typekro 0.26.0 → 0.27.1

package/dist/alchemy/kro-delete.d.ts

@@ -32,6 +32,14 @@ export interface KubernetesObjectCleanupApi {
             namespace?: string;
         };
     }): Promise<unknown>;
+    read(resource: {
+        apiVersion: string;
+        kind: string;
+        metadata: {
+            name: string;
+            namespace?: string;
+        };
+    }): Promise<unknown>;
 }
 export interface KubernetesObjectInstanceApi extends KubernetesObjectCleanupApi {
     read(resource: {

package/dist/alchemy/kro-delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kro-delete.d.ts","sourceRoot":"","sources":["../../src/alchemy/kro-delete.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAM1D,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmCD,UAAU,mBAAmB;IAC3B,uBAAuB,CAAC,OAAO,EAAE;QAC/B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,QAAQ,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,OAAO,CAAC;gBAAC,SAAS,CAAC,EAAE,OAAO,CAAA;aAAE,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,CAAC,QAAQ,EAAE;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChD,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,2BAA4B,SAAQ,0BAA0B;IAC7E,IAAI,CAAC,QAAQ,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChD,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,2BAA2B,CAAC;IACpC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAqCD,iBAAe,gBAAgB,CAC7B,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,kBAAkB,EAC3B,SAAS,GAAE,mBAA4F,GACtG,OAAO,CAAC,KAAK,CAAC;IAAE,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC,CAYxE;AAED,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,yBAAmB,CAAC;AAExD,wBAAsB,eAAe,CACnC,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,kBAAkB,EAC3B,MAAM,GAAE,0BAA6G,GACpH,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED,wBAAsB,8BAA8B,CAClD,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,iBAAe,sCAAsC,CACnD,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAqFf;AAED,6EAA6E;AAC7E,eAAO,MAAM,qCAAqC,+CAAyC,CAAC"}
+{"version":3,"file":"kro-delete.d.ts","sourceRoot":"","sources":["../../src/alchemy/kro-delete.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAuB,MAAM,yBAAyB,CAAC;AAO/E,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmCD,UAAU,mBAAmB;IAC3B,uBAAuB,CAAC,OAAO,EAAE;QAC/B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,QAAQ,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,OAAO,CAAC;gBAAC,SAAS,CAAC,EAAE,OAAO,CAAA;aAAE,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,CAAC,QAAQ,EAAE;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChD,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAIrB,IAAI,CAAC,QAAQ,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChD,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,2BAA4B,SAAQ,0BAA0B;IAC7E,IAAI,CAAC,QAAQ,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAChD,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,2BAA2B,CAAC;IACpC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAqCD,iBAAe,gBAAgB,CAC7B,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,kBAAkB,EAC3B,SAAS,GAAE,mBAA4F,GACtG,OAAO,CAAC,KAAK,CAAC;IAAE,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC,CAYxE;AAED,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,yBAAmB,CAAC;AAExD,wBAAsB,eAAe,CACnC,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,kBAAkB,EAC3B,MAAM,GAAE,0BAA6G,GACpH,OAAO,CAAC,IAAI,CAAC,CA6Cf;AAED,wBAAsB,8BAA8B,CAClD,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,iBAAe,sCAAsC,CACnD,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAqFf;AAED,6EAA6E;AAC7E,eAAO,MAAM,qCAAqC,+CAAyC,CAAC"}

package/dist/alchemy/kro-delete.js

@@ -1,4 +1,5 @@
 import { CRDInstanceError, ensureError } from '../core/errors.js';
+import { createRollbackManager } from '../core/deployment/rollback-manager.js';
 import { createBunCompatibleCustomObjectsApi, createBunCompatibleKubernetesObjectApi } from '../core/kubernetes/bun-api-client.js';
 import { getComponentLogger } from '../core/logging/index.js';
 function getSchemaVersion(apiVersion) {
@@ -60,47 +61,45 @@ export async function hasKroInstances(kubeConfig, options) {
 }
 export async function deleteKroDefinition(kubeConfig, options, k8sApi = createBunCompatibleKubernetesObjectApi(kubeConfig)) {
     const logger = getComponentLogger('alchemy-kro-delete');
-    const crdPlural = options.plural ?? await lookupCRDPlural(kubeConfig, options, k8sApi);
+    // ONE gating mechanism: the engine's rollback manager deletes then polls to a REAL 404
+    // and THROWS on timeout — the SAME primitive the imperative KRO teardown uses. A
+    // pre-existing 404 is treated as already-gone.
+    const rollback = createRollbackManager(k8sApi);
+    const timeout = options.timeout ?? 300000;
+    // The RGD delete is a HARD gate (throws on timeout).
     try {
-        await k8sApi.delete({
-            apiVersion: 'kro.run/v1alpha1',
-            kind: 'ResourceGraphDefinition',
-            metadata: { name: options.rgdName },
-        });
+        await rollback.deleteResourceAndWait({ apiVersion: 'kro.run/v1alpha1', kind: 'ResourceGraphDefinition', name: options.rgdName }, { timeout });
     }
     catch (error) {
-        if (getKubernetesErrorCode(error) !== 404) {
-            logger.error('Alchemy KRO RGD cleanup failed', ensureError(error), {
-                rgdName: options.rgdName,
-                error: ensureError(error).message,
-            });
-            throw error;
-        }
-    }
-    if (!crdPlural) {
-        logger.debug('Alchemy KRO CRD already absent during RGD cleanup', {
-            kind: options.kind,
+        logger.error('Alchemy KRO RGD cleanup failed', ensureError(error), {
             rgdName: options.rgdName,
+            error: ensureError(error).message,
         });
-        return;
-    }
-    const crdName = `${crdPlural}.${getSchemaGroup(options)}`;
-    try {
-        await k8sApi.delete({
-            apiVersion: 'apiextensions.k8s.io/v1',
-            kind: 'CustomResourceDefinition',
-            metadata: { name: crdName },
-        });
-    }
-    catch (error) {
-        if (getKubernetesErrorCode(error) !== 404) {
-            logger.error('Alchemy KRO CRD cleanup failed', ensureError(error), {
-                crdName,
-                error: ensureError(error).message,
-            });
-            throw error;
-        }
+        throw error;
     }
+    // FINDING #1 — DO NOT delete the generated CRD here (leave it for out-of-band GC).
