typekro 0.25.0 → 0.27.0

package/dist/core/deployment/kro-factory.d.ts

@@ -89,6 +89,80 @@ export declare class KroResourceFactoryImpl<TSpec extends KroCompatibleType, TSt
     private getSchemaVersion;
     private getSchemaGroup;
     private getInstanceApiVersion;
+    /**
+     * Resolve the namespace the KRO instance CR lives in for this call.
+     *
+     * The default CR placement is the FACTORY namespace (`this.namespace`), exactly
+     * as v0.26.0 always did — the maintainer's explicit decision (finding #2). This
+     * fixes the silent-relocation regression: an upgrade never moves an existing CR
+     * versus the released v0.26.0, and NO per-call `spec.namespace` is consulted for
+     * CR placement. An explicit `instanceNamespace` factory option still wins as an
+     * override (the only way to place the CR elsewhere).
+     *
+     * Identity distinctness within a single alchemy stack comes from the instance
+     * NAME: the top-level alchemy id is the legacy namespace-agnostic kind+name (see
+     * {@link instanceAlchemyId}, finding #1). NOTE: a different k8s factory namespace
+     * does NOT by itself create a different alchemy scope — two factories with the same
+     * instance name but different namespaces expose the SAME alchemy id and, if
+     * materialized in the SAME alchemy stack, collide (last write wins). Isolating
+     * same-named instances (e.g. `analytics` in dev vs prod) is the CALLER's
+     * responsibility: put them in SEPARATE alchemy stacks/scopes. `spec.namespace` is
+     * never consulted for CR placement or identity.
+     *
+     * The `spec` parameter is accepted only for call-site symmetry with the other
+     * resolvers and is deliberately unused (CR placement must not vary per spec, or
+     * `getInstances`/`deleteInstance` — which have no spec — could target a different
+     * namespace than `deploy` and orphan the CR, finding #3).
+     *
+     * Finalizer-stranding safety comes from HOISTING the composition's own workload
+     * Namespace OUT of the RGD graph (see {@link hoistedNamespaceNames}), not from
+     * where the instance CR lives.
+     */
+    private resolveInstanceNamespace;
+    /**
+     * Every Namespace HOISTED out of the RGD graph, mapped to its RAW `metadata.name`
+     * value — the UNCONDITIONAL model (typekro NEVER emits a Namespace into RGD YAML).
+     * Selection is trivially `kind === 'Namespace'` (excluding `__externalRef`
+     * observed namespaces); see {@link selectHoistedNamespaces}.
+     *
+     * This is a STABLE STRUCTURAL property of the RGD, computed WITHOUT any concrete
+     * spec: the set of hoisted ids is IDENTICAL for every instance of this factory, so
+     * the shared RGD never changes shape per-instance (deploying instance 2 can't
+     * mutate the graph instance 1 depends on). The name VALUES feed the reference
+     * rewriter so a reference to a hoisted Namespace's `metadata.name` becomes that
+     * Namespace's own concrete name expression.
+     */
+    private hoistedNamespaceRefs;
+    /**
+     * The CONCRETE Namespace resources to emit as SIBLINGS (deps-first, outside the
+     * graph) for this spec, keyed by namespace NAME.
+     *
+     * The set of hoisted IDS is STRUCTURAL (spec-independent); resolving those ids to
+     * concrete resources needs the spec. Re-executing the composition against the
+     * concrete spec yields the FULL concrete Namespace metadata (name + all labels,
+     * incl. Pod Security, + all annotations), which the emission paths PRESERVE and
+     * merge retention onto (finding #5) — never a bare synthesized Namespace. A hoisted
+     * id that is inactive under THIS spec (e.g. `includeWhen: false`) or whose name
+     * can't be resolved is skipped, so emission stays per-spec and order-independent.
+     * The map value is the ORIGINAL concrete Namespace resource (keyed by resolved
+     * name).
+     */
+    private concreteHoistedNamespaces;
+    /**
+     * The concrete NAMES of the namespaces hoisted out of the graph for this spec —
+     * used to tell the ownership guard which owned namespace is now safe (no longer a
+     * graph child), and as the singleton keys for sibling emission.
