typekro 0.3.1 → 0.5.0

package/dist/core/deployment/kro-factory.js

@@ -5,15 +5,24 @@
  * using the Kro controller for dependency resolution and resource management.
  */
 import * as k8s from '@kubernetes/client-node';
-import { createAlchemyResourceId, ensureResourceTypeRegistered, KroTypeKroDeployer, } from '../../alchemy/deployment.js';
-import { kroCustomResource } from '../../factories/kro/kro-custom-resource.js';
-import { resourceGraphDefinition } from '../../factories/kro/resource-graph-definition.js';
-import { createKubernetesClientProvider, createKubernetesClientProviderWithKubeConfig, } from '../kubernetes/client-provider.js';
+import { compile as compileExpression } from 'angular-expressions';
+import { preserveNonEnumerableProperties } from '../../utils/helpers.js';
+import { DEFAULT_DEPLOYMENT_TIMEOUT, DEFAULT_KRO_INSTANCE_TIMEOUT, DEFAULT_RGD_TIMEOUT, } from '../config/defaults.js';
+import { CEL_EXPRESSION_BRAND } from '../constants/brands.js';
+import { CRDInstanceError, ensureError, ResourceGraphFactoryError } from '../errors.js';
+import { createBunCompatibleKubernetesObjectApi } from '../kubernetes/index.js';
 import { getComponentLogger } from '../logging/index.js';
 import { createSchemaProxy, DeploymentMode } from '../references/index.js';
+// Dependency inversion: kroCustomResource, resourceGraphDefinition, and
+// alchemy bridge are injected via FactoryOptions providers (Phase 3.5)
+// instead of dynamic import() from higher layers.
+import { getResourceId } from '../resources/id.js';
 import { generateKroSchemaFromArktype } from '../serialization/schema.js';
 import { serializeResourceGraphToYaml } from '../serialization/yaml.js';
+import { KubernetesClientManager } from './client-provider-manager.js';
 import { DirectDeploymentEngine } from './engine.js';
+import { waitForKroInstanceReady as waitForKroInstanceReadyShared } from './kro-readiness.js';
+import { convertToKubernetesName, generateInstanceName, pluralizeKind, validateSpec, } from './shared-utilities.js';
 /**
  * KroResourceFactory implementation
  *
@@ -34,23 +43,31 @@ export class KroResourceFactoryImpl {
     alchemyScope;
     logger = getComponentLogger('kro-factory');
     factoryOptions;
-    clientProvider;
+    clientManager;
+    // Dependency-inversion providers (Phase 3.5) — injected via FactoryOptions
+    // instead of dynamic import() from factories/ and alchemy/ layers.
+    kroCustomResourceProvider;
+    rgdProvider;
+    alchemyBridge;
     constructor(name, resources, schemaDefinition, statusMappings, options = {}) {
         this.name = name;
         this.namespace = options.namespace || 'default';
         this.alchemyScope = options.alchemyScope;
         this.isAlchemyManaged = !!options.alchemyScope;
-        this.rgdName = this.convertToKubernetesName(name); // Convert to valid Kubernetes resource name
+        this.rgdName = convertToKubernetesName(name); // Convert to valid Kubernetes resource name
         this.resources = resources;
         this.closures = options.closures || {};
         this.schemaDefinition = schemaDefinition;
         this.statusMappings = statusMappings;
         this.factoryOptions = options;
+        this.clientManager = new KubernetesClientManager(options);
         this.schema = createSchemaProxy();
+        // Injected providers — fall back to dynamic import() for backward compatibility
+        this.kroCustomResourceProvider = options.kroCustomResourceProvider;
+        this.rgdProvider = options.rgdProvider;
+        this.alchemyBridge = options.alchemyBridge;
         // Validate closures for Kro mode - detect KubernetesRef inputs and raise clear errors
         this.validateClosuresForKroMode();
-        // Don't initialize client provider in constructor - do it lazily when needed
-        // This allows tests to create factories without requiring a kubeconfig
     }
     /**
      * Validate closures for Kro mode compatibility
@@ -68,75 +85,33 @@ export class KroResourceFactoryImpl {
             closureNames: Object.keys(this.closures),
         });
     }
-    /**
-     * Convert camelCase resource graph name to valid Kubernetes resource name (kebab-case)
-     */
-    convertToKubernetesName(name) {
-        // Validate input name
-        if (!name || typeof name !== 'string') {
-            throw new Error(`Invalid resource graph name: ${JSON.stringify(name)}. Resource graph name must be a non-empty string.`);
-        }
-        const trimmedName = name.trim();
-        if (trimmedName.length === 0) {
-            throw new Error(`Invalid resource graph name: Resource graph name cannot be empty or whitespace-only.`);
-        }
-        // Convert to kebab-case and validate result
-        const kubernetesName = trimmedName
-            .replace(/([a-z])([A-Z])/g, '$1-$2') // Insert dash before capital letters
-            .toLowerCase(); // Convert to lowercase
-        // Validate Kubernetes naming conventions
-        if (!/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(kubernetesName)) {
-            throw new Error(`Invalid resource graph name: "${name}" converts to "${kubernetesName}" which is not a valid Kubernetes resource name. Names must consist of lowercase alphanumeric characters or '-', and must start and end with an alphanumeric character.`);
-        }
-        if (kubernetesName.length > 253) {
-            throw new Error(`Invalid resource graph name: "${name}" converts to "${kubernetesName}" which exceeds the 253 character limit for Kubernetes resource names.`);
-        }
-        return kubernetesName;
-    }
     /**
      * Get or create the Kubernetes client provider (lazy initialization)
      */
     getClientProvider() {
-        if (!this.clientProvider) {
-            this.clientProvider = this.createClientProvider(this.factoryOptions);
-        }
-        return this.clientProvider;
+        return this.clientManager.getClientProvider();
     }
     /**
-     * Create and configure the Kubernetes client provider
