alchemy-kubernetes-native 0.1.1

package/dist/index.mjs

@@ -0,0 +1,1024 @@
+import { RandomProvider, Resource, isResolved } from "alchemy";
+import * as Effect from "effect/Effect";
+import { createHash } from "node:crypto";
+import { Unowned } from "alchemy/AdoptPolicy";
+import * as Provider from "alchemy/Provider";
+import * as Kubernetes from "alchemy/Kubernetes";
+import { findClusterAdapter, toConnection } from "alchemy/Kubernetes";
+import * as Layer from "effect/Layer";
+import { request } from "node:http";
+import { request as request$1 } from "node:https";
+import * as Duration from "effect/Duration";
+import { readFileSync } from "node:fs";
+import { parseAllDocuments, stringify } from "yaml";
+import { execFileSync } from "node:child_process";
+//#region src/resource.ts
+const ObjectResource = Resource("KubernetesApi.Object");
+const Object$1 = (id, props) => {
+	const { dependsOn, ...resourceProps } = props;
+	return registerObject(id, resourceProps, dependsOn);
+};
+const lifecycleKeys = /* @__PURE__ */ new Set([
+	"cluster",
+	"fieldManager",
+	"forceConflicts",
+	"skipAwait",
+	"timeoutSeconds",
+	"waitFor",
+	"deletionPropagation",
+	"replaceOnChanges"
+]);
+const toObjectProps = (apiVersion, kind, props, mode) => {
+	const lifecycle = {};
+	const manifest = {
+		apiVersion,
+		kind
+	};
+	for (const [key, value] of globalThis.Object.entries(props)) {
+		if (key === "dependsOn") continue;
+		(lifecycleKeys.has(key) ? lifecycle : manifest)[key] = value;
+	}
+	return {
+		...lifecycle,
+		manifest,
+		mode
+	};
+};
+const registerObject = (id, props, dependency) => {
+	const resource = ObjectResource(id, props);
+	return dependency === void 0 ? resource : Effect.tap(resource, (registered) => registered.bind("dependsOn", { dependency }));
+};
+const defineBuiltin = (apiVersion, kind) => ((id, props) => registerObject(id, toObjectProps(apiVersion, kind, props, "object"), props.dependsOn));
+const definePatch = (apiVersion, kind) => ((id, props) => registerObject(id, toObjectProps(apiVersion, kind, props, "patch"), props.dependsOn));
+//#endregion
+//#region src/generated.ts
+const api = {
+	core: { v1: {
+		ConfigMap: defineBuiltin("v1", "ConfigMap"),
+		ConfigMapPatch: definePatch("v1", "ConfigMap"),
+		Endpoints: defineBuiltin("v1", "Endpoints"),
+		EndpointsPatch: definePatch("v1", "Endpoints"),
+		Event: defineBuiltin("v1", "Event"),
+		EventPatch: definePatch("v1", "Event"),
+		LimitRange: defineBuiltin("v1", "LimitRange"),
+		LimitRangePatch: definePatch("v1", "LimitRange"),
+		Namespace: defineBuiltin("v1", "Namespace"),
+		NamespacePatch: definePatch("v1", "Namespace"),
+		Node: defineBuiltin("v1", "Node"),
+		NodePatch: definePatch("v1", "Node"),
+		PersistentVolume: defineBuiltin("v1", "PersistentVolume"),
+		PersistentVolumePatch: definePatch("v1", "PersistentVolume"),
+		PersistentVolumeClaim: defineBuiltin("v1", "PersistentVolumeClaim"),
+		PersistentVolumeClaimPatch: definePatch("v1", "PersistentVolumeClaim"),
+		Pod: defineBuiltin("v1", "Pod"),
+		PodPatch: definePatch("v1", "Pod"),
+		PodTemplate: defineBuiltin("v1", "PodTemplate"),
+		PodTemplatePatch: definePatch("v1", "PodTemplate"),
+		ReplicationController: defineBuiltin("v1", "ReplicationController"),
+		ReplicationControllerPatch: definePatch("v1", "ReplicationController"),
+		ResourceQuota: defineBuiltin("v1", "ResourceQuota"),
+		ResourceQuotaPatch: definePatch("v1", "ResourceQuota"),
+		Service: defineBuiltin("v1", "Service"),
+		ServicePatch: definePatch("v1", "Service"),
+		ServiceAccount: defineBuiltin("v1", "ServiceAccount"),
+		ServiceAccountPatch: definePatch("v1", "ServiceAccount")
+	} },
+	apps: { v1: {
+		ControllerRevision: defineBuiltin("apps/v1", "ControllerRevision"),
+		ControllerRevisionPatch: definePatch("apps/v1", "ControllerRevision"),
+		DaemonSet: defineBuiltin("apps/v1", "DaemonSet"),
+		DaemonSetPatch: definePatch("apps/v1", "DaemonSet"),
+		Deployment: defineBuiltin("apps/v1", "Deployment"),
+		DeploymentPatch: definePatch("apps/v1", "Deployment"),
+		ReplicaSet: defineBuiltin("apps/v1", "ReplicaSet"),
+		ReplicaSetPatch: definePatch("apps/v1", "ReplicaSet"),
+		StatefulSet: defineBuiltin("apps/v1", "StatefulSet"),
+		StatefulSetPatch: definePatch("apps/v1", "StatefulSet")
+	} },
+	batch: { v1: {
+		CronJob: defineBuiltin("batch/v1", "CronJob"),
+		CronJobPatch: definePatch("batch/v1", "CronJob"),
+		Job: defineBuiltin("batch/v1", "Job"),
+		JobPatch: definePatch("batch/v1", "Job")
+	} },
+	networking: { v1: {
+		IPAddress: defineBuiltin("networking.k8s.io/v1", "IPAddress"),
+		IPAddressPatch: definePatch("networking.k8s.io/v1", "IPAddress"),
+		Ingress: defineBuiltin("networking.k8s.io/v1", "Ingress"),
+		IngressPatch: definePatch("networking.k8s.io/v1", "Ingress"),
+		IngressClass: defineBuiltin("networking.k8s.io/v1", "IngressClass"),
+		IngressClassPatch: definePatch("networking.k8s.io/v1", "IngressClass"),
+		NetworkPolicy: defineBuiltin("networking.k8s.io/v1", "NetworkPolicy"),
+		NetworkPolicyPatch: definePatch("networking.k8s.io/v1", "NetworkPolicy"),
+		ServiceCIDR: defineBuiltin("networking.k8s.io/v1", "ServiceCIDR"),
+		ServiceCIDRPatch: definePatch("networking.k8s.io/v1", "ServiceCIDR")
+	} },
+	rbac: { v1: {
+		ClusterRole: defineBuiltin("rbac.authorization.k8s.io/v1", "ClusterRole"),
+		ClusterRolePatch: definePatch("rbac.authorization.k8s.io/v1", "ClusterRole"),
+		ClusterRoleBinding: defineBuiltin("rbac.authorization.k8s.io/v1", "ClusterRoleBinding"),
+		ClusterRoleBindingPatch: definePatch("rbac.authorization.k8s.io/v1", "ClusterRoleBinding"),
