applied = yield* applyObject({
+                transport,
+                object,
+                redactions,
+            });
+            const ref = toKubernetesObjectRef(object);
+            const witnessed = isPlainObject(applied) ? applied : undefined;
+            baselines.set(kubernetesObjectKey(ref), {
+                driftMask: driftMask(object, witnessed),
+                baselineHash: yield* hashDriftSelection(object, witnessed ?? object),
+            });
+        }), { concurrency: "unbounded" });
+    }
+    return desiredRefs.map((ref) => ({
+        ...ref,
+        ...baselines.get(kubernetesObjectKey(ref)),
+    }));
+});
+export const deleteObjects = Effect.fn(function* ({ transport, objects, }) {
+    for (const object of sortRefsForDelete(objects)) {
+        yield* deleteObject({
+            transport,
+            object,
+        });
+    }
+});
+//# sourceMappingURL=Client.js.map

package/lib/Client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Client.js","sourceRoot":"","sources":["../src/Client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC5E;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,iCAAiC,EACjC,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,GAItB,MAAM,cAAc,CAAC;AAEtB,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAK3E;IACA,IAAa,OAAO;QAClB,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,UAAU,KAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cACpD,EAAE,CAAC;IACL,CAAC;CACF;AAED,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,kEAAkE;AAClE,MAAM,cAAc,GAAG,YAAY,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAsB,EAAE,EAAE,CACvD,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAC3C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CACzD,CAAC;AAEJ,uEAAuE;AACvE,MAAM,OAAO,kBAAmB,SAAQ,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAI3E;IACA,IAAa,OAAO;QAClB,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,mBAChC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cACpD,EAAE,CAAC;IACL,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAU,MAAqD,EAAE,EAAE,CAChG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAEnG,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EACvC,SAAS,EACT,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,UAAU,GAAG,EAAE,GAQhB;IACC,sEAAsE;IACtE,mCAAmC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9C,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACvC,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACtF,OAAO;YACL,OAAO;YACP,aAAa,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YAC7E,EAAE,EACA,SAAS,CAAC,wBAAwB,KAAK,SAAS;gBAC9C,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChF,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC;SACtF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAGrC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B;YACE,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG;YACrB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,MAAM;YACN,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,cAAc,EAAE,8BAA8B;wBAC9C,gBAAgB,EAAE,QAAQ,CAAC,aAAa;qBACzC,CAAC;aACP;YACD,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;YACzD,GAAG,CAAC,SAAS,CAAC,UAAU;gBACtB,CAAC,CAAC;oBACE,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,WAAW;oBACtC,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG;iBAC9B;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,MAAM,MAAM,GAAiB,EAAE,CAAC;YAChC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAiB,EAAE,EAAE;gBACxC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;oBAChC,MAAM,CACJ,MAAM,CAAC,IAAI,CACT,IAAI,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,mCAAmC,CAAC,CAC3E,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;gBAC9C,MAAM,CACJ,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBACjB,UAAU;oBACV,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBAC7C,CAAC,CAAC,CACJ,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,2EAA2E;QAC3E,yEAAyE;QACzE,8CAA8C;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACtB,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAC9B,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,KAAK,CACP,qBAAqB,MAAM,IAAI,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjG,CACJ;IACD,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,kCAAkC;IAClC,MAAM,CAAC,KAAK,CAAC;QACX,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3E,CAAC,CACH,CAAC;IAEF,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC5D,2DAA2D;QAC3D,2DAA2D;QAC3D,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3F,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC;YACnC,MAAM;YACN,IAAI;YACJ,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAY,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAYH,4EAA4E;AAC5E,mDAAmD;AACnD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAoC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAClD,SAAS,EACT,KAAK,GAIN;IACC,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,QAAQ,GAAG,GAAG,SAAS,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClD,CAAC,CAAC,SAAS,KAAK,CAAC,UAAU,EAAE;QAC7B,CAAC,CAAC,QAAQ,KAAK,CAAC,UAAU,EAAE,CAAC;IAE/B,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;QACjC,SAAS;QACT,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,aAAa;KACpB,CAAC,CAAoB,CAAC;IAEvB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,CACrC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAC7B,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;QAClC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChC,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,CAAC;YACnC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,SAAS,KAAK,CAAC,IAAI,6BAA6B,KAAK,CAAC,UAAU,GAAG;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAA6B;QACrC,MAAM,EAAE,QAAQ,CAAC,IAAI;QACrB,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACrD,SAAS,EAAE,kBAAkB;KAC9B,CAAC;IACF,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EACrC,SAAS,EACT,MAAM,GAIP;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACvB,GAAG,EAAE,GAAG,EAAE,CAAC,iCAAiC,CAAC,MAAM,EAAE,IAAI,CAAC;QAC1D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,4EAA4E;AAE5E,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC7C,SAAS,EACT,MAAM,GAIP;IACC,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC;QACxB,SAAS;QACT,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;KAC9C,CAAC,CAAC,IAAI;IACL,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG;QACjF,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KAC1E,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC9C,SAAS,EACT,MAAM,EACN,UAAU,GAMX;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;QAChC,SAAS;QACT,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,QAAQ,iBAAiB,YAAY,aAAa,CAAC;IAEnE,yEAAyE;IACzE,sEAAsE;IACtE,iCAAiC;IACjC,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC;QACxB,SAAS;QACT,MAAM,EAAE,OAAO;QACf,IAAI;QACJ,IAAI,EAAE,MAAM;QACZ,UAAU;KACX,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,CAAC,EAAW,EAAE,CACpB,CAAC,YAAY,kBAAkB;YAC/B,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG;gBAClB,CAAC,CAAC,UAAU,KAAK,GAAG;gBACpB,CAAC,CAAC,UAAU,KAAK,GAAG;gBACpB,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC;QACzB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;KAC5E,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC/C,SAAS,EACT,MAAM,GAIP;IACC,KAAK,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,WAAW,CAAC;QACV,SAAS;QACT,MAAM,EAAE,QAAQ;QAChB,iEAAiE;QACjE,uDAAuD;QACvD,IAAI,EAAE,GAAG,IAAI,+BAA+B;KAC7C,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACzD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EACnD,SAAS,EACT,eAAe,EACf,cAAc,EACd,UAAU,GAMX;IACC,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAElE,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAC1D,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,CAAC,YAAY,CAAC;YAClB,SAAS;YACT,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwD,CAAC;IAClF,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,KAAK,EACL,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;gBACjC,SAAS;gBACT,MAAM;gBACN,UAAU;aACX,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/D,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE;gBACtC,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;gBACvC,YAAY,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,IAAI,MAAM,CAAC;aACrE,CAAC,CAAC;QACL,CAAC,CAAC,EACJ,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/B,GAAG,GAAG;QACN,GAAG,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;KAC3C,CAAC,CAAC,CAAC;AACN,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAChD,SAAS,EACT,OAAO,GAIR;IACC,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,CAAC,YAAY,CAAC;YAClB,SAAS;YACT,MAAM;SACP,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/lib/ClusterAdapter.d.ts

@@ -0,0 +1,322 @@
+import type { InlineDockerfile } from "@alchemy.run/docker/Dockerfile";
+import type * as Bundle from "alchemy/Bundle/Bundle";
+import type { ResourceBinding } from "alchemy/Resource";
+import type { ResourceContext } from "alchemy/ResourceContext";
+import type { Stack } from "alchemy/Stack";
+import type { Stage } from "alchemy/Stage";
+/**
+ * The extension seam between the cluster-agnostic `Kubernetes.*` workloads
+ * and the platform a cluster runs on.
+ *
+ * A {@link ClusterAdapterService} is registered under a keyed Context tag —
+ * `Kubernetes.ClusterAdapter/<auth kind>` — and resolved dynamically from
+ * the ambient provider context by {@link findClusterAdapter}, mirroring how
+ * resource providers are resolved by type. `Kubernetes.providers()` ships
+ * the built-in adapters (`kubeconfig`, `token`, `client-cert`, `exec`);
+ * cloud provider layers contribute theirs (`AWS.providers()` registers
+ * `aws-eks`).
