typekro 0.13.0 → 0.15.0

package/dist/core/deployment/kro-factory.js

@@ -11,7 +11,6 @@ import { preserveNonEnumerableProperties } from '../../utils/helpers.js';
 import { isKubernetesRef } from '../../utils/type-guards.js';
 import { applyAspects } from '../aspects/apply.js';
 import { createCompositionContext, runWithCompositionContext } from '../composition/context.js';
-import { hasContainerImageRefs, resolveContainerImages } from '../containers/index.js';
 import { buildNestedCompositionAliasTargets } from '../composition/nested-status-cel.js';
 import { DEFAULT_DEPLOYMENT_TIMEOUT, DEFAULT_KRO_INSTANCE_TIMEOUT, DEFAULT_RGD_TIMEOUT, } from '../config/defaults.js';
 import { CEL_EXPRESSION_BRAND, KUBERNETES_REF_SCHEMA_MARKER_SOURCE } from '../constants/brands.js';
@@ -19,6 +18,7 @@ import { CRDInstanceError, ensureError, ResourceGraphFactoryError, TypeKroError,
 import { applyAnalysisToResources } from '../expressions/composition/composition-analyzer.js';
 import { createBunCompatibleKubernetesObjectApi } from '../kubernetes/index.js';
 import { getComponentLogger } from '../logging/index.js';
+import { createAlchemyResourceId } from '../../alchemy/utilities.js';
 // Dependency inversion: kroCustomResource, resourceGraphDefinition, and
 // alchemy bridge are injected via FactoryOptions providers (Phase 3.5)
 // instead of dynamic import() from higher layers.
@@ -33,7 +33,7 @@ import { DirectDeploymentEngine } from './engine.js';
 import { logHandleSnapshot } from './handle-tracing.js';
 import { isNotFoundError } from './k8s-helpers.js';
 import { waitForKroInstanceReady as waitForKroInstanceReadyShared } from './kro-readiness.js';
-import { convertToKubernetesName, generateInstanceName, getSingletonInstanceName, pluralizeKind, validateAlchemyScope, validateSpec, } from './shared-utilities.js';
+import { convertToKubernetesName, extractSerializableKubeConfigOptions, generateInstanceName, getSingletonInstanceName, pluralizeKind, validateSpec, } from './shared-utilities.js';
 import { joinYamlDocuments, singletonOwnerInstanceYamls, singletonRgdYamls, } from './singleton-gitops.js';
 import { assertNoDeployedSingletonSpecDrift, singletonSpecFingerprintAnnotationValue, } from './singleton-owner-drift.js';
 /**
@@ -105,14 +105,12 @@ export class KroResourceFactoryImpl {
     mode = 'kro';
     name;
     namespace;
-    isAlchemyManaged;
     rgdName;
     schema;
     resources;
     closures;
     schemaDefinition;
     statusMappings;
-    alchemyScope;
     singletonDefinitions;
     singletonOwnerStatuses = new Map();
     logger = getComponentLogger('kro-factory');
@@ -143,12 +141,9 @@ export class KroResourceFactoryImpl {
     // instead of dynamic import() from factories/ and alchemy/ layers.
     kroCustomResourceProvider;
     rgdProvider;
-    alchemyBridge;
     constructor(name, resources, schemaDefinition, statusMappings, options = {}) {
         this.name = name;
         this.namespace = options.namespace || 'default';
-        this.alchemyScope = options.alchemyScope;
-        this.isAlchemyManaged = !!options.alchemyScope;
         this.rgdName = convertToKubernetesName(name); // Convert to valid Kubernetes resource name
         this.resources = resources;
         this.closures = options.closures || {};
@@ -165,7 +160,6 @@ export class KroResourceFactoryImpl {
         // Injected providers — fall back to dynamic import() for backward compatibility
         this.kroCustomResourceProvider = options.kroCustomResourceProvider;
         this.rgdProvider = options.rgdProvider;
-        this.alchemyBridge = options.alchemyBridge;
         // Validate closures for Kro mode - detect KubernetesRef inputs and raise clear errors
         this.validateClosuresForKroMode();
     }
@@ -397,69 +391,50 @@ export class KroResourceFactoryImpl {
         });
         // Execute closures before RGD creation (Kro mode requirement)
         await this.executeClosuresBeforeRGD(spec);
-        // Resolve any container() image refs to literal URIs (build + push via buildContainer) BEFORE the
-        // RGD is serialized — Kro reconciles in-cluster and can't build images, so it must see a literal.