+		Role: defineBuiltin("rbac.authorization.k8s.io/v1", "Role"),
+		RolePatch: definePatch("rbac.authorization.k8s.io/v1", "Role"),
+		RoleBinding: defineBuiltin("rbac.authorization.k8s.io/v1", "RoleBinding"),
+		RoleBindingPatch: definePatch("rbac.authorization.k8s.io/v1", "RoleBinding")
+	} },
+	autoscaling: { v2: {
+		HorizontalPodAutoscaler: defineBuiltin("autoscaling/v2", "HorizontalPodAutoscaler"),
+		HorizontalPodAutoscalerPatch: definePatch("autoscaling/v2", "HorizontalPodAutoscaler")
+	} },
+	policy: { v1: {
+		PodDisruptionBudget: defineBuiltin("policy/v1", "PodDisruptionBudget"),
+		PodDisruptionBudgetPatch: definePatch("policy/v1", "PodDisruptionBudget")
+	} },
+	storage: { v1: {
+		CSIDriver: defineBuiltin("storage.k8s.io/v1", "CSIDriver"),
+		CSIDriverPatch: definePatch("storage.k8s.io/v1", "CSIDriver"),
+		CSINode: defineBuiltin("storage.k8s.io/v1", "CSINode"),
+		CSINodePatch: definePatch("storage.k8s.io/v1", "CSINode"),
+		CSIStorageCapacity: defineBuiltin("storage.k8s.io/v1", "CSIStorageCapacity"),
+		CSIStorageCapacityPatch: definePatch("storage.k8s.io/v1", "CSIStorageCapacity"),
+		StorageClass: defineBuiltin("storage.k8s.io/v1", "StorageClass"),
+		StorageClassPatch: definePatch("storage.k8s.io/v1", "StorageClass"),
+		VolumeAttachment: defineBuiltin("storage.k8s.io/v1", "VolumeAttachment"),
+		VolumeAttachmentPatch: definePatch("storage.k8s.io/v1", "VolumeAttachment"),
+		VolumeAttributesClass: defineBuiltin("storage.k8s.io/v1", "VolumeAttributesClass"),
+		VolumeAttributesClassPatch: definePatch("storage.k8s.io/v1", "VolumeAttributesClass")
+	} },
+	apiextensions: { v1: {
+		CustomResourceDefinition: defineBuiltin("apiextensions.k8s.io/v1", "CustomResourceDefinition"),
+		CustomResourceDefinitionPatch: definePatch("apiextensions.k8s.io/v1", "CustomResourceDefinition")
+	} }
+};
+const { core, apps, batch, networking, rbac, autoscaling, policy, storage, apiextensions } = api;
+//#endregion
+//#region src/client.ts
+var KubernetesApiError = class extends Error {
+	method;
+	path;
+	statusCode;
+	name = "KubernetesApiError";
+	immutable;
+	constructor(method, path, statusCode, responseBody) {
+		super(`Kubernetes API ${method} ${path} returned ${String(statusCode)}`);
+		this.method = method;
+		this.path = path;
+		this.statusCode = statusCode;
+		this.immutable = statusCode === 422 && /immutable|may not change|updates? to [\s\S]*spec[\s\S]*forbidden/i.test(responseBody);
+	}
+};
+const connectCluster = Effect.fn(function* (cluster) {
+	const connection = toConnection(cluster);
+	return {
+		connection,
+		transport: yield* (yield* findClusterAdapter(connection.auth.kind)).connect(connection)
+	};
+});
+const requestJson = Effect.fn(function* ({ transport, method, path, body, timeoutMs = 3e4, contentType }) {
+	const headers = yield* transport.headers;
+	const url = new URL(path, transport.endpoint);
+	if (url.protocol !== "http:" && url.protocol !== "https:") return yield* Effect.fail(/* @__PURE__ */ new Error(`Unsupported Kubernetes API protocol: ${url.protocol}`));
+	if (url.protocol === "http:" && ![
+		"127.0.0.1",
+		"::1",
+		"localhost"
+	].includes(url.hostname)) return yield* Effect.fail(/* @__PURE__ */ new Error("Refusing to send Kubernetes credentials over remote HTTP"));
+	const payload = body === void 0 ? void 0 : JSON.stringify(body);
+	return yield* Effect.tryPromise({
+		try: () => new Promise((resolve, reject) => {
+			const request$2 = (url.protocol === "https:" ? request$1 : request)({
+				protocol: url.protocol,
+				hostname: url.hostname,
+				port: url.port || void 0,
+				path: `${url.pathname}${url.search}`,
+				method,
+				headers: {
+					...headers,
+					Accept: "application/json",
+					...payload === void 0 ? {} : {
+						"Content-Type": contentType ?? "application/json",
+						"Content-Length": Buffer.byteLength(payload)
+					}
+				},
+				...url.protocol === "https:" && transport.certificateAuthorityData !== void 0 ? { ca: Buffer.from(transport.certificateAuthorityData, "base64").toString("utf8") } : {},
+				...url.protocol === "https:" && transport.clientCert !== void 0 ? {
+					cert: transport.clientCert.certificate,
+					key: transport.clientCert.key
+				} : {},
+				...url.protocol === "https:" && transport.insecureSkipTlsVerify ? { rejectUnauthorized: false } : {}
+			}, (response) => {
+				const chunks = [];
+				response.on("data", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+				response.on("end", () => {
+					const responseBody = Buffer.concat(chunks).toString("utf8");
+					const statusCode = response.statusCode ?? 500;
+					if (statusCode < 200 || statusCode >= 300) {
+						reject(new KubernetesApiError(method, path, statusCode, responseBody));
+						return;
+					}
+					if (responseBody.trim().length === 0) {
+						resolve(void 0);
+						return;
+					}
+					try {
+						resolve(JSON.parse(responseBody));
+					} catch {
+						reject(/* @__PURE__ */ new Error("Kubernetes API returned invalid JSON"));
+					}
+				});
+			});
+			request$2.setTimeout(timeoutMs, () => request$2.destroy(/* @__PURE__ */ new Error("Kubernetes API request timed out")));
+			request$2.on("error", reject);
+			if (payload !== void 0) request$2.write(payload);
+			request$2.end();
+		}),
+		catch: (error) => error instanceof KubernetesApiError ? error : /* @__PURE__ */ new Error("Kubernetes API request failed")
+	});
+});
+const discoveredKinds = /* @__PURE__ */ new Map();
+const resolveKind = Effect.fn(function* ({ transport, ref }) {
+	const cacheKey = `${transport.endpoint}|${ref.apiVersion}|${ref.kind}`;