+     */
+    private hoistedNamespaceNames;
+    /**
+     * The resource map serialized into the RGD: `resources` minus EVERY hoisted
+     * Namespace, with every remaining reference to a hoisted Namespace's
+     * `metadata.name` rewritten to that Namespace's own concrete name expression
+     * (finding #3) so the emitted RGD carries no dangling reference to a removed
+     * resource. The hoist decision is STRUCTURAL (spec-independent), so the RGD shape
+     * is stable across every instance of this factory (finding #4).
+     */
+    private resourcesForRgd;
     /**
      * Idempotently create the factory's target namespace if it doesn't
      * exist. KRO does not auto-create the CR's containing namespace, and
@@ -111,6 +185,16 @@ export declare class KroResourceFactoryImpl<TSpec extends KroCompatibleType, TSt
      * step hasn't populated {@link discoveredPlural}.
      */
     private lookupCRDPlural;
+    /**
+     * STRICT plural discovery (finding #3, fail-closed). Distinguishes a definitive
+     * "CRD absent" (a successful CRD list with no matching definition → fresh cluster)
+     * from a discovery FAILURE (RBAC/connectivity/list error) — the latter is NOT proof
+     * of absence, so it THROWS rather than being swallowed into `undefined` the way
+     * {@link lookupCRDPlural} does. Callers that must fail closed (the pre-hoist safety
+     * guard) use this; callers that may fall back to a heuristic keep using
+     * {@link lookupCRDPlural}.
+     */
+    private discoverGeneratedCrdPlural;
     private requireCRDPluralForCleanup;
     private createKubernetesObjectApi;
     /**
@@ -160,6 +244,62 @@ export declare class KroResourceFactoryImpl<TSpec extends KroCompatibleType, TSt
      * Deploy directly to Kubernetes using DirectDeploymentEngine
      */
     private deployDirect;
+    /**
+     * Apply a hoisted workload Namespace as a RETAINED resource OUTSIDE the KRO
+     * graph, with its COMPLETE preserved configuration — all labels (incl. Pod
+     * Security + schema-derived), all annotations, AND spec — plus retention markers
+     * (finding #8), using typekro's own field manager (not KRO's). Server-side apply
+     * is idempotent and does not conflict with KRO because KRO no longer considers
+     * the Namespace desired.
+     *
+     * If the full Namespace cannot be applied, this FAILS (finding #8) rather than
+     * silently degrading to a bare `ensureTargetNamespace` that would drop Pod
+     * Security + other declared configuration.
+     */
+    private applyRetainedHoistedNamespace;
+    /**
+     * FINDING #2 — fail-closed PRE-HOIST detection (detection only; no migration).
+     *
+     * On deploy, BEFORE the RGD is (re)applied, check every namespace this factory would
+     * hoist. If a live namespace is currently a KRO ApplySet member — it carries
+     * `applyset.kubernetes.io/part-of` and/or any `kro.run/*` ownership label from a
+     * PRE-HOIST RGD (which owned the namespace as a graph child) — then rolling the new,
+     * hoisted RGD (which no longer lists the namespace) over the old one makes KRO's
+     * ApplySet prune enumerate and DELETE the live namespace, taking the workload with
+     * it. We THROW a clear, actionable error instead. This does NOT re-introduce the
+     * removed automatic migration/drain/strip machinery — it only refuses to proceed.
+     *
+     * typekro's own v2 sibling namespaces carry `typekro.io/kro-instance-namespace=true`
+     * but NEITHER an ApplySet `part-of` NOR any `kro.run/*` label (KRO never owns them),
+     * so steady-state re-deploys never trip this. A 404 (fresh) is not a pre-hoist signal.
+     *
+     * FINDING #7 (hardened): the check covers not only the namespaces resolved from the
+     * INCOMING spec but EVERY existing instance of this shared RGD (their hoisted
+     * namespaces too) — an upgrade prunes the ApplySet for ALL of them at once, so
+     * missing another instance's namespace would let KRO delete it. And reads FAIL
+     * CLOSED: a non-404 read error is NOT proof of safety, so it ABORTS the deploy
+     * rather than being skipped.