+    //
+    // Under alchemy's reverse-topo teardown the hoisted workload Namespace is a SEPARATE
+    // resource deleted AFTER the RGD/instance (both `dependsOn` it): the order is
+    // instance → RGD → namespace. `deleteKroDefinition` runs during the instance/RGD
+    // delete, which is BEFORE the namespace resource's own delete step. If we deleted the
+    // CRD here, it would be Terminating while the namespace later drains — and a namespace
+    // controller stalls indefinitely enumerating a *Terminating* CRD's type (the
+    // apiextensions `customresourcecleanup` finalizer is slow/fragile even with zero
+    // instances, upstream kro #1171). That is the EXACT hang the imperative path avoids by
+    // deleting the CRD strictly AFTER the namespace.
+    //
+    // Alchemy cannot cheaply reorder the CRD delete to run after the (separate, later,
+    // possibly SHARED/deduped) namespace resource, so we choose the other invariant-safe
+    // option: NEVER delete the CRD in the alchemy path. It is never Terminating during
+    // namespace teardown, so a namespace can never hang against it. A leftover Active CRD
+    // with zero instances is harmless (KRO's default allowCRDDeletion=false already leaves
+    // it), cluster-scoped, and can be GC'd out-of-band. This is the accepted residual of the
+    // alchemy #1 fix — documented, not silent.
+    logger.debug('Alchemy KRO teardown: leaving the generated CRD for out-of-band GC (finding #1)', {
+        kind: options.kind,
+        rgdName: options.rgdName,
+    });
 }
 export async function deleteKroInstanceFinalizerSafe(kubeConfig, name, options) {
     return deleteKroInstanceFinalizerSafeWithApis(kubeConfig, name, options, {

package/dist/alchemy/kro-delete.js.map

@@ -1 +1 @@
-{"version":3,"file":"kro-delete.js","sourceRoot":"","sources":["../../src/alchemy/kro-delete.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AACnI,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAY9D,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AACxF,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxC,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACtG,CAAC;AAED,SAAS,qBAAqB,CAAC,OAA2B;IACxD,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,QAAQ,GAAG,KAAyE,CAAC;IAC3F,OAAO,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAgF,EAChF,UAAkB,EAClB,eAAwB,EACxB,eAAuB;IAEvB,MAAM,SAAS,GAAG,eAAe;QAC/B,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC5B,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YACxD,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,KAAK,eAAe,CAAC;QAC1D,CAAC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9B,CAAC;AAiCD,KAAK,UAAU,eAAe,CAC5B,UAAsB,EACtB,OAA2B,EAC3B,SAAqC,sCAAsC,CAAC,UAAU,CAA+B;IAErH,MAAM,MAAM,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAC7B,yBAAyB,EACzB,0BAA0B,CAC3B,CAIA,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAC5B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,cAAc,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAC/F,CAAC;QACF,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC;IACpC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;YACjE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,gBAAgB,CACxB,4CAA4C,OAAO,CAAC,IAAI,yDAAyD,EACjH,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,IAAI,EACZ,GAAG,EACH,UAAU,EACV,WAAW,CAAC,KAAK,CAAC,CACnB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,UAAsB,EACtB,OAA2B,EAC3B,YAAiC,mCAAmC,CAAC,UAAU,CAAwB;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,uBAAuB,CAAC;QACvD,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC;QAC9B,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7C,MAAM;KACP,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAsB,EACtB,OAA2B;IAE3B,OAAO,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAsB,EACtB,OAA2B,EAC3B,SAAqC,sCAAsC,CAAC,UAAU,CAA+B;IAErH,MAAM,MAAM,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC;YAClB,UAAU,EAAE,kBAAkB;YAC9B,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,sBAAsB,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE;gBACjE,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;aAClC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE;YAChE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC;YAClB,UAAU,EAAE,yBAAyB;YACrC,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,sBAAsB,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE;gBACjE,OAAO;gBACP,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;aAClC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,UAAsB,EACtB,IAAY,EACZ,OAA2B;IAE3B,OAAO,sCAAsC,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;QACvE,MAAM,EAAE,sCAAsC,CAAC,UAAU,CAAgC;KAC1F,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,UAAsB,EACtB,IAAY,EACZ,OAA2B,EAC3B,IAA6B;IAE7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;IAC9G,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;IAC1C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC;YAClB,UAAU;YACV,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;SACjD,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC;oBAChB,UAAU;oBACV,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;iBACjD,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,SAAkB,EAAE,CAAC;gBAC5B,IAAI,sBAAsB,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC9C,eAAe,GAAG,IAAI,CAAC;oBACvB,MAAM;gBACR,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;oBACxD,IAAI;oBACJ,SAAS,EAAE,sBAAsB,CAAC,SAAS,CAAC;iBAC7C,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,gBAAgB,GAAG,IAAI,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;gBAC3E,IAAI;gBACJ,OAAO;gBACP,IAAI,EAAE,kFAAkF;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,sBAAsB,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1C,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,gBAAgB,CACxB,6BAA6B,IAAI,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAClE,UAAU,EACV,OAAO,CAAC,IAAI,EACZ,IAAI,EACJ,UAAU,EACV,WAAW,CAAC,KAAK,CAAC,CACnB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,IAAI,qCAAqC,OAAO,IAAI,EACpE,UAAU,EACV,OAAO,CAAC,IAAI,EACZ,IAAI,EACJ,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACzE,qBAAqB,GAAG,iBAAiB,CAAC,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,2EAA2E,EAAE;YACvF,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;SAClC,CAAC,CAAC;QACH,qBAAqB,GAAG,IAAI,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,MAAM,mBAAmB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;AAEH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qCAAqC,GAAG,sCAAsC,CAAC"}
