@ankhorage/kubernetes 0.1.0 → 0.2.0

package/dist/features/workload-reconciliation/application/use-cases/materializeKubernetesSecretsAsync.js

@@ -0,0 +1,32 @@
+import { getKubernetesResourceKey } from '../../utils/getKubernetesResourceKey';
+/*** Resolve referenced secrets into ephemeral Kubernetes apply resources. */
+export async function materializeKubernetesSecretsAsync(request, projection) {
+    const values = new Map();
+    const diagnostics = [];
+    for (const binding of projection.secretBindings) {
+        const resolved = await request.context.secrets.resolveAsync(binding.reference);
+        if (!resolved.ok) {
+            diagnostics.push(...resolved.diagnostics);
+            continue;
+        }
+        const resourceValues = values.get(getKubernetesResourceKey(binding.resource)) ?? {};
+        resourceValues[binding.key] = resolved.value;
+        values.set(getKubernetesResourceKey(binding.resource), resourceValues);
+    }
+    if (diagnostics.length > 0)
+        return { ok: false, diagnostics };
+    return {
+        ok: true,
+        value: projection.resources.map((desired) => {
+            const secretValues = values.get(desired.owner.externalId ?? '');
+            if (secretValues === undefined)
+                return desired;
+            return {
+                ...desired,
+                resource: { ...desired.resource, stringData: secretValues },
+            };
+        }),
+        diagnostics: [],
+    };
+}
+//# sourceMappingURL=materializeKubernetesSecretsAsync.js.map

package/dist/features/workload-reconciliation/application/use-cases/materializeKubernetesSecretsAsync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"materializeKubernetesSecretsAsync.js","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/materializeKubernetesSecretsAsync.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgC,EAChC,UAAgC;IAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACpF,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAE9D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,YAAY,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YAC/C,OAAO;gBACL,GAAG,OAAO;gBACV,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE;aAC5D,CAAC;QACJ,CAAC,CAAC;QACF,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraDiagnostic, InfraResult } from '@ankhorage/contracts/infra';\n\nimport type { KubernetesDriverRequest } from '../../../../types/kubernetesDriver';\nimport type {\n  KubernetesDesiredResource,\n  KubernetesProjection,\n} from '../../../../types/kubernetesResources';\nimport { getKubernetesResourceKey } from '../../utils/getKubernetesResourceKey';\n\n/*** Resolve referenced secrets into ephemeral Kubernetes apply resources. */\nexport async function materializeKubernetesSecretsAsync(\n  request: KubernetesDriverRequest,\n  projection: KubernetesProjection,\n): Promise<InfraResult<readonly KubernetesDesiredResource[]>> {\n  const values = new Map<string, Record<string, string>>();\n  const diagnostics: InfraDiagnostic[] = [];\n\n  for (const binding of projection.secretBindings) {\n    const resolved = await request.context.secrets.resolveAsync(binding.reference);\n    if (!resolved.ok) {\n      diagnostics.push(...resolved.diagnostics);\n      continue;\n    }\n    const resourceValues = values.get(getKubernetesResourceKey(binding.resource)) ?? {};\n    resourceValues[binding.key] = resolved.value;\n    values.set(getKubernetesResourceKey(binding.resource), resourceValues);\n  }\n\n  if (diagnostics.length > 0) return { ok: false, diagnostics };\n\n  return {\n    ok: true,\n    value: projection.resources.map((desired) => {\n      const secretValues = values.get(desired.owner.externalId ?? '');\n      if (secretValues === undefined) return desired;\n      return {\n        ...desired,\n        resource: { ...desired.resource, stringData: secretValues },\n      };\n    }),\n    diagnostics: [],\n  };\n}\n"]}

package/dist/features/workload-reconciliation/application/use-cases/planKubernetesResourcesAsync.d.ts

@@ -0,0 +1,5 @@
+import type { InfraPlanAction, InfraResult } from '@ankhorage/contracts/infra';
+import type { KubernetesDriverOptions, KubernetesDriverRequest } from '../../../../types/kubernetesDriver';
+/*** Produce a side-effect-free Kubernetes reconciliation plan. */
+export declare function planKubernetesResourcesAsync(options: KubernetesDriverOptions, request: KubernetesDriverRequest): Promise<InfraResult<readonly InfraPlanAction[]>>;
+//# sourceMappingURL=planKubernetesResourcesAsync.d.ts.map

package/dist/features/workload-reconciliation/application/use-cases/planKubernetesResourcesAsync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planKubernetesResourcesAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/planKubernetesResourcesAsync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE/E,OAAO,KAAK,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,oCAAoC,CAAC;AAG5C,kEAAkE;AAClE,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAKlD"}

package/dist/features/workload-reconciliation/application/use-cases/planKubernetesResourcesAsync.js

@@ -0,0 +1,9 @@
+import { prepareKubernetesChangesAsync } from './prepareKubernetesChangesAsync';
+/*** Produce a side-effect-free Kubernetes reconciliation plan. */
+export async function planKubernetesResourcesAsync(options, request) {
+    const prepared = await prepareKubernetesChangesAsync(options, request);
+    return prepared.ok
+        ? { ok: true, value: prepared.value.changes.map(({ action }) => action), diagnostics: [] }
+        : prepared;
+}
+//# sourceMappingURL=planKubernetesResourcesAsync.js.map

package/dist/features/workload-reconciliation/application/use-cases/planKubernetesResourcesAsync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planKubernetesResourcesAsync.js","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/planKubernetesResourcesAsync.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAgC,EAChC,OAAgC;IAEhC,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC,EAAE;QAChB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;QAC1F,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC","sourcesContent":["import type { InfraPlanAction, InfraResult } from '@ankhorage/contracts/infra';\n\nimport type {\n  KubernetesDriverOptions,\n  KubernetesDriverRequest,\n} from '../../../../types/kubernetesDriver';\nimport { prepareKubernetesChangesAsync } from './prepareKubernetesChangesAsync';\n\n/*** Produce a side-effect-free Kubernetes reconciliation plan. */\nexport async function planKubernetesResourcesAsync(\n  options: KubernetesDriverOptions,\n  request: KubernetesDriverRequest,\n): Promise<InfraResult<readonly InfraPlanAction[]>> {\n  const prepared = await prepareKubernetesChangesAsync(options, request);\n  return prepared.ok\n    ? { ok: true, value: prepared.value.changes.map(({ action }) => action), diagnostics: [] }\n    : prepared;\n}\n"]}

package/dist/features/workload-reconciliation/application/use-cases/prepareKubernetesChangesAsync.d.ts

@@ -0,0 +1,6 @@
+import type { InfraResult } from '@ankhorage/contracts/infra';
+import type { KubernetesDriverOptions, KubernetesDriverRequest } from '../../../../types/kubernetesDriver';
+import type { KubernetesPreparedChanges } from '../../../../types/kubernetesResources';
+/*** Prepare deterministic create, update, no-op, retain and stale-delete changes. */
+export declare function prepareKubernetesChangesAsync(options: KubernetesDriverOptions, request: KubernetesDriverRequest): Promise<InfraResult<KubernetesPreparedChanges>>;
+//# sourceMappingURL=prepareKubernetesChangesAsync.d.ts.map

package/dist/features/workload-reconciliation/application/use-cases/prepareKubernetesChangesAsync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepareKubernetesChangesAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/prepareKubernetesChangesAsync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE/E,OAAO,KAAK,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAGV,yBAAyB,EAE1B,MAAM,uCAAuC,CAAC;AAU/C,qFAAqF;AACrF,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,CAwBjD"}

package/dist/features/workload-reconciliation/application/use-cases/prepareKubernetesChangesAsync.js