+     * Get the Kubernetes config from the centralized provider
      */
-    createClientProvider(options) {
-        // If a pre-configured kubeConfig is provided, use it directly
-        if (options.kubeConfig) {
-            this.logger.debug('Using pre-configured KubeConfig from factory options');
-            return createKubernetesClientProviderWithKubeConfig(options.kubeConfig);
-        }
-        // Create client provider with configuration from factory options
-        const clientConfig = {
-            ...(options.skipTLSVerify !== undefined && { skipTLSVerify: options.skipTLSVerify }),
-            // Add other configuration options as needed
-        };
-        this.logger.debug('Creating new KubernetesClientProvider with configuration', {
-            skipTLSVerify: clientConfig.skipTLSVerify,
-        });
-        return createKubernetesClientProvider(clientConfig);
+    getKubeConfig() {
+        return this.clientManager.getKubeConfig();
     }
     /**
-     * Get the Kubernetes config from the centralized provider
+     * Get CustomObjectsApi client
      */
-    getKubeConfig() {
-        const clientProvider = this.getClientProvider();
-        return clientProvider.getKubeConfig();
+    getCustomObjectsApi() {
+        return this.clientManager.getCustomObjectsApi();
     }
     /**
      * Deploy a new instance by creating a custom resource
      */
     async deploy(spec) {
         // Validate spec against ArkType schema
-        const validationResult = this.schemaDefinition.spec(spec);
-        if (validationResult instanceof Error) {
-            throw new Error(`Invalid spec: ${validationResult.message}`);
-        }
+        validateSpec(spec, this.schemaDefinition, {
+            kind: this.schemaDefinition.kind,
+            name: this.name,
+        });
         // Execute closures before RGD creation (Kro mode requirement)
         await this.executeClosuresBeforeRGD(spec);
         if (this.isAlchemyManaged) {
@@ -161,11 +136,11 @@ export class KroResourceFactoryImpl {
         // The closures returned by the resource builder are deployment closures that expect a DeploymentContext
         // We need to execute them with a mock context to trigger validation
         const mockDeploymentContext = {
-            kubernetesApi: null, // Not needed for validation
+            // kubernetesApi intentionally omitted - not needed for validation
             namespace: this.namespace,
             deployedResources: new Map(),
             resolveReference: async (ref) => {
-                throw new Error(`Kro mode does not support dynamic reference resolution. Found reference: ${ref.resourceId}.${ref.fieldPath}`);
+                throw new ResourceGraphFactoryError(`Kro mode does not support dynamic reference resolution. Found reference: ${ref.resourceId}.${ref.fieldPath}`, this.name, 'deployment');
             },
         };
         for (const [closureName, closure] of Object.entries(this.closures)) {
@@ -180,18 +155,21 @@ export class KroResourceFactoryImpl {
                     throw error;
                 }
                 // For other errors, wrap them with context
-                throw new Error(`Failed to validate closure '${closureName}': ${error}`);
+                throw new ResourceGraphFactoryError(`Failed to validate closure '${closureName}': ${ensureError(error).message}`, this.name, 'deployment');
             }
         }
         const allResults = [];
         // Only create deployment context after validation passes
+        // Use createBunCompatibleKubernetesObjectApi which handles both Bun and Node.js
+        const kubeConfig = this.getKubeConfig();
         const deploymentContext = {
-            kubernetesApi: this.getKubeConfig().makeApiClient(k8s.KubernetesObjectApi),
+            kubernetesApi: createBunCompatibleKubernetesObjectApi(kubeConfig),
+            kubeConfig: kubeConfig,
             ...(this.alchemyScope && { alchemyScope: this.alchemyScope }),
             namespace: this.namespace,
             deployedResources: new Map(), // Empty for pre-RGD execution
             resolveReference: async (ref) => {
-                throw new Error(`Kro mode does not support dynamic reference resolution. Found reference: ${ref.resourceId}.${ref.fieldPath}`);
+                throw new ResourceGraphFactoryError(`Kro mode does not support dynamic reference resolution. Found reference: ${ref.resourceId}.${ref.fieldPath}`, this.name, 'deployment');
             },
         };
         // Execute closures sequentially to maintain order
@@ -219,9 +197,9 @@ export class KroResourceFactoryImpl {
                 }
                 this.logger.error('Closure execution failed', {
                     name: closureName,
-                    message: error instanceof Error ? error.message : String(error),
+                    message: ensureError(error).message,
                 });
-                throw new Error(`Failed to execute closure '${closureName}': ${error instanceof Error ? error.message : String(error)}`);
+                throw new ResourceGraphFactoryError(`Failed to execute closure '${closureName}': ${ensureError(error).message}`, this.name, 'deployment', ensureError(error));
             }
         }
         this.logger.info('All closures executed successfully', {
@@ -238,9 +216,11 @@ export class KroResourceFactoryImpl {
         // Create DirectDeploymentEngine with KRO mode for CEL string conversion
         const deploymentEngine = new DirectDeploymentEngine(this.getKubeConfig(), undefined, undefined, DeploymentMode.KRO);
         // Create custom resource instance
-        const instanceName = this.generateInstanceName(spec);
+        const instanceName = generateInstanceName(spec, this.name);
         const customResourceData = this.createCustomResourceInstance(instanceName, spec);
         // Wrap with kroCustomResource factory to get Enhanced object with readiness evaluation
+        const kroCustomResource = this.kroCustomResourceProvider ??