+{"version":3,"file":"kro-delete.js","sourceRoot":"","sources":["../../src/alchemy/kro-delete.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AACnI,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAY9D,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AACxF,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxC,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACtG,CAAC;AAED,SAAS,qBAAqB,CAAC,OAA2B;IACxD,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,QAAQ,GAAG,KAAyE,CAAC;IAC3F,OAAO,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAgF,EAChF,UAAkB,EAClB,eAAwB,EACxB,eAAuB;IAEvB,MAAM,SAAS,GAAG,eAAe;QAC/B,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC5B,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YACxD,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,KAAK,eAAe,CAAC;QAC1D,CAAC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9B,CAAC;AAyCD,KAAK,UAAU,eAAe,CAC5B,UAAsB,EACtB,OAA2B,EAC3B,SAAqC,sCAAsC,CAAC,UAAU,CAA+B;IAErH,MAAM,MAAM,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAC7B,yBAAyB,EACzB,0BAA0B,CAC3B,CAIA,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAC5B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,cAAc,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAC/F,CAAC;QACF,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC;IACpC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;YACjE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,gBAAgB,CACxB,4CAA4C,OAAO,CAAC,IAAI,yDAAyD,EACjH,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,IAAI,EACZ,GAAG,EACH,UAAU,EACV,WAAW,CAAC,KAAK,CAAC,CACnB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,UAAsB,EACtB,OAA2B,EAC3B,YAAiC,mCAAmC,CAAC,UAAU,CAAwB;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,uBAAuB,CAAC;QACvD,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC;QAC9B,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7C,MAAM;KACP,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAsB,EACtB,OAA2B;IAE3B,OAAO,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAsB,EACtB,OAA2B,EAC3B,SAAqC,sCAAsC,CAAC,UAAU,CAA+B;IAErH,MAAM,MAAM,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IACxD,uFAAuF;IACvF,iFAAiF;IACjF,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAwC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;IAE1C,qDAAqD;IACrD,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,qBAAqB,CAClC,EAAE,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAC1F,EAAE,OAAO,EAAE,CACZ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE;YACjE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;SAClC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IAED,mFAAmF;IACnF,EAAE;IACF,qFAAqF;IACrF,8EAA8E;IAC9E,iFAAiF;IACjF,sFAAsF;IACtF,uFAAuF;IACvF,6EAA6E;IAC7E,iFAAiF;IACjF,uFAAuF;IACvF,iDAAiD;IACjD,EAAE;IACF,mFAAmF;IACnF,qFAAqF;IACrF,mFAAmF;IACnF,sFAAsF;IACtF,uFAAuF;IACvF,yFAAyF;IACzF,2CAA2C;IAC3C,MAAM,CAAC,KAAK,CAAC,iFAAiF,EAAE;QAC9F,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,UAAsB,EACtB,IAAY,EACZ,OAA2B;IAE3B,OAAO,sCAAsC,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;QACvE,MAAM,EAAE,sCAAsC,CAAC,UAAU,CAAgC;KAC1F,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,UAAsB,EACtB,IAAY,EACZ,OAA2B,EAC3B,IAA6B;IAE7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;IAC9G,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;IAC1C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC;YAClB,UAAU;YACV,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;SACjD,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC;oBAChB,UAAU;oBACV,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;iBACjD,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,SAAkB,EAAE,CAAC;gBAC5B,IAAI,sBAAsB,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC9C,eAAe,GAAG,IAAI,CAAC;oBACvB,MAAM;gBACR,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;oBACxD,IAAI;oBACJ,SAAS,EAAE,sBAAsB,CAAC,SAAS,CAAC;iBAC7C,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,gBAAgB,GAAG,IAAI,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;gBAC3E,IAAI;gBACJ,OAAO;gBACP,IAAI,EAAE,kFAAkF;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,sBAAsB,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1C,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,gBAAgB,CACxB,6BAA6B,IAAI,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAClE,UAAU,EACV,OAAO,CAAC,IAAI,EACZ,IAAI,EACJ,UAAU,EACV,WAAW,CAAC,KAAK,CAAC,CACnB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,IAAI,qCAAqC,OAAO,IAAI,EACpE,UAAU,EACV,OAAO,CAAC,IAAI,EACZ,IAAI,EACJ,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACzE,qBAAqB,GAAG,iBAAiB,CAAC,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,2EAA2E,EAAE;YACvF,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;SAClC,CAAC,CAAC;QACH,qBAAqB,GAAG,IAAI,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,MAAM,mBAAmB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;AAEH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qCAAqC,GAAG,sCAAsC,CAAC"}

package/dist/alchemy/resource-registration.d.ts

@@ -13,11 +13,14 @@
  * The Kubernetes machinery (`deployers`, `kro-delete`, client/deployer construction) is
  * alchemy-version-agnostic and reused verbatim; only the registration glue changed.
  */
+import type { KubeConfig } from '@kubernetes/client-node';
 import { Effect } from 'effect';
 import * as ProviderMod from 'alchemy/Provider';
 import * as ResourceMod from 'alchemy/Resource';
 import type { Resource as ResourceT } from 'alchemy/Resource';
+import { type TypeKroLogger } from '../core/logging/index.js';
 import { type ResourceScope } from '../core/metadata/index.js';
+import { listNamespacesOwnedByRgd } from '../core/deployment/kro-namespace-teardown.js';
 import type { DeploymentOptions } from '../core/types/deployment.js';
 import type { Enhanced } from '../core/types/kubernetes.js';
 import type { KroDeletionOptions } from './kro-delete.js';
@@ -83,6 +86,63 @@ export declare function singletonDriftVerdict(expectedFingerprint: string, deplo
     drift: true;
     reason: string;
 };
+/**
+ * The namespaces of EVERY existing instance of the shared RGD (finding #7, alchemy).
+ * Discovers the generated CRD from {@link TypeKroResourceProps.namespacePreHoistQuery},
+ * lists instances cluster-wide, and returns each instance's namespace.
+ *
+ * FAIL CLOSED: a CRD-discovery or instance-list FAILURE (RBAC/connectivity) is NOT proof
+ * of absence — it THROWS. Only a successful CRD list with no matching CRD (fresh cluster),
+ * or a definitive 404 listing instances, yields an empty set.