@@ -0,0 +1,84 @@
+import { areKubernetesResourcesEquivalent } from '../../utils/areKubernetesResourcesEquivalent';
+import { getKubernetesOwnershipQuery } from '../../utils/getKubernetesOwnershipQuery';
+import { getKubernetesResourceKey } from '../../utils/getKubernetesResourceKey';
+import { getKubernetesResourceReference } from '../../utils/getKubernetesResourceReference';
+import { readKubernetesOwnedResource } from '../../utils/readKubernetesOwnedResource';
+import { sortKubernetesResourcesForRemoval } from '../../utils/sortKubernetesResourcesForRemoval';
+import { materializeKubernetesSecretsAsync } from './materializeKubernetesSecretsAsync';
+import { projectKubernetesResourcesAsync } from './projectKubernetesResourcesAsync';
+/*** Prepare deterministic create, update, no-op, retain and stale-delete changes. */
+export async function prepareKubernetesChangesAsync(options, request) {
+    try {
+        const projection = await projectKubernetesResourcesAsync(request);
+        if (!projection.ok)
+            return projection;
+        const materialized = await materializeKubernetesSecretsAsync(request, projection.value);
+        if (!materialized.ok)
+            return materialized;
+        const observed = await options.api.listOwnedAsync(getKubernetesOwnershipQuery(request));
+        const desiredChanges = createDesiredChanges(materialized.value, observed);
+        const desiredKeys = new Set(materialized.value.map(({ owner }) => owner.externalId ?? ''));
+        const staleChanges = createStaleChanges(request, observed, desiredKeys);
+        const changes = [...desiredChanges, ...staleChanges];
+        return { ok: true, value: { changes, projection: projection.value }, diagnostics: [] };
+    }
+    catch {
+        return {
+            ok: false,
+            diagnostics: [
+                {
+                    severity: 'error',
+                    code: 'kubernetes-plan-failed',
+                    message: 'Kubernetes desired and observed resources could not be compared safely.',
+                },
+            ],
+        };
+    }
+}
+/*** Compare desired resources against the observed resource map. */
+function createDesiredChanges(desiredResources, observed) {
+    const actual = new Map(observed.map((resource) => [
+        getKubernetesResourceKey(getKubernetesResourceReference(resource)),
+        resource,
+    ]));
+    return desiredResources.map((desired) => {
+        const current = actual.get(desired.owner.externalId ?? '');
+        const operation = current === undefined
+            ? 'create'
+            : areKubernetesResourcesEquivalent(desired.resource, current)
+                ? 'noop'
+                : 'update';
+        return {
+            action: createAction(desired.owner.identity, desired.owner.dependsOn, operation),
+            desired,
+            ...(current === undefined ? {} : { actual: current }),
+        };
+    });
+}
+/*** Identify obsolete owned resources without admitting malformed ownership metadata. */
+function createStaleChanges(request, observed, desiredKeys) {
+    const stale = observed.flatMap((resource) => {
+        const key = getKubernetesResourceKey(getKubernetesResourceReference(resource));
+        if (desiredKeys.has(key))
+            return [];
+        const owner = readKubernetesOwnedResource(resource, request);
+        if (owner === undefined)
+            return [];
+        return [{ resource, owner }];
+    });
+    return sortKubernetesResourcesForRemoval(stale).map(({ resource, owner }) => ({
+        action: createAction(owner.identity, owner.dependsOn, owner.persistent ? 'retain' : 'delete'),
+        actual: resource,
+    }));
+}
+/*** Create one non-secret plan action. */
+function createAction(owner, dependsOn, operation) {
+    return {
+        owner,
+        operation,
+        impact: operation === 'delete' ? 'interrupts-service' : 'none',
+        detail: `Kubernetes resource ${owner.resourceId}: ${operation}.`,
+        dependsOn,
+    };
+}
+//# sourceMappingURL=prepareKubernetesChangesAsync.js.map

