@ankhorage/kubernetes 0.1.0 → 0.2.0

package/dist/features/workload-reconciliation/application/use-cases/validateKubernetesWorkloads.js

@@ -0,0 +1,26 @@
+/*** Validate portable invariants required for deterministic Kubernetes projection. */
+export function validateKubernetesWorkloads(workloads) {
+    const diagnostics = [];
+    const ids = new Set();
+    for (const workload of workloads) {
+        if (ids.has(workload.id)) {
+            diagnostics.push({
+                severity: 'error',
+                code: 'kubernetes-workload-duplicate',
+                message: `Workload ID ${workload.id} is duplicated.`,
+            });
+        }
+        ids.add(workload.id);
+        for (const dependency of workload.dependsOn ?? []) {
+            if (!workloads.some((candidate) => candidate.id === dependency)) {
+                diagnostics.push({
+                    severity: 'error',
+                    code: 'kubernetes-workload-dependency-missing',
+                    message: `Workload ${workload.id} depends on missing workload ${dependency}.`,
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+//# sourceMappingURL=validateKubernetesWorkloads.js.map

package/dist/features/workload-reconciliation/application/use-cases/validateKubernetesWorkloads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateKubernetesWorkloads.js","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/validateKubernetesWorkloads.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,MAAM,UAAU,2BAA2B,CACzC,SAAuC;IAEvC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,eAAe,QAAQ,CAAC,EAAE,iBAAiB;aACrD,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrB,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC;gBAChE,WAAW,CAAC,IAAI,CAAC;oBACf,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,wCAAwC;oBAC9C,OAAO,EAAE,YAAY,QAAQ,CAAC,EAAE,gCAAgC,UAAU,GAAG;iBAC9E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import type { InfraDiagnostic, InfraWorkloadSpec } from '@ankhorage/contracts/infra';\n\n/*** Validate portable invariants required for deterministic Kubernetes projection. */\nexport function validateKubernetesWorkloads(\n  workloads: readonly InfraWorkloadSpec[],\n): readonly InfraDiagnostic[] {\n  const diagnostics: InfraDiagnostic[] = [];\n  const ids = new Set<string>();\n  for (const workload of workloads) {\n    if (ids.has(workload.id)) {\n      diagnostics.push({\n        severity: 'error',\n        code: 'kubernetes-workload-duplicate',\n        message: `Workload ID ${workload.id} is duplicated.`,\n      });\n    }\n    ids.add(workload.id);\n    for (const dependency of workload.dependsOn ?? []) {\n      if (!workloads.some((candidate) => candidate.id === dependency)) {\n        diagnostics.push({\n          severity: 'error',\n          code: 'kubernetes-workload-dependency-missing',\n          message: `Workload ${workload.id} depends on missing workload ${dependency}.`,\n        });\n      }\n    }\n  }\n  return diagnostics;\n}\n"]}

package/dist/features/workload-reconciliation/application/use-cases/waitForKubernetesReadinessAsync.d.ts

@@ -0,0 +1,5 @@
+import type { InfraResourceStatus, InfraResult } from '@ankhorage/contracts/infra';
+import type { KubernetesDriverOptions, KubernetesDriverRequest } from '../../../../types/kubernetesDriver';
+/*** Wait dependency-first for required Kubernetes resources to report ready. */
+export declare function waitForKubernetesReadinessAsync(options: KubernetesDriverOptions, request: KubernetesDriverRequest): Promise<InfraResult<readonly InfraResourceStatus[]>>;
+//# sourceMappingURL=waitForKubernetesReadinessAsync.d.ts.map

package/dist/features/workload-reconciliation/application/use-cases/waitForKubernetesReadinessAsync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waitForKubernetesReadinessAsync.d.ts","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/waitForKubernetesReadinessAsync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,mBAAmB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEpG,OAAO,KAAK,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,oCAAoC,CAAC;AAY5C,gFAAgF;AAChF,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC,CA6CtD"}

package/dist/features/workload-reconciliation/application/use-cases/waitForKubernetesReadinessAsync.js

@@ -0,0 +1,56 @@
+import { getKubernetesResourceReference } from '../../utils/getKubernetesResourceReference';
+import { projectKubernetesResourcesAsync } from './projectKubernetesResourcesAsync';
+const READINESS_KINDS = new Set([
+    'Namespace',
+    'PersistentVolumeClaim',
+    'Deployment',
+    'Service',
+    'Ingress',
+]);
+/*** Wait dependency-first for required Kubernetes resources to report ready. */
+export async function waitForKubernetesReadinessAsync(options, request) {
+    const projection = await projectKubernetesResourcesAsync(request);
+    if (!projection.ok)
+        return projection;
+    try {
+        const statuses = [];
+        const diagnostics = [];
+        for (const desired of projection.value.resources) {
+            if (!READINESS_KINDS.has(desired.resource.kind))
+                continue;
+            const observation = await options.api.waitUntilReadyAsync(getKubernetesResourceReference(desired.resource), {
+                timeoutSeconds: options.defaultReadinessTimeoutSeconds ?? 300,
+                ...(request.context.signal === undefined ? {} : { signal: request.context.signal }),
+            });
+            statuses.push({
+                owner: desired.owner.identity,
+                state: observation.state,
+                ...(observation.detail === undefined ? {} : { detail: observation.detail }),
+            });
+            if (observation.state !== 'ready') {
+                diagnostics.push({
+                    severity: 'error',
+                    code: 'kubernetes-readiness-failed',
+                    message: `Kubernetes resource ${desired.owner.identity.resourceId} is ${observation.state}.`,
+                    owner: desired.owner.identity,
+                });
+            }
+        }
+        return diagnostics.length > 0
+            ? { ok: false, diagnostics }
+            : { ok: true, value: statuses, diagnostics: [] };
+    }
+    catch {
+        return {
+            ok: false,
+            diagnostics: [
+                {
+                    severity: 'error',
+                    code: 'kubernetes-readiness-failed',
+                    message: 'Kubernetes readiness could not be established.',
+                },
+            ],
+        };
+    }
+}
+//# sourceMappingURL=waitForKubernetesReadinessAsync.js.map