-        await this.resolveContainerImagesBeforeRGD();
         await this.ensureSingletonOwners(spec);
-        if (this.isAlchemyManaged) {
-            return this.deployWithAlchemy(spec, opts?.instanceNameOverride, opts?.singletonSpecFingerprint);
-        }
-        else {
-            return this.deployDirect(spec, opts?.instanceNameOverride, opts?.singletonSpecFingerprint);
-        }
+        return this.deployDirect(spec, opts?.instanceNameOverride, opts?.singletonSpecFingerprint);
     }
     /**
-     * Build + substitute any `container()` image references in the resource set to literal image URIs,
-     * delegating to `buildContainer` (no duplicated build logic). Runs client-side before RGD
-     * serialization; a no-op when nothing references a container image. Mutates `this.resources` so the
-     * subsequent `buildRgdYaml` serializes literal images (Kro never sees a build).
+     * Discover the singleton-owner definitions this composition depends on (deduped by key): from
+     * re-executing the composition fn under a discovery context, plus any injected definitions.
+     * Shared by {@link ensureSingletonOwners} (imperative deploy) and {@link toAlchemyResources}.
      */
-    async resolveContainerImagesBeforeRGD() {
-        const resources = Object.values(this.resources);
-        if (!hasContainerImageRefs(resources))
-            return;
-        await resolveContainerImages(resources);
-    }
-    async ensureSingletonOwners(spec) {
-        const discoveredSingletons = new Map();
+    discoverSingletonDefinitions(spec) {
+        const discovered = new Map();
         if (this.factoryOptions.compositionFn) {
-            const singletonContext = createCompositionContext('singleton-owner-discovery');
-            runWithCompositionContext(singletonContext, () => {
+            const ctx = createCompositionContext('singleton-owner-discovery');
+            runWithCompositionContext(ctx, () => {
                 this.factoryOptions.compositionFn?.(spec);
             });
-            for (const [key, definition] of singletonContext.singletonDefinitions ?? []) {
-                discoveredSingletons.set(key, definition);
+            for (const [key, definition] of ctx.singletonDefinitions ?? []) {
+                discovered.set(key, definition);
             }
         }
         for (const definition of this.singletonDefinitions) {
-            if (!discoveredSingletons.has(definition.key)) {
-                discoveredSingletons.set(definition.key, definition);
-            }
+            if (!discovered.has(definition.key))
+                discovered.set(definition.key, definition);
         }
-        if (discoveredSingletons.size === 0)
-            return;
-        const singletonRecords = new Map();
-        for (const definition of discoveredSingletons.values()) {
-            if (!singletonRecords.has(definition.key)) {
-                singletonRecords.set(definition.key, definition);
-            }
-        }
-        for (const definition of singletonRecords.values()) {
+        return Array.from(discovered.values());
+    }
+    /** Build the KRO factory that owns a singleton's RGD + instance (its registry namespace). */
+    singletonFactoryFor(definition) {
+        return definition.composition.factory('kro', {
+            namespace: definition.registryNamespace,
+            waitForReady: true,
+            ...(this.factoryOptions.timeout !== undefined ? { timeout: this.factoryOptions.timeout } : {}),
+            ...(this.factoryOptions.kubeConfig !== undefined
+                ? { kubeConfig: this.factoryOptions.kubeConfig }
+                : {}),
+            ...(this.factoryOptions.skipTLSVerify !== undefined
+                ? { skipTLSVerify: this.factoryOptions.skipTLSVerify }
+                : {}),
+        });
+    }
+    async ensureSingletonOwners(spec) {
+        for (const definition of this.discoverSingletonDefinitions(spec)) {
             await this.ensureTargetNamespace(definition.registryNamespace);
             const singletonInstanceName = getSingletonInstanceName(definition.id);
-            const singletonFactory = definition.composition.factory('kro', {