package/dist/features/workload-reconciliation/application/use-cases/prepareKubernetesChangesAsync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepareKubernetesChangesAsync.js","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/prepareKubernetesChangesAsync.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgC,EAChC,OAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,MAAM,YAAY,GAAG,MAAM,iCAAiC,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QACxF,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,YAAY,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;QACxF,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,CAAC,GAAG,cAAc,EAAE,GAAG,YAAY,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE;gBACX;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,yEAAyE;iBACnF;aACF;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,oBAAoB,CAC3B,gBAAsD,EACtD,QAAuC;IAEvC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QACzB,wBAAwB,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;QAClE,QAAQ;KACT,CAAC,CACH,CAAC;IACF,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GACb,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,gCAAgC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAC3D,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,QAAQ,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC;YAChF,OAAO;YACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,SAAS,kBAAkB,CACzB,OAAgC,EAChC,QAAuC,EACvC,WAAgC;IAEhC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,wBAAwB,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/E,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,2BAA2B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,OAAO,iCAAiC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7F,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,0CAA0C;AAC1C,SAAS,YAAY,CACnB,KAA+B,EAC/B,SAAuC,EACvC,SAAuC;IAEvC,OAAO;QACL,KAAK;QACL,SAAS;QACT,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;QAC9D,MAAM,EAAE,uBAAuB,KAAK,CAAC,UAAU,KAAK,SAAS,GAAG;QAChE,SAAS;KACV,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraPlanAction, InfraResult } from '@ankhorage/contracts/infra';\n\nimport type {\n  KubernetesDriverOptions,\n  KubernetesDriverRequest,\n} from '../../../../types/kubernetesDriver';\nimport type {\n  KubernetesDesiredResource,\n  KubernetesPreparedChange,\n  KubernetesPreparedChanges,\n  KubernetesResource,\n} from '../../../../types/kubernetesResources';\nimport { areKubernetesResourcesEquivalent } from '../../utils/areKubernetesResourcesEquivalent';\nimport { getKubernetesOwnershipQuery } from '../../utils/getKubernetesOwnershipQuery';\nimport { getKubernetesResourceKey } from '../../utils/getKubernetesResourceKey';\nimport { getKubernetesResourceReference } from '../../utils/getKubernetesResourceReference';\nimport { readKubernetesOwnedResource } from '../../utils/readKubernetesOwnedResource';\nimport { sortKubernetesResourcesForRemoval } from '../../utils/sortKubernetesResourcesForRemoval';\nimport { materializeKubernetesSecretsAsync } from './materializeKubernetesSecretsAsync';\nimport { projectKubernetesResourcesAsync } from './projectKubernetesResourcesAsync';\n\n/*** Prepare deterministic create, update, no-op, retain and stale-delete changes. */\nexport async function prepareKubernetesChangesAsync(\n  options: KubernetesDriverOptions,\n  request: KubernetesDriverRequest,\n): Promise<InfraResult<KubernetesPreparedChanges>> {\n  try {\n    const projection = await projectKubernetesResourcesAsync(request);\n    if (!projection.ok) return projection;\n    const materialized = await materializeKubernetesSecretsAsync(request, projection.value);\n    if (!materialized.ok) return materialized;\n    const observed = await options.api.listOwnedAsync(getKubernetesOwnershipQuery(request));\n    const desiredChanges = createDesiredChanges(materialized.value, observed);\n    const desiredKeys = new Set(materialized.value.map(({ owner }) => owner.externalId ?? ''));\n    const staleChanges = createStaleChanges(request, observed, desiredKeys);\n    const changes = [...desiredChanges, ...staleChanges];\n    return { ok: true, value: { changes, projection: projection.value }, diagnostics: [] };\n  } catch {\n    return {\n      ok: false,\n      diagnostics: [\n        {\n          severity: 'error',\n          code: 'kubernetes-plan-failed',\n          message: 'Kubernetes desired and observed resources could not be compared safely.',\n        },\n      ],\n    };\n  }\n}\n\n/*** Compare desired resources against the observed resource map. */\nfunction createDesiredChanges(\n  desiredResources: readonly KubernetesDesiredResource[],\n  observed: readonly KubernetesResource[],\n): readonly KubernetesPreparedChange[] {\n  const actual = new Map(\n    observed.map((resource) => [\n      getKubernetesResourceKey(getKubernetesResourceReference(resource)),\n      resource,\n    ]),\n  );\n  return desiredResources.map((desired) => {\n    const current = actual.get(desired.owner.externalId ?? '');\n    const operation =\n      current === undefined\n        ? 'create'\n        : areKubernetesResourcesEquivalent(desired.resource, current)\n          ? 'noop'\n          : 'update';\n    return {\n      action: createAction(desired.owner.identity, desired.owner.dependsOn, operation),\n      desired,\n      ...(current === undefined ? {} : { actual: current }),\n    };\n  });\n}\n\n/*** Identify obsolete owned resources without admitting malformed ownership metadata. */\nfunction createStaleChanges(\n  request: KubernetesDriverRequest,\n  observed: readonly KubernetesResource[],\n  desiredKeys: ReadonlySet<string>,\n): readonly KubernetesPreparedChange[] {\n  const stale = observed.flatMap((resource) => {\n    const key = getKubernetesResourceKey(getKubernetesResourceReference(resource));\n    if (desiredKeys.has(key)) return [];\n    const owner = readKubernetesOwnedResource(resource, request);\n    if (owner === undefined) return [];\n    return [{ resource, owner }];\n  });\n  return sortKubernetesResourcesForRemoval(stale).map(({ resource, owner }) => ({\n    action: createAction(owner.identity, owner.dependsOn, owner.persistent ? 'retain' : 'delete'),\n    actual: resource,\n  }));\n}\n\n/*** Create one non-secret plan action. */\nfunction createAction(\n  owner: InfraPlanAction['owner'],\n  dependsOn: InfraPlanAction['dependsOn'],\n  operation: InfraPlanAction['operation'],\n): InfraPlanAction {\n  return {\n    owner,\n    operation,\n    impact: operation === 'delete' ? 'interrupts-service' : 'none',\n    detail: `Kubernetes resource ${owner.resourceId}: ${operation}.`,\n    dependsOn,\n  };\n}\n"]}

package/dist/features/workload-reconciliation/application/use-cases/projectKubernetesResourcesAsync.d.ts

@@ -0,0 +1,11 @@
+import type { InfraResult } from '@ankhorage/contracts/infra';
+import type { KubernetesDriverRequest } from '../../../../types/kubernetesDriver';
+import type { KubernetesProjection } from '../../../../types/kubernetesResources';
+/***
+ * Project portable workload desired state into deterministic standard Kubernetes resources.
+ *
+ * Resolved secret values are deliberately absent. The projection carries only references for
+ * runtime materialization immediately before apply.
+ */
+export declare function projectKubernetesResourcesAsync(request: KubernetesDriverRequest): Promise<InfraResult<KubernetesProjection>>;
+//# sourceMappingURL=projectKubernetesResourcesAsync.d.ts.map

package/dist/features/workload-reconciliation/application/use-cases/projectKubernetesResourcesAsync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectKubernetesResourcesAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/projectKubernetesResourcesAsync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,KAAK,EAEV,oBAAoB,EAErB,MAAM,uCAAuC,CAAC;AAO/C;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CA8B5C"}

package/dist/features/workload-reconciliation/application/use-cases/projectKubernetesResourcesAsync.js

@@ -0,0 +1,53 @@
+import { createKubernetesDesiredResource } from '../../utils/createKubernetesDesiredResource';
+import { createKubernetesIdentity } from '../../utils/createKubernetesIdentity';
+import { getKubernetesOwnershipQuery } from '../../utils/getKubernetesOwnershipQuery';
+import { projectKubernetesWorkload } from './projectKubernetesWorkload';
+import { validateKubernetesWorkloads } from './validateKubernetesWorkloads';
+/***
+ * Project portable workload desired state into deterministic standard Kubernetes resources.
+ *
+ * Resolved secret values are deliberately absent. The projection carries only references for
+ * runtime materialization immediately before apply.
+ */
+export function projectKubernetesResourcesAsync(request) {
+    const validation = validateKubernetesWorkloads(request.workloads);
+    if (validation.length > 0)
+        return Promise.resolve({ ok: false, diagnostics: validation });
+    const { namespace } = getKubernetesOwnershipQuery(request);
+    const namespaceResource = createNamespace(request, namespace);
+    const workloadOwners = new Map(request.workloads.map((workload) => [
+        workload.id,
+        createKubernetesIdentity(request, `workload:${workload.id}`),
+    ]));
+    const resources = [namespaceResource];
+    const secretBindings = [];
+    for (const workload of request.workloads) {
+        const projected = projectKubernetesWorkload(request, {
+            namespace,
+            namespaceOwner: namespaceResource.owner.identity,
+            workloadOwners,
+            workload,
+        });
+        if (!projected.ok)
+            return Promise.resolve(projected);
+        resources.push(...projected.value.resources);
+        secretBindings.push(...projected.value.secretBindings);
+    }
+    return Promise.resolve({
+        ok: true,
+        value: { resources, secretBindings },
+        diagnostics: [],
+    });
+}
+/*** Create the environment namespace before all namespaced resources. */
+function createNamespace(request, namespace) {
+    return createKubernetesDesiredResource(request, {
+        resourceId: `namespace:${namespace}`,
+        resource: {
+            apiVersion: 'v1',
+            kind: 'Namespace',
+            metadata: { name: namespace, labels: {}, annotations: {} },
+        },
+    });
+}
+//# sourceMappingURL=projectKubernetesResourcesAsync.js.map