package/dist/features/workload-reconciliation/application/use-cases/waitForKubernetesReadinessAsync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waitForKubernetesReadinessAsync.js","sourceRoot":"","sources":["../../../../../src/features/workload-reconciliation/application/use-cases/waitForKubernetesReadinessAsync.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,WAAW;IACX,uBAAuB;IACvB,YAAY;IACZ,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAgC,EAChC,OAAgC;IAEhC,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAA0B,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAsB,EAAE,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,mBAAmB,CACvD,8BAA8B,CAAC,OAAO,CAAC,QAAQ,CAAC,EAChD;gBACE,cAAc,EAAE,OAAO,CAAC,8BAA8B,IAAI,GAAG;gBAC7D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;aACpF,CACF,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;gBAC7B,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;aAC5E,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBAClC,WAAW,CAAC,IAAI,CAAC;oBACf,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,6BAA6B;oBACnC,OAAO,EAAE,uBAAuB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,OAAO,WAAW,CAAC,KAAK,GAAG;oBAC5F,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC;YAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;YAC5B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE;gBACX;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,6BAA6B;oBACnC,OAAO,EAAE,gDAAgD;iBAC1D;aACF;SACF,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type { InfraDiagnostic, InfraResourceStatus, InfraResult } from '@ankhorage/contracts/infra';\n\nimport type {\n  KubernetesDriverOptions,\n  KubernetesDriverRequest,\n} from '../../../../types/kubernetesDriver';\nimport { getKubernetesResourceReference } from '../../utils/getKubernetesResourceReference';\nimport { projectKubernetesResourcesAsync } from './projectKubernetesResourcesAsync';\n\nconst READINESS_KINDS = new Set([\n  'Namespace',\n  'PersistentVolumeClaim',\n  'Deployment',\n  'Service',\n  'Ingress',\n]);\n\n/*** Wait dependency-first for required Kubernetes resources to report ready. */\nexport async function waitForKubernetesReadinessAsync(\n  options: KubernetesDriverOptions,\n  request: KubernetesDriverRequest,\n): Promise<InfraResult<readonly InfraResourceStatus[]>> {\n  const projection = await projectKubernetesResourcesAsync(request);\n  if (!projection.ok) return projection;\n\n  try {\n    const statuses: InfraResourceStatus[] = [];\n    const diagnostics: InfraDiagnostic[] = [];\n    for (const desired of projection.value.resources) {\n      if (!READINESS_KINDS.has(desired.resource.kind)) continue;\n      const observation = await options.api.waitUntilReadyAsync(\n        getKubernetesResourceReference(desired.resource),\n        {\n          timeoutSeconds: options.defaultReadinessTimeoutSeconds ?? 300,\n          ...(request.context.signal === undefined ? {} : { signal: request.context.signal }),\n        },\n      );\n      statuses.push({\n        owner: desired.owner.identity,\n        state: observation.state,\n        ...(observation.detail === undefined ? {} : { detail: observation.detail }),\n      });\n      if (observation.state !== 'ready') {\n        diagnostics.push({\n          severity: 'error',\n          code: 'kubernetes-readiness-failed',\n          message: `Kubernetes resource ${desired.owner.identity.resourceId} is ${observation.state}.`,\n          owner: desired.owner.identity,\n        });\n      }\n    }\n    return diagnostics.length > 0\n      ? { ok: false, diagnostics }\n      : { ok: true, value: statuses, diagnostics: [] };\n  } catch {\n    return {\n      ok: false,\n      diagnostics: [\n        {\n          severity: 'error',\n          code: 'kubernetes-readiness-failed',\n          message: 'Kubernetes readiness could not be established.',\n        },\n      ],\n    };\n  }\n}\n"]}

package/dist/features/workload-reconciliation/composition/createKubernetesDriver.d.ts

@@ -1,12 +1,12 @@
-import type { KubernetesDriver } from '../../../types/kubernetesDriver';
+import type { KubernetesDriver, KubernetesDriverOptions } from '../../../types/kubernetesDriver';
 /***
  * Create the shared Kubernetes workload driver entrypoint.
  *
  * Kubernetes is an implementation dependency for runtime adapters, not a selectable Infra
- * provider. Workload projection and reconciliation operations are added at this boundary in the
- * driver implementation phase.
+ * provider. The supplied API port is already authenticated cluster access; the driver adds only
+ * standard Kubernetes workload projection and lifecycle semantics.
  *
  * @readme
  */
-export declare function createKubernetesDriver(): KubernetesDriver;
+export declare function createKubernetesDriver(options: KubernetesDriverOptions): KubernetesDriver;
 //# sourceMappingURL=createKubernetesDriver.d.ts.map

package/dist/features/workload-reconciliation/composition/createKubernetesDriver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createKubernetesDriver.d.ts","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/composition/createKubernetesDriver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,gBAAgB,CAEzD"}
+{"version":3,"file":"createKubernetesDriver.d.ts","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/composition/createKubernetesDriver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AASjG;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,CAWzF"}

package/dist/features/workload-reconciliation/composition/createKubernetesDriver.js

@@ -1,13 +1,29 @@
+import { getKubernetesOutputsAsync } from '../application/use-cases/getKubernetesOutputsAsync';
+import { getKubernetesStatusAsync } from '../application/use-cases/getKubernetesStatusAsync';
+import { planKubernetesResourcesAsync } from '../application/use-cases/planKubernetesResourcesAsync';
+import { projectKubernetesResourcesAsync } from '../application/use-cases/projectKubernetesResourcesAsync';
+import { reconcileKubernetesResourcesAsync } from '../application/use-cases/reconcileKubernetesResourcesAsync';
+import { removeKubernetesResourcesAsync } from '../application/use-cases/removeKubernetesResourcesAsync';
+import { waitForKubernetesReadinessAsync } from '../application/use-cases/waitForKubernetesReadinessAsync';
 /***
  * Create the shared Kubernetes workload driver entrypoint.
  *
  * Kubernetes is an implementation dependency for runtime adapters, not a selectable Infra
- * provider. Workload projection and reconciliation operations are added at this boundary in the
- * driver implementation phase.
+ * provider. The supplied API port is already authenticated cluster access; the driver adds only
+ * standard Kubernetes workload projection and lifecycle semantics.
  *
  * @readme
  */
-export function createKubernetesDriver() {
-    return { kind: 'kubernetes' };
+export function createKubernetesDriver(options) {
+    return {
+        kind: 'kubernetes',
+        projectAsync: projectKubernetesResourcesAsync,
+        planAsync: (request) => planKubernetesResourcesAsync(options, request),
+        reconcileAsync: (request) => reconcileKubernetesResourcesAsync(options, request),
+        removeAsync: (request, destroy) => removeKubernetesResourcesAsync(options, request, destroy),
+        statusAsync: (request) => getKubernetesStatusAsync(options, request),
+        waitUntilReadyAsync: (request) => waitForKubernetesReadinessAsync(options, request),
+        outputsAsync: (request) => getKubernetesOutputsAsync(options, request),
+    };
 }
 //# sourceMappingURL=createKubernetesDriver.js.map

package/dist/features/workload-reconciliation/composition/createKubernetesDriver.js.map