-                namespace: definition.registryNamespace,
-                waitForReady: true,
-                ...(this.factoryOptions.timeout !== undefined
-                    ? { timeout: this.factoryOptions.timeout }
-                    : {}),
-                ...(this.factoryOptions.kubeConfig !== undefined
-                    ? { kubeConfig: this.factoryOptions.kubeConfig }
-                    : {}),
-                ...(this.factoryOptions.skipTLSVerify !== undefined
-                    ? { skipTLSVerify: this.factoryOptions.skipTLSVerify }
-                    : {}),
-            });
+            const singletonFactory = this.singletonFactoryFor(definition);
             try {
                 this.logger.info('Ensuring singleton owner boundary', {
                     singletonId: definition.id,
@@ -558,7 +533,6 @@ export class KroResourceFactoryImpl {
         const deploymentContext = {
             kubernetesApi: createBunCompatibleKubernetesObjectApi(kubeConfig),
             kubeConfig: kubeConfig,
-            ...(this.alchemyScope && { alchemyScope: this.alchemyScope }),
             namespace: this.namespace,
             deployedResources: new Map(), // Empty for pre-RGD execution
             resolveReference: async (ref) => {
@@ -669,78 +643,6 @@ export class KroResourceFactoryImpl {
             await deploymentEngine.dispose();
         }
     }
-    /**
-     * Deploy using type-safe alchemy resource wrapping
-     *
-     * In alchemy mode, the RGD gets one typed alchemy Resource and each instance gets another
-     */
-    async deployWithAlchemy(spec, instanceNameOverride, singletonSpecFingerprint) {
-        validateAlchemyScope(this.alchemyScope, 'KRO Alchemy deployment');
-        const alchemyScope = this.alchemyScope;
-        // Use static registration functions
-        // Create deployer instance using DirectDeploymentEngine with KRO mode
-        const kroEngine = new DirectDeploymentEngine(this.getKubeConfig(), undefined, undefined, DeploymentMode.KRO);
-        const kubeConfigOptions = this.extractKubeConfigOptionsForAlchemy();
-        const kroDeletion = this.createAlchemyKroDeletionOptions();
-        try {
-            // 1. Ensure RGD is deployed via alchemy (once per factory). Reuse the
-            // normal serializer so externalRef/forEach/includeWhen/readyWhen and
-            // singleton owner boundaries match non-Alchemy KRO deploys.
-            const rgdManifest = yaml.load(this.buildRgdYaml());
-            // Register RGD type dynamically
-            const rgdFactory = this.rgdProvider ??
-                (await import('../../factories/kro/resource-graph-definition.js')).resourceGraphDefinition;
-            const rgdEnhanced = rgdFactory(rgdManifest);
-            const bridge = this.alchemyBridge ?? (await import('../../alchemy/deployment.js'));
-            const RGDProvider = bridge.ensureResourceTypeRegistered(rgdEnhanced);
-            const rgdId = bridge.createAlchemyResourceId(rgdEnhanced, this.namespace);
-            await alchemyScope.run(async () => {
-                await RGDProvider(rgdId, {
-                    resource: rgdEnhanced,
-                    namespace: this.namespace,
-                    deploymentStrategy: 'kro',
-                    kubeConfigOptions,
-                    kroDeletion,
-                    options: {
-                        waitForReady: true,
-                        timeout: DEFAULT_RGD_TIMEOUT, // RGD should be ready quickly
-                    },
-                });
-            });
-            await this.waitForCRDReadyWithEngine(kroEngine);
-            // 2. Create instance via alchemy (once per deploy call)
-            await this.ensureTargetNamespace();
-            const instanceName = instanceNameOverride ?? generateInstanceName(spec, this.name);
-            const crdInstanceManifest = this.createCustomResourceInstance(instanceName, spec, singletonSpecFingerprint);
-            // Register CRD instance type dynamically
-            // Cast required: crdInstanceManifest is a plain KubernetesResource, but alchemy functions
-            // expect Enhanced<unknown, unknown>. They only access kind/metadata.name for type inference.