+            (await import('../../factories/kro/kro-custom-resource.js')).kroCustomResource;
         const enhancedCustomResource = kroCustomResource({
             apiVersion: customResourceData.apiVersion,
             kind: customResourceData.kind,
@@ -261,27 +241,28 @@ export class KroResourceFactoryImpl {
             },
             spec: customResourceData.spec, // Use spec directly from customResourceData to ensure it's preserved
         };
-        // Preserve the readiness evaluator (non-enumerable property)
-        const readinessEvaluator = enhancedCustomResource.readinessEvaluator;
-        if (readinessEvaluator) {
-            Object.defineProperty(deployableResource, 'readinessEvaluator', {
-                value: readinessEvaluator,
-                enumerable: false,
-                configurable: false,
-                writable: false,
-            });
-        }
+        // Preserve non-enumerable properties (readinessEvaluator, __resourceId) lost during spread
+        preserveNonEnumerableProperties(enhancedCustomResource, deployableResource);
         // Deploy without waiting for readiness - we'll handle that ourselves
+        this.logger.info('Deploying Kro instance', { instanceName, rgdName: this.rgdName });
         const _deployedResource = await deploymentEngine.deployResource(deployableResource, {
             mode: 'kro',
             namespace: this.namespace,
             waitForReady: false, // We'll handle Kro-specific readiness ourselves
-            timeout: this.factoryOptions.timeout || 300000,
+            timeout: this.factoryOptions.timeout || DEFAULT_DEPLOYMENT_TIMEOUT,
+        });
+        this.logger.info('Instance deployed, checking readiness', {
+            instanceName,
+            rgdName: this.rgdName,
         });
         // Handle Kro-specific readiness checking if requested
         if (this.factoryOptions.waitForReady ?? true) {
-            await this.waitForKroInstanceReady(instanceName, this.factoryOptions.timeout || 600000); // 10 minutes
+            await this.waitForKroInstanceReady(instanceName, this.factoryOptions.timeout || DEFAULT_KRO_INSTANCE_TIMEOUT); // 10 minutes
         }
+        this.logger.info('Instance ready, creating enhanced proxy', {
+            instanceName,
+            rgdName: this.rgdName,
+        });
         // Create Enhanced proxy for the deployed instance
         return await this.createEnhancedProxy(spec, instanceName);
     }
@@ -292,12 +273,14 @@ export class KroResourceFactoryImpl {
      */
     async deployWithAlchemy(spec) {
         if (!this.alchemyScope) {
-            throw new Error('Alchemy scope is required for alchemy deployment');
+            throw new ResourceGraphFactoryError('Alchemy scope is required for alchemy deployment', this.name, 'deployment');
         }
         // Use static registration functions
         // Create deployer instance using DirectDeploymentEngine with KRO mode
         const kroEngine = new DirectDeploymentEngine(this.getKubeConfig(), undefined, undefined, DeploymentMode.KRO);
-        const deployer = new KroTypeKroDeployer(kroEngine);
+        const deployer = this.alchemyBridge
+            ? this.alchemyBridge.createDeployer(kroEngine)
+            : new (await import('../../alchemy/deployment.js')).KroTypeKroDeployer(kroEngine);
         // 1. Ensure RGD is deployed via alchemy (once per factory)
         const kroSchema = generateKroSchemaFromArktype(this.name, this.schemaDefinition, this.resources, this.statusMappings);
         const rgdManifest = {
@@ -310,37 +293,43 @@ export class KroResourceFactoryImpl {
             spec: {
                 schema: kroSchema,
                 resources: Object.values(this.resources).map((resource) => ({
-                    id: resource.id || resource.metadata?.name || 'unknown',
+                    id: getResourceId(resource),
                     template: resource,
                 })),
             },
         };
         // Register RGD type dynamically
-        const rgdEnhanced = resourceGraphDefinition(rgdManifest);
-        const RGDProvider = ensureResourceTypeRegistered(rgdEnhanced);
-        const rgdId = createAlchemyResourceId(rgdEnhanced, this.namespace);
+        const rgdFactory = this.rgdProvider ??