@@ -1 +1 @@
-{"version":3,"file":"createKubernetesDriver.js","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/composition/createKubernetesDriver.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC","sourcesContent":["import type { KubernetesDriver } from '../../../types/kubernetesDriver';\n\n/***\n * Create the shared Kubernetes workload driver entrypoint.\n *\n * Kubernetes is an implementation dependency for runtime adapters, not a selectable Infra\n * provider. Workload projection and reconciliation operations are added at this boundary in the\n * driver implementation phase.\n *\n * @readme\n */\nexport function createKubernetesDriver(): KubernetesDriver {\n  return { kind: 'kubernetes' };\n}\n"]}
+{"version":3,"file":"createKubernetesDriver.js","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/composition/createKubernetesDriver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAC;AACrG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0DAA0D,CAAC;AAC3G,OAAO,EAAE,iCAAiC,EAAE,MAAM,4DAA4D,CAAC;AAC/G,OAAO,EAAE,8BAA8B,EAAE,MAAM,yDAAyD,CAAC;AACzG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0DAA0D,CAAC;AAE3G;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACrE,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,YAAY,EAAE,+BAA+B;QAC7C,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,EAAE,OAAO,CAAC;QACtE,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,iCAAiC,CAAC,OAAO,EAAE,OAAO,CAAC;QAChF,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,8BAA8B,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC5F,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC;QACpE,mBAAmB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,+BAA+B,CAAC,OAAO,EAAE,OAAO,CAAC;QACnF,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC;KACvE,CAAC;AACJ,CAAC","sourcesContent":["import type { KubernetesDriver, KubernetesDriverOptions } from '../../../types/kubernetesDriver';\nimport { getKubernetesOutputsAsync } from '../application/use-cases/getKubernetesOutputsAsync';\nimport { getKubernetesStatusAsync } from '../application/use-cases/getKubernetesStatusAsync';\nimport { planKubernetesResourcesAsync } from '../application/use-cases/planKubernetesResourcesAsync';\nimport { projectKubernetesResourcesAsync } from '../application/use-cases/projectKubernetesResourcesAsync';\nimport { reconcileKubernetesResourcesAsync } from '../application/use-cases/reconcileKubernetesResourcesAsync';\nimport { removeKubernetesResourcesAsync } from '../application/use-cases/removeKubernetesResourcesAsync';\nimport { waitForKubernetesReadinessAsync } from '../application/use-cases/waitForKubernetesReadinessAsync';\n\n/***\n * Create the shared Kubernetes workload driver entrypoint.\n *\n * Kubernetes is an implementation dependency for runtime adapters, not a selectable Infra\n * provider. The supplied API port is already authenticated cluster access; the driver adds only\n * standard Kubernetes workload projection and lifecycle semantics.\n *\n * @readme\n */\nexport function createKubernetesDriver(options: KubernetesDriverOptions): KubernetesDriver {\n  return {\n    kind: 'kubernetes',\n    projectAsync: projectKubernetesResourcesAsync,\n    planAsync: (request) => planKubernetesResourcesAsync(options, request),\n    reconcileAsync: (request) => reconcileKubernetesResourcesAsync(options, request),\n    removeAsync: (request, destroy) => removeKubernetesResourcesAsync(options, request, destroy),\n    statusAsync: (request) => getKubernetesStatusAsync(options, request),\n    waitUntilReadyAsync: (request) => waitForKubernetesReadinessAsync(options, request),\n    outputsAsync: (request) => getKubernetesOutputsAsync(options, request),\n  };\n}\n"]}

package/dist/features/workload-reconciliation/constants.d.ts

@@ -0,0 +1,14 @@
+export declare const KUBERNETES_OWNERSHIP: {
+    readonly managedByLabel: "app.kubernetes.io/managed-by";
+    readonly managedByValue: "ankhorage-infra";
+    readonly projectLabel: "infra.ankhorage.dev/project";
+    readonly environmentLabel: "infra.ankhorage.dev/environment";
+    readonly projectAnnotation: "infra.ankhorage.dev/project-id";
+    readonly environmentAnnotation: "infra.ankhorage.dev/environment";
+    readonly adapterAnnotation: "infra.ankhorage.dev/adapter";
+    readonly resourceAnnotation: "infra.ankhorage.dev/resource-id";
+    readonly persistentAnnotation: "infra.ankhorage.dev/persistent";
+    readonly retentionAnnotation: "infra.ankhorage.dev/retention";
+    readonly dependenciesAnnotation: "infra.ankhorage.dev/depends-on";
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/features/workload-reconciliation/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/features/workload-reconciliation/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oBAAoB;;;;;;;;;;;;CAYvB,CAAC"}

package/dist/features/workload-reconciliation/constants.js

@@ -0,0 +1,14 @@
+export const KUBERNETES_OWNERSHIP = {
+    managedByLabel: 'app.kubernetes.io/managed-by',
+    managedByValue: 'ankhorage-infra',
+    projectLabel: 'infra.ankhorage.dev/project',
+    environmentLabel: 'infra.ankhorage.dev/environment',
+    projectAnnotation: 'infra.ankhorage.dev/project-id',
+    environmentAnnotation: 'infra.ankhorage.dev/environment',
+    adapterAnnotation: 'infra.ankhorage.dev/adapter',
+    resourceAnnotation: 'infra.ankhorage.dev/resource-id',
+    persistentAnnotation: 'infra.ankhorage.dev/persistent',
+    retentionAnnotation: 'infra.ankhorage.dev/retention',
+    dependenciesAnnotation: 'infra.ankhorage.dev/depends-on',
+};
+//# sourceMappingURL=constants.js.map

package/dist/features/workload-reconciliation/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/features/workload-reconciliation/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc,EAAE,8BAA8B;IAC9C,cAAc,EAAE,iBAAiB;IACjC,YAAY,EAAE,6BAA6B;IAC3C,gBAAgB,EAAE,iCAAiC;IACnD,iBAAiB,EAAE,gCAAgC;IACnD,qBAAqB,EAAE,iCAAiC;IACxD,iBAAiB,EAAE,6BAA6B;IAChD,kBAAkB,EAAE,iCAAiC;IACrD,oBAAoB,EAAE,gCAAgC;IACtD,mBAAmB,EAAE,+BAA+B;IACpD,sBAAsB,EAAE,gCAAgC;CAChD,CAAC","sourcesContent":["export const KUBERNETES_OWNERSHIP = {\n  managedByLabel: 'app.kubernetes.io/managed-by',\n  managedByValue: 'ankhorage-infra',\n  projectLabel: 'infra.ankhorage.dev/project',\n  environmentLabel: 'infra.ankhorage.dev/environment',\n  projectAnnotation: 'infra.ankhorage.dev/project-id',\n  environmentAnnotation: 'infra.ankhorage.dev/environment',\n  adapterAnnotation: 'infra.ankhorage.dev/adapter',\n  resourceAnnotation: 'infra.ankhorage.dev/resource-id',\n  persistentAnnotation: 'infra.ankhorage.dev/persistent',\n  retentionAnnotation: 'infra.ankhorage.dev/retention',\n  dependenciesAnnotation: 'infra.ankhorage.dev/depends-on',\n} as const;\n"]}

package/dist/features/workload-reconciliation/utils/areKubernetesResourcesEquivalent.d.ts