-            const crdAsEnhanced = crdInstanceManifest;
-            const CRDInstanceProvider = bridge.ensureResourceTypeRegistered(crdAsEnhanced);
-            const instanceId = bridge.createAlchemyResourceId(crdAsEnhanced, this.namespace);
-            await alchemyScope.run(async () => {
-                await CRDInstanceProvider(instanceId, {
-                    resource: crdAsEnhanced,
-                    namespace: this.namespace,
-                    deploymentStrategy: 'kro',
-                    kubeConfigOptions,
-                    kroDeletion,
-                    options: {
-                        waitForReady: false,
-                        timeout: this.factoryOptions.timeout ?? DEFAULT_DEPLOYMENT_TIMEOUT,
-                    },
-                });
-            });
-            if (this.factoryOptions.waitForReady ?? true) {
-                await this.waitForKroInstanceReady(instanceName, this.factoryOptions.timeout || DEFAULT_KRO_INSTANCE_TIMEOUT);
-            }
-            // Create Enhanced proxy for the deployed instance
-            return await this.createEnhancedProxy(spec, instanceName);
-        }
-        finally {
-            await kroEngine.dispose();
-        }
-    }
     /**
      * Get all deployed instances
      */
@@ -985,41 +887,106 @@ export class KroResourceFactoryImpl {
         // KRO's finalizer processing handles deleting all child resources
         // (including Namespaces) via its applyset — no manual cleanup needed.
     }
-    extractKubeConfigOptionsForAlchemy() {
-        const kc = this.getKubeConfig();
-        const cluster = kc.getCurrentCluster();
-        const user = typeof kc.getCurrentUser === 'function' ? kc.getCurrentUser() : undefined;
-        const context = typeof kc.getCurrentContext === 'function' ? kc.getCurrentContext() : undefined;
-        const finalSkipTLS = this.factoryOptions.skipTLSVerify === true ? true : (cluster?.skipTLSVerify ?? false);
-        return {
-            skipTLSVerify: finalSkipTLS,
-            ...(cluster?.server && { server: cluster.server }),
-            ...(context && { context }),
-            ...(cluster && {
-                cluster: {
-                    name: cluster.name,
-                    server: cluster.server,
-                    skipTLSVerify: finalSkipTLS,
-                    ...(cluster.caData && { caData: cluster.caData }),
-                    ...(cluster.caFile && { caFile: cluster.caFile }),
-                },
-            }),
-            ...(user && {
-                user: {
-                    name: user.name,
-                    ...(user.token && { token: user.token }),
-                    ...(user.certData && { certData: user.certData }),
-                    ...(user.certFile && { certFile: user.certFile }),
-                    ...(user.keyData && { keyData: user.keyData }),
-                    ...(user.keyFile && { keyFile: user.keyFile }),
-                    ...(user.exec ? { exec: user.exec } : {}),
-                    ...(user.authProvider
-                        ? { authProvider: user.authProvider }
-                        : {}),
+    /**
+     * Emit this factory's KRO deployment as declarative alchemy **v2** resources — the v2
+     * analog of the removed imperative `deployWithAlchemy(scope)`. Returns, in dependency order, a
+     * declaration for each discovered **singleton owner** (its own RGD + instance — mirroring
+     * `ensureSingletonOwners` in the imperative `deploy()` path), then the **RGD** (shared, deployed
+     * once), then the **CR instance** (one per `spec`, which `dependsOn` the RGD + the singletons),
+     * matching the old integration's per-resource state granularity. The caller instantiates
+     * each with `KroResource` inside their Stack (RGD first so reverse-topo removes the
+     * instance before the shared RGD):
+     *
+     * ```ts
+     * for (const { id, props } of await factory.toAlchemyResources(spec)) {
+     *   yield* KroResource(id, props);
+     * }
+     * ```
+     *
+     * Each declaration carries serialized `kubeConfigOptions` (so reconcile can reconnect to the
+     * cluster after state rehydration) and `kroDeletion` (so delete is finalizer-safe / shared-RGD
+     * aware). The actual deploy/teardown runs in `kroProvider`'s reconcile/delete.
+     */
+    async toAlchemyResources(spec, opts) {
+        const kubeConfigOptions = this.extractKubeConfigOptionsForAlchemy();
+        const kroDeletion = this.createAlchemyKroDeletionOptions();
+        // 0. Singleton owners. The imperative `deploy()` ensures shared singleton owners (each its own
+        // RGD + instance, in its registry namespace) via `ensureSingletonOwners` BEFORE the main
+        // instance; emit them as declarations too so the declarative path has the same boundaries.
+        // Their deterministic ids/names mean alchemy dedupes a singleton shared across compositions.
+        // (The runtime spec-drift check from `ensureSingletonOwners` is omitted here — `toAlchemyResources`
+        // stays cluster-free — but the spec-fingerprint annotation it relied on is still emitted.)