+            (await import('../../factories/kro/resource-graph-definition.js')).resourceGraphDefinition;
+        const rgdEnhanced = rgdFactory(rgdManifest);
+        const bridge = this.alchemyBridge ?? (await import('../../alchemy/deployment.js'));
+        const RGDProvider = bridge.ensureResourceTypeRegistered(rgdEnhanced);
+        const rgdId = bridge.createAlchemyResourceId(rgdEnhanced, this.namespace);
         await RGDProvider(rgdId, {
             resource: rgdEnhanced,
             namespace: this.namespace,
             deployer: deployer,
             options: {
                 waitForReady: true,
-                timeout: 60000, // RGD should be ready quickly
+                timeout: DEFAULT_RGD_TIMEOUT, // RGD should be ready quickly
             },
         });
         // 2. Create instance via alchemy (once per deploy call)
-        const instanceName = this.generateInstanceName(spec);
+        const instanceName = generateInstanceName(spec, this.name);
         const crdInstanceManifest = this.createCustomResourceInstance(instanceName, spec);
         // Register CRD instance type dynamically
-        const CRDInstanceProvider = ensureResourceTypeRegistered(crdInstanceManifest);
-        const instanceId = createAlchemyResourceId(crdInstanceManifest, this.namespace);
+        // Cast required: crdInstanceManifest is a plain KubernetesResource, but alchemy functions
+        // expect Enhanced<unknown, unknown>. They only access kind/metadata.name for type inference.
+        const crdAsEnhanced = crdInstanceManifest;
+        const CRDInstanceProvider = bridge.ensureResourceTypeRegistered(crdAsEnhanced);
+        const instanceId = bridge.createAlchemyResourceId(crdAsEnhanced, this.namespace);
         await CRDInstanceProvider(instanceId, {
-            resource: crdInstanceManifest,
+            resource: crdAsEnhanced,
             namespace: this.namespace,
             deployer: deployer,
             options: {
                 waitForReady: this.factoryOptions.waitForReady ?? true,
-                timeout: this.factoryOptions.timeout ?? 300000,
+                timeout: this.factoryOptions.timeout ?? DEFAULT_DEPLOYMENT_TIMEOUT,
             },
         });
         // Create Enhanced proxy for the deployed instance
@@ -351,40 +340,50 @@ export class KroResourceFactoryImpl {
      */
     async getInstances() {
         const kubeConfig = this.getKubeConfig();
-        const customApi = kubeConfig.makeApiClient(k8s.CustomObjectsApi);
+        // Use Bun-compatible API client to ensure proper TLS handling
+        const { createBunCompatibleCustomObjectsApi } = await import('../kubernetes/bun-api-client.js');
+        const customApi = createBunCompatibleCustomObjectsApi(kubeConfig);
         try {
             // The schema definition should contain just the version part (e.g., 'v1alpha1')
             // If it somehow contains the full API version, extract just the version part
             const version = this.schemaDefinition.apiVersion.includes('/')
                 ? this.schemaDefinition.apiVersion.split('/')[1] || this.schemaDefinition.apiVersion
                 : this.schemaDefinition.apiVersion;
-            const listResponse = await customApi.listNamespacedCustomObject('kro.run', version, this.namespace, `${this.schemaDefinition.kind.toLowerCase()}s` // Pluralize the kind
-            );
-            const instances = listResponse.body.items || [];
+            // In the new API, methods take request objects and return objects directly
+            const listResponse = await customApi.listNamespacedCustomObject({
+                group: 'kro.run',
+                version,
+                namespace: this.namespace,
+                plural: `${this.schemaDefinition.kind.toLowerCase()}s`, // Pluralize the kind
+            });
+            const listResult = listResponse;
+            const instances = listResult.items || [];
             return await Promise.all(instances.map(async (instance) => {
-                return await this.createEnhancedProxy(instance.spec, instance.metadata.name);
+                return await this.createEnhancedProxy(instance.spec, instance.metadata?.name || 'unknown');
             }));
         }
         catch (error) {
             const k8sError = error;
             // If the CRD doesn't exist yet or there are no instances, return empty array
+            const bodyString = typeof k8sError.body === 'string' ? k8sError.body : JSON.stringify(k8sError.body || '');
             if (k8sError.message?.includes('not found') ||
                 k8sError.message?.includes('404') ||
-                k8sError.body?.includes('not found') ||
-                k8sError.body?.includes('404') ||
+                bodyString.includes('not found') ||
+                bodyString.includes('404') ||
                 k8sError.statusCode === 404 ||
                 String(error).includes('404') ||
                 String(error).includes('not found')) {
                 return [];
             }
-            throw new Error(`Failed to list instances: ${k8sError.message || String(error)}`);
+            throw new CRDInstanceError(`Failed to list instances: ${k8sError.message || String(error)}`, this.schemaDefinition.apiVersion, this.schemaDefinition.kind, '*', 'statusResolution', ensureError(error));
         }
     }
     /**
      * Delete a specific instance by name
      */
     async deleteInstance(name) {
-        const k8sApi = this.getKubeConfig().makeApiClient(k8s.KubernetesObjectApi);
+        const kubeConfig = this.getKubeConfig();
+        const k8sApi = createBunCompatibleKubernetesObjectApi(kubeConfig);