@@ -0,0 +1,4 @@
+import type { KubernetesResource } from '../../../types/kubernetesResources';
+/*** Compare desired and observed Kubernetes resources while ignoring server-owned metadata. */
+export declare function areKubernetesResourcesEquivalent(desired: KubernetesResource, actual: KubernetesResource): boolean;
+//# sourceMappingURL=areKubernetesResourcesEquivalent.d.ts.map

package/dist/features/workload-reconciliation/utils/areKubernetesResourcesEquivalent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"areKubernetesResourcesEquivalent.d.ts","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/areKubernetesResourcesEquivalent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,+FAA+F;AAC/F,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAET"}

package/dist/features/workload-reconciliation/utils/areKubernetesResourcesEquivalent.js

@@ -0,0 +1,41 @@
+/*** Compare desired and observed Kubernetes resources while ignoring server-owned metadata. */
+export function areKubernetesResourcesEquivalent(desired, actual) {
+    return stableSerialize(normalize(desired)) === stableSerialize(normalize(actual));
+}
+/*** Normalize write-only Secret data and recursively order object keys. */
+function normalize(resource) {
+    const { stringData } = resource;
+    const data = stringData === undefined
+        ? resource.data
+        : Object.fromEntries(Object.entries(stringData).map(([key, value]) => [
+            key,
+            Buffer.from(value).toString('base64'),
+        ]));
+    return {
+        apiVersion: resource.apiVersion,
+        kind: resource.kind,
+        metadata: {
+            name: resource.metadata.name,
+            ...(resource.metadata.namespace === undefined
+                ? {}
+                : { namespace: resource.metadata.namespace }),
+            labels: resource.metadata.labels,
+            annotations: resource.metadata.annotations,
+        },
+        ...(data === undefined ? {} : { data }),
+        ...(resource.spec === undefined ? {} : { spec: resource.spec }),
+    };
+}
+/*** Serialize plain Kubernetes desired data with stable recursive key ordering. */
+function stableSerialize(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableSerialize).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => `${JSON.stringify(key)}:${stableSerialize(item)}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=areKubernetesResourcesEquivalent.js.map

package/dist/features/workload-reconciliation/utils/areKubernetesResourcesEquivalent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"areKubernetesResourcesEquivalent.js","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/areKubernetesResourcesEquivalent.ts"],"names":[],"mappings":"AAEA,+FAA+F;AAC/F,MAAM,UAAU,gCAAgC,CAC9C,OAA2B,EAC3B,MAA0B;IAE1B,OAAO,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,QAA4B;IAC7C,MAAM,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;IAChC,MAAM,IAAI,GACR,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,QAAQ,CAAC,IAAI;QACf,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YAC/C,GAAG;YACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACtC,CAAC,CACH,CAAC;IACR,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YAC5B,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC/C,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;YAChC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;SAC3C;QACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAC7B,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;aACvE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["import type { KubernetesResource } from '../../../types/kubernetesResources';\n\n/*** Compare desired and observed Kubernetes resources while ignoring server-owned metadata. */\nexport function areKubernetesResourcesEquivalent(\n  desired: KubernetesResource,\n  actual: KubernetesResource,\n): boolean {\n  return stableSerialize(normalize(desired)) === stableSerialize(normalize(actual));\n}\n\n/*** Normalize write-only Secret data and recursively order object keys. */\nfunction normalize(resource: KubernetesResource): unknown {\n  const { stringData } = resource;\n  const data =\n    stringData === undefined\n      ? resource.data\n      : Object.fromEntries(\n          Object.entries(stringData).map(([key, value]) => [\n            key,\n            Buffer.from(value).toString('base64'),\n          ]),\n        );\n  return {\n    apiVersion: resource.apiVersion,\n    kind: resource.kind,\n    metadata: {\n      name: resource.metadata.name,\n      ...(resource.metadata.namespace === undefined\n        ? {}\n        : { namespace: resource.metadata.namespace }),\n      labels: resource.metadata.labels,\n      annotations: resource.metadata.annotations,\n    },\n    ...(data === undefined ? {} : { data }),\n    ...(resource.spec === undefined ? {} : { spec: resource.spec }),\n  };\n}\n\n/*** Serialize plain Kubernetes desired data with stable recursive key ordering. */\nfunction stableSerialize(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableSerialize).join(',')}]`;\n  if (value !== null && typeof value === 'object') {\n    return `{${Object.entries(value)\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([key, item]) => `${JSON.stringify(key)}:${stableSerialize(item)}`)\n      .join(',')}}`;\n  }\n  return JSON.stringify(value);\n}\n"]}

package/dist/features/workload-reconciliation/utils/createKubernetesDesiredResource.d.ts

@@ -0,0 +1,14 @@
+import type { InfraOwnedResource, InfraResourceIdentity } from '@ankhorage/contracts/infra';
+import type { KubernetesDriverRequest } from '../../../types/kubernetesDriver';
+import type { KubernetesDesiredResource, KubernetesResource } from '../../../types/kubernetesResources';
+/*** Attach canonical Infra ownership to a standard Kubernetes desired resource. */
+export declare function createKubernetesDesiredResource(request: KubernetesDriverRequest, input: CreateKubernetesDesiredResourceInput): KubernetesDesiredResource;
+interface CreateKubernetesDesiredResourceInput {
+    readonly resourceId: string;
+    readonly resource: KubernetesResource;
+    readonly persistent?: boolean;
+    readonly retention?: InfraOwnedResource['retention'];
+    readonly dependsOn?: readonly InfraResourceIdentity[];
+}
+export {};
+//# sourceMappingURL=createKubernetesDesiredResource.d.ts.map

package/dist/features/workload-reconciliation/utils/createKubernetesDesiredResource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createKubernetesDesiredResource.d.ts","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/createKubernetesDesiredResource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAE5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EACV,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAM5C,mFAAmF;AACnF,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,oCAAoC,GAC1C,yBAAyB,CAyC3B;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACvD"}

package/dist/features/workload-reconciliation/utils/createKubernetesDesiredResource.js