+	const cached = discoveredKinds.get(cacheKey);
+	if (cached !== void 0) return cached;
+	const path = ref.apiVersion.includes("/") ? `/apis/${ref.apiVersion}` : `/api/${ref.apiVersion}`;
+	const resource = (yield* requestJson({
+		transport,
+		method: "GET",
+		path
+	})).resources?.find((candidate) => candidate.kind === ref.kind && candidate.name !== void 0 && !candidate.name.includes("/"));
+	if (resource?.name === void 0) return yield* Effect.fail(new KubernetesApiError("GET", path, 404, `Kind ${ref.kind} was not found`));
+	const result = {
+		plural: resource.name,
+		namespaced: resource.namespaced === true
+	};
+	discoveredKinds.set(cacheKey, result);
+	return result;
+});
+const objectPath = Effect.fn(function* ({ transport, ref, collection = false }) {
+	const kind = yield* resolveKind({
+		transport,
+		ref
+	});
+	const root = ref.apiVersion.includes("/") ? `/apis/${ref.apiVersion}` : `/api/${ref.apiVersion}`;
+	if (kind.namespaced && ref.namespace === void 0) return yield* Effect.fail(/* @__PURE__ */ new Error(`${ref.apiVersion}/${ref.kind} ${ref.name} requires metadata.namespace`));
+	return `${root}${kind.namespaced ? `/namespaces/${encodeURIComponent(ref.namespace)}` : ""}/${kind.plural}${collection ? "" : `/${encodeURIComponent(ref.name)}`}`;
+});
+const readObject = Effect.fn(function* ({ transport, ref }) {
+	return yield* requestJson({
+		transport,
+		method: "GET",
+		path: yield* objectPath({
+			transport,
+			ref
+		})
+	});
+});
+const applyObject = Effect.fn(function* ({ transport, object, fieldManager, forceConflicts, dryRun = false }) {
+	const ref = {
+		apiVersion: object.apiVersion,
+		kind: object.kind,
+		name: object.metadata.name,
+		namespace: object.metadata.namespace
+	};
+	const query = new URLSearchParams({ fieldManager });
+	if (forceConflicts) query.set("force", "true");
+	if (dryRun) query.set("dryRun", "All");
+	return yield* requestJson({
+		transport,
+		method: "PATCH",
+		path: `${yield* objectPath({
+			transport,
+			ref
+		})}?${query.toString()}`,
+		body: object,
+		contentType: "application/apply-patch+yaml"
+	});
+});
+const deleteObject = Effect.fn(function* ({ transport, ref, uid, propagationPolicy }) {
+	return yield* requestJson({
+		transport,
+		method: "DELETE",
+		path: yield* objectPath({
+			transport,
+			ref
+		}),
+		body: {
+			apiVersion: "v1",
+			kind: "DeleteOptions",
+			propagationPolicy,
+			...uid === void 0 ? {} : { preconditions: { uid } }
+		}
+	}).pipe(Effect.catchIf((error) => error instanceof KubernetesApiError && error.statusCode === 404, () => Effect.void));
+});
+const watchObject = Effect.fn(function* ({ transport, ref, resourceVersion, timeoutSeconds, accept }) {
+	const headers = yield* transport.headers;
+	const basePath = yield* objectPath({
+		transport,
+		ref,
+		collection: true
+	});
+	const query = new URLSearchParams({
+		watch: "true",
+		allowWatchBookmarks: "true",
+		fieldSelector: `metadata.name=${ref.name}`,
+		timeoutSeconds: String(Math.max(1, Math.ceil(timeoutSeconds)))
+	});
+	if (resourceVersion !== void 0) query.set("resourceVersion", resourceVersion);
+	const url = new URL(`${basePath}?${query.toString()}`, transport.endpoint);
+	return yield* Effect.tryPromise({
+		try: () => new Promise((resolve, reject) => {
+			const request$3 = (url.protocol === "https:" ? request$1 : request)({
+				protocol: url.protocol,
+				hostname: url.hostname,
+				port: url.port || void 0,
+				path: `${url.pathname}${url.search}`,
+				method: "GET",
+				headers: {
+					...headers,
+					Accept: "application/json"
+				},
+				...url.protocol === "https:" && transport.certificateAuthorityData !== void 0 ? { ca: Buffer.from(transport.certificateAuthorityData, "base64").toString("utf8") } : {},
+				...url.protocol === "https:" && transport.clientCert !== void 0 ? {
+					cert: transport.clientCert.certificate,
+					key: transport.clientCert.key
+				} : {},
+				...url.protocol === "https:" && transport.insecureSkipTlsVerify ? { rejectUnauthorized: false } : {}
+			}, (response) => {
+				const statusCode = response.statusCode ?? 500;
+				if (statusCode < 200 || statusCode >= 300) {
+					response.resume();
+					reject(new KubernetesApiError("GET", basePath, statusCode, ""));
+					return;
+				}
+				let buffer = "";
+				let settled = false;
+				response.setEncoding("utf8");
+				response.on("data", (chunk) => {
+					buffer += chunk;
+					const lines = buffer.split("\n");
+					buffer = lines.pop() ?? "";
+					for (const line of lines) {
+						if (line.trim().length === 0) continue;
+						const event = JSON.parse(line);
+						if (event.type === "ERROR" && event.object?.code === 410) {
+							settled = true;
+							request$3.destroy();
+							reject(new KubernetesApiError("GET", basePath, 410, ""));
+							return;
+						}
+						if (event.type === "BOOKMARK") continue;
+						if (accept(event.type === "DELETED" ? void 0 : event.object)) {
+							settled = true;
+							request$3.destroy();
+							resolve(true);
+							return;
+						}
+					}
+				});
+				response.on("end", () => {
+					if (!settled) resolve(false);
+				});
+			});
+			request$3.setTimeout((timeoutSeconds + 2) * 1e3, () => {
+				request$3.destroy();
+				resolve(false);
+			});
+			request$3.on("error", (error) => {
+				if (error.code === "ECONNRESET") resolve(false);
+				else reject(error);
+			});
+			request$3.end();
+		}),
+		catch: (error) => error instanceof KubernetesApiError ? error : /* @__PURE__ */ new Error("Kubernetes API watch failed")
+	});
+});
+//#endregion
+//#region src/providers.ts