         const apiVersion = this.schemaDefinition.apiVersion.includes('/')
             ? this.schemaDefinition.apiVersion
             : `kro.run/${this.schemaDefinition.apiVersion}`;
@@ -401,7 +400,7 @@ export class KroResourceFactoryImpl {
         catch (error) {
             const k8sError = error;
             if (k8sError.statusCode !== 404) {
-                throw new Error(`Failed to delete instance ${name}: ${k8sError.message || String(error)}`);
+                throw new CRDInstanceError(`Failed to delete instance ${name}: ${k8sError.message || String(error)}`, this.schemaDefinition.apiVersion, this.schemaDefinition.kind, name, 'deletion', ensureError(error));
             }
             // Instance already deleted, ignore 404
         }
@@ -425,8 +424,10 @@ export class KroResourceFactoryImpl {
      * Get ResourceGraphDefinition status
      */
     async getRGDStatus() {
-        const k8sApi = this.getKubeConfig().makeApiClient(k8s.KubernetesObjectApi);
+        const kubeConfig = this.getKubeConfig();
+        const k8sApi = createBunCompatibleKubernetesObjectApi(kubeConfig);
         try {
+            // In the new API, methods return objects directly (no .body wrapper)
             const response = await k8sApi.read({
                 apiVersion: 'kro.run/v1alpha1',
                 kind: 'ResourceGraphDefinition',
@@ -435,7 +436,7 @@ export class KroResourceFactoryImpl {
                     namespace: this.namespace,
                 },
             });
-            const rgd = response.body;
+            const rgd = response;
             // Map Kro's state to our phase enum
             let phase = 'pending';
             if (rgd.status?.state === 'Active') {
@@ -455,14 +456,24 @@ export class KroResourceFactoryImpl {
         }
         catch (error) {
             const k8sError = error;
-            if (k8sError.statusCode === 404) {
+            // Check for 404 in multiple ways since different API clients report it differently
+            const bodyString = typeof k8sError.body === 'string' ? k8sError.body : JSON.stringify(k8sError.body || '');
+            const is404 = k8sError.statusCode === 404 ||
+                k8sError.message?.includes('404') ||
+                k8sError.message?.includes('not found') ||
+                k8sError.message?.includes('NotFound') ||
+                bodyString.includes('"code":404') ||
+                bodyString.includes('"reason":"NotFound"') ||
+                String(error).includes('404') ||
+                String(error).includes('not found');
+            if (is404) {
                 return {
                     name: this.rgdName,
                     phase: 'pending',
                     conditions: [],
                 };
             }
-            throw new Error(`Failed to get RGD status: ${k8sError.message || String(error)}`);
+            throw new ResourceGraphFactoryError(`Failed to get RGD status: ${k8sError.message || String(error)}`, this.name, 'getInstance', ensureError(error));
         }
     }
     /**
@@ -471,7 +482,7 @@ export class KroResourceFactoryImpl {
     toYaml(spec) {
         if (spec) {
             // Generate CRD instance YAML
-            const instanceName = this.generateInstanceName(spec);
+            const instanceName = generateInstanceName(spec, this.name);
             const customResource = this.createCustomResourceInstance(instanceName, spec);
             return `apiVersion: ${customResource.apiVersion}
 kind: ${customResource.kind}
@@ -511,56 +522,71 @@ ${Object.entries(spec)
             },
         };
         // Create Enhanced RGD with readiness evaluator
-        const enhancedRGD = resourceGraphDefinition(rgdWithMetadata);
+        const rgdFactory = this.rgdProvider ??
+            (await import('../../factories/kro/resource-graph-definition.js')).resourceGraphDefinition;
+        const enhancedRGD = rgdFactory(rgdWithMetadata);
+        // Create a deployable resource with the required 'id' field
+        const deployableRGD = {
+            ...enhancedRGD,
+            id: this.rgdName,
+        };
+        // Preserve non-enumerable properties (readinessEvaluator, __resourceId) lost during spread
+        preserveNonEnumerableProperties(enhancedRGD, deployableRGD);
         // Debug: Log the RGD being deployed
         this.logger.debug('Deploying RGD', {
             rgdName: this.rgdName,
-            rgdManifest: JSON.stringify(rgdWithMetadata, null, 2)
+            rgdManifest: JSON.stringify(rgdWithMetadata, null, 2),
         });
         try {
             // Deploy RGD using DirectDeploymentEngine with readiness checking
-            await deploymentEngine.deployResource(enhancedRGD, {
+            this.logger.info('Deploying RGD via engine', { rgdName: this.rgdName });
+            await deploymentEngine.deployResource(deployableRGD, {
                 mode: 'direct',
                 namespace: this.namespace,
                 waitForReady: true,
-                timeout: this.factoryOptions.timeout || 60000,
+                timeout: this.factoryOptions.timeout || DEFAULT_RGD_TIMEOUT,
             });
+            this.logger.info('RGD deployed, waiting for CRD', { rgdName: this.rgdName });
             // Wait for the CRD to be created by Kro using DirectDeploymentEngine
             await this.waitForCRDReadyWithEngine(deploymentEngine);
+            this.logger.info('CRD ready', { rgdName: this.rgdName });
         }
         catch (error) {
             // Debug: Check the actual RGD status when it fails
             try {
-                const k8sApi = this.getKubeConfig().makeApiClient(k8s.KubernetesObjectApi);