+     */
+    private assertNoPreHoistNamespaceConflict;
+    /**
+     * The hoisted-namespace names of EVERY existing instance of this shared RGD (finding
+     * #7), resolved EXACTLY and PER INSTANCE from that instance's OWN durable record
+     * (finding #1, v7) — never approximated, and never from an RGD-wide aggregate.
+     *
+     * Each instance's namespaces come from its OWN CR `typekro.io/hoisted-namespaces`
+     * annotation — the only PER-INSTANCE proof. An instance that lacks its own record (a
+     * genuinely-legacy deployment) FAILS CLOSED (throws): the RGD-wide set of Namespaces
+     * carrying `typekro.io/created-by-rgd == this.rgdName` is NOT per-instance proof — a
+     * DIFFERENT (modern) instance could have stamped it, so a non-empty RGD-wide set would
+     * otherwise MASK a legacy instance whose own — possibly different — namespace is invisible
+     * and would be pruned. We also never approximate from metadata.namespace / spec.namespace.
+     *
+     * The RGD-wide `created-by-rgd` set IS still unioned into the returned protected set (it
+     * is a superset that catches namespaces leaked by an interrupted teardown) — it just never
+     * SATISFIES the per-instance check. FRESH clusters (no CRD / no instances yet) yield an
+     * empty set; any list error FAILS CLOSED so the guard is never silently bypassed.
+     */
+    private existingInstancesHoistedNamespaceNames;
     /**
      * Get all deployed instances
      */
@@ -173,6 +313,13 @@ export declare class KroResourceFactoryImpl<TSpec extends KroCompatibleType, TSt
         scopes?: string[];
         includeUnscopedResources?: boolean;
     }): Promise<void>;
+    /**
+     * BEST-EFFORT deletion of this factory's generated CRD, the LAST teardown step (after
+     * the owned namespace is gone). Never throws: a slow/stuck apiextensions cleanup
+     * finalizer (upstream kro #1171) must not fail an otherwise-complete teardown, and by
+     * this point nothing depends on the CRD being gone. Logs the outcome.
+     */
+    private deleteGeneratedCrdBestEffort;
     /**
      * Emit this factory's KRO deployment as declarative alchemy **v2** resources — the v2
      * analog of the removed imperative `deployWithAlchemy(scope)`. Returns, in dependency order, a
@@ -197,6 +344,24 @@ export declare class KroResourceFactoryImpl<TSpec extends KroCompatibleType, TSt
         instanceNameOverride?: string;
         singletonSpecFingerprint?: string;
     }): Promise<AlchemyResourceDeclaration[]>;
+    /**
+     * The alchemy resource id for a KRO instance CR — the LEGACY, namespace-agnostic
+     * kind+name id (finding #1).
+     *
+     * This deliberately does NOT fold the namespace into the id. An earlier revision
+     * appended a namespace hash to distinguish same-named instances placed in
+     * different namespaces, but that changed every existing instance's id versus the
+     * released v0.26.0, so alchemy would see remove+replace and could tear down
+     * (delete) the live CR on upgrade. Reverting to the legacy id keeps existing
+     * alchemy state identity stable.
+     *
+     * Consequence to be honest about: within ONE alchemy stack, two instances collide
+     * iff they share this kind+name id — regardless of their k8s namespace. A
+     * different factory namespace does NOT automatically yield a different alchemy
+     * scope. To keep same-named instances (e.g. `analytics` in dev vs prod) separate,
+     * the CALLER must materialize them in SEPARATE alchemy stacks/scopes.
+     */
+    private instanceAlchemyId;
     /** Serialize the factory's cluster connection so an alchemy resource can reconnect after rehydration. */
     private extractKubeConfigOptionsForAlchemy;
     /** Build the finalizer-safe, shared-RGD-aware deletion metadata for this factory's instances. */
@@ -228,8 +393,21 @@ export declare class KroResourceFactoryImpl<TSpec extends KroCompatibleType, TSt
      * step — it's applied inline during ref-to-CEL conversion via
      * `SerializationContext.omitFields`, which `serializeResourceGraphToYaml`
      * populates from `kroSchema.__omitFields` automatically.