+ *
+ * An adapter owns everything platform-specific:
+ *
+ * - **connect** (required) — resolve the API server endpoint/CA and mint
+ *   per-request auth headers.
+ * - **identity** (optional) — provision workload identity for a namespace +
+ *   service account and translate host bindings into cloud credentials
+ *   (EKS Pod Identity, GKE Workload Identity Federation).
+ * - **registry** (optional) — build/mirror container images into a managed
+ *   registry the cluster can pull from (ECR on EKS, Artifact Registry on GKE).
+ * - **bootstrap** (optional) — platform-specific generated container
+ *   entries for Effect-native workloads (e.g. wiring the AWS credential
+ *   chain for Pod Identity).
+ * - **loadBalancerDefaults** (optional) — platform defaults for
+ *   `LoadBalancer` Services (EKS Auto Mode's `loadBalancerClass` +
+ *   internet-facing scheme).
+ */
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import type { Connection } from "./Connection.ts";
+/**
+ * Per-resource engine services ambient inside every provider lifecycle
+ * operation. Adapter methods run inside the workload providers' lifecycle
+ * ops, so they may require these (physical-name generation needs the
+ * resource's ResourceContext + Stack + Stage) — everything else an adapter
+ * needs is captured at its layer build.
+ */
+export type AdapterLifecycleServices = ResourceContext | Stack | Stage;
+declare const ClusterNotFoundError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Kubernetes.ClusterNotFoundError";
+} & Readonly<A>;
+/**
+ * The target cluster no longer exists (definitively — e.g. the managed
+ * control plane is deleted or deleting). Distinct from transient
+ * unreachability: `read`/`delete` treat this as "everything in-cluster is
+ * already gone".
+ */
+export declare class ClusterNotFoundError extends ClusterNotFoundError_base<{
+    message: string;
+}> {
+}
+/**
+ * A resolved transport to a cluster's API server. `headers` is an Effect
+ * so short-lived tokens (EKS SigV4 presigns, exec plugin credentials) are
+ * minted per request.
+ */
+export interface ClusterTransport {
+    /** The API server endpoint URL. */
+    endpoint: string;
+    /** Base64-encoded PEM certificate authority bundle. */
+    certificateAuthorityData?: string;
+    /** Skip TLS verification (self-signed local clusters). */
+    insecureSkipTlsVerify?: boolean;
+    /** Mint the auth headers for one request. */
+    headers: Effect.Effect<Record<string, string>, Error>;
+    /** PEM client certificate credentials for mutual TLS. */
+    clientCert?: {
+        certificate: string;
+        key: string;
+    };
+}
+/**
+ * Workload identity state persisted on a workload's attributes, keyed by
+ * adapter kind. Cloud providers extend it via module augmentation — AWS
+ * registers:
+ *
+ * ```ts
+ * declare module "@alchemy.run/kubernetes/ClusterAdapter" {
+ *   interface IdentityStateRegistry {
+ *     "aws-pod-identity": {
+ *       roleArn: string;
+ *       roleName: string;
+ *       associationArn: string;
+ *       associationId: string;
+ *     };
+ *   }
+ * }
+ * ```
+ */
+export interface IdentityStateRegistry {
+}
+/** The discriminated identity-state union across all registered adapters. */
+export type IdentityState = {
+    [K in keyof IdentityStateRegistry]: {
+        readonly kind: K;
+    } & IdentityStateRegistry[K];
+}[keyof IdentityStateRegistry];
+/**
+ * Image-registry state persisted on a workload's attributes, keyed by
+ * adapter kind (AWS registers `"aws-ecr"` with the repository name/URI).
+ * The built-in `"registry"` entry records images pushed to a connection's
+ * {@link Connection.registry}.
+ */
+export interface RegistryStateRegistry {
+    registry: {
+        /** The registry `server` the image was pushed to. */
+        server: string;
+        /** The repository the image was pushed to (`<server>/<name>`). */
+        repository: string;
+    };
+}
+/** The discriminated registry-state union across all registered adapters. */
+export type RegistryState = {
+    [K in keyof RegistryStateRegistry]: {
+        readonly kind: K;
+    } & RegistryStateRegistry[K];
+}[keyof RegistryStateRegistry];
+/**
+ * Cloud-specific workload identity options, extended via module
+ * augmentation (AWS adds `managedPolicyArns`, GCP `gcpServiceAccount`).