+                const kubeConfig = this.getKubeConfig();
+                const k8sApi = createBunCompatibleKubernetesObjectApi(kubeConfig);
+                // In the new API, methods return objects directly (no .body wrapper)
                 const rgdStatus = await k8sApi.read({
                     apiVersion: 'kro.run/v1alpha1',
                     kind: 'ResourceGraphDefinition',
-                    metadata: { name: this.rgdName, namespace: this.namespace }
+                    metadata: { name: this.rgdName, namespace: this.namespace },
                 });
+                const rgdResult = rgdStatus;
                 this.logger.error('RGD deployment failed, current status:', undefined, {
                     rgdName: this.rgdName,
-                    status: rgdStatus.body.status,
-                    conditions: rgdStatus.body.status?.conditions
+                    status: rgdResult.status,
+                    conditions: rgdResult.status?.conditions,
                 });
             }
             catch (statusError) {
-                this.logger.error('Could not fetch RGD status for debugging', statusError);
+                this.logger.error('Could not fetch RGD status for debugging', ensureError(statusError));
             }
-            throw new Error(`Failed to deploy RGD using DirectDeploymentEngine: ${error instanceof Error ? error.message : String(error)}`);
+            throw new ResourceGraphFactoryError(`Failed to deploy RGD using DirectDeploymentEngine: ${ensureError(error).message}`, this.name, 'deployment', ensureError(error));
         }
     }
     /**
      * Wait for the CRD to be created by Kro using DirectDeploymentEngine
      */
     async waitForCRDReadyWithEngine(deploymentEngine) {
-        const crdName = `${this.schemaDefinition.kind.toLowerCase()}s.kro.run`;
+        const crdName = `${pluralizeKind(this.schemaDefinition.kind)}.kro.run`;
         // Debug: Check if the method exists
         if (typeof deploymentEngine.waitForCRDReady !== 'function') {
-            throw new Error(`deploymentEngine.waitForCRDReady is not a function. Available methods: ${Object.getOwnPropertyNames(Object.getPrototypeOf(deploymentEngine)).join(', ')}`);
+            throw new ResourceGraphFactoryError(`deploymentEngine.waitForCRDReady is not a function. Available methods: ${Object.getOwnPropertyNames(Object.getPrototypeOf(deploymentEngine)).join(', ')}`, this.name, 'deployment');
         }
         // Use the deployment engine's built-in CRD readiness checking
         // This will wait for the CRD to be created by Kro and become ready
-        await deploymentEngine.waitForCRDReady(crdName, this.factoryOptions.timeout || 60000);
+        await deploymentEngine.waitForCRDReady(crdName, this.factoryOptions.timeout || DEFAULT_RGD_TIMEOUT);
     }
     /**
      * Separate static and dynamic status fields
@@ -574,21 +600,188 @@ ${Object.entries(spec)
         return separateStatusFields(this.statusMappings);
     }
     /**
-     * Generate instance name from spec
+     * Evaluate static CEL expressions with actual spec values
      */
-    generateInstanceName(spec) {
-        // Try to extract name from spec - check common name fields
-        if (typeof spec === 'object' && spec !== null) {
-            const specObj = spec;
-            // Check for common name fields in order of preference
-            for (const nameField of ['name', 'appName', 'serviceName', 'resourceName']) {
-                if (nameField in specObj && specObj[nameField]) {
-                    return String(specObj[nameField]);
+    async evaluateStaticFields(staticFields, spec) {
+        const evaluatedFields = {};
+        for (const [fieldName, fieldValue] of Object.entries(staticFields)) {
+            if (this.isCelExpression(fieldValue)) {
+                try {
+                    // Evaluate CEL expressions that contain only schema references
+                    const evaluatedValue = this.evaluateStaticCelExpression(fieldValue, spec);
+                    evaluatedFields[fieldName] = evaluatedValue;
+                }
+                catch (error) {
+                    this.logger.warn('Failed to evaluate static CEL expression', {
+                        field: fieldName,
+                        expression: fieldValue.expression,
+                        error: ensureError(error).message,
+                    });
+                    // Fallback to the original value
+                    evaluatedFields[fieldName] = fieldValue;
+                }
+            }
+            else if (typeof fieldValue === 'string' &&
+                fieldValue.includes('__KUBERNETES_REF___schema___')) {
+                // Resolve __KUBERNETES_REF_ marker strings from template literal coercion.
+                // When the composition function uses template literals like `${spec.name}-suffix`,
+                // the proxy's Symbol.toPrimitive produces marker strings at runtime. These need
+                // to be resolved to actual spec values at deploy time.
+                evaluatedFields[fieldName] = this.resolveSchemaRefMarkers(fieldValue, spec);
+            }
+            else if (typeof fieldValue === 'string' &&
+                fieldValue.startsWith('${') &&
+                fieldValue.endsWith('}')) {
+                // Evaluate inline CEL expression strings produced by the composition AST analyzer.
+                // statusOverrides from analyzeCompositionBody write ternary/conditional expressions
+                // as plain strings like "${schema.spec.enabled ? 2 : 1}" into statusMappings.
+                // These must be evaluated with actual spec values at deploy time.