+     *
+     * The hoist decision is SPEC-INDEPENDENT (finding #4): the RGD is shared by every
+     * instance of this factory, so its shape must be a stable structural property and
+     * must NOT vary with a per-call spec. `spec` is accepted only for signature
+     * symmetry with the callers and is deliberately NOT used to decide hoisting — see
+     * {@link hoistedNamespaceRefs} / {@link resourcesForRgd}.
      */
     private buildRgdYaml;
+    /**
+     * Assert the emitted RGD carries NO leftover reference to a hoisted (removed)
+     * resource id — neither a CEL interpolation `${<id>.…}` nor a raw
+     * `__KUBERNETES_REF_<id>_…` marker (finding #6). A negative lookbehind avoids
+     * matching an id that is only a suffix of a longer identifier.
+     */
+    private assertNoDanglingHoistedReferences;
     /**
      * Strict CEL diagnostics: verify that every dynamic status CEL expression
      * references only resources that exist in this graph.
@@ -251,7 +429,10 @@ export declare class KroResourceFactoryImpl<TSpec extends KroCompatibleType, TSt
      */
     private addRgdSchemaStatusPruneMarkers;
     /**
-     * Ensure the ResourceGraphDefinition is deployed using DirectDeploymentEngine
+     * Ensure the ResourceGraphDefinition is deployed using DirectDeploymentEngine.
+     *
+     * The `spec` (when the caller has one) lets the RGD hoist the composition's own
+     * workload Namespace out of the graph with its schema-driven name resolved.
      */
     private ensureRGDDeployed;
     private applyKroPrerequisites;
@@ -321,6 +502,72 @@ export declare class KroResourceFactoryImpl<TSpec extends KroCompatibleType, TSt
      * Create custom resource instance
      */
     private createCustomResourceInstance;
+    /**
+     * Labels/annotations marking a hoisted workload Namespace as SHARED, RETAINED
+     * infrastructure that must survive any single consumer's teardown/prune.
+     *
+     * Retention is declared for BOTH major GitOps reconcilers, not just Flux, so a
+     * prune (or an Application deletion) by whichever tool manages a consuming app
+     * can never delete this shared namespace (and with it every OTHER stack's
+     * resources living inside it):
+     *   - `kustomize.toolkit.fluxcd.io/prune: disabled` — Flux Kustomize.
+     *   - `argocd.argoproj.io/sync-options: Prune=false,Delete=false` — Argo CD.
+     *     `Delete=false` is what survives an Argo Application DELETION, not merely a
+     *     sync-prune (`Prune=false` alone does NOT).
+     * The alchemy path pairs these with a `retain` prop (see
+     * {@link hoistedNamespaceAlchemyDeclaration}) that skips delete. For any other
+     * GitOps tool, pre-create the workload namespace out-of-band.
+     */
+    private static readonly INSTANCE_NAMESPACE_METADATA;
+    /**
+     * The collision-free singleton id for a hoisted workload Namespace, deduped by
+     * the namespace NAME (finding #7). {@link toCamelCase} alone destroys separators
+     * (`foo-bar` and `foo--bar` both camel-case to `fooBar`), so two DISTINCT
+     * namespaces would collapse to one id — silently deduping unrelated namespaces
+     * into a single retained resource. Appending a stable hash of the RAW name keeps
+     * distinct names distinct while staying deterministic (same name → same id, so
+     * the intended cross-factory dedup still holds).
+     */
+    private static hoistedNamespaceId;
+    /**
+     * Resolve a single Namespace metadata VALUE (a label/annotation value) against
+     * the concrete spec to its final string form (finding #8). Handles:
+     *   - plain strings (kept verbatim),
+     *   - numbers / booleans (stringified — a "non-string" declared value),
+     *   - schema-derived CEL expressions / KubernetesRefs (resolved to the concrete
+     *     value; re-execution already collapsed the schema ref, but this evaluates
+     *     it against the spec for robustness).
+     * Returns `undefined` for a value that cannot be resolved to a string, so the
+     * caller drops only genuinely-unresolvable entries rather than the whole class of
+     * non-string / schema-derived metadata (the old string-only filter dropped them).