+        const singletonDeclarations = [];
+        const singletonInstanceIds = [];
+        for (const definition of this.discoverSingletonDefinitions(spec)) {
+            const singletonFactory = this.singletonFactoryFor(definition);
+            try {
+                const decls = await singletonFactory.toAlchemyResources(definition.spec, {
+                    instanceNameOverride: getSingletonInstanceName(definition.id),
+                    singletonSpecFingerprint: singletonSpecFingerprintAnnotationValue(definition.specFingerprint),
+                });
+                singletonDeclarations.push(...decls);
+                // `toAlchemyResources` returns the owner's OWN CR instance LAST (after any of ITS nested
+                // singletons + its RGD), so the consumer must wait on `decls[last]` — using "first decl
+                // with a dependency" would wrongly point at a nested singleton's instance.
+                const ownerInstance = decls[decls.length - 1];
+                if (ownerInstance)
+                    singletonInstanceIds.push(ownerInstance.id);
+            }
+            finally {
+                await singletonFactory.dispose?.();
+            }
+        }
+        // 1. RGD declaration (deployed once per factory; shared by all instances). Reuse the normal
+        // serializer so externalRef/forEach/includeWhen/readyWhen + singleton boundaries match
+        // non-alchemy KRO deploys.
+        const rgdManifest = yaml.load(this.buildRgdYaml());
+        const rgdFactory = this.rgdProvider ??
+            (await import('../../factories/kro/resource-graph-definition.js')).resourceGraphDefinition;
+        const rgdEnhanced = rgdFactory(rgdManifest);
+        const rgdId = createAlchemyResourceId(rgdEnhanced, this.namespace);
+        const rgdDeclaration = {
+            id: rgdId,
+            dependsOn: [],
+            props: {
+                resource: rgdEnhanced,
+                namespace: this.namespace,
+                deploymentStrategy: 'kro',
+                kubeConfigOptions,
+                kroDeletion,
+                options: { waitForReady: true, timeout: DEFAULT_RGD_TIMEOUT },
+            },
+        };
+        // 2. CR instance declaration (one per deploy call). Depends on the RGD so alchemy applies the
+        // instance only after the RGD's CRD is established (else the CR apply races a missing kind).
+        const instanceName = opts?.instanceNameOverride ?? generateInstanceName(spec, this.name);
+        const crdInstanceManifest = this.createCustomResourceInstance(instanceName, spec, opts?.singletonSpecFingerprint);
+        // Cast: a plain KubernetesResource is fine — the alchemy path only reads kind/metadata.
+        const crdAsEnhanced = crdInstanceManifest;
+        const instanceDeclaration = {
+            id: createAlchemyResourceId(crdAsEnhanced, this.namespace),
+            // Wait for the RGD's CRD AND for any singleton owners (mirrors `ensureSingletonOwners` running
+            // before the main deploy), so the instance applies only once its dependencies exist.
+            dependsOn: [rgdId, ...singletonInstanceIds],
+            props: {
+                resource: crdAsEnhanced,
+                namespace: this.namespace,
+                deploymentStrategy: 'kro',
+                kubeConfigOptions,
+                kroDeletion,
+                options: {
+                    waitForReady: false,
+                    timeout: this.factoryOptions.timeout ?? DEFAULT_DEPLOYMENT_TIMEOUT,
                 },
-            }),
+            },
         };
+        return [...singletonDeclarations, rgdDeclaration, instanceDeclaration];
+    }
+    /** Serialize the factory's cluster connection so an alchemy resource can reconnect after rehydration. */
+    extractKubeConfigOptionsForAlchemy() {
+        return extractSerializableKubeConfigOptions(this.getKubeConfig(), this.factoryOptions.skipTLSVerify === true ? true : undefined);
     }
+    /** Build the finalizer-safe, shared-RGD-aware deletion metadata for this factory's instances. */
     createAlchemyKroDeletionOptions() {
         return {
             apiVersion: this.schemaDefinition.apiVersion,
@@ -1040,7 +1007,6 @@ export class KroResourceFactoryImpl {
         return {
             name: this.name,
             mode: this.mode,
-            isAlchemyManaged: this.isAlchemyManaged,
             namespace: this.namespace,
             instanceCount: instances.length,
             health: rgdStatus.phase === 'ready' ? 'healthy' : 'degraded',