+var Providers = class extends Provider.ProviderCollection()("KubernetesApi") {};
+//#endregion
+//#region src/readiness.ts
+const conditionsOf = (object) => {
+	const status = object.status;
+	return Array.isArray(status?.conditions) ? status.conditions : [];
+};
+const count = (value) => typeof value === "number" && Number.isFinite(value) ? value : 0;
+const conditionSummary = (conditions) => conditions.filter(({ type }) => type !== void 0).map(({ type, status, reason }) => `${type}=${status ?? "Unknown"}${reason === void 0 ? "" : `(${reason})`}`).join(", ") || "none";
+const jsonPathValue = (object, expression) => {
+	const path = expression.trim().replace(/^\{?\$?\.?/, "").replace(/\}?$/, "");
+	if (path.length === 0) return object;
+	const segments = path.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
+	let current = object;
+	for (const segment of segments) {
+		if (typeof current !== "object" || current === null) return void 0;
+		current = current[segment];
+	}
+	return current;
+};
+const kubernetesObjectReadiness = (object, waitFor) => {
+	const conditions = conditionsOf(object);
+	const summary = conditionSummary(conditions);
+	if (typeof object.metadata?.name !== "string" || typeof object.metadata?.uid !== "string") return {
+		ready: false,
+		terminal: false,
+		detail: "waiting for a complete observed object"
+	};
+	if (waitFor !== void 0) {
+		if ("condition" in waitFor) {
+			const expected = waitFor.status ?? "True";
+			return {
+				ready: conditions.some(({ type, status }) => type === waitFor.condition && status === expected),
+				terminal: false,
+				detail: `waiting for condition ${waitFor.condition}=${expected}; conditions: ${summary}`
+			};
+		}
+		const actual = jsonPathValue(object, waitFor.jsonPath);
+		return {
+			ready: JSON.stringify(actual) === JSON.stringify(waitFor.equals),
+			terminal: false,
+			detail: `waiting for ${waitFor.jsonPath}=${JSON.stringify(waitFor.equals)}; current=${JSON.stringify(actual)}`
+		};
+	}
+	const metadata = object.metadata;
+	const generation = count(metadata.generation);
+	const spec = object.spec;
+	const status = object.status;
+	const observed = count(status?.observedGeneration);
+	switch (object.kind) {
+		case "Namespace": return {
+			ready: status?.phase === "Active",
+			terminal: status?.phase === "Terminating",
+			detail: `phase=${String(status?.phase ?? "Pending")}`
+		};
+		case "CustomResourceDefinition": return {
+			ready: conditions.some(({ type, status: conditionStatus }) => type === "Established" && conditionStatus === "True"),
+			terminal: conditions.some(({ type, status: conditionStatus }) => type === "NamesAccepted" && conditionStatus === "False"),
+			detail: `conditions: ${summary}`
+		};
+		case "Pod": return {
+			ready: conditions.some(({ type, status: conditionStatus }) => type === "Ready" && conditionStatus === "True"),
+			terminal: status?.phase === "Failed",
+			detail: `phase=${String(status?.phase ?? "Pending")}, conditions: ${summary}`
+		};
+		case "Deployment": {
+			const desired = spec?.replicas === void 0 ? 1 : count(spec.replicas);
+			const available = count(status?.availableReplicas);
+			return {
+				ready: observed >= generation && available >= desired,
+				terminal: conditions.some(({ type, status: conditionStatus, reason }) => type === "Progressing" && conditionStatus === "False" && reason === "ProgressDeadlineExceeded"),
+				detail: `observedGeneration=${String(observed)}/${String(generation)}, availableReplicas=${String(available)}/${String(desired)}, conditions: ${summary}`
+			};
+		}
+		case "StatefulSet": {
+			const desired = spec?.replicas === void 0 ? 1 : count(spec.replicas);
+			const ready = count(status?.readyReplicas);
+			return {
+				ready: observed >= generation && ready >= desired,
+				terminal: false,
+				detail: `observedGeneration=${String(observed)}/${String(generation)}, readyReplicas=${String(ready)}/${String(desired)}, conditions: ${summary}`
+			};
+		}
+		case "DaemonSet": {
+			const desired = count(status?.desiredNumberScheduled);
+			const available = count(status?.numberAvailable);
+			return {
+				ready: observed >= generation && available >= desired,
+				terminal: false,
+				detail: `observedGeneration=${String(observed)}/${String(generation)}, numberAvailable=${String(available)}/${String(desired)}, conditions: ${summary}`
+			};
+		}
+		case "Job": return {
+			ready: conditions.some(({ type, status: conditionStatus }) => (type === "Complete" || type === "SuccessCriteriaMet") && conditionStatus === "True"),
+			terminal: conditions.some(({ type, status: conditionStatus }) => (type === "Failed" || type === "FailureTarget") && conditionStatus === "True"),
+			detail: `conditions: ${summary}`
+		};
+		case "PersistentVolumeClaim": return {
+			ready: status?.phase === "Bound",
+			terminal: status?.phase === "Lost",
+			detail: `phase=${String(status?.phase ?? "Pending")}`
+		};
+		case "Service": {
+			if (spec?.type !== "LoadBalancer") return {
+				ready: true,
+				terminal: false,
+				detail: "service accepted"
+			};
+			const loadBalancer = status?.loadBalancer;
+			return {
+				ready: (loadBalancer?.ingress?.length ?? 0) > 0,
+				terminal: false,
+				detail: `loadBalancer.ingress=${String(loadBalancer?.ingress?.length ?? 0)}`
+			};
+		}
+		case "Ingress": {
+			const loadBalancer = status?.loadBalancer;
+			return {
+				ready: (loadBalancer?.ingress?.length ?? 0) > 0,
+				terminal: false,
+				detail: `loadBalancer.ingress=${String(loadBalancer?.ingress?.length ?? 0)}`
+			};
+		}
+		default: return {
+			ready: true,