@@ -0,0 +1,45 @@
+import { KUBERNETES_OWNERSHIP } from '../constants';
+import { getKubernetesResourceKey } from './getKubernetesResourceKey';
+import { getKubernetesResourceReference } from './getKubernetesResourceReference';
+import { toKubernetesName } from './toKubernetesName';
+/*** Attach canonical Infra ownership to a standard Kubernetes desired resource. */
+export function createKubernetesDesiredResource(request, input) {
+    const identity = {
+        projectId: request.context.projectId,
+        environment: request.context.environment,
+        adapter: request.ownerAdapter,
+        resourceId: input.resourceId,
+    };
+    const dependsOn = input.dependsOn ?? [];
+    const resource = {
+        ...input.resource,
+        metadata: {
+            ...input.resource.metadata,
+            labels: {
+                ...input.resource.metadata.labels,
+                [KUBERNETES_OWNERSHIP.managedByLabel]: KUBERNETES_OWNERSHIP.managedByValue,
+                [KUBERNETES_OWNERSHIP.projectLabel]: toKubernetesName(request.context.projectId),
+                [KUBERNETES_OWNERSHIP.environmentLabel]: request.context.environment,
+            },
+            annotations: {
+                ...input.resource.metadata.annotations,
+                [KUBERNETES_OWNERSHIP.projectAnnotation]: request.context.projectId,
+                [KUBERNETES_OWNERSHIP.environmentAnnotation]: request.context.environment,
+                [KUBERNETES_OWNERSHIP.adapterAnnotation]: request.ownerAdapter,
+                [KUBERNETES_OWNERSHIP.resourceAnnotation]: input.resourceId,
+                [KUBERNETES_OWNERSHIP.persistentAnnotation]: String(input.persistent ?? false),
+                [KUBERNETES_OWNERSHIP.retentionAnnotation]: input.retention ?? 'retain',
+                [KUBERNETES_OWNERSHIP.dependenciesAnnotation]: JSON.stringify(dependsOn.map((dependency) => dependency.resourceId)),
+            },
+        },
+    };
+    const owner = {
+        identity,
+        externalId: getKubernetesResourceKey(getKubernetesResourceReference(resource)),
+        persistent: input.persistent ?? false,
+        retention: input.retention ?? 'retain',
+        dependsOn,
+    };
+    return { resource, owner };
+}
+//# sourceMappingURL=createKubernetesDesiredResource.js.map

package/dist/features/workload-reconciliation/utils/createKubernetesDesiredResource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createKubernetesDesiredResource.js","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/createKubernetesDesiredResource.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,mFAAmF;AACnF,MAAM,UAAU,+BAA+B,CAC7C,OAAgC,EAChC,KAA2C;IAE3C,MAAM,QAAQ,GAA0B;QACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QACpC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;QACxC,OAAO,EAAE,OAAO,CAAC,YAAY;QAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAuB;QACnC,GAAG,KAAK,CAAC,QAAQ;QACjB,QAAQ,EAAE;YACR,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ;YAC1B,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM;gBACjC,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC,cAAc;gBAC1E,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;gBAChF,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;aACrE;YACD,WAAW,EAAE;gBACX,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;gBACtC,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;gBACnE,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;gBACzE,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,YAAY;gBAC9D,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,UAAU;gBAC3D,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC;gBAC9E,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,SAAS,IAAI,QAAQ;gBACvE,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,SAAS,CAC3D,SAAS,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CACrD;aACF;SACF;KACF,CAAC;IAEF,MAAM,KAAK,GAAuB;QAChC,QAAQ;QACR,UAAU,EAAE,wBAAwB,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;QAC9E,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,QAAQ;QACtC,SAAS;KACV,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import type { InfraOwnedResource, InfraResourceIdentity } from '@ankhorage/contracts/infra';\n\nimport type { KubernetesDriverRequest } from '../../../types/kubernetesDriver';\nimport type {\n  KubernetesDesiredResource,\n  KubernetesResource,\n} from '../../../types/kubernetesResources';\nimport { KUBERNETES_OWNERSHIP } from '../constants';\nimport { getKubernetesResourceKey } from './getKubernetesResourceKey';\nimport { getKubernetesResourceReference } from './getKubernetesResourceReference';\nimport { toKubernetesName } from './toKubernetesName';\n\n/*** Attach canonical Infra ownership to a standard Kubernetes desired resource. */\nexport function createKubernetesDesiredResource(\n  request: KubernetesDriverRequest,\n  input: CreateKubernetesDesiredResourceInput,\n): KubernetesDesiredResource {\n  const identity: InfraResourceIdentity = {\n    projectId: request.context.projectId,\n    environment: request.context.environment,\n    adapter: request.ownerAdapter,\n    resourceId: input.resourceId,\n  };\n  const dependsOn = input.dependsOn ?? [];\n  const resource: KubernetesResource = {\n    ...input.resource,\n    metadata: {\n      ...input.resource.metadata,\n      labels: {\n        ...input.resource.metadata.labels,\n        [KUBERNETES_OWNERSHIP.managedByLabel]: KUBERNETES_OWNERSHIP.managedByValue,\n        [KUBERNETES_OWNERSHIP.projectLabel]: toKubernetesName(request.context.projectId),\n        [KUBERNETES_OWNERSHIP.environmentLabel]: request.context.environment,\n      },\n      annotations: {\n        ...input.resource.metadata.annotations,\n        [KUBERNETES_OWNERSHIP.projectAnnotation]: request.context.projectId,\n        [KUBERNETES_OWNERSHIP.environmentAnnotation]: request.context.environment,\n        [KUBERNETES_OWNERSHIP.adapterAnnotation]: request.ownerAdapter,\n        [KUBERNETES_OWNERSHIP.resourceAnnotation]: input.resourceId,\n        [KUBERNETES_OWNERSHIP.persistentAnnotation]: String(input.persistent ?? false),\n        [KUBERNETES_OWNERSHIP.retentionAnnotation]: input.retention ?? 'retain',\n        [KUBERNETES_OWNERSHIP.dependenciesAnnotation]: JSON.stringify(\n          dependsOn.map((dependency) => dependency.resourceId),\n        ),\n      },\n    },\n  };\n\n  const owner: InfraOwnedResource = {\n    identity,\n    externalId: getKubernetesResourceKey(getKubernetesResourceReference(resource)),\n    persistent: input.persistent ?? false,\n    retention: input.retention ?? 'retain',\n    dependsOn,\n  };\n  return { resource, owner };\n}\n\ninterface CreateKubernetesDesiredResourceInput {\n  readonly resourceId: string;\n  readonly resource: KubernetesResource;\n  readonly persistent?: boolean;\n  readonly retention?: InfraOwnedResource['retention'];\n  readonly dependsOn?: readonly InfraResourceIdentity[];\n}\n"]}

package/dist/features/workload-reconciliation/utils/createKubernetesIdentity.d.ts