package/dist/features/workload-reconciliation/application/use-cases/projectKubernetesResourcesAsync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectKubernetesResourcesAsync.js","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/projectKubernetesResourcesAsync.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAAgC;IAEhC,MAAM,UAAU,GAAG,2BAA2B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IAE1F,MAAM,EAAE,SAAS,EAAE,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClC,QAAQ,CAAC,EAAE;QACX,wBAAwB,CAAC,OAAO,EAAE,YAAY,QAAQ,CAAC,EAAE,EAAE,CAAC;KAC7D,CAAC,CACH,CAAC;IACF,MAAM,SAAS,GAAgC,CAAC,iBAAiB,CAAC,CAAC;IACnE,MAAM,cAAc,GAA8B,EAAE,CAAC;IACrD,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,EAAE;YACnD,SAAS;YACT,cAAc,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ;YAChD,cAAc;YACd,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrD,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7C,cAAc,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;QACrB,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE;QACpC,WAAW,EAAE,EAAE;KAChB,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CACtB,OAAgC,EAChC,SAAiB;IAEjB,OAAO,+BAA+B,CAAC,OAAO,EAAE;QAC9C,UAAU,EAAE,aAAa,SAAS,EAAE;QACpC,QAAQ,EAAE;YACR,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;SAC3D;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { InfraResult } from '@ankhorage/contracts/infra';\n\nimport type { KubernetesDriverRequest } from '../../../../types/kubernetesDriver';\nimport type {\n  KubernetesDesiredResource,\n  KubernetesProjection,\n  KubernetesSecretBinding,\n} from '../../../../types/kubernetesResources';\nimport { createKubernetesDesiredResource } from '../../utils/createKubernetesDesiredResource';\nimport { createKubernetesIdentity } from '../../utils/createKubernetesIdentity';\nimport { getKubernetesOwnershipQuery } from '../../utils/getKubernetesOwnershipQuery';\nimport { projectKubernetesWorkload } from './projectKubernetesWorkload';\nimport { validateKubernetesWorkloads } from './validateKubernetesWorkloads';\n\n/***\n * Project portable workload desired state into deterministic standard Kubernetes resources.\n *\n * Resolved secret values are deliberately absent. The projection carries only references for\n * runtime materialization immediately before apply.\n */\nexport function projectKubernetesResourcesAsync(\n  request: KubernetesDriverRequest,\n): Promise<InfraResult<KubernetesProjection>> {\n  const validation = validateKubernetesWorkloads(request.workloads);\n  if (validation.length > 0) return Promise.resolve({ ok: false, diagnostics: validation });\n\n  const { namespace } = getKubernetesOwnershipQuery(request);\n  const namespaceResource = createNamespace(request, namespace);\n  const workloadOwners = new Map(\n    request.workloads.map((workload) => [\n      workload.id,\n      createKubernetesIdentity(request, `workload:${workload.id}`),\n    ]),\n  );\n  const resources: KubernetesDesiredResource[] = [namespaceResource];\n  const secretBindings: KubernetesSecretBinding[] = [];\n  for (const workload of request.workloads) {\n    const projected = projectKubernetesWorkload(request, {\n      namespace,\n      namespaceOwner: namespaceResource.owner.identity,\n      workloadOwners,\n      workload,\n    });\n    if (!projected.ok) return Promise.resolve(projected);\n    resources.push(...projected.value.resources);\n    secretBindings.push(...projected.value.secretBindings);\n  }\n  return Promise.resolve({\n    ok: true,\n    value: { resources, secretBindings },\n    diagnostics: [],\n  });\n}\n\n/*** Create the environment namespace before all namespaced resources. */\nfunction createNamespace(\n  request: KubernetesDriverRequest,\n  namespace: string,\n): KubernetesDesiredResource {\n  return createKubernetesDesiredResource(request, {\n    resourceId: `namespace:${namespace}`,\n    resource: {\n      apiVersion: 'v1',\n      kind: 'Namespace',\n      metadata: { name: namespace, labels: {}, annotations: {} },\n    },\n  });\n}\n"]}

package/dist/features/workload-reconciliation/application/use-cases/projectKubernetesWorkload.d.ts

@@ -0,0 +1,12 @@
+import type { InfraResourceIdentity, InfraResult, InfraWorkloadSpec } from '@ankhorage/contracts/infra';
+import type { KubernetesDriverRequest } from '../../../../types/kubernetesDriver';
+import type { KubernetesWorkloadProjection } from '../../../../types/kubernetesResources';
+/*** Project one workload while retaining dependency-first resource ordering. */
+export declare function projectKubernetesWorkload(request: KubernetesDriverRequest, input: ProjectKubernetesWorkloadInput): InfraResult<KubernetesWorkloadProjection>;
+export interface ProjectKubernetesWorkloadInput {
+    readonly namespace: string;
+    readonly namespaceOwner: InfraResourceIdentity;
+    readonly workloadOwners: ReadonlyMap<string, InfraResourceIdentity>;
+    readonly workload: InfraWorkloadSpec;
+}
+//# sourceMappingURL=projectKubernetesWorkload.d.ts.map

package/dist/features/workload-reconciliation/application/use-cases/projectKubernetesWorkload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectKubernetesWorkload.d.ts","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/projectKubernetesWorkload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAO1F,gFAAgF;AAChF,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,8BAA8B,GACpC,WAAW,CAAC,4BAA4B,CAAC,CAoC3C;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC"}

package/dist/features/workload-reconciliation/application/use-cases/projectKubernetesWorkload.js

@@ -0,0 +1,45 @@
+import { toKubernetesName } from '../../utils/toKubernetesName';
+import { createKubernetesController } from './createKubernetesController';
+import { createKubernetesExposure } from './createKubernetesExposure';
+import { createKubernetesPrerequisites } from './createKubernetesPrerequisites';
+import { resolveKubernetesWorkloadValues } from './resolveKubernetesWorkloadValues';
+/*** Project one workload while retaining dependency-first resource ordering. */
+export function projectKubernetesWorkload(request, input) {
+    const workloadName = toKubernetesName(input.workload.id);
+    const values = resolveKubernetesWorkloadValues(request.availableOutputs ?? [], input.workload);
+    if (!values.ok)
+        return values;
+    const prerequisites = createKubernetesPrerequisites(request, {
+        namespace: input.namespace,
+        namespaceOwner: input.namespaceOwner,
+        workloadName,
+        workload: input.workload,
+        values: values.value,
+    });
+    const declaredDependencies = (input.workload.dependsOn ?? []).flatMap((id) => {
+        const owner = input.workloadOwners.get(id);
+        return owner === undefined ? [] : [owner];
+    });
+    const controller = createKubernetesController(request, {
+        namespace: input.namespace,
+        workloadName,
+        workload: input.workload,
+        values: values.value,
+        dependsOn: [...prerequisites.owners, ...declaredDependencies],
+    });
+    const exposure = createKubernetesExposure(request, {
+        namespace: input.namespace,
+        workloadName,
+        workload: input.workload,
+        controller: controller.owner.identity,
+    });
+    return {
+        ok: true,
+        value: {
+            resources: [...prerequisites.resources, controller, ...exposure],
+            secretBindings: prerequisites.secretBindings,
+        },
+        diagnostics: [],
+    };
+}
+//# sourceMappingURL=projectKubernetesWorkload.js.map