+			terminal: false,
+			detail: "object accepted"
+		};
+	}
+};
+var KubernetesReadinessError = class extends Error {
+	ref;
+	timedOut;
+	name = "KubernetesReadinessError";
+	constructor(message, ref, timedOut) {
+		super(message);
+		this.ref = ref;
+		this.timedOut = timedOut;
+	}
+};
+const label = (ref) => `${ref.apiVersion}/${ref.kind} ${ref.namespace === void 0 ? "" : `${ref.namespace}/`}${ref.name}`;
+const waitForObjectReady = Effect.fn(function* ({ transport, ref, timeoutSeconds, waitFor }) {
+	if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) return yield* Effect.fail(/* @__PURE__ */ new Error("Kubernetes timeoutSeconds must be greater than zero"));
+	const deadline = Date.now() + timeoutSeconds * 1e3;
+	let lastDetail = "object not found";
+	while (Date.now() < deadline) {
+		let observed = yield* readObject({
+			transport,
+			ref
+		}).pipe(Effect.catchIf((error) => error instanceof KubernetesApiError && error.statusCode === 404, () => Effect.succeed(void 0)));
+		if (observed !== void 0) {
+			const readiness = kubernetesObjectReadiness(observed, waitFor);
+			lastDetail = readiness.detail;
+			if (readiness.ready) return observed;
+			if (readiness.terminal) return yield* Effect.fail(new KubernetesReadinessError(`${label(ref)} reached a terminal state: ${readiness.detail}`, ref, false));
+		}
+		const remainingSeconds = Math.max(1, (deadline - Date.now()) / 1e3);
+		if ((yield* watchObject({
+			transport,
+			ref,
+			...observed?.metadata.resourceVersion === void 0 ? {} : { resourceVersion: observed.metadata.resourceVersion },
+			timeoutSeconds: Math.min(15, remainingSeconds),
+			accept: (candidate) => {
+				observed = candidate;
+				if (candidate === void 0) return false;
+				const readiness = kubernetesObjectReadiness(candidate, waitFor);
+				lastDetail = readiness.detail;
+				return readiness.ready || readiness.terminal;
+			}
+		}).pipe(Effect.catchIf((error) => error instanceof KubernetesApiError && error.statusCode === 410, () => Effect.succeed(false)))) && observed !== void 0) {
+			const readiness = kubernetesObjectReadiness(observed, waitFor);
+			if (readiness.ready) return observed;
+			if (readiness.terminal) return yield* Effect.fail(new KubernetesReadinessError(`${label(ref)} reached a terminal state: ${readiness.detail}`, ref, false));
+		}
+		if (Date.now() < deadline) yield* Effect.sleep(Duration.millis(250));
+	}
+	return yield* Effect.fail(new KubernetesReadinessError(`Timed out waiting for ${label(ref)}: ${lastDetail}`, ref, true));
+});
+const waitForObjectDeleted = Effect.fn(function* ({ transport, ref, uid, timeoutSeconds }) {
+	const deadline = Date.now() + timeoutSeconds * 1e3;
+	let finalizers = [];
+	while (Date.now() < deadline) {
+		let observed = yield* readObject({
+			transport,
+			ref
+		}).pipe(Effect.catchIf((error) => error instanceof KubernetesApiError && error.statusCode === 404, () => Effect.succeed(void 0)));
+		if (observed === void 0) return;
+		if (uid !== void 0 && observed.metadata.uid !== uid) return yield* Effect.fail(/* @__PURE__ */ new Error(`Refusing to treat ${label(ref)} as deleted: UID changed from ${uid} to ${String(observed.metadata.uid)}`));
+		finalizers = observed.metadata.finalizers ?? [];
+		const remainingSeconds = Math.max(1, (deadline - Date.now()) / 1e3);
+		if ((yield* watchObject({
+			transport,
+			ref,
+			...observed.metadata.resourceVersion === void 0 ? {} : { resourceVersion: observed.metadata.resourceVersion },
+			timeoutSeconds: Math.min(15, remainingSeconds),
+			accept: (candidate) => {
+				observed = candidate;
+				return candidate === void 0;
+			}
+		}).pipe(Effect.catchIf((error) => error instanceof KubernetesApiError && error.statusCode === 410, () => Effect.succeed(false)))) || observed === void 0) return;
+	}
+	return yield* Effect.fail(new KubernetesReadinessError(`Timed out deleting ${label(ref)}${finalizers.length === 0 ? "" : `; blocking finalizers: ${finalizers.join(", ")}`}`, ref, true));
+});
+//#endregion
+//#region src/provider.ts
+const FQN_ANNOTATION = "alchemy.run/fqn";
+const INSTANCE_ANNOTATION = "alchemy.run/instance-id";
+const serverMetadata = /* @__PURE__ */ new Set([
+	"uid",
+	"resourceVersion",
+	"generation",
+	"creationTimestamp",
+	"deletionTimestamp",
+	"deletionGracePeriodSeconds",
+	"managedFields",
+	"selfLink"
+]);
+const connectionIdentity = (cluster) => {
+	const connection = Kubernetes.toConnection(cluster);
+	const auth = connection.auth;
+	return JSON.stringify({
+		endpoint: connection.endpoint,
+		certificateAuthorityData: connection.certificateAuthorityData,
+		insecureSkipTlsVerify: connection.insecureSkipTlsVerify,
+		auth: Object.fromEntries(Object.entries(auth).map(([key, value]) => [key, [
+			"token",
+			"key",
+			"certificate",
+			"env"
+		].includes(key) ? "<credential>" : value]))
+	});
+};
+const refOf = (object) => ({
+	apiVersion: object.apiVersion,
+	kind: object.kind,
+	name: object.metadata.name,
+	namespace: object.metadata.namespace
+});
+const fieldManagerOf = (fqn, requested) => {
+	const manager = requested ?? `alchemy-${createHash("sha256").update(fqn).digest("hex").slice(0, 20)}`;
+	if (manager.length === 0 || manager.length > 128) throw new Error("Kubernetes fieldManager must contain 1 to 128 characters");
+	return manager;
+};
+const desiredObject = ({ props, fqn, instanceId }) => {
+	if (props.manifest.kind === "Secret") throw new Error("Kubernetes Secret is intentionally unavailable through KubernetesApi.Object; use KubernetesAddons.Secret so values never enter plans or live attributes");