@@ -0,0 +1,5 @@
+import type { InfraResourceIdentity } from '@ankhorage/contracts/infra';
+import type { KubernetesDriverRequest } from '../../../types/kubernetesDriver';
+/*** Create a runtime-owned Infra identity without provider-specific assumptions. */
+export declare function createKubernetesIdentity(request: KubernetesDriverRequest, resourceId: string): InfraResourceIdentity;
+//# sourceMappingURL=createKubernetesIdentity.d.ts.map

package/dist/features/workload-reconciliation/utils/createKubernetesIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createKubernetesIdentity.d.ts","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/createKubernetesIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,oFAAoF;AACpF,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,uBAAuB,EAChC,UAAU,EAAE,MAAM,GACjB,qBAAqB,CAOvB"}

package/dist/features/workload-reconciliation/utils/createKubernetesIdentity.js

@@ -0,0 +1,10 @@
+/*** Create a runtime-owned Infra identity without provider-specific assumptions. */
+export function createKubernetesIdentity(request, resourceId) {
+    return {
+        projectId: request.context.projectId,
+        environment: request.context.environment,
+        adapter: request.ownerAdapter,
+        resourceId,
+    };
+}
+//# sourceMappingURL=createKubernetesIdentity.js.map

package/dist/features/workload-reconciliation/utils/createKubernetesIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createKubernetesIdentity.js","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/createKubernetesIdentity.ts"],"names":[],"mappings":"AAIA,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CACtC,OAAgC,EAChC,UAAkB;IAElB,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QACpC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;QACxC,OAAO,EAAE,OAAO,CAAC,YAAY;QAC7B,UAAU;KACX,CAAC;AACJ,CAAC","sourcesContent":["import type { InfraResourceIdentity } from '@ankhorage/contracts/infra';\n\nimport type { KubernetesDriverRequest } from '../../../types/kubernetesDriver';\n\n/*** Create a runtime-owned Infra identity without provider-specific assumptions. */\nexport function createKubernetesIdentity(\n  request: KubernetesDriverRequest,\n  resourceId: string,\n): InfraResourceIdentity {\n  return {\n    projectId: request.context.projectId,\n    environment: request.context.environment,\n    adapter: request.ownerAdapter,\n    resourceId,\n  };\n}\n"]}

package/dist/features/workload-reconciliation/utils/getKubernetesOwnershipQuery.d.ts

@@ -0,0 +1,5 @@
+import type { KubernetesDriverRequest } from '../../../types/kubernetesDriver';
+import type { KubernetesOwnershipQuery } from '../../../types/kubernetesResources';
+/*** Build the narrow ownership selector used for every read and prune operation. */
+export declare function getKubernetesOwnershipQuery(request: KubernetesDriverRequest): KubernetesOwnershipQuery;
+//# sourceMappingURL=getKubernetesOwnershipQuery.d.ts.map

package/dist/features/workload-reconciliation/utils/getKubernetesOwnershipQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getKubernetesOwnershipQuery.d.ts","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/getKubernetesOwnershipQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAInF,oFAAoF;AACpF,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,uBAAuB,GAC/B,wBAAwB,CAY1B"}

package/dist/features/workload-reconciliation/utils/getKubernetesOwnershipQuery.js

@@ -0,0 +1,16 @@
+import { KUBERNETES_OWNERSHIP } from '../constants';
+import { toKubernetesName } from './toKubernetesName';
+/*** Build the narrow ownership selector used for every read and prune operation. */
+export function getKubernetesOwnershipQuery(request) {
+    return {
+        namespace: request.namespace ??
+            toKubernetesName(`${request.context.projectId}-${request.context.environment}`),
+        labels: {
+            [KUBERNETES_OWNERSHIP.managedByLabel]: KUBERNETES_OWNERSHIP.managedByValue,
+            [KUBERNETES_OWNERSHIP.projectLabel]: toKubernetesName(request.context.projectId),
+            [KUBERNETES_OWNERSHIP.environmentLabel]: request.context.environment,
+        },
+        ...(request.context.signal === undefined ? {} : { signal: request.context.signal }),
+    };
+}
+//# sourceMappingURL=getKubernetesOwnershipQuery.js.map

package/dist/features/workload-reconciliation/utils/getKubernetesOwnershipQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getKubernetesOwnershipQuery.js","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/getKubernetesOwnershipQuery.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CACzC,OAAgC;IAEhC,OAAO;QACL,SAAS,EACP,OAAO,CAAC,SAAS;YACjB,gBAAgB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACjF,MAAM,EAAE;YACN,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC,cAAc;YAC1E,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;YAChF,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;SACrE;QACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC","sourcesContent":["import type { KubernetesDriverRequest } from '../../../types/kubernetesDriver';\nimport type { KubernetesOwnershipQuery } from '../../../types/kubernetesResources';\nimport { KUBERNETES_OWNERSHIP } from '../constants';\nimport { toKubernetesName } from './toKubernetesName';\n\n/*** Build the narrow ownership selector used for every read and prune operation. */\nexport function getKubernetesOwnershipQuery(\n  request: KubernetesDriverRequest,\n): KubernetesOwnershipQuery {\n  return {\n    namespace:\n      request.namespace ??\n      toKubernetesName(`${request.context.projectId}-${request.context.environment}`),\n    labels: {\n      [KUBERNETES_OWNERSHIP.managedByLabel]: KUBERNETES_OWNERSHIP.managedByValue,\n      [KUBERNETES_OWNERSHIP.projectLabel]: toKubernetesName(request.context.projectId),\n      [KUBERNETES_OWNERSHIP.environmentLabel]: request.context.environment,\n    },\n    ...(request.context.signal === undefined ? {} : { signal: request.context.signal }),\n  };\n}\n"]}

package/dist/features/workload-reconciliation/utils/getKubernetesResourceKey.d.ts