+ *
+ * NAMESPACE RESOLUTION (finding #1, v7 — per-instance exact or fail closed): each existing
+ * instance's namespaces are resolved EXACTLY and PER INSTANCE from that instance's OWN CR
+ * `typekro.io/hoisted-namespaces` record — the only per-instance proof. An instance that
+ * lacks its own record (a genuinely-legacy deployment) FAILS CLOSED (throws): the RGD-wide
+ * set of Namespaces carrying `typekro.io/created-by-rgd == props.namespaceOwnerRgd` is NOT
+ * per-instance proof — a DIFFERENT (modern) instance could have stamped it, so a non-empty
+ * RGD-wide set would MASK a legacy instance whose own — possibly different — namespace is
+ * then invisible and pruned. We never approximate from `metadata.namespace` / `spec.namespace`.
+ * The RGD-wide set IS unioned into the returned protected set (a superset catching leaked
+ * namespaces) — it just never SATISFIES the per-instance check. The incoming namespace is
+ * always checked directly by the caller regardless.
+ */
+/**
+ * Injectable API surface for {@link _existingInstanceNamespacesAlchemy} — lets the
+ * deterministic unit test supply mocks instead of a live cluster. Production passes
+ * nothing and the Bun-compatible clients are constructed from the KubeConfig.
+ */
+interface AlchemyPreHoistDeps {
+    objectApi?: {
+        list(apiVersion: string, kind: string): Promise<unknown>;
+    };
+    customApi?: {
+        listClusterCustomObject(request: {
+            group: string;
+            version: string;
+            plural: string;
+        }): Promise<{
+            items?: Array<{
+                metadata?: {
+                    namespace?: unknown;
+                    annotations?: Record<string, string>;
+                };
+                spec?: unknown;
+            }>;
+        }>;
+    };
+    /** The NamespaceListApi passed to {@link listNamespacesOwnedByRgd}. */
+    ownedNamespaceListApi?: Parameters<typeof listNamespacesOwnedByRgd>[2] extends infer O ? O extends {
+        k8sApi?: infer A;
+    } ? A : never : never;
+}
+declare function _existingInstanceNamespacesAlchemy<T extends Enhanced<unknown, unknown>>(props: TypeKroResourceProps<T>, kc: KubeConfig, logger: TypeKroLogger, deps?: AlchemyPreHoistDeps): Promise<Set<string>>;
+/**
+ * Test-only export of the alchemy pre-hoist namespace resolver (finding #1, v7) so the
+ * deterministic unit test can prove the per-instance-exact-or-fail-closed behavior with
+ * injected API mocks (no cluster).
+ */
+export declare const existingInstanceNamespacesAlchemyForTest: typeof _existingInstanceNamespacesAlchemy;
 declare function inferKroDeletionOptions<T extends Enhanced<unknown, unknown>>(props: TypeKroResourceProps<T>): KroDeletionOptions | undefined;
 /** Internal test hook for legacy Alchemy KRO state rehydration. */
 export declare const inferKroDeletionOptionsForTest: typeof inferKroDeletionOptions;

package/dist/alchemy/resource-registration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-registration.d.ts","sourceRoot":"","sources":["../../src/alchemy/resource-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,IAAI,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAO9D,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAGjF,OAAO,KAAK,EAAoB,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAsB,MAAM,6BAA6B,CAAC;AAOhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EACV,0BAA0B,EAG1B,eAAe,EACf,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAoBpB,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,EAAG,qBAA8B,CAAC;AAEhE;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,CAClC,OAAO,iBAAiB,EACxB,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAChD,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAC5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,yCAAwD,CAAC;AAEjF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,gFAgCvB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,OAAO,WAAW,EAC/B,YAAY,EAAE,SAAS,0BAA0B,EAAE,+DAoCpD;AAmED,0DAA0D;AAC1D,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACpD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,mBAAmB,EAAE,MAAM,EAC3B,aAAa,EAAE,OAAO,EACtB,IAAI,EAAE,kBAAkB,GAAG,SAAS,GACnC;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAYpD;AAsMD,iBAAS,uBAAuB,CAAC,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EACnE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC7B,kBAAkB,GAAG,SAAS,CAqDhC;AAED,mEAAmE;AACnE,eAAO,MAAM,8BAA8B,gCAA0B,CAAC;AAoBtE;;;;;;GAMG;AACH,iBAAe,iBAAiB,CAAC,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EACnE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,iDAAiD;AACjD,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AA6C1D,iBAAS,4BAA4B,CAAC,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EACxE,QAAQ,EAAE,CAAC,EACX,aAAa,CAAC,EAAE,aAAa,GAC5B,CAAC,CAaH;AAED,oEAAoE;AACpE,eAAO,MAAM,mCAAmC,qCAA+B,CAAC;AAEhF,wBAAgB,6BAA6B,CAAC,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAChF,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC7B,iBAAiB,CAcnB"}
+{"version":3,"file":"resource-registration.d.ts","sourceRoot":"","sources":["../../src/alchemy/resource-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,IAAI,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI9D,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAMlF,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAIL,wBAAwB,EAGzB,MAAM,8CAA8C,CAAC;AAGtD,OAAO,KAAK,EAAoB,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAsB,MAAM,6BAA6B,CAAC;AAOhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EACV,0BAA0B,EAG1B,eAAe,EACf,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAsBpB,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,EAAG,qBAA8B,CAAC;AAEhE;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,CAClC,OAAO,iBAAiB,EACxB,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAChD,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAC5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,yCAAwD,