+     */
+    private static resolveMetadataStringValue;
+    /**
+     * Merge the SHARED/RETAINED marker labels + annotations onto an ORIGINAL,
+     * fully-concrete Namespace resource, PRESERVING the COMPLETE declared config
+     * (findings #6 + #8): ALL labels — including Pod Security (`pod-security.kubernetes.io/*`)
+     * AND non-string / schema-derived labels resolved against the spec — ALL
+     * annotations, the remaining declarative ObjectMeta (`finalizers`,
+     * `ownerReferences`), AND the Namespace `spec` (e.g. `spec.finalizers`). The
+     * retention markers are added on top.
+     */
+    private static mergedHoistedNamespaceMetadata;
+    /**
+     * A workload Namespace this composition owns, HOISTED out of the RGD graph and
+     * emitted as a retained resource instead. It is created OUTSIDE the KRO graph —
+     * deps-first in GitOps/alchemy, and applied directly in the imperative path — so
+     * KRO never garbage-collects it and the instance's finalizer can never be
+     * stranded by its own namespace terminating.
+     *
+     * The COMPLETE original Namespace configuration is preserved (finding #5) — see
+     * {@link mergedHoistedNamespaceMetadata}. It is a SHARED SINGLETON deduped by the
+     * namespace NAME (collision-free id, see {@link hoistedNamespaceId}), so every
+     * consumer/stack targeting the SAME workload namespace emits the SAME declaration
+     * — alchemy dedupes them to one retained owner rather than N fighting copies.
+     */
+    private buildHoistedNamespaceResource;
+    private hoistedNamespaceAlchemyDeclaration;
+    private hoistedNamespaceYaml;
     private assertInstanceNamespaceOwnershipSafe;
     private assertSingletonOwnersNamespaceOwnershipSafe;
     /**

package/dist/core/deployment/kro-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kro-factory.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/kro-factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,KAAK,EACV,0BAA0B,EAE3B,MAAM,wBAAwB,CAAC;AA6ChC,OAAO,KAAK,EAKV,cAAc,EACd,aAAa,EAIb,kBAAkB,EAGlB,SAAS,EAEV,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAyB,QAAQ,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,KAAK,EACV,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACZ,MAAM,2BAA2B,CAAC;AA8BnC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAI/B,SAAS,EAAE,aAAa,CAAC;IAAE,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC,EAChF,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,OAAO,EACxB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAST;AA8BD;;;;;GAKG;AACH,qBAAa,sBAAsB,CACjC,KAAK,SAAS,iBAAiB,EAC/B,OAAO,SAAS,iBAAiB,CACjC,YAAW,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC;IAE7C,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmC;IACpE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IACzD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA8B;IACnE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA8C;IACrF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,0BAA0B,CAAS;IAE3C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB,CAAqB;IAI7C,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAwC;IAClF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8C;gBAGxE,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC7C,gBAAgB,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,EAClD,cAAc,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAC7C,OAAO,GAAE,cAAmB;IA6B9B,iFAAiF;IACjF,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,qBAAqB;IAI7B;;;;;;;;;OASG;YACW,qBAAqB;IAsGnC;;;;;;;;;OASG;YACW,eAAe;YA2Bf,0BAA0B;IAgBxC,OAAO,CAAC,yBAAyB;IAIjC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAclC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,OAAO,CAAC,aAAa;IAIrB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,aAAa;IAUf,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAU9B;;OAEG;IACG,MAAM,CACV,IAAI,EAAE,KAAK,EACX,IAAI,CAAC,EAAE;QACL