@@ -0,0 +1,4 @@
+import type { KubernetesResourceReference } from '../../../types/kubernetesResources';
+/*** Build a stable comparison key for a Kubernetes resource identity. */
+export declare function getKubernetesResourceKey(resource: KubernetesResourceReference): string;
+//# sourceMappingURL=getKubernetesResourceKey.d.ts.map

package/dist/features/workload-reconciliation/utils/getKubernetesResourceKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getKubernetesResourceKey.d.ts","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/getKubernetesResourceKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,yEAAyE;AACzE,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM,CAEtF"}

package/dist/features/workload-reconciliation/utils/getKubernetesResourceKey.js

@@ -0,0 +1,5 @@
+/*** Build a stable comparison key for a Kubernetes resource identity. */
+export function getKubernetesResourceKey(resource) {
+    return [resource.apiVersion, resource.kind, resource.namespace ?? '', resource.name].join('/');
+}
+//# sourceMappingURL=getKubernetesResourceKey.js.map

package/dist/features/workload-reconciliation/utils/getKubernetesResourceKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getKubernetesResourceKey.js","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/getKubernetesResourceKey.ts"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CAAC,QAAqC;IAC5E,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjG,CAAC","sourcesContent":["import type { KubernetesResourceReference } from '../../../types/kubernetesResources';\n\n/*** Build a stable comparison key for a Kubernetes resource identity. */\nexport function getKubernetesResourceKey(resource: KubernetesResourceReference): string {\n  return [resource.apiVersion, resource.kind, resource.namespace ?? '', resource.name].join('/');\n}\n"]}

package/dist/features/workload-reconciliation/utils/getKubernetesResourceReference.d.ts

@@ -0,0 +1,4 @@
+import type { KubernetesResource, KubernetesResourceReference } from '../../../types/kubernetesResources';
+/*** Return the immutable Kubernetes identity of a desired or observed resource. */
+export declare function getKubernetesResourceReference(resource: KubernetesResource): KubernetesResourceReference;
+//# sourceMappingURL=getKubernetesResourceReference.d.ts.map

package/dist/features/workload-reconciliation/utils/getKubernetesResourceReference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getKubernetesResourceReference.d.ts","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/getKubernetesResourceReference.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,2BAA2B,EAC5B,MAAM,oCAAoC,CAAC;AAE5C,mFAAmF;AACnF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,kBAAkB,GAC3B,2BAA2B,CAS7B"}

package/dist/features/workload-reconciliation/utils/getKubernetesResourceReference.js

@@ -0,0 +1,12 @@
+/*** Return the immutable Kubernetes identity of a desired or observed resource. */
+export function getKubernetesResourceReference(resource) {
+    return {
+        apiVersion: resource.apiVersion,
+        kind: resource.kind,
+        name: resource.metadata.name,
+        ...(resource.metadata.namespace === undefined
+            ? {}
+            : { namespace: resource.metadata.namespace }),
+    };
+}
+//# sourceMappingURL=getKubernetesResourceReference.js.map

package/dist/features/workload-reconciliation/utils/getKubernetesResourceReference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getKubernetesResourceReference.js","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/getKubernetesResourceReference.ts"],"names":[],"mappings":"AAKA,mFAAmF;AACnF,MAAM,UAAU,8BAA8B,CAC5C,QAA4B;IAE5B,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;QAC5B,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  KubernetesResource,\n  KubernetesResourceReference,\n} from '../../../types/kubernetesResources';\n\n/*** Return the immutable Kubernetes identity of a desired or observed resource. */\nexport function getKubernetesResourceReference(\n  resource: KubernetesResource,\n): KubernetesResourceReference {\n  return {\n    apiVersion: resource.apiVersion,\n    kind: resource.kind,\n    name: resource.metadata.name,\n    ...(resource.metadata.namespace === undefined\n      ? {}\n      : { namespace: resource.metadata.namespace }),\n  };\n}\n"]}

package/dist/features/workload-reconciliation/utils/readKubernetesOwnedResource.d.ts

@@ -0,0 +1,6 @@
+import type { InfraOwnedResource } from '@ankhorage/contracts/infra';
+import type { KubernetesDriverRequest } from '../../../types/kubernetesDriver';
+import type { KubernetesResource } from '../../../types/kubernetesResources';
+/*** Read trusted ownership metadata, rejecting resources outside the active Infra identity. */
+export declare function readKubernetesOwnedResource(resource: KubernetesResource, request: KubernetesDriverRequest): InfraOwnedResource | undefined;
+//# sourceMappingURL=readKubernetesOwnedResource.d.ts.map

package/dist/features/workload-reconciliation/utils/readKubernetesOwnedResource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readKubernetesOwnedResource.d.ts","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/readKubernetesOwnedResource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAyB,MAAM,4BAA4B,CAAC;AAE5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAK7E,+FAA+F;AAC/F,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,uBAAuB,GAC/B,kBAAkB,GAAG,SAAS,CAmChC"}

package/dist/features/workload-reconciliation/utils/readKubernetesOwnedResource.js

@@ -0,0 +1,49 @@
+import { KUBERNETES_OWNERSHIP } from '../constants';
+import { getKubernetesResourceKey } from './getKubernetesResourceKey';
+import { getKubernetesResourceReference } from './getKubernetesResourceReference';
+/*** Read trusted ownership metadata, rejecting resources outside the active Infra identity. */
+export function readKubernetesOwnedResource(resource, request) {
+    const { annotations } = resource.metadata;
+    if (annotations[KUBERNETES_OWNERSHIP.projectAnnotation] !== request.context.projectId ||
+        annotations[KUBERNETES_OWNERSHIP.environmentAnnotation] !== request.context.environment ||
+        annotations[KUBERNETES_OWNERSHIP.adapterAnnotation] !== request.ownerAdapter) {
+        return undefined;
+    }
+    const resourceId = annotations[KUBERNETES_OWNERSHIP.resourceAnnotation];
+    if (resourceId === undefined || resourceId.length === 0)
+        return undefined;
+    const identity = {
+        projectId: request.context.projectId,
+        environment: request.context.environment,
+        adapter: request.ownerAdapter,
+        resourceId,
+    };
+    const dependencies = readDependencies(annotations[KUBERNETES_OWNERSHIP.dependenciesAnnotation], identity);
+    if (dependencies === undefined)
+        return undefined;
+    return {
+        identity,
+        externalId: getKubernetesResourceKey(getKubernetesResourceReference(resource)),
+        persistent: annotations[KUBERNETES_OWNERSHIP.persistentAnnotation] === 'true',
+        retention: annotations[KUBERNETES_OWNERSHIP.retentionAnnotation] === 'delete-on-destroy'
+            ? 'delete-on-destroy'
+            : 'retain',
+        dependsOn: dependencies,
+    };
+}
+/*** Decode dependency IDs without trusting arbitrary serialized identity objects. */
+function readDependencies(value, identity) {
+    if (value === undefined)
+        return [];
+    try {
+        const parsed = JSON.parse(value);
+        if (!Array.isArray(parsed) || !parsed.every((item) => typeof item === 'string')) {
+            return undefined;
+        }
+        return parsed.map((resourceId) => ({ ...identity, resourceId }));
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=readKubernetesOwnedResource.js.map