CAAC;AAEjF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,gFAgCvB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,OAAO,WAAW,EAC/B,YAAY,EAAE,SAAS,0BAA0B,EAAE,+DAoCpD;AAgFD,0DAA0D;AAC1D,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACpD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,mBAAmB,EAAE,MAAM,EAC3B,aAAa,EAAE,OAAO,EACtB,IAAI,EAAE,kBAAkB,GAAG,SAAS,GACnC;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAYpD;AAwED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;;;;GAIG;AACH,UAAU,mBAAmB;IAC3B,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC1D,CAAC;IACF,SAAS,CAAC,EAAE;QACV,uBAAuB,CAAC,OAAO,EAAE;YAC/B,KAAK,EAAE,MAAM,CAAC;YACd,OAAO,EAAE,MAAM,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC;SAChB,GAAG,OAAO,CAAC;YACV,KAAK,CAAC,EAAE,KAAK,CAAC;gBACZ,QAAQ,CAAC,EAAE;oBAAE,SAAS,CAAC,EAAE,OAAO,CAAC;oBAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;iBAAE,CAAC;gBACzE,IAAI,CAAC,EAAE,OAAO,CAAC;aAChB,CAAC,CAAC;SACJ,CAAC,CAAC;KACJ,CAAC;IACF,uEAAuE;IACvE,qBAAqB,CAAC,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,GAClF,CAAC,SAAS;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;KAAE,GAC5B,CAAC,GACD,KAAK,GACP,KAAK,CAAC;CACX;AAED,iBAAe,kCAAkC,CAAC,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EACpF,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAC9B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAkHtB;AAED;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,2CAAqC,CAAC;AAkR3F,iBAAS,uBAAuB,CAAC,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EACnE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC7B,kBAAkB,GAAG,SAAS,CAqDhC;AAED,mEAAmE;AACnE,eAAO,MAAM,8BAA8B,gCAA0B,CAAC;AAoBtE;;;;;;GAMG;AACH,iBAAe,iBAAiB,CAAC,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EACnE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CA8Df;AAED,iDAAiD;AACjD,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AAgD1D,iBAAS,4BAA4B,CAAC,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EACxE,QAAQ,EAAE,CAAC,EACX,aAAa,CAAC,EAAE,aAAa,GAC5B,CAAC,CAaH;AAED,oEAAoE;AACpE,eAAO,MAAM,mCAAmC,qCAA+B,CAAC;AAEhF,wBAAgB,6BAA6B,CAAC,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAChF,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC7B,iBAAiB,CAcnB"}

package/dist/alchemy/resource-registration.js

@@ -22,8 +22,9 @@ import { ensureError } from '../core/errors.js';
 import { createKubernetesClientProvider } from '../core/kubernetes/client-provider.js';
 import { getComponentLogger } from '../core/logging/index.js';
 import { CEL_EXPRESSION_BRAND } from '../core/constants/brands.js';
-import { createBunCompatibleKubernetesObjectApi } from '../core/kubernetes/index.js';
+import { createBunCompatibleCustomObjectsApi, createBunCompatibleKubernetesObjectApi, } from '../core/kubernetes/index.js';
 import { getResourceScope } from '../core/metadata/index.js';
+import { decideNamespaceOwnershipCreateFirst, deleteNamespaceIfEmpty, HOISTED_NAMESPACES_ANNOTATION, listNamespacesOwnedByRgd, NAMESPACE_OWNER_ANNOTATION, readHoistedNamespacesRecord, } from '../core/deployment/kro-namespace-teardown.js';
 import { SINGLETON_SPEC_FINGERPRINT_ANNOTATION } from '../core/deployment/resource-tagging.js';
 import { stableSerialize } from '../core/singleton/singleton.js';
 import { DirectTypeKroDeployer, KroTypeKroDeployer, ResourceGraphDefinitionDeletionDeferredError, } from './deployers.js';
@@ -120,27 +121,37 @@ export function materializeAlchemyResources(kroResource, declarations) {
  */
 async function deployKroResource(props) {
     const logger = getComponentLogger('alchemy-deployment').child({ alchemyType: KRO_RESOURCE_TYPE });
+    // Fail-closed PRE-HOIST guard on the ALCHEMY path (finding #7): before applying a
+    // typekro-hoisted workload Namespace, refuse to proceed if it is still a KRO ApplySet
+    // member from a pre-hoist RGD — rolling the new hoisted RGD over the old one would let
+    // KRO's prune delete it. Cluster-checked here since `toAlchemyResources` is cluster-free.
+    await _assertNoPreHoistNamespaceConflictAlchemy(props, logger);
     // Singleton-owner spec-drift protection (the declarative analog of `assertNoDeployedSingletonSpecDrift`
     // in the imperative deploy path): refuse to clobber a shared singleton that already exists with a
     // different spec. Cluster-checked here since `toAlchemyResources` is intentionally cluster-free.
     await _assertNoSingletonDrift(props, logger);
-    const { deployer, dispose } = await _resolveDeployer(props, 'deployment');
+    // finding #2 (adopted-namespace): the hoisted workload Namespace is stamped
+    // owned-by-this-RGD at BUILD time (cluster-free). READ the live namespace here and
+    // KEEP that stamp ONLY when typekro actually creates it (404) or already owns it;
+    // otherwise strip it so teardown never deletes a namespace typekro merely adopted.
+    const effectiveProps = await _preserveHoistedNamespaceAdoption(props, logger);
+    const { deployer, dispose } = await _resolveDeployer(effectiveProps, 'deployment');
     try {
         // Direct mode: hand the deployer the live state of this resource's dependencies so the engine
         // resolves its cross-resource references + CEL expressions against them (the deps deployed
         // first via alchemy ordering). KRO docs are self-contained, so the seed is irrelevant there.
-        const seedResources = _seedFromDependencies(props);
+        const seedResources = _seedFromDependencies(effectiveProps);
         // alchemy serializes props to state, flattening this resource's CEL refs to `${…}` STRINGS.
         // The engine resolver only evaluates CEL OBJECTS, so (direct mode, with dependency state to
         // resolve against) re-hydrate those strings into template CEL objects before deploying — but
         // ONLY strings that reference a known dependency id, so genuine `${…}` literals (e.g. a shell
         // `${HOME}` in an env var) are left untouched.