+	if (typeof props.manifest.apiVersion !== "string" || props.manifest.apiVersion.length === 0 || typeof props.manifest.kind !== "string" || props.manifest.kind.length === 0 || typeof props.manifest.metadata?.name !== "string" || props.manifest.metadata.name.length === 0) throw new Error("Kubernetes objects require apiVersion, kind, and metadata.name");
+	const metadata = Object.fromEntries(Object.entries(props.manifest.metadata).filter(([key]) => !serverMetadata.has(key)));
+	if ((props.mode ?? "object") === "object") metadata.annotations = {
+		...metadata.annotations ?? {},
+		[FQN_ANNOTATION]: fqn,
+		[INSTANCE_ANNOTATION]: instanceId
+	};
+	return {
+		...Object.fromEntries(Object.entries(props.manifest).filter(([key]) => key !== "status" && key !== "metadata")),
+		metadata
+	};
+};
+const sanitizeObservedObject = (object) => {
+	const metadata = Object.fromEntries(Object.entries(object.metadata).filter(([key]) => key !== "managedFields"));
+	return {
+		...object,
+		metadata
+	};
+};
+const attributesOf = ({ connection, object, mode }) => {
+	const live = sanitizeObservedObject(object);
+	const ref = refOf(live);
+	return {
+		connection,
+		ref,
+		apiVersion: ref.apiVersion,
+		kind: ref.kind,
+		name: ref.name,
+		namespace: ref.namespace,
+		uid: live.metadata.uid,
+		resourceVersion: live.metadata.resourceVersion,
+		generation: live.metadata.generation,
+		metadata: live.metadata,
+		spec: live.spec,
+		status: live.status,
+		live,
+		mode
+	};
+};
+const mergeKey = (value) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
+	const item = value;
+	for (const key of [
+		"name",
+		"key",
+		"port",
+		"containerPort",
+		"mountPath",
+		"type",
+		"topologyKey"
+	]) if ([
+		"string",
+		"number",
+		"boolean"
+	].includes(typeof item[key])) return `${key}:${String(item[key])}`;
+};
+const desiredProjection = (desired, observed) => {
+	if (Array.isArray(desired)) {
+		if (!Array.isArray(observed)) return observed;
+		return desired.map((item, index) => {
+			const key = mergeKey(item);
+			const candidate = key === void 0 ? observed[index] : observed.find((observedItem) => mergeKey(observedItem) === key);
+			return desiredProjection(item, candidate);
+		});
+	}
+	if (typeof desired === "object" && desired !== null) {
+		if (typeof observed !== "object" || observed === null) return observed;
+		return Object.fromEntries(Object.entries(desired).map(([key, value]) => [key, desiredProjection(value, observed[key])]));
+	}
+	return observed;
+};
+const equalJson = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const valueAtPath = (value, path) => {
+	const segments = path.replace(/^\$?\.?/, "").replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
+	let current = value;
+	for (const segment of segments) {
+		if (typeof current !== "object" || current === null) return void 0;
+		current = current[segment];
+	}
+	return current;
+};
+const isNotFound = (error) => error instanceof KubernetesApiError && error.statusCode === 404;
+const ObjectProvider = () => Provider.succeed(ObjectResource, {
+	stables: [
+		"connection",
+		"apiVersion",
+		"kind",
+		"name",
+		"namespace",
+		"ref"
+	],
+	nuke: { skip: true },
+	read: ({ fqn, instanceId, olds, output }) => Effect.gen(function* () {
+		const cluster = output?.connection ?? olds.cluster;
+		const connected = yield* connectCluster(cluster).pipe(Effect.catchIf((error) => error instanceof Kubernetes.ClusterNotFoundError, () => Effect.succeed(void 0)));
+		if (connected === void 0) return void 0;
+		const desired = desiredObject({
+			props: olds,
+			fqn,
+			instanceId
+		});
+		const ref = output?.ref ?? refOf(desired);
+		const observed = yield* readObject({
+			transport: connected.transport,
+			ref
+		}).pipe(Effect.catchIf(isNotFound, () => Effect.succeed(void 0)));
+		if (observed === void 0) return void 0;
+		const mode = olds.mode ?? output?.mode ?? "object";
+		const attributes = attributesOf({
+			connection: connected.connection,
+			object: observed,
+			mode
+		});
+		if (mode === "patch") return attributes;
+		const annotations = observed.metadata.annotations ?? {};
+		return annotations["alchemy.run/fqn"] === fqn && annotations["alchemy.run/instance-id"] === instanceId ? attributes : Unowned(attributes);
+	}),
+	diff: ({ fqn, instanceId, olds, news, output }) => Effect.gen(function* () {
+		if (!isResolved(news)) return void 0;
+		const oldDesired = desiredObject({
+			props: olds,
+			fqn,
+			instanceId
+		});
+		const nextDesired = desiredObject({
+			props: news,
+			fqn,
+			instanceId
+		});
+		const oldRef = refOf(oldDesired);
+		const nextRef = refOf(nextDesired);
+		if (connectionIdentity(olds.cluster) !== connectionIdentity(news.cluster) || !equalJson(oldRef, nextRef)) return {
+			action: "replace",
+			deleteFirst: connectionIdentity(olds.cluster) === connectionIdentity(news.cluster) && oldRef.apiVersion === nextRef.apiVersion && oldRef.kind === nextRef.kind && oldRef.name === nextRef.name && oldRef.namespace === nextRef.namespace
+		};
+		for (const path of news.replaceOnChanges ?? []) if (!equalJson(valueAtPath(oldDesired, path), valueAtPath(nextDesired, path))) return {
+			action: "replace",
+			deleteFirst: true
+		};
+		const connected = output === void 0 ? void 0 : yield* connectCluster(news.cluster);
+		const live = connected === void 0 ? void 0 : yield* readObject({
+			transport: connected.transport,
+			ref: nextRef
+		}).pipe(Effect.catchIf(isNotFound, () => Effect.succeed(void 0)));
+		const persistedAnnotations = output?.live.metadata.annotations ?? {};