package/dist/features/workload-reconciliation/application/use-cases/projectKubernetesWorkload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectKubernetesWorkload.js","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/projectKubernetesWorkload.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CACvC,OAAgC,EAChC,KAAqC;IAErC,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,+BAA+B,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/F,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,aAAa,GAAG,6BAA6B,CAAC,OAAO,EAAE;QAC3D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,MAAM,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,EAAE;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,SAAS,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,oBAAoB,CAAC;KAC9D,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,EAAE;QACjD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ;KACtC,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,SAAS,EAAE,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;YAChE,cAAc,EAAE,aAAa,CAAC,cAAc;SAC7C;QACD,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  InfraResourceIdentity,\n  InfraResult,\n  InfraWorkloadSpec,\n} from '@ankhorage/contracts/infra';\n\nimport type { KubernetesDriverRequest } from '../../../../types/kubernetesDriver';\nimport type { KubernetesWorkloadProjection } from '../../../../types/kubernetesResources';\nimport { toKubernetesName } from '../../utils/toKubernetesName';\nimport { createKubernetesController } from './createKubernetesController';\nimport { createKubernetesExposure } from './createKubernetesExposure';\nimport { createKubernetesPrerequisites } from './createKubernetesPrerequisites';\nimport { resolveKubernetesWorkloadValues } from './resolveKubernetesWorkloadValues';\n\n/*** Project one workload while retaining dependency-first resource ordering. */\nexport function projectKubernetesWorkload(\n  request: KubernetesDriverRequest,\n  input: ProjectKubernetesWorkloadInput,\n): InfraResult<KubernetesWorkloadProjection> {\n  const workloadName = toKubernetesName(input.workload.id);\n  const values = resolveKubernetesWorkloadValues(request.availableOutputs ?? [], input.workload);\n  if (!values.ok) return values;\n  const prerequisites = createKubernetesPrerequisites(request, {\n    namespace: input.namespace,\n    namespaceOwner: input.namespaceOwner,\n    workloadName,\n    workload: input.workload,\n    values: values.value,\n  });\n  const declaredDependencies = (input.workload.dependsOn ?? []).flatMap((id) => {\n    const owner = input.workloadOwners.get(id);\n    return owner === undefined ? [] : [owner];\n  });\n  const controller = createKubernetesController(request, {\n    namespace: input.namespace,\n    workloadName,\n    workload: input.workload,\n    values: values.value,\n    dependsOn: [...prerequisites.owners, ...declaredDependencies],\n  });\n  const exposure = createKubernetesExposure(request, {\n    namespace: input.namespace,\n    workloadName,\n    workload: input.workload,\n    controller: controller.owner.identity,\n  });\n  return {\n    ok: true,\n    value: {\n      resources: [...prerequisites.resources, controller, ...exposure],\n      secretBindings: prerequisites.secretBindings,\n    },\n    diagnostics: [],\n  };\n}\n\nexport interface ProjectKubernetesWorkloadInput {\n  readonly namespace: string;\n  readonly namespaceOwner: InfraResourceIdentity;\n  readonly workloadOwners: ReadonlyMap<string, InfraResourceIdentity>;\n  readonly workload: InfraWorkloadSpec;\n}\n"]}

package/dist/features/workload-reconciliation/application/use-cases/reconcileKubernetesResourcesAsync.d.ts

@@ -0,0 +1,5 @@
+import type { InfraReconcileResult, InfraResult } from '@ankhorage/contracts/infra';
+import type { KubernetesDriverOptions, KubernetesDriverRequest } from '../../../../types/kubernetesDriver';
+/*** Apply desired changes and prune only obsolete, non-persistent Infra-owned resources. */
+export declare function reconcileKubernetesResourcesAsync(options: KubernetesDriverOptions, request: KubernetesDriverRequest): Promise<InfraResult<InfraReconcileResult>>;
+//# sourceMappingURL=reconcileKubernetesResourcesAsync.d.ts.map

package/dist/features/workload-reconciliation/application/use-cases/reconcileKubernetesResourcesAsync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcileKubernetesResourcesAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/reconcileKubernetesResourcesAsync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,oBAAoB,EACpB,WAAW,EACZ,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,oCAAoC,CAAC;AAM5C,4FAA4F;AAC5F,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CA+C5C"}

package/dist/features/workload-reconciliation/application/use-cases/reconcileKubernetesResourcesAsync.js

@@ -0,0 +1,51 @@
+import { getKubernetesResourceReference } from '../../utils/getKubernetesResourceReference';
+import { readKubernetesOwnedResource } from '../../utils/readKubernetesOwnedResource';
+import { getKubernetesOutputsAsync } from './getKubernetesOutputsAsync';
+import { prepareKubernetesChangesAsync } from './prepareKubernetesChangesAsync';
+/*** Apply desired changes and prune only obsolete, non-persistent Infra-owned resources. */
+export async function reconcileKubernetesResourcesAsync(options, request) {
+    const prepared = await prepareKubernetesChangesAsync(options, request);
+    if (!prepared.ok)
+        return prepared;
+    try {
+        const retained = [];
+        for (const change of prepared.value.changes) {
+            if ((change.action.operation === 'create' || change.action.operation === 'update') &&
+                change.desired !== undefined) {
+                await options.api.applyAsync(change.desired.resource, request.context.signal);
+            }
+            if (change.action.operation === 'delete' && change.actual !== undefined) {
+                await options.api.deleteAsync(getKubernetesResourceReference(change.actual), request.context.signal);
+            }
+            if (change.action.operation === 'retain' && change.actual !== undefined) {
+                const owner = readKubernetesOwnedResource(change.actual, request);
+                if (owner !== undefined)
+                    retained.push(owner);
+            }
+        }
+        const outputs = await getKubernetesOutputsAsync(options, request);
+        if (!outputs.ok)
+            return outputs;
+        return {
+            ok: true,
+            value: {
+                resources: [...prepared.value.projection.resources.map(({ owner }) => owner), ...retained],
+                outputs: outputs.value,
+            },
+            diagnostics: [],
+        };
+    }
+    catch {
+        return {
+            ok: false,
+            diagnostics: [
+                {
+                    severity: 'error',
+                    code: 'kubernetes-reconcile-failed',
+                    message: 'Kubernetes resources could not be reconciled safely.',
+                },
+            ],
+        };
+    }
+}
+//# sourceMappingURL=reconcileKubernetesResourcesAsync.js.map