+                try {
+                    evaluatedFields[fieldName] = this.evaluateInlineCelString(fieldValue, spec);
+                }
+                catch (error) {
+                    this.logger.warn('Failed to evaluate inline CEL expression string', {
+                        field: fieldName,
+                        expression: fieldValue,
+                        error: ensureError(error).message,
+                    });
+                    evaluatedFields[fieldName] = fieldValue;
                 }
             }
+            else if (typeof fieldValue === 'object' &&
+                fieldValue !== null &&
+                !Array.isArray(fieldValue)) {
+                // Recursively evaluate nested objects
+                evaluatedFields[fieldName] = await this.evaluateStaticFields(fieldValue, spec);
+            }
+            else {
+                // Keep non-CEL values as-is
+                evaluatedFields[fieldName] = fieldValue;
+            }
         }
-        // Generate a unique name
-        return `${this.name}-${Date.now()}`;
+        return evaluatedFields;
+    }
+    /**
+     * Evaluate a static CEL expression that contains only schema references or literal values.
+     *
+     * Uses `angular-expressions` for safe AST-based evaluation instead of `new Function()` / `eval()`.
+     * Spec field references (e.g., `schema.spec.name`, `spec.replicas`) are resolved by passing the
+     * spec values as a scope object, eliminating string interpolation injection risks entirely.
+     */
+    evaluateStaticCelExpression(celExpression, spec) {
+        const expression = celExpression.expression;
+        // Use null-prototype object to prevent prototype chain access (defense-in-depth).
+        // angular-expressions has hasOwnProperty guards, but a null-prototype scope
+        // eliminates any residual risk from constructor/toString/__proto__ leaking.
+        // Object.freeze prevents expression-based mutation of the original spec data.
+        const specRecord = Object.freeze(Object.assign(Object.create(null), spec));
+        // Build a scope expression by stripping schema.spec. or spec. prefixes so that
+        // angular-expressions can resolve field references directly from the spec scope.
+        let scopeExpression = expression;
+        if (expression.includes('schema.spec.')) {
+            // Replace schema.spec.fieldName → fieldName (resolved from scope)
+            scopeExpression = scopeExpression.replace(/schema\.spec\.(\w+)/g, '$1');
+        }
+        if (scopeExpression.includes('spec.')) {
+            // Replace spec.fieldName → fieldName (resolved from scope)
+            scopeExpression = scopeExpression.replace(/\bspec\.(\w+)/g, '$1');
+        }
+        try {
+            const evaluator = compileExpression(scopeExpression);
+            const result = evaluator(specRecord);
+            return result;
+        }
+        catch (error) {
+            // If evaluation fails, the expression might be an unquoted string like: http://kro-webapp-service
+            // In this case, return it as-is (it's already a string value)
+            if (!expression.includes('schema.spec.') && !expression.includes('spec.')) {
+                this.logger.debug('Static expression evaluation failed, returning as string literal', {
+                    expression,
+                    error: ensureError(error).message,
+                });
+                return expression;
+            }
+            this.logger.warn('Failed to evaluate expression safely', {
+                expression: scopeExpression,
+                originalExpression: expression,
+                error: ensureError(error).message,
+            });
+            throw error;
+        }
+    }
+    /**
+     * Resolve `__KUBERNETES_REF___schema___<fieldPath>__` markers in a string.
+     *
+     * When a composition function uses template literals like `` `${spec.name}-suffix` ``,
+     * the magic proxy's Symbol.toPrimitive returns a marker string at composition time.
+     * At deploy time we replace each marker with the actual spec value.
+     */
+    resolveSchemaRefMarkers(value, spec) {
+        const resolved = value.replace(/__KUBERNETES_REF___schema___([a-zA-Z0-9.$]+)__/g, (_match, fieldPath) => {
+            // fieldPath is e.g. "spec.name" or "spec.nested.field"
+            const parts = fieldPath.replace(/^spec\./, '').split('.');
+            let current = spec;
+            for (const part of parts) {
+                if (current != null && typeof current === 'object') {
+                    current = current[part];
+                }
+                else {
+                    this.logger.warn('Could not resolve schema ref marker', {
+                        marker: _match,
+                        fieldPath,
+                        failedAt: part,
+                    });
+                    return _match; // Keep marker if unresolvable
+                }
+            }
+            return String(current ?? '');
+        });
+        return resolved;
+    }
+    /**
+     * Evaluate an inline CEL expression string like `"${schema.spec.enabled ? 2 : 1}"`.
+     *
+     * The composition body AST analyzer produces these for ternary expressions in
+     * status return values (statusOverrides). They are plain strings wrapping a CEL
+     * expression that must be evaluated with the real spec values.