+		const takingOwnership = output !== void 0 && (news.mode ?? "object") === "object" && (persistedAnnotations["alchemy.run/fqn"] !== fqn || persistedAnnotations["alchemy.run/instance-id"] !== instanceId);
+		if (live !== void 0 && (news.mode ?? "object") === "object" && !takingOwnership) {
+			const liveAnnotations = live.metadata.annotations ?? {};
+			if (output?.uid !== void 0 && live.metadata.uid !== output.uid || liveAnnotations["alchemy.run/fqn"] !== fqn || liveAnnotations["alchemy.run/instance-id"] !== instanceId) return yield* Effect.fail(/* @__PURE__ */ new Error(`Kubernetes object ${nextRef.apiVersion}/${nextRef.kind} ${nextRef.namespace ?? "_cluster"}/${nextRef.name} no longer has this resource's UID and ownership annotations; refusing to mutate a replacement object`));
+		}
+		const desiredChanged = !equalJson(oldDesired, nextDesired);
+		const objectDrifted = live === void 0 || !equalJson(nextDesired, desiredProjection(nextDesired, live));
+		const lifecycleChanged = !equalJson({
+			fieldManager: olds.fieldManager,
+			forceConflicts: olds.forceConflicts,
+			skipAwait: olds.skipAwait,
+			timeoutSeconds: olds.timeoutSeconds,
+			waitFor: olds.waitFor,
+			deletionPropagation: olds.deletionPropagation,
+			mode: olds.mode
+		}, {
+			fieldManager: news.fieldManager,
+			forceConflicts: news.forceConflicts,
+			skipAwait: news.skipAwait,
+			timeoutSeconds: news.timeoutSeconds,
+			waitFor: news.waitFor,
+			deletionPropagation: news.deletionPropagation,
+			mode: news.mode
+		});
+		if (!desiredChanged && !objectDrifted && !lifecycleChanged) return { action: "noop" };
+		if (output !== void 0 && (desiredChanged || objectDrifted)) {
+			const dryRun = yield* applyObject({
+				transport: connected.transport,
+				object: nextDesired,
+				fieldManager: fieldManagerOf(fqn, news.fieldManager),
+				forceConflicts: news.forceConflicts ?? takingOwnership,
+				dryRun: true
+			}).pipe(Effect.result);
+			if (dryRun._tag === "Failure") {
+				const error = dryRun.failure;
+				if (error instanceof KubernetesApiError && error.immutable) return {
+					action: "replace",
+					deleteFirst: true
+				};
+				if (error instanceof KubernetesApiError && error.statusCode === 409) return yield* Effect.fail(/* @__PURE__ */ new Error(`Kubernetes field ownership conflict for ${nextRef.apiVersion}/${nextRef.kind} ${nextRef.namespace ?? "_cluster"}/${nextRef.name}; set forceConflicts only when this stack should take those fields`));
+				return yield* Effect.fail(error);
+			}
+		}
+		return { action: "update" };
+	}),
+	reconcile: ({ fqn, instanceId, news, olds, output, session }) => Effect.gen(function* () {
+		const connected = yield* connectCluster(news.cluster);
+		const desired = desiredObject({
+			props: news,
+			fqn,
+			instanceId
+		});
+		let applied = yield* applyObject({
+			transport: connected.transport,
+			object: desired,
+			fieldManager: fieldManagerOf(fqn, news.fieldManager),
+			forceConflicts: news.forceConflicts ?? (olds === void 0 && output !== void 0)
+		});
+		const ref = refOf(applied);
+		if (!(news.skipAwait ?? false)) applied = yield* waitForObjectReady({
+			transport: connected.transport,
+			ref,
+			timeoutSeconds: news.timeoutSeconds ?? 300,
+			...news.waitFor === void 0 ? {} : { waitFor: news.waitFor }
+		});
+		yield* session.note(`Applied ${ref.apiVersion}/${ref.kind} ${ref.namespace === void 0 ? "" : `${ref.namespace}/`}${ref.name}`);
+		return attributesOf({
+			connection: connected.connection,
+			object: applied,
+			mode: news.mode ?? "object"
+		});
+	}),
+	delete: ({ olds, output, session }) => Effect.gen(function* () {
+		if (output.mode === "patch" || olds.mode === "patch") return;
+		const connected = yield* connectCluster(output.connection).pipe(Effect.catchIf((error) => error instanceof Kubernetes.ClusterNotFoundError, () => Effect.succeed(void 0)));
+		if (connected === void 0) return;
+		const observed = yield* readObject({
+			transport: connected.transport,
+			ref: output.ref
+		}).pipe(Effect.catchIf(isNotFound, () => Effect.succeed(void 0)));
+		if (observed === void 0) return;
+		if (output.uid !== void 0 && observed.metadata.uid !== output.uid) return yield* Effect.fail(/* @__PURE__ */ new Error(`Refusing to delete ${output.apiVersion}/${output.kind} ${output.namespace ?? "_cluster"}/${output.name}: expected UID ${output.uid}, found ${String(observed.metadata.uid)}`));
+		yield* deleteObject({
+			transport: connected.transport,
+			ref: output.ref,
+			...output.uid === void 0 ? {} : { uid: output.uid },
+			propagationPolicy: olds.deletionPropagation ?? "Foreground"
+		});
+		yield* waitForObjectDeleted({
+			transport: connected.transport,
+			ref: output.ref,
+			...output.uid === void 0 ? {} : { uid: output.uid },
+			timeoutSeconds: olds.timeoutSeconds ?? 300
+		});
+		yield* session.note(`Deleted ${output.apiVersion}/${output.kind} ${output.namespace === void 0 ? "" : `${output.namespace}/`}${output.name}`);
+	})
+});
+const providers = () => Layer.effect(Providers, Provider.collection([ObjectResource])).pipe(Layer.provide(ObjectProvider()), Layer.provideMerge(RandomProvider()));
+//#endregion
+//#region src/yaml.ts
+const clusterScopedKinds = /* @__PURE__ */ new Set([
+	"CustomResourceDefinition",
+	"Namespace",
+	"Node",
+	"PersistentVolume",
+	"ClusterRole",
+	"ClusterRoleBinding",
+	"IngressClass",
+	"StorageClass",
+	"CSIDriver",
+	"CSINode",
+	"VolumeAttachment",
+	"VolumeAttributesClass"
+]);
+const applyRank = (object) => {
+	if (object.kind === "Namespace") return 10;
+	if (object.kind === "CustomResourceDefinition") return 20;
+	if ([