,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;KACnC,GACA,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAuBpC;;;;OAIG;IACH,OAAO,CAAC,4BAA4B;IAiBpC,6FAA6F;IAC7F,OAAO,CAAC,mBAAmB;YAkBb,qBAAqB;YAgDrB,uCAAuC;IAuBrD,OAAO,CAAC,+BAA+B;IAcvC;;;OAGG;YACW,wBAAwB;IAmHtC;;OAEG;YACW,YAAY;IA4F1B;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YA0F3C,uBAAuB;YA6BvB,sBAAsB;IAOpC;;OAEG;IACG,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/D,OAAO,CAAC,IAAI,CAAC;IAwLhB;;;;;;;;;;;;;;;;;;;OAmBG;IACG,kBAAkB,CACtB,IAAI,EAAE,KAAK,EACX,IAAI,CAAC,EAAE;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1E,OAAO,CAAC,0BAA0B,EAAE,CAAC;IA4HxC,yGAAyG;IACzG,OAAO,CAAC,kCAAkC;IAO1C,iGAAiG;IACjG,OAAO,CAAC,+BAA+B;IAYvC;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAazC;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IA0ExC;;OAEG;IACH,MAAM,IAAI,MAAM;IAChB;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM;IAkC3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,YAAY;IAiFpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,uCAAuC;IAiC/C,OAAO,CAAC,MAAM,CAAC,QAAQ;IAOvB,OAAO,CAAC,MAAM,CAAC,qBAAqB;IASpC;;;;OAIG;YACW,8BAA8B;IA8C5C;;OAEG;YACW,iBAAiB;YA+GjB,qBAAqB;IAkDnC,OAAO,CAAC,6BAA6B;IAsErC,OAAO,CAAC,yBAAyB;IAYjC,OAAO,CAAC,kCAAkC;IAY1C,OAAO,CAAC,+BAA+B;IA+BvC,OAAO,CAAC,yCAAyC;IAcjD,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,+BAA+B;IAIvC;;;;;;;OAOG;YACW,yBAAyB;IAiBvC;;OAEG;YACW,oBAAoB;IAalC;;OAEG;YACW,oBAAoB;YAapB,wBAAwB;IAqEtC,OAAO,CAAC,qBAAqB;IAe7B;;;;;;OAMG;IACH,OAAO,CAAC,2BAA2B;IAwBnC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAyB/B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IA4B/B;;;OAGG;IACH,OAAO,CAAC,oCAAoC;IAyB5C,OAAO,CAAC,2BAA2B;IAenC,OAAO,CAAC,cAAc;IAiBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAYvB;;OAEG;IACH,OAAO,CAAC,4BAA4B;IA8BpC,OAAO,CAAC,oCAAoC;IAa5C,OAAO,CAAC,2CAA2C;IAMnD;;OAEG;YACW,qCAAqC;IAmHnD;;;OAGG;YACW,uBAAuB;IA4GrC,OAAO,CAAC,gCAAgC;IAwCxC;;OAEG;YACW,mBAAmB;IAOjC;;;OAGG;YACW,uBAAuB;IAmBrC;;OAEG;YACW,0BAA0B;CA0CzC;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAsB1F;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,SAAS,iBAAiB,EAC/B,OAAO,SAAS,iBAAiB,EAEjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC7C,gBAAgB,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,EAClD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,OAAO,GAAE,cAAmB,GAC3B,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAQpC"}
+{"version":3,"file":"kro-factory.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/kro-factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,KAAK,EACV,0BAA0B,EAE3B,MAAM,wBAAwB,CAAC;AAgDhC,OAAO,KAAK,EAKV,cAAc,EACd,aAAa,EAIb,kBAAkB,EAGlB,SAAS,EAEV,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAyB,QAAQ,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,KAAK,EACV,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACZ,MAAM,2BAA2B,CAAC;AAwDnC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAI/B,SAAS,EAAE,aAAa,CAAC;IAAE,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC,EAChF,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,OAAO,EACxB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAST;AA8BD;;;;;GAKG;AACH,qBAAa,sBAAsB,CACjC,KAAK,SAAS,iBAAiB,EAC/B,OAAO,SAAS,iBAAiB,CACjC,YAAW,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC;IAE7C,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmC;IACpE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IACzD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA8B;IACnE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA8C;IACrF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,0BAA0B,CAAS;IAE3C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB,CAAqB;IAI7C,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAwC;IAClF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8C;gBAGxE,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC7C,gBAAgB,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