package/dist/features/workload-reconciliation/application/use-cases/reconcileKubernetesResourcesAsync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcileKubernetesResourcesAsync.js","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/reconcileKubernetesResourcesAsync.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgC,EAChC,OAAgC;IAEhC,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAyB,EAAE,CAAC;QAC1C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC5C,IACE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC;gBAC9E,MAAM,CAAC,OAAO,KAAK,SAAS,EAC5B,CAAC;gBACD,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAC3B,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7C,OAAO,CAAC,OAAO,CAAC,MAAM,CACvB,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,KAAK,GAAG,2BAA2B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAClE,IAAI,KAAK,KAAK,SAAS;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACL,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC;gBAC1F,OAAO,EAAE,OAAO,CAAC,KAAK;aACvB;YACD,WAAW,EAAE,EAAE;SAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE;gBACX;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,6BAA6B;oBACnC,OAAO,EAAE,sDAAsD;iBAChE;aACF;SACF,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type {\n  InfraOwnedResource,\n  InfraReconcileResult,\n  InfraResult,\n} from '@ankhorage/contracts/infra';\n\nimport type {\n  KubernetesDriverOptions,\n  KubernetesDriverRequest,\n} from '../../../../types/kubernetesDriver';\nimport { getKubernetesResourceReference } from '../../utils/getKubernetesResourceReference';\nimport { readKubernetesOwnedResource } from '../../utils/readKubernetesOwnedResource';\nimport { getKubernetesOutputsAsync } from './getKubernetesOutputsAsync';\nimport { prepareKubernetesChangesAsync } from './prepareKubernetesChangesAsync';\n\n/*** Apply desired changes and prune only obsolete, non-persistent Infra-owned resources. */\nexport async function reconcileKubernetesResourcesAsync(\n  options: KubernetesDriverOptions,\n  request: KubernetesDriverRequest,\n): Promise<InfraResult<InfraReconcileResult>> {\n  const prepared = await prepareKubernetesChangesAsync(options, request);\n  if (!prepared.ok) return prepared;\n\n  try {\n    const retained: InfraOwnedResource[] = [];\n    for (const change of prepared.value.changes) {\n      if (\n        (change.action.operation === 'create' || change.action.operation === 'update') &&\n        change.desired !== undefined\n      ) {\n        await options.api.applyAsync(change.desired.resource, request.context.signal);\n      }\n      if (change.action.operation === 'delete' && change.actual !== undefined) {\n        await options.api.deleteAsync(\n          getKubernetesResourceReference(change.actual),\n          request.context.signal,\n        );\n      }\n      if (change.action.operation === 'retain' && change.actual !== undefined) {\n        const owner = readKubernetesOwnedResource(change.actual, request);\n        if (owner !== undefined) retained.push(owner);\n      }\n    }\n\n    const outputs = await getKubernetesOutputsAsync(options, request);\n    if (!outputs.ok) return outputs;\n    return {\n      ok: true,\n      value: {\n        resources: [...prepared.value.projection.resources.map(({ owner }) => owner), ...retained],\n        outputs: outputs.value,\n      },\n      diagnostics: [],\n    };\n  } catch {\n    return {\n      ok: false,\n      diagnostics: [\n        {\n          severity: 'error',\n          code: 'kubernetes-reconcile-failed',\n          message: 'Kubernetes resources could not be reconciled safely.',\n        },\n      ],\n    };\n  }\n}\n"]}

package/dist/features/workload-reconciliation/application/use-cases/removeKubernetesResourcesAsync.d.ts

@@ -0,0 +1,5 @@
+import type { InfraDestroyRequest, InfraReconcileResult, InfraResult } from '@ankhorage/contracts/infra';
+import type { KubernetesDriverOptions, KubernetesDriverRequest } from '../../../../types/kubernetesDriver';
+/*** Remove owned resources in reverse dependency order while enforcing persistence authorization. */
+export declare function removeKubernetesResourcesAsync(options: KubernetesDriverOptions, request: KubernetesDriverRequest, destroy: InfraDestroyRequest): Promise<InfraResult<InfraReconcileResult>>;
+//# sourceMappingURL=removeKubernetesResourcesAsync.d.ts.map

package/dist/features/workload-reconciliation/application/use-cases/removeKubernetesResourcesAsync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"removeKubernetesResourcesAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/removeKubernetesResourcesAsync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EAEnB,oBAAoB,EAEpB,WAAW,EACZ,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,oCAAoC,CAAC;AAM5C,qGAAqG;AACrG,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CA6B5C"}

package/dist/features/workload-reconciliation/application/use-cases/removeKubernetesResourcesAsync.js

@@ -0,0 +1,75 @@
+import { getKubernetesOwnershipQuery } from '../../utils/getKubernetesOwnershipQuery';
+import { getKubernetesResourceReference } from '../../utils/getKubernetesResourceReference';
+import { readKubernetesOwnedResource } from '../../utils/readKubernetesOwnedResource';
+import { sortKubernetesResourcesForRemoval } from '../../utils/sortKubernetesResourcesForRemoval';
+/*** Remove owned resources in reverse dependency order while enforcing persistence authorization. */
+export async function removeKubernetesResourcesAsync(options, request, destroy) {
+    if (!isConfirmed(request, destroy)) {
+        return {
+            ok: false,
+            diagnostics: [
+                {
+                    severity: 'error',
+                    code: 'kubernetes-destroy-unconfirmed',
+                    message: 'Kubernetes removal requires matching explicit project and environment confirmation.',
+                },
+            ],
+        };
+    }
+    try {
+        return await performRemovalAsync(options, request, destroy);
+    }
+    catch {
+        return {
+            ok: false,
+            diagnostics: [
+                {
+                    severity: 'error',
+                    code: 'kubernetes-remove-failed',
+                    message: 'Kubernetes resources could not be removed safely.',
+                },
+            ],
+        };
+    }
+}
+/*** Execute the already-confirmed removal against the narrow owned-resource selector. */
+async function performRemovalAsync(options, request, destroy) {
+    const observed = await options.api.listOwnedAsync(getKubernetesOwnershipQuery(request));
+    const owned = observed.flatMap((resource) => {
+        const owner = readKubernetesOwnedResource(resource, request);
+        return owner === undefined ? [] : [{ resource, owner }];
+    });
+    const retained = [];
+    const retainNamespace = owned.some(({ owner }) => owner.persistent && !canDelete(owner, destroy));
+    for (const { resource, owner } of sortKubernetesResourcesForRemoval(owned)) {
+        if ((resource.kind === 'Namespace' && retainNamespace) || !canDelete(owner, destroy)) {
+            retained.push(owner);
+            continue;
+        }
+        await options.api.deleteAsync(getKubernetesResourceReference(resource), request.context.signal);
+    }
+    return { ok: true, value: { resources: retained, outputs: [] }, diagnostics: [] };
+}
+/*** Confirm request identity at both destroy boundaries. */
+function isConfirmed(request, destroy) {
+    return (destroy.projectId === request.context.projectId &&
+        destroy.environment === request.context.environment &&
+        destroy.confirmation.projectId === request.context.projectId &&
+        destroy.confirmation.environment === request.context.environment);
+}
+/*** Decide whether explicit persistence policy authorizes this exact owner. */
+function canDelete(owner, destroy) {
+    if (!owner.persistent)
+        return true;
+    return (owner.retention === 'delete-on-destroy' &&
+        destroy.persistence.policy === 'delete' &&
+        destroy.persistence.confirmedResources.some((identity) => identitiesEqual(identity, owner.identity)));
+}
+/*** Compare canonical resource identities without object-reference assumptions. */
+function identitiesEqual(left, right) {
+    return (left.projectId === right.projectId &&
+        left.environment === right.environment &&
+        left.adapter === right.adapter &&
+        left.resourceId === right.resourceId);
+}
+//# sourceMappingURL=removeKubernetesResourcesAsync.js.map