+ */
+export interface WorkloadIdentityOptions {
+}
+/**
+ * The binding contract of `Kubernetes.Deployment` / `Kubernetes.Job`
+ * hosts. The core contract is environment variables; cloud providers
+ * augment it with their credential-grant channels (AWS adds
+ * `policyStatements`, GCP adds `iam`), which the matching {@link ClusterAdapterService}'s
+ * identity adapter materializes at deploy time.
+ */
+export interface WorkloadBindingContract {
+    env?: Record<string, any>;
+}
+/**
+ * Ambient runtime services the workload platforms assume inside the
+ * deployed container, keyed by contributor and extended via module
+ * augmentation — AWS registers its credential-chain services so inline
+ * impls can use AWS bindings without providing them:
+ *
+ * ```ts
+ * declare module "@alchemy.run/kubernetes/ClusterAdapter" {
+ *   interface WorkloadServicesRegistry {
+ *     aws: Credentials | Region | AWSEnvironment;
+ *   }
+ * }
+ * ```
+ */
+export interface WorkloadServicesRegistry {
+}
+/** The union of all registered ambient workload services. */
+export type WorkloadServices = WorkloadServicesRegistry[keyof WorkloadServicesRegistry];
+/**
+ * The image-source shape shared by every workload: exactly one of `main`
+ * (bundle an inline Effect program), `context`/`dockerfile` (build the
+ * user's Dockerfile), or `image` (a pre-built registry reference).
+ * Structurally mirrors the AWS container platforms' source props.
+ */
+export interface WorkloadImageSource {
+    main?: string;
+    handler?: string;
+    /**
+     * Bundler configuration for `main`. Unused code is tree-shaken.
+     * `effect`, alchemy, and `@distilled.cloud` are marked pure so unused
+     * parts prune more aggressively. List extra packages with
+     * `pure.packages`, or disable with `pure: false`.
+     */
+    build?: Bundle.BundleConfig;
+    context?: string;
+    dockerfile?: string | InlineDockerfile;
+    image?: string;
+}
+export interface WorkloadIdentityReconcileOptions {
+    /** Logical resource id. */
+    id: string;
+    /** The resolved cluster connection. */
+    connection: Connection;
+    /** The namespace the workload runs in. */
+    namespace: string;
+    /** The service account name the workload's pods run as. */
+    serviceAccount: string;
+    /** Host bindings attached to the workload. */
+    bindings: ResourceBinding<WorkloadBindingContract>[];
+    /** Cloud-specific identity options from the workload's `identity` prop. */
+    options: WorkloadIdentityOptions | undefined;
+    /**
+     * Previously persisted identity state, if any — untyped hints because
+     * legacy pre-rename rows carry the old flat attribute shape; adapters
+     * narrow structurally and re-observe cloud state as the authority.
+     */
+    state: Record<string, unknown> | undefined;
+    /** Internal + user tags for identity-owned cloud resources. */
+    tags: Record<string, string>;
+}
+export interface WorkloadIdentityResult {
+    /** Extra container environment collected from bindings. */
+    env: Record<string, any>;
+    /** Annotations to stamp on the workload's ServiceAccount object. */
+    serviceAccountAnnotations?: Record<string, string>;
+    /** Serializable state persisted on the workload's attributes. */
+    state: IdentityState | undefined;
+}
+export interface WorkloadIdentityDeleteOptions {
+    /** The persisted cluster connection (may reference a gone cluster). */
+    connection: Connection | undefined;
+    /**
+     * The persisted identity state. Untyped because legacy pre-rename rows
+     * carry the old flat attribute shape — adapters narrow structurally.