-        let resourceForDeploy = props.resource;
-        if (seedResources && props.deploymentStrategy === 'direct') {
-            resourceForDeploy = _rehydrateCelStrings(props.resource, new Set(seedResources.map((s) => s.id)));
+        let resourceForDeploy = effectiveProps.resource;
+        if (seedResources && effectiveProps.deploymentStrategy === 'direct') {
+            resourceForDeploy = _rehydrateCelStrings(effectiveProps.resource, new Set(seedResources.map((s) => s.id)));
         }
-        else if (props.deploymentStrategy === 'kro' &&
-            props.resource.kind !== 'ResourceGraphDefinition') {
+        else if (effectiveProps.deploymentStrategy === 'kro' &&
+            effectiveProps.resource.kind !== 'ResourceGraphDefinition') {
             // KRO CR instance (the custom resource an RGD defines — not the RGD itself). After alchemy
             // serializes props to state, the resource is a plain manifest with no readiness evaluator, so a
             // `waitForReady` deploy throws "No readiness evaluator found for <Kind>". Re-wrap it with
@@ -148,7 +159,7 @@ async function deployKroResource(props) {
             // InstanceSynced) — the same KRO-instance readiness the imperative deploy path waits on. The RGD
             // is excluded (it carries its own evaluator via the resourceGraphDefinition factory).
             const { kroCustomResource } = await import('../factories/kro/kro-custom-resource.js');
-            const r = props.resource;
+            const r = effectiveProps.resource;
             resourceForDeploy = kroCustomResource({
                 apiVersion: r.apiVersion ?? '',
                 kind: r.kind ?? '',
@@ -156,9 +167,11 @@ async function deployKroResource(props) {
                 spec: (r.spec ?? {}),
             });
         }
-        const deployProps = resourceForDeploy === props.resource ? props : { ...props, resource: resourceForDeploy };
+        const deployProps = resourceForDeploy === effectiveProps.resource
+            ? effectiveProps
+            : { ...effectiveProps, resource: resourceForDeploy };
         const { resourceProperties } = await _deployAndCreateResult(deployProps, deployer, seedResources);
-        _logDeploymentSuccess(logger, KRO_RESOURCE_TYPE, props, resourceProperties);
+        _logDeploymentSuccess(logger, KRO_RESOURCE_TYPE, effectiveProps, resourceProperties);
         return resourceProperties;
     }
     catch (error) {
@@ -200,6 +213,226 @@ export function singletonDriftVerdict(expectedFingerprint, deployingSpec, live)
  * fires for resources carrying the singleton spec-fingerprint annotation (i.e. singleton instances);
  * a missing instance / absent CRD / unreachable cluster is treated as "nothing to drift from".
  */
+/**
+ * Fail-closed PRE-HOIST detection for the ALCHEMY deploy path (finding #7). Runs ONLY
+ * for a typekro-hoisted workload Namespace (`namespaceEmptyGate`). If the live namespace
+ * is a KRO ApplySet member (carries `applyset.kubernetes.io/part-of` or any `kro.run/*`
+ * label from a pre-hoist RGD), applying the new hoisted RGD would let KRO's prune delete
+ * it — so THROW. A 404 (fresh) is safe; any OTHER read error FAILS CLOSED (throws).
+ */
+async function _assertNoPreHoistNamespaceConflictAlchemy(props, logger) {
+    if (props.namespaceEmptyGate !== true)
+        return;
+    const incoming = props.resource.metadata?.name;
+    if (typeof incoming !== 'string' || incoming.length === 0)
+        return;
+    const kc = _createClientProvider(props, 'pre-hoist-check');
+    const api = createBunCompatibleKubernetesObjectApi(kc);
+    // The set of namespaces to check: the incoming one PLUS every EXISTING instance's
+    // namespace (finding #7). An upgrade prunes the ApplySet for ALL instances of the
+    // shared RGD at once, so missing one would let KRO delete it.
+    const namespacesToCheck = new Set([incoming]);
+    for (const ns of await _existingInstanceNamespacesAlchemy(props, kc, logger)) {
+        namespacesToCheck.add(ns);
+    }
+    for (const name of namespacesToCheck) {
+        let labels = {};
+        try {
+            const live = (await api.read({
+                apiVersion: 'v1',
+                kind: 'Namespace',
+                metadata: { name },
+            }));
+            labels = live.metadata?.labels ?? {};
+        }
+        catch (error) {
+            const k8sErr = error;
+            const code = k8sErr.statusCode ?? k8sErr.code ?? k8sErr.body?.code;
+            if (code === 404)
+                continue; // fresh namespace — nothing to migrate
+            // FAIL CLOSED: a non-404 read error means we cannot prove the namespace is safe.
+            throw new Error(`Pre-hoist safety check could not read Namespace "${name}" (${ensureError(error).message}). ` +
+                `Refusing to deploy: a hoist over an unreadable namespace could let KRO's ApplySet prune delete it.`);
+        }
+        const partOfKro = typeof labels['applyset.kubernetes.io/part-of'] === 'string' ||
+            Object.keys(labels).some((key) => key.startsWith('kro.run/'));
+        if (partOfKro) {
+            throw new Error(`Pre-hoist deployment detected: the live Namespace "${name}" is a KRO ApplySet member ` +
+                `(carries applyset.kubernetes.io/part-of and/or kro.run/* labels from a pre-hoist RGD). ` +
+                `typekro now HOISTS every owned Namespace out of the RGD, so applying the new RGD in place ` +
+                `would drop "${name}" from KRO's ApplySet and KRO's prune would DELETE it and its workloads. ` +
+                `This upgrade is not auto-migrated — see docs/advanced/migration.md.`);
+        }
+    }
+    logger.debug('Pre-hoist namespace check passed (alchemy)', {
+        namespaces: [...namespacesToCheck],
+    });
+}
+async function _existingInstanceNamespacesAlchemy(props, kc, logger, deps = {}) {
+    const result = new Set();
+    const query = props.namespacePreHoistQuery;
+    if (!query)
+        return result;
+    // STRICT CRD discovery — a list failure FAILS CLOSED (throws).
+    const objectApi = deps.objectApi ?? createBunCompatibleKubernetesObjectApi(kc);
+    const crds = (await objectApi.list('apiextensions.k8s.io/v1', 'CustomResourceDefinition'));
+    const match = crds?.items?.find((crd) => crd.spec?.group === query.group && crd.spec?.names?.kind === query.kind);
+    const plural = match?.spec?.names?.plural;
+    if (!plural)
+        return result; // definitively fresh — no CRD, so no existing instances
+    let items;
+    try {
+        const customApi = deps.customApi ??