package/dist/features/workload-reconciliation/application/use-cases/removeKubernetesResourcesAsync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"removeKubernetesResourcesAsync.js","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/removeKubernetesResourcesAsync.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,iCAAiC,EAAE,MAAM,+CAA+C,CAAC;AAElG,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAgC,EAChC,OAAgC,EAChC,OAA4B;IAE5B,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE;gBACX;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,gCAAgC;oBACtC,OAAO,EACL,qFAAqF;iBACxF;aACF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE;gBACX;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,mDAAmD;iBAC7D;aACF;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,mBAAmB,CAChC,OAAgC,EAChC,OAAgC,EAChC,OAA4B;IAE5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,2BAA2B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7D,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAClG,KAAK,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,iCAAiC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACrF,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,8BAA8B,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACpF,CAAC;AAED,4DAA4D;AAC5D,SAAS,WAAW,CAAC,OAAgC,EAAE,OAA4B;IACjF,OAAO,CACL,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,SAAS;QAC/C,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW;QACnD,OAAO,CAAC,YAAY,CAAC,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,SAAS;QAC5D,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW,CACjE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,KAAyB,EAAE,OAA4B;IACxE,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,CACL,KAAK,CAAC,SAAS,KAAK,mBAAmB;QACvC,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,QAAQ;QACvC,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvD,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAC1C,CACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,IAA2B,EAAE,KAA4B;IAChF,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAClC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CACrC,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  InfraDestroyRequest,\n  InfraOwnedResource,\n  InfraReconcileResult,\n  InfraResourceIdentity,\n  InfraResult,\n} from '@ankhorage/contracts/infra';\n\nimport type {\n  KubernetesDriverOptions,\n  KubernetesDriverRequest,\n} from '../../../../types/kubernetesDriver';\nimport { getKubernetesOwnershipQuery } from '../../utils/getKubernetesOwnershipQuery';\nimport { getKubernetesResourceReference } from '../../utils/getKubernetesResourceReference';\nimport { readKubernetesOwnedResource } from '../../utils/readKubernetesOwnedResource';\nimport { sortKubernetesResourcesForRemoval } from '../../utils/sortKubernetesResourcesForRemoval';\n\n/*** Remove owned resources in reverse dependency order while enforcing persistence authorization. */\nexport async function removeKubernetesResourcesAsync(\n  options: KubernetesDriverOptions,\n  request: KubernetesDriverRequest,\n  destroy: InfraDestroyRequest,\n): Promise<InfraResult<InfraReconcileResult>> {\n  if (!isConfirmed(request, destroy)) {\n    return {\n      ok: false,\n      diagnostics: [\n        {\n          severity: 'error',\n          code: 'kubernetes-destroy-unconfirmed',\n          message:\n            'Kubernetes removal requires matching explicit project and environment confirmation.',\n        },\n      ],\n    };\n  }\n\n  try {\n    return await performRemovalAsync(options, request, destroy);\n  } catch {\n    return {\n      ok: false,\n      diagnostics: [\n        {\n          severity: 'error',\n          code: 'kubernetes-remove-failed',\n          message: 'Kubernetes resources could not be removed safely.',\n        },\n      ],\n    };\n  }\n}\n\n/*** Execute the already-confirmed removal against the narrow owned-resource selector. */\nasync function performRemovalAsync(\n  options: KubernetesDriverOptions,\n  request: KubernetesDriverRequest,\n  destroy: InfraDestroyRequest,\n): Promise<InfraResult<InfraReconcileResult>> {\n  const observed = await options.api.listOwnedAsync(getKubernetesOwnershipQuery(request));\n  const owned = observed.flatMap((resource) => {\n    const owner = readKubernetesOwnedResource(resource, request);\n    return owner === undefined ? [] : [{ resource, owner }];\n  });\n  const retained: InfraOwnedResource[] = [];\n  const retainNamespace = owned.some(({ owner }) => owner.persistent && !canDelete(owner, destroy));\n  for (const { resource, owner } of sortKubernetesResourcesForRemoval(owned)) {\n    if ((resource.kind === 'Namespace' && retainNamespace) || !canDelete(owner, destroy)) {\n      retained.push(owner);\n      continue;\n    }\n    await options.api.deleteAsync(getKubernetesResourceReference(resource), request.context.signal);\n  }\n  return { ok: true, value: { resources: retained, outputs: [] }, diagnostics: [] };\n}\n\n/*** Confirm request identity at both destroy boundaries. */\nfunction isConfirmed(request: KubernetesDriverRequest, destroy: InfraDestroyRequest): boolean {\n  return (\n    destroy.projectId === request.context.projectId &&\n    destroy.environment === request.context.environment &&\n    destroy.confirmation.projectId === request.context.projectId &&\n    destroy.confirmation.environment === request.context.environment\n  );\n}\n\n/*** Decide whether explicit persistence policy authorizes this exact owner. */\nfunction canDelete(owner: InfraOwnedResource, destroy: InfraDestroyRequest): boolean {\n  if (!owner.persistent) return true;\n  return (\n    owner.retention === 'delete-on-destroy' &&\n    destroy.persistence.policy === 'delete' &&\n    destroy.persistence.confirmedResources.some((identity) =>\n      identitiesEqual(identity, owner.identity),\n    )\n  );\n}\n\n/*** Compare canonical resource identities without object-reference assumptions. */\nfunction identitiesEqual(left: InfraResourceIdentity, right: InfraResourceIdentity): boolean {\n  return (\n    left.projectId === right.projectId &&\n    left.environment === right.environment &&\n    left.adapter === right.adapter &&\n    left.resourceId === right.resourceId\n  );\n}\n"]}

package/dist/features/workload-reconciliation/application/use-cases/resolveKubernetesWorkloadValues.d.ts

@@ -0,0 +1,5 @@
+import type { InfraOutput, InfraResult, InfraWorkloadSpec } from '@ankhorage/contracts/infra';
+import type { KubernetesResolvedWorkloadValues } from '../../../../types/kubernetesResources';
+/*** Resolve public outputs while retaining privileged workload values as secret references. */
+export declare function resolveKubernetesWorkloadValues(outputs: readonly InfraOutput[], workload: InfraWorkloadSpec): InfraResult<KubernetesResolvedWorkloadValues>;
+//# sourceMappingURL=resolveKubernetesWorkloadValues.d.ts.map

package/dist/features/workload-reconciliation/application/use-cases/resolveKubernetesWorkloadValues.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveKubernetesWorkloadValues.d.ts","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/resolveKubernetesWorkloadValues.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,WAAW,EACX,WAAW,EACX,iBAAiB,EAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,uCAAuC,CAAC;AAG/C,+FAA+F;AAC/F,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,QAAQ,EAAE,iBAAiB,GAC1B,WAAW,CAAC,gCAAgC,CAAC,CAkC/C"}

package/dist/features/workload-reconciliation/application/use-cases/resolveKubernetesWorkloadValues.js