package/dist/features/workload-reconciliation/utils/readKubernetesOwnedResource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readKubernetesOwnedResource.js","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/readKubernetesOwnedResource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAElF,+FAA+F;AAC/F,MAAM,UAAU,2BAA2B,CACzC,QAA4B,EAC5B,OAAgC;IAEhC,MAAM,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC1C,IACE,WAAW,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,SAAS;QACjF,WAAW,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW;QACvF,WAAW,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,KAAK,OAAO,CAAC,YAAY,EAC5E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IACxE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1E,MAAM,QAAQ,GAA0B;QACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QACpC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;QACxC,OAAO,EAAE,OAAO,CAAC,YAAY;QAC7B,UAAU;KACX,CAAC;IACF,MAAM,YAAY,GAAG,gBAAgB,CACnC,WAAW,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,EACxD,QAAQ,CACT,CAAC;IACF,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjD,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,wBAAwB,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;QAC9E,UAAU,EAAE,WAAW,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,KAAK,MAAM;QAC7E,SAAS,EACP,WAAW,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,mBAAmB;YAC3E,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,QAAQ;QACd,SAAS,EAAE,YAAY;KACxB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,gBAAgB,CACvB,KAAyB,EACzB,QAA+B;IAE/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import type { InfraOwnedResource, InfraResourceIdentity } from '@ankhorage/contracts/infra';\n\nimport type { KubernetesDriverRequest } from '../../../types/kubernetesDriver';\nimport type { KubernetesResource } from '../../../types/kubernetesResources';\nimport { KUBERNETES_OWNERSHIP } from '../constants';\nimport { getKubernetesResourceKey } from './getKubernetesResourceKey';\nimport { getKubernetesResourceReference } from './getKubernetesResourceReference';\n\n/*** Read trusted ownership metadata, rejecting resources outside the active Infra identity. */\nexport function readKubernetesOwnedResource(\n  resource: KubernetesResource,\n  request: KubernetesDriverRequest,\n): InfraOwnedResource | undefined {\n  const { annotations } = resource.metadata;\n  if (\n    annotations[KUBERNETES_OWNERSHIP.projectAnnotation] !== request.context.projectId ||\n    annotations[KUBERNETES_OWNERSHIP.environmentAnnotation] !== request.context.environment ||\n    annotations[KUBERNETES_OWNERSHIP.adapterAnnotation] !== request.ownerAdapter\n  ) {\n    return undefined;\n  }\n\n  const resourceId = annotations[KUBERNETES_OWNERSHIP.resourceAnnotation];\n  if (resourceId === undefined || resourceId.length === 0) return undefined;\n\n  const identity: InfraResourceIdentity = {\n    projectId: request.context.projectId,\n    environment: request.context.environment,\n    adapter: request.ownerAdapter,\n    resourceId,\n  };\n  const dependencies = readDependencies(\n    annotations[KUBERNETES_OWNERSHIP.dependenciesAnnotation],\n    identity,\n  );\n  if (dependencies === undefined) return undefined;\n\n  return {\n    identity,\n    externalId: getKubernetesResourceKey(getKubernetesResourceReference(resource)),\n    persistent: annotations[KUBERNETES_OWNERSHIP.persistentAnnotation] === 'true',\n    retention:\n      annotations[KUBERNETES_OWNERSHIP.retentionAnnotation] === 'delete-on-destroy'\n        ? 'delete-on-destroy'\n        : 'retain',\n    dependsOn: dependencies,\n  };\n}\n\n/*** Decode dependency IDs without trusting arbitrary serialized identity objects. */\nfunction readDependencies(\n  value: string | undefined,\n  identity: InfraResourceIdentity,\n): readonly InfraResourceIdentity[] | undefined {\n  if (value === undefined) return [];\n  try {\n    const parsed: unknown = JSON.parse(value);\n    if (!Array.isArray(parsed) || !parsed.every((item) => typeof item === 'string')) {\n      return undefined;\n    }\n    return parsed.map((resourceId) => ({ ...identity, resourceId }));\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/features/workload-reconciliation/utils/sortKubernetesResourcesForRemoval.d.ts

@@ -0,0 +1,9 @@
+import type { InfraOwnedResource } from '@ankhorage/contracts/infra';
+import type { KubernetesResource } from '../../../types/kubernetesResources';
+export interface OwnedKubernetesResource {
+    readonly resource: KubernetesResource;
+    readonly owner: InfraOwnedResource;
+}
+/*** Sort owned resources deterministically with dependents before their dependencies. */
+export declare function sortKubernetesResourcesForRemoval(resources: readonly OwnedKubernetesResource[]): readonly OwnedKubernetesResource[];
+//# sourceMappingURL=sortKubernetesResourcesForRemoval.d.ts.map

package/dist/features/workload-reconciliation/utils/sortKubernetesResourcesForRemoval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sortKubernetesResourcesForRemoval.d.ts","sourceRoot":"","sources":["../../../../src/features/workload-reconciliation/utils/sortKubernetesResourcesForRemoval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;CACpC;AAED,yFAAyF;AACzF,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,SAAS,uBAAuB,EAAE,GAC5C,SAAS,uBAAuB,EAAE,CAkBpC"}

package/dist/features/workload-reconciliation/utils/sortKubernetesResourcesForRemoval.js

@@ -0,0 +1,21 @@
+/*** Sort owned resources deterministically with dependents before their dependencies. */
+export function sortKubernetesResourcesForRemoval(resources) {
+    const remaining = new Map(resources.map((item) => [item.owner.identity.resourceId, item]));
+    const ordered = [];
+    while (remaining.size > 0) {
+        const leaves = [...remaining.values()]
+            .filter(({ owner }) => ![...remaining.values()].some(({ owner: candidate }) => candidate.dependsOn.some(({ resourceId }) => resourceId === owner.identity.resourceId)))
+            .sort(compareResourceKeys);
+        const selected = leaves.at(0) ?? [...remaining.values()].sort(compareResourceKeys).at(0);
+        if (selected === undefined)
+            break;
+        ordered.push(selected);
+        remaining.delete(selected.owner.identity.resourceId);
+    }
+    return ordered;
+}
+/*** Compare owned resources by stable external resource identity. */
+function compareResourceKeys(left, right) {
+    return (left.owner.externalId ?? '').localeCompare(right.owner.externalId ?? '');
+}
+//# sourceMappingURL=sortKubernetesResourcesForRemoval.js.map