+            createBunCompatibleCustomObjectsApi(kc);
+        const listResponse = await customApi.listClusterCustomObject({
+            group: query.group,
+            version: query.version,
+            plural,
+        });
+        items = listResponse.items ?? [];
+    }
+    catch (error) {
+        const k8sErr = error;
+        const status = k8sErr.statusCode ?? k8sErr.code ?? k8sErr.body?.code;
+        if (status === 404)
+            return result; // CRD/instances vanished — fresh
+        throw new Error(`Pre-hoist safety check could not list existing instances of the RGD's CRD ` +
+            `(${ensureError(error).message}). Refusing to deploy: another instance's namespace could ` +
+            `be pruned by the hoist without being checked.`);
+    }
+    if (items.length === 0)
+        return result;
+    // The RGD-wide record of every namespace this RGD created: namespaces carrying
+    // `typekro.io/created-by-rgd == props.namespaceOwnerRgd`. We union it into the PROTECTED set
+    // as a superset (it catches namespaces leaked by an interrupted teardown), but it is NOT
+    // used to satisfy the per-instance check below (finding #1, v7) — being RGD-wide it cannot
+    // prove a SPECIFIC instance's namespaces. A list error FAILS CLOSED.
+    const ownerRgd = props.namespaceOwnerRgd;
+    const ownedNamespaces = new Set();
+    if (typeof ownerRgd === 'string' && ownerRgd.length > 0) {
+        let owned;
+        try {
+            owned = await listNamespacesOwnedByRgd(kc, ownerRgd, {
+                logger,
+                ...(deps.ownedNamespaceListApi ? { k8sApi: deps.ownedNamespaceListApi } : {}),
+            });
+        }
+        catch (error) {
+            throw new Error(`Pre-hoist safety check could not list namespaces owned by RGD "${ownerRgd}" ` +
+                `(${ensureError(error).message}). Refusing to deploy: without the durable ownership ` +
+                `record we cannot prove the hoist won't prune an existing instance's namespace.`);
+        }
+        for (const ns of owned)
+            ownedNamespaces.add(ns);
+        for (const ns of ownedNamespaces)
+            result.add(ns);
+    }
+    for (const item of items) {
+        // Resolve THIS instance's namespaces from its OWN exact PER-INSTANCE record — the CR
+        // `typekro.io/hoisted-namespaces` annotation (finding #1, v7). It carries the instance's
+        // EXACT hoisted names (a name derived from an arbitrary spec field round-trips) and is the
+        // ONLY per-instance proof.
+        const record = readHoistedNamespacesRecord(item.metadata?.annotations?.[HOISTED_NAMESPACES_ANNOTATION]);
+        if (record.status === 'present') {
+            // A VALID record — including an explicit empty `[]` — is per-instance proof: this instance
+            // hoists exactly these namespaces (possibly none). Resolved; do NOT fail closed.
+            for (const ns of record.names)
+                result.add(ns);
+            continue;
+        }
+        // MISSING or MALFORMED record → NO per-instance exact record. FAIL CLOSED (finding #1, v7). We do NOT
+        // fall back to the RGD-wide `created-by-rgd` set: being RGD-wide it is not per-instance
+        // proof — a DIFFERENT (modern) instance could have stamped it, so a non-empty set would
+        // MASK this legacy instance whose own — possibly different — owned namespace is then
+        // invisible and pruned. Nor do we approximate from metadata.namespace / spec.namespace.
+        throw new Error(`Pre-hoist safety check found an existing instance with no per-instance namespace record — ` +
+            `its CR carries no "${HOISTED_NAMESPACES_ANNOTATION}" annotation. The RGD-wide ` +
+            `"${NAMESPACE_OWNER_ANNOTATION}${ownerRgd ? `=${ownerRgd}` : ''}" set is NOT per-instance ` +
+            `proof (another instance could have stamped it), so this instance's own owned namespace ` +
+            `could be pruned by the hoist unseen. Refusing to deploy: migrate it (redeploy with a ` +
+            `current TypeKro so its namespaces are recorded) and retry.`);
+    }
+    logger.debug('Enumerated existing-instance namespaces for the alchemy pre-hoist check', {
+        count: result.size,
+    });
+    return result;
+}
+/**
+ * Test-only export of the alchemy pre-hoist namespace resolver (finding #1, v7) so the
+ * deterministic unit test can prove the per-instance-exact-or-fail-closed behavior with
+ * injected API mocks (no cluster).
+ */
+export const existingInstanceNamespacesAlchemyForTest = _existingInstanceNamespacesAlchemy;
+/**
+ * finding #2 (alchemy adopted-namespace, mirrors the imperative `applyRetainedHoistedNamespace`
+ * create-vs-adopt logic): the hoisted workload Namespace carries a build-time
+ * `typekro.io/created-by-rgd` ownership stamp (added cluster-free in
+ * `buildHoistedNamespaceResource`). Applying it unconditionally would let the empty-gated
+ * teardown DELETE a namespace typekro merely ADOPTED. So READ the live namespace and keep
+ * the stamp ONLY when typekro truly creates it (404) or already owns it (stamp already ==
+ * this RGD); otherwise STRIP the stamp from the resource before apply so the live namespace
+ * never carries our ownership record and teardown retains it. `namespaceOwnerRgd` is KEPT on
+ * props either way — at delete time the empty-gate compares the LIVE annotation to it, and a
+ * stripped/adopted namespace (no matching annotation) is retained.
+ *
+ * Returns props unchanged for non-hoisted-namespace resources or when the stamp should
+ * stay; otherwise a shallow copy whose resource has the ownership annotation removed.
+ */
+async function _preserveHoistedNamespaceAdoption(props, logger) {
+    if (props.namespaceEmptyGate !== true || props.namespaceOwnerRgd === undefined)
+        return props;
+    const name = props.resource.metadata?.name;
+    if (typeof name !== 'string' || name.length === 0)
+        return props;
+    const kc = _createClientProvider(props, 'ownership-check');
+    const api = createBunCompatibleKubernetesObjectApi(kc);
+    // CREATE-FIRST ownership (finding #3), matching the imperative path: attempt to CREATE
+    // the namespace WITH the build-time stamp. A 201 is atomic proof typekro created it
+    // (owned). A 409 means it already exists — owned ONLY if a prior create by this RGD
+    // stamped it; otherwise adopted. This replaces the raceable read→(404)→own decision:
+    // there is no window in which another actor creates the namespace between our read and
+    // our claim. The generic deployer still SSA-applies the full config afterwards
+    // (idempotent), so a 201 here is not the final apply — it is the ownership PROBE.