@@ -0,0 +1,45 @@
+import { toKubernetesName } from '../../utils/toKubernetesName';
+/*** Resolve public outputs while retaining privileged workload values as secret references. */
+export function resolveKubernetesWorkloadValues(outputs, workload) {
+    const environment = {};
+    const files = {};
+    const secrets = [];
+    const diagnostics = [];
+    for (const [name, value] of Object.entries(workload.environment ?? {}).sort(([a], [b]) => a.localeCompare(b))) {
+        assignValue(outputs, value, { kind: 'environment', name }, environment, secrets, diagnostics, `env-${name}`);
+    }
+    for (const [index, file] of (workload.files ?? []).entries()) {
+        assignValue(outputs, file.content, { kind: 'file', path: file.path }, files, secrets, diagnostics, `file-${index}`);
+    }
+    return diagnostics.length > 0
+        ? { ok: false, diagnostics }
+        : { ok: true, value: { environment, files, secrets }, diagnostics: [] };
+}
+/*** Assign one portable value without resolving privileged content. */
+function assignValue(outputs, value, target, publicValues, secrets, diagnostics, key) {
+    const publicKey = target.kind === 'environment' ? target.name : target.path;
+    if (value.kind === 'literal') {
+        Object.assign(publicValues, { [publicKey]: value.value });
+        return;
+    }
+    if (value.kind === 'secret') {
+        secrets.push({ key: toKubernetesName(key), reference: value.reference, target });
+        return;
+    }
+    const matches = outputs.filter((output) => output.owner.resourceId === value.resourceId && output.name === value.output);
+    const [output] = matches;
+    if (matches.length !== 1 || output === undefined) {
+        diagnostics.push({
+            severity: 'error',
+            code: 'kubernetes-output-unresolved',
+            message: `Workload output ${value.resourceId}.${value.output} did not resolve uniquely.`,
+        });
+        return;
+    }
+    if (output.visibility === 'secret') {
+        secrets.push({ key: toKubernetesName(key), reference: output.reference, target });
+        return;
+    }
+    Object.assign(publicValues, { [publicKey]: String(output.value) });
+}
+//# sourceMappingURL=resolveKubernetesWorkloadValues.js.map

package/dist/features/workload-reconciliation/application/use-cases/resolveKubernetesWorkloadValues.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveKubernetesWorkloadValues.js","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/resolveKubernetesWorkloadValues.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,+FAA+F;AAC/F,MAAM,UAAU,+BAA+B,CAC7C,OAA+B,EAC/B,QAA2B;IAE3B,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACvF,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,EAAE,CAAC;QACF,WAAW,CACT,OAAO,EACP,KAAK,EACL,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAC7B,WAAW,EACX,OAAO,EACP,WAAW,EACX,OAAO,IAAI,EAAE,CACd,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7D,WAAW,CACT,OAAO,EACP,IAAI,CAAC,OAAO,EACZ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACjC,KAAK,EACL,OAAO,EACP,WAAW,EACX,QAAQ,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;QAC5B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,uEAAuE;AACvE,SAAS,WAAW,CAClB,OAA+B,EAC/B,KAAyB,EACzB,MAAwC,EACxC,YAAoC,EACpC,OAAiC,EACjC,WAA8B,EAC9B,GAAW;IAEX,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAC5B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CACzF,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;IACzB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACjD,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,mBAAmB,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,4BAA4B;SACzF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACrE,CAAC","sourcesContent":["import type {\n  InfraDiagnostic,\n  InfraOutput,\n  InfraResult,\n  InfraWorkloadSpec,\n  InfraWorkloadValue,\n} from '@ankhorage/contracts/infra';\n\nimport type {\n  KubernetesResolvedWorkloadValues,\n  KubernetesSecretTarget,\n} from '../../../../types/kubernetesResources';\nimport { toKubernetesName } from '../../utils/toKubernetesName';\n\n/*** Resolve public outputs while retaining privileged workload values as secret references. */\nexport function resolveKubernetesWorkloadValues(\n  outputs: readonly InfraOutput[],\n  workload: InfraWorkloadSpec,\n): InfraResult<KubernetesResolvedWorkloadValues> {\n  const environment: Record<string, string> = {};\n  const files: Record<string, string> = {};\n  const secrets: KubernetesSecretTarget[] = [];\n  const diagnostics: InfraDiagnostic[] = [];\n\n  for (const [name, value] of Object.entries(workload.environment ?? {}).sort(([a], [b]) =>\n    a.localeCompare(b),\n  )) {\n    assignValue(\n      outputs,\n      value,\n      { kind: 'environment', name },\n      environment,\n      secrets,\n      diagnostics,\n      `env-${name}`,\n    );\n  }\n  for (const [index, file] of (workload.files ?? []).entries()) {\n    assignValue(\n      outputs,\n      file.content,\n      { kind: 'file', path: file.path },\n      files,\n      secrets,\n      diagnostics,\n      `file-${index}`,\n    );\n  }\n\n  return diagnostics.length > 0\n    ? { ok: false, diagnostics }\n    : { ok: true, value: { environment, files, secrets }, diagnostics: [] };\n}\n\n/*** Assign one portable value without resolving privileged content. */\nfunction assignValue(\n  outputs: readonly InfraOutput[],\n  value: InfraWorkloadValue,\n  target: KubernetesSecretTarget['target'],\n  publicValues: Record<string, string>,\n  secrets: KubernetesSecretTarget[],\n  diagnostics: InfraDiagnostic[],\n  key: string,\n): void {\n  const publicKey = target.kind === 'environment' ? target.name : target.path;\n  if (value.kind === 'literal') {\n    Object.assign(publicValues, { [publicKey]: value.value });\n    return;\n  }\n  if (value.kind === 'secret') {\n    secrets.push({ key: toKubernetesName(key), reference: value.reference, target });\n    return;\n  }\n\n  const matches = outputs.filter(\n    (output) => output.owner.resourceId === value.resourceId && output.name === value.output,\n  );\n  const [output] = matches;\n  if (matches.length !== 1 || output === undefined) {\n    diagnostics.push({\n      severity: 'error',\n      code: 'kubernetes-output-unresolved',\n      message: `Workload output ${value.resourceId}.${value.output} did not resolve uniquely.`,\n    });\n    return;\n  }\n  if (output.visibility === 'secret') {\n    secrets.push({ key: toKubernetesName(key), reference: output.reference, target });\n    return;\n  }\n  Object.assign(publicValues, { [publicKey]: String(output.value) });\n}\n"]}

package/dist/features/workload-reconciliation/application/use-cases/validateKubernetesWorkloads.d.ts

@@ -0,0 +1,4 @@
+import type { InfraDiagnostic, InfraWorkloadSpec } from '@ankhorage/contracts/infra';
+/*** Validate portable invariants required for deterministic Kubernetes projection. */
+export declare function validateKubernetesWorkloads(workloads: readonly InfraWorkloadSpec[]): readonly InfraDiagnostic[];
+//# sourceMappingURL=validateKubernetesWorkloads.d.ts.map

package/dist/features/workload-reconciliation/application/use-cases/validateKubernetesWorkloads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateKubernetesWorkloads.d.ts","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/validateKubernetesWorkloads.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAErF,sFAAsF;AACtF,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,SAAS,iBAAiB,EAAE,GACtC,SAAS,eAAe,EAAE,CAuB5B"}