+     */
+    state: Record<string, unknown> | undefined;
+}
+export interface ImageRegistryResolveOptions {
+    /** Logical resource id — keys generated repository names. */
+    id: string;
+    /** The image-source props bag. */
+    source: WorkloadImageSource;
+    /** Target image platform (`linux/amd64` / `linux/arm64`). */
+    platform: string;
+    /** Port the generated Dockerfile exposes (`main` sources only). */
+    port?: number;
+    /** True when `main` bundles as-is (no Effect bootstrap entry). */
+    isExternal?: boolean;
+    /** The generated-entry bootstrap wrapped around `main`. */
+    bootstrap: (importPath: string) => string;
+    /** Tags for registry-owned cloud resources. */
+    tags: Record<string, string>;
+    /**
+     * Previously persisted registry state, if any — untyped hints because
+     * legacy pre-rename rows carry the old flat attribute shape; adapters
+     * narrow structurally.
+     */
+    state: Record<string, unknown> | undefined;
+    /** Plan-status session for build/push progress notes. */
+    session: {
+        note: (message: string) => Effect.Effect<void>;
+    };
+}
+export interface ImageRegistryResult {
+    /** Full image reference the pod spec should run. */
+    imageUri: string;
+    /** Content hash identifying the image. */
+    codeHash: string;
+    /** Serializable state persisted on the workload's attributes. */
+    state: RegistryState | undefined;
+}
+export interface ImageRegistryHashOptions {
+    source: WorkloadImageSource;
+    platform: string;
+    port?: number;
+    isExternal?: boolean;
+    bootstrap: (importPath: string) => string;
+}
+export interface ImageRegistryDeleteOptions {
+    /**
+     * The persisted registry state. Untyped because legacy pre-rename rows
+     * carry the old flat attribute shape — adapters narrow structurally.
+     */
+    state: Record<string, unknown> | undefined;
+}
+export interface ClusterAdapterService {
+    readonly kind: "Kubernetes.ClusterAdapter";
+    /**
+     * Resolve the transport for a connection: discover the endpoint/CA when
+     * the connection doesn't carry them, and return a per-request auth
+     * header mint. Fails with {@link ClusterNotFoundError} when the cluster
+     * definitively no longer exists.
+     */
+    readonly connect: (connection: Connection) => Effect.Effect<ClusterTransport, ClusterNotFoundError | Error>;
+    /** Workload identity provisioning (Pod Identity on EKS, Workload Identity Federation on GKE). */
+    readonly identity?: {
+        readonly reconcile: (options: WorkloadIdentityReconcileOptions) => Effect.Effect<WorkloadIdentityResult, any, AdapterLifecycleServices>;
+        readonly delete: (options: WorkloadIdentityDeleteOptions) => Effect.Effect<void, any, AdapterLifecycleServices>;
+    };
+    /** Managed container-image registry (ECR on EKS, Artifact Registry on GKE). */
+    readonly registry?: {
+        readonly resolve: (options: ImageRegistryResolveOptions) => Effect.Effect<ImageRegistryResult, any, AdapterLifecycleServices>;
+        /** Plan-time content hash used by `diff` to surface source drift. */
+        readonly hash: (options: ImageRegistryHashOptions) => Effect.Effect<string | undefined, any, AdapterLifecycleServices>;
+        readonly delete: (options: ImageRegistryDeleteOptions) => Effect.Effect<void, any, AdapterLifecycleServices>;
+    };
+    /**
+     * Platform-specific generated container entries for Effect-native
+     * workloads. Defaults to the platform-neutral bootstraps when omitted.
+     */
+    readonly bootstrap?: {
+        readonly server?: (handler: string) => (importPath: string) => string;
+        readonly job?: (handler: string) => (importPath: string) => string;
+    };
+    /**
+     * Platform defaults applied to a `LoadBalancer` Service (EKS Auto Mode
+     * sets `loadBalancerClass: eks.amazonaws.com/nlb` and defaults the
+     * scheme to internet-facing). User `serviceAnnotations` always win.