+    let ownsNamespace;
+    try {
+        const decision = await decideNamespaceOwnershipCreateFirst(api, props.resource, props.namespaceOwnerRgd);
+        ownsNamespace = decision.owned;
+    }
+    catch (error) {
+        // A non-conflict CREATE failure (or a failed conflict-read) — do NOT claim ownership
+        // (conservative: a namespace we cannot provably create/own must not be stampable, or
+        // teardown might delete an adopted one). The deployer's SSA apply below surfaces the
+        // real error if the cluster is genuinely broken.
+        logger.debug('Create-first ownership probe failed; treating as adopted (alchemy)', {
+            namespace: name,
+            rgd: props.namespaceOwnerRgd,
+            error: ensureError(error).message,
+        });
+        ownsNamespace = false;
+    }
+    if (ownsNamespace)
+        return props; // keep the build-time ownership stamp
+    logger.debug('Preserving namespace adoption — stripping build-time ownership stamp (alchemy)', {
+        namespace: name,
+        rgd: props.namespaceOwnerRgd,
+    });
+    return { ...props, resource: _stripNamespaceOwnerAnnotation(props.resource) };
+}
+/**
+ * Return a shallow copy of a Namespace resource with the `typekro.io/created-by-rgd`
+ * ownership annotation removed. Used by {@link _preserveHoistedNamespaceAdoption} to avoid
+ * stamping ownership onto an adopted namespace. By reconcile time alchemy has JSON-round-
+ * tripped props to state (no symbols/brands), so a shallow object copy is safe here.
+ */
+function _stripNamespaceOwnerAnnotation(resource) {
+    const src = resource;
+    const annotations = { ...(src.metadata?.annotations ?? {}) };
+    delete annotations[NAMESPACE_OWNER_ANNOTATION];
+    return {
+        ...resource,
+        metadata: { ...(src.metadata ?? {}), annotations },
+    };
+}
 async function _assertNoSingletonDrift(props, logger) {
     const resource = props.resource;
     const expected = resource.metadata?.annotations?.[SINGLETON_SPEC_FINGERPRINT_ANNOTATION];
@@ -308,6 +541,9 @@ function propsFromOutput(output) {
         deploymentStrategy: output.deploymentStrategy ?? 'kro',
         ...(output.kubeConfigOptions !== undefined && { kubeConfigOptions: output.kubeConfigOptions }),
         ...(output.kroDeletion !== undefined && { kroDeletion: output.kroDeletion }),
+        ...(output.retain === true && { retain: true }),
+        ...(output.namespaceEmptyGate === true && { namespaceEmptyGate: true }),
+        ...(output.namespaceOwnerRgd !== undefined && { namespaceOwnerRgd: output.namespaceOwnerRgd }),
     };
 }
 /**
@@ -423,6 +659,46 @@ async function _resolveDeployer(props, phase) {
  */
 async function deleteKroResource(props) {
     const logger = getComponentLogger('alchemy-deployment').child({ alchemyType: KRO_RESOURCE_TYPE });
+    // Retained (shared) resources — e.g. the KRO instance control-plane Namespace —
+    // must survive a single stack's teardown/prune: another stack targeting the same
+    // workload namespace may still have KRO instances inside it. Drop only the state
+    // entry (like the deferred shared-RGD delete below), leaving the object on-cluster.
+    if (props.retain === true) {
+        logger.debug('Skipping delete: resource is retained (shared); dropping state entry only', {
+            resourceName: props.resource.metadata?.name,
+            namespace: props.namespace,
+        });
+        return;
+    }
+    // Empty-gated Namespace teardown (findings #3 + #4): a typekro-hoisted workload
+    // Namespace is deleted ONLY if empty and RETAINED if another stack/user still has
+    // resources inside it. Alchemy's reverse-topo teardown runs this AFTER the RGD +
+    // instance that `dependsOn` it are gone; the instance is deleted FIRST and its delete
+    // waits for the CR's `kro.run/finalizer` to clear (KRO graph-deletes all children),
+    // so by the time this runs everything THIS instance owned has already drained from
+    // the namespace (finding #1's ordering, provided here by the dependency graph + the
+    // instance-drain wait rather than an in-line CRD-404 wait; the gate is fail-safe
+    // regardless). Replaces the old retain-by-name-equality distinction — runtime
+    // emptiness is the truth for both the instance's own namespace and a shared one.
+    if (props.namespaceEmptyGate === true) {
+        const namespaceName = props.resource.metadata?.name;
+        if (typeof namespaceName !== 'string' || namespaceName.length === 0) {
+            logger.warn('Empty-gated namespace teardown skipped: resource has no metadata.name', {
+                namespace: props.namespace,
+            });
+            return;
+        }
+        const kubeConfig = _createClientProvider(props, 'delete');
+        await deleteNamespaceIfEmpty(kubeConfig, namespaceName, {
+            logger,
+            // Ownership record (finding #4) + gated delete (finding #1): only delete a
+            // namespace this composition's RGD created, and gate it to a real 404.
+            ...(props.namespaceOwnerRgd !== undefined && { ownedByRgd: props.namespaceOwnerRgd }),
+            ...(props.options?.timeout !== undefined && { timeoutMs: props.options.timeout }),
+            context: { alchemyType: KRO_RESOURCE_TYPE },
+        });
+        return;
+    }
     const { deployer, dispose } = await _resolveDeployer(props, 'delete');
     try {
         await deployer.delete(props.resource, {
@@ -473,6 +749,9 @@ async function _deployAndCreateResult(props, deployer, seedResources) {
         deploymentStrategy: props.deploymentStrategy,
         ...(props.kubeConfigOptions !== undefined && { kubeConfigOptions: props.kubeConfigOptions }),
         ...(props.kroDeletion !== undefined && { kroDeletion: props.kroDeletion }),
+        ...(props.retain === true && { retain: true }),
+        ...(props.namespaceEmptyGate === true && { namespaceEmptyGate: true }),
+        ...(props.namespaceOwnerRgd !== undefined && { namespaceOwnerRgd: props.namespaceOwnerRgd }),
         deployedResource: cleanDeployedResource,
         ready: true,
         deployedAt: Date.now(),