,EAClD,cAAc,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAC7C,OAAO,GAAE,cAAmB;IA6B9B,iFAAiF;IACjF,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,qBAAqB;IAI7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAM5B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yBAAyB;IA4BjC;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAWvB;;;;;;;;;OASG;YACW,qBAAqB;IAsGnC;;;;;;;;;OASG;YACW,eAAe;IA2B7B;;;;;;;;OAQG;YACW,0BAA0B;YAoB1B,0BAA0B;IAoBxC,OAAO,CAAC,yBAAyB;IAIjC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAclC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,OAAO,CAAC,aAAa;IAIrB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,aAAa;IAUf,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAU9B;;OAEG;IACG,MAAM,CACV,IAAI,EAAE,KAAK,EACX,IAAI,CAAC,EAAE;QACL,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;KACnC,GACA,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAuBpC;;;;OAIG;IACH,OAAO,CAAC,4BAA4B;IAiBpC,6FAA6F;IAC7F,OAAO,CAAC,mBAAmB;YAuBb,qBAAqB;YAgDrB,uCAAuC;IAuBrD,OAAO,CAAC,+BAA+B;IAcvC;;;OAGG;YACW,wBAAwB;IAmHtC;;OAEG;YACW,YAAY;IAuH1B;;;;;;;;;;;OAWG;YACW,6BAA6B;IAwF3C;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,iCAAiC;IA2D/C;;;;;;;;;;;;;;;;;OAiBG;YACW,sCAAsC;IAyHpD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YA8F3C,uBAAuB;YAiCvB,sBAAsB;IAOpC;;OAEG;IACG,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/D,OAAO,CAAC,IAAI,CAAC;IA+RhB;;;;;OAKG;YACW,4BAA4B;IA+B1C;;;;;;;;;;;;;;;;;;;OAmBG;IACG,kBAAkB,CACtB,IAAI,EAAE,KAAK,EACX,IAAI,CAAC,EAAE;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1E,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAyJxC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,iBAAiB;IAIzB,yGAAyG;IACzG,OAAO,CAAC,kCAAkC;IAO1C,iGAAiG;IACjG,OAAO,CAAC,+BAA+B;IAYvC;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAazC;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IA0ExC;;OAEG;IACH,MAAM,IAAI,MAAM;IAChB;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM;IA4C3B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,YAAY;IAoHpB;;;;;OAKG;IACH,OAAO,CAAC,iCAAiC;IAazC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,uCAAuC;IAiC/C,OAAO,CAAC,MAAM,CAAC,QAAQ;IAOvB,OAAO,CAAC,MAAM,CAAC,qBAAqB;IASpC;;;;OAIG;YACW,8BAA8B;IA8C5C;;;;;OAKG;YACW,iBAAiB;YA+GjB,qBAAqB;IAkDnC,OAAO,CAAC,6BAA6B;IAsErC,OAAO,CAAC,yBAAyB;IAYjC,OAAO,CAAC,kCAAkC;IAY1C,OAAO,CAAC,+BAA+B;IA+BvC,OAAO,CAAC,yCAAyC;IAcjD,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,+BAA+B;IAIvC;;;;;;;OAOG;YACW,yBAAyB;IAiBvC;;OAEG;YACW,oBAAoB;IAalC;;OAEG;YACW,oBAAoB;YAapB,wBAAwB;IAqEtC,OAAO,CAAC,qBAAqB;IAe7B;;;;;;OAMG;IACH,OAAO,CAAC,2BAA2B;IAwBnC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAyB/B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IA4B/B;;;OAGG;IACH,OAAO,CAAC,oCAAoC;IAyB5C,OAAO,CAAC,2BAA2B;IAenC,OAAO,CAAC,cAAc;IAiBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAYvB;;OAEG;IACH,OAAO,CAAC,4BAA4B;IAuCpC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CASxC;IAEX;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAIjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,0BAA0B;IAUzC;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,8BAA8B;IA8E7C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,6BAA6B;IA4CrC,OAAO,CAAC,kCAAkC;IAgD1C,OAAO,CAAC,oBAAoB;IA+B5B,OAAO,CAAC,oCAAoC;IAkB5C,OAAO,CAAC,2CAA2C;IAMnD;;OAEG;YACW,qCAAqC;IAoHnD;;;OAGG;YACW,uBAAuB;IA4GrC,OAAO,CAAC,gCAAgC;IAwCxC;;OAEG;YACW,mBAAmB;IAOjC;;;OAGG;YACW,uBAAuB;IAuBrC;;OAEG;YACW,0BAA0B;CA2CzC;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAsB1F;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,SAAS,iBAAiB,EAC/B,OAAO,SAAS,iBAAiB,EAEjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC7C,gBAAgB,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,EAClD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,OAAO,GAAE,cAAmB,GAC3B,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAQpC"}