+     */
+    readonly loadBalancerDefaults?: (options: {
+        connection: Connection;
+    }) => Effect.Effect<{
+        loadBalancerClass?: string | undefined;
+        annotations?: Record<string, string>;
+    }, any, AdapterLifecycleServices>;
+}
+/**
+ * The keyed Context tag for an adapter. Same auth kind → same tag, so a
+ * layer built with `ClusterAdapter("aws-eks")` is found by any dynamic
+ * lookup for that kind.
+ */
+export declare const ClusterAdapter: (authKind: string) => Context.Service<ClusterAdapterService, ClusterAdapterService>;
+/**
+ * Resolve the {@link ClusterAdapterService} for a connection's auth kind
+ * from the ambient context (the stack's composed provider layers). Dies
+ * with setup guidance when no adapter is registered — that means the
+ * provider layer contributing it (e.g. `AWS.providers()` for `aws-eks`)
+ * is missing from the stack.
+ */
+export declare const findClusterAdapter: (authKind: string) => Effect.Effect<ClusterAdapterService>;
+export {};
+//# sourceMappingURL=ClusterAdapter.d.ts.map

package/lib/ClusterAdapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterAdapter.d.ts","sourceRoot":"","sources":["../src/ClusterAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,KAAK,MAAM,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,eAAe,GAAG,KAAK,GAAG,KAAK,CAAC;;;;AAEvE;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,0BAAoD;IAC5F,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;CAAG;AAEL;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,0DAA0D;IAC1D,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,yDAAyD;IACzD,UAAU,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,qBAAqB;CAAG;AAEzC,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG;KACzB,CAAC,IAAI,MAAM,qBAAqB,GAAG;QAClC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;KAClB,GAAG,qBAAqB,CAAC,CAAC,CAAC;CAC7B,CAAC,MAAM,qBAAqB,CAAC,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE;QACR,qDAAqD;QACrD,MAAM,EAAE,MAAM,CAAC;QACf,kEAAkE;QAClE,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG;KACzB,CAAC,IAAI,MAAM,qBAAqB,GAAG;QAClC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;KAClB,GAAG,qBAAqB,CAAC,CAAC,CAAC;CAC7B,CAAC,MAAM,qBAAqB,CAAC,CAAC;AAE/B;;;GAGG;AACH,MAAM,WAAW,uBAAuB;CAAG;AAE3C;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;CAAG;AAE5C,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,MAAM,wBAAwB,CAAC,CAAC;AAExF;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gCAAgC;IAC/C,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,uCAAuC;IACvC,UAAU,EAAE,UAAU,CAAC;IACvB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,QAAQ,EAAE,eAAe,CAAC,uBAAuB,CAAC,EAAE,CAAC;IACrD,2EAA2E;IAC3E,OAAO,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC7C;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC3C,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzB,oEAAoE;IACpE,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,iEAAiE;IACjE,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,6BAA6B;IAC5C,uEAAuE;IACvE,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,2BAA2B;IAC1C,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2DAA2D;IAC3D,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1C,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC3C,yDAAyD;IACzD,OAAO,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;CAC3C;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,CAChB,UAAU,EAAE,UAAU,KACnB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,GAAG,KAAK,CAAC,CAAC;IACnE,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,SAAS,EAAE,CAClB,OAAO,EAAE,gCAAgC,KACtC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC1E,QAAQ,CAAC,MAAM,EAAE,CACf,OAAO,EAAE,6BAA6B,KACnC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;KACzD,CAAC;IACF,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,OAAO,EAAE,CAChB,OAAO,EAAE,2BAA2B,KACjC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACvE,qEAAqE;QACrE,QAAQ,CAAC,IAAI,EAAE,CACb,OAAO,EAAE,wBAAwB,KAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACtE,QAAQ,CAAC,MAAM,EAAE,CACf,OAAO,EAAE,0BAA0B,KAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;KACzD,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;QACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;KACpE,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,KAAK,MAAM,CAAC,MAAM,CACpF;QACE,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACvC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,EACD,GAAG,EACH,wBAAwB,CACzB,CAAC;CACH;AAID;;;;GAIG;AACH,eAAO,MAAM,cAAc,aACf,MAAM,KACf,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,qBAAqB,CAC+B,CAAC;AAE/F;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,aAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAmBtF,CAAC"}