+		"ServiceAccount",
+		"ClusterRole",
+		"Role"
+	].includes(object.kind)) return 30;
+	if (["ClusterRoleBinding", "RoleBinding"].includes(object.kind)) return 40;
+	if ([
+		"ConfigMap",
+		"Service",
+		"PersistentVolumeClaim"
+	].includes(object.kind)) return 50;
+	return 100;
+};
+const parseKubernetesYaml = (source) => parseAllDocuments(source).flatMap((document) => {
+	if (document.errors.length > 0) throw new Error(`Invalid Kubernetes YAML: ${document.errors[0].message}`);
+	const value = document.toJS();
+	if (value === null || value === void 0) return [];
+	if (typeof value !== "object" || Array.isArray(value)) throw new Error("Every Kubernetes YAML document must be an object");
+	const object = value;
+	if (object.kind === "List") {
+		const items = object.items;
+		if (!Array.isArray(items)) throw new Error("Kubernetes List YAML requires an items array");
+		return items;
+	}
+	return [object];
+});
+const normalizeConfigGroupObjects = (props) => {
+	const yamlSources = [...typeof props.yaml === "string" ? [props.yaml] : props.yaml ?? [], ...(props.files ?? []).map((file) => readFileSync(file, "utf8"))];
+	const objects = [...props.objects ?? [], ...yamlSources.flatMap(parseKubernetesYaml)].map((object) => {
+		if (props.defaultNamespace === void 0 || clusterScopedKinds.has(object.kind) || object.metadata?.namespace !== void 0) return object;
+		return {
+			...object,
+			metadata: {
+				...object.metadata,
+				namespace: props.defaultNamespace
+			}
+		};
+	});
+	for (const object of objects) {
+		if (typeof object.apiVersion !== "string" || typeof object.kind !== "string" || typeof object.metadata?.name !== "string") throw new Error("Every ConfigGroup object requires apiVersion, kind, and metadata.name");
+		if (object.kind === "Secret") throw new Error("ConfigGroup refuses Kubernetes Secret documents; use KubernetesAddons.Secret");
+	}
+	return objects.sort((left, right) => applyRank(left) - applyRank(right) || `${left.apiVersion}/${left.kind}/${left.metadata.namespace ?? ""}/${left.metadata.name}`.localeCompare(`${right.apiVersion}/${right.kind}/${right.metadata.namespace ?? ""}/${right.metadata.name}`));
+};
+const ConfigGroup = (id, props) => Effect.gen(function* () {
+	const { cluster, objects, yaml, files, defaultNamespace, dependsOn, ...lifecycle } = props;
+	const normalized = normalizeConfigGroupObjects({
+		...objects === void 0 ? {} : { objects },
+		...yaml === void 0 ? {} : { yaml },
+		...files === void 0 ? {} : { files },
+		...defaultNamespace === void 0 ? {} : { defaultNamespace }
+	});
+	const resources = [];
+	let dependency = dependsOn;
+	const usedIds = /* @__PURE__ */ new Map();
+	for (const object of normalized) {
+		const baseId = `${id}${object.kind}${object.metadata.name}`.replace(/[^A-Za-z0-9_-]/g, "_");
+		const count = usedIds.get(baseId) ?? 0;
+		usedIds.set(baseId, count + 1);
+		const logicalId = count === 0 ? baseId : `${baseId}_${String(count + 1)}`;
+		const resource = yield* Object$1(logicalId, {
+			cluster,
+			manifest: object,
+			...lifecycle,
+			...dependency === void 0 ? {} : { dependsOn: dependency }
+		});
+		resources.push(resource);
+		dependency = resource.resourceVersion;
+	}
+	return {
+		resources,
+		objects: normalized
+	};
+});
+//#endregion
+//#region src/helm.ts
+const helmTemplateArgs = (id, props) => [
+	"template",
+	props.releaseName ?? id.toLowerCase(),
+	props.chart,
+	"--skip-tests",
+	"--namespace",
+	props.namespace ?? "default",
+	...props.includeCrds === false ? [] : ["--include-crds"],
+	...props.repository === void 0 ? [] : ["--repo", props.repository],
+	...props.version === void 0 ? [] : ["--version", props.version],
+	...props.kubeVersion === void 0 ? [] : ["--kube-version", props.kubeVersion],
+	...(props.apiVersions ?? []).flatMap((version) => ["--api-versions", version]),
+	"--values",
+	"-"
+];
+const renderHelmChart = (id, props) => {
+	try {
+		return execFileSync("helm", helmTemplateArgs(id, props), {
+			encoding: "utf8",
+			input: stringify(props.values ?? {}),
+			maxBuffer: 67108864
+		});
+	} catch {
+		throw new Error(`Failed to render Helm chart ${props.chart}; install helm and verify the chart reference`);
+	}
+};
+const HelmChart = (id, props) => {
+	const { cluster, dependsOn, fieldManager, forceConflicts, skipAwait, timeoutSeconds, waitFor, deletionPropagation, replaceOnChanges, ...chart } = props;
+	const rendered = renderHelmChart(id, chart);
+	return ConfigGroup(id, {
+		cluster,
+		yaml: rendered,
+		defaultNamespace: chart.namespace ?? "default",
+		...dependsOn === void 0 ? {} : { dependsOn },
+		...fieldManager === void 0 ? {} : { fieldManager },
+		...forceConflicts === void 0 ? {} : { forceConflicts },
+		...skipAwait === void 0 ? {} : { skipAwait },
+		...timeoutSeconds === void 0 ? {} : { timeoutSeconds },
+		...waitFor === void 0 ? {} : { waitFor },
+		...deletionPropagation === void 0 ? {} : { deletionPropagation },
+		...replaceOnChanges === void 0 ? {} : { replaceOnChanges }
+	});
+};
+//#endregion
+export { ConfigGroup, FQN_ANNOTATION, HelmChart, INSTANCE_ANNOTATION, KubernetesApiError, KubernetesReadinessError, Object$1 as Object, ObjectProvider, ObjectResource, Providers, api, apiextensions, applyObject, apps, autoscaling, batch, connectCluster, core, deleteObject, desiredObject, desiredProjection, helmTemplateArgs, jsonPathValue, kubernetesObjectReadiness, networking, normalizeConfigGroupObjects, objectPath, parseKubernetesYaml, policy, providers, rbac, readObject, renderHelmChart, requestJson, resolveKind, sanitizeObservedObject, storage, watchObject };