+     */
+    evaluateInlineCelString(celString, spec) {
+        // Strip the wrapping ${ ... }
+        const innerExpression = celString.slice(2, -1);
+        // Build scope expression: strip schema.spec. / spec. prefixes
+        let scopeExpression = innerExpression;
+        if (scopeExpression.includes('schema.spec.')) {
+            scopeExpression = scopeExpression.replace(/schema\.spec\.(\w+)/g, '$1');
+        }
+        if (scopeExpression.includes('spec.')) {
+            scopeExpression = scopeExpression.replace(/\bspec\.(\w+)/g, '$1');
+        }
+        // Resolve any __KUBERNETES_REF_ markers that may be embedded in the expression
+        // (e.g. from template literals inside ternary branches)
+        if (scopeExpression.includes('__KUBERNETES_REF___schema___')) {
+            scopeExpression = scopeExpression.replace(/__KUBERNETES_REF___schema___([a-zA-Z0-9.$]+)__/g, (_match, fieldPath) => {
+                const parts = fieldPath.replace(/^spec\./, '').split('.');
+                return parts.join('.');
+            });
+        }
+        // Convert CEL single-quoted string literals to double-quoted for angular-expressions
+        // Match single-quoted strings that are NOT inside backticks
+        scopeExpression = scopeExpression.replace(/'([^'\\]*)'/g, '"$1"');
+        const specRecord = Object.freeze(Object.assign(Object.create(null), spec));
+        const evaluator = compileExpression(scopeExpression);
+        return evaluator(specRecord);
+    }
+    /**
+     * Check if a value is a CEL expression (using canonical brand symbol)
+     */
+    isCelExpression(value) {
+        if (typeof value !== 'object' || value === null) {
+            return false;
+        }
+        return (CEL_EXPRESSION_BRAND in value &&
+            value[CEL_EXPRESSION_BRAND] === true &&
+            'expression' in value &&
+            typeof value.expression === 'string');
     }
     /**
      * Create custom resource instance
@@ -616,8 +809,10 @@ ${Object.entries(spec)
         const hydrationLogger = this.logger.child({ instanceName });
         // Separate static and dynamic status fields
         const { staticFields, dynamicFields } = await this.separateStatusFields();
-        // Start with static fields as the base status
-        const status = { ...staticFields };
+        // Evaluate static CEL expressions with actual spec values
+        const evaluatedStaticFields = await this.evaluateStaticFields(staticFields, spec);
+        // Start with evaluated static fields as the base status
+        const status = { ...evaluatedStaticFields };
         // Create the initial Enhanced proxy
         // The Enhanced proxy should represent the actual instance, which uses the full API version
         const instanceApiVersion = this.schemaDefinition.apiVersion.includes('/')
@@ -642,6 +837,9 @@ ${Object.entries(spec)
                     'typekro.io/kind': this.schemaDefinition.kind,
                 },
             },
+            // Type cast: constructing a partial Enhanced proxy — only metadata.name and spec
+            // are accessed by callers at this call site. TypeScript cannot verify structural
+            // completeness; callers are responsible for only accessing these fields.
         };
         // Hydrate dynamic status fields if enabled and there are dynamic fields
         if (this.factoryOptions.hydrateStatus !== false && Object.keys(dynamicFields).length > 0) {
@@ -657,7 +855,7 @@ ${Object.entries(spec)
                 Object.assign(enhancedProxy.status, mergedStatus);
             }
             catch (error) {
-                hydrationLogger.warn('Dynamic status hydration failed', error);
+                hydrationLogger.error('Dynamic status hydration failed', ensureError(error));
                 // Continue with static fields only if dynamic hydration fails
             }
         }
@@ -670,81 +868,26 @@ ${Object.entries(spec)
         return this.createEnhancedProxyWithMixedHydration(spec, instanceName);
     }
     /**
-     * Wait for Kro instance to be ready with Kro-specific logic
+     * Wait for Kro instance to be ready with Kro-specific logic.
+     * Delegates to the shared `waitForKroInstanceReady` in `kro-readiness.ts`.
      */
     async waitForKroInstanceReady(instanceName, timeout) {
-        const startTime = Date.now();
-        const readinessLogger = this.logger.child({ instanceName, rgdName: this.name });
-        while (Date.now() - startTime < timeout) {
-            try {
-                const apiVersion = this.schemaDefinition.apiVersion.includes('/')
-                    ? this.schemaDefinition.apiVersion
-                    : `kro.run/${this.schemaDefinition.apiVersion}`;
-                const k8sApi = this.getKubeConfig().makeApiClient(k8s.KubernetesObjectApi);
-                const response = await k8sApi.read({
-                    apiVersion,
-                    kind: this.schemaDefinition.kind,
-                    metadata: {
-                        name: instanceName,
-                        namespace: this.namespace,
-                    },
-                });
-                const instance = response.body;
-                // Kro-specific readiness logic
-                const status = instance.status;
-                if (!status) {
-                    readinessLogger.debug('No status found yet, continuing to wait', { instanceName });
-                    await new Promise((resolve) => setTimeout(resolve, 2000));
-                    continue;
-                }
-                const state = status.state;
-                const conditions = status.conditions || [];
-                const syncedCondition = conditions.find((c) => c.type === 'InstanceSynced');
-                // Check if status has fields beyond the basic Kro fields (conditions, state)
-                const statusKeys = Object.keys(status);
-                const basicKroFields = ['conditions', 'state'];
-                const hasCustomStatusFields = statusKeys.some((key) => !basicKroFields.includes(key));
-                const isActive = state === 'ACTIVE';
-                const isSynced = syncedCondition?.status === 'True';
-                readinessLogger.debug('Kro instance status check', {
-                    instanceName,
-                    state,
-                    isActive,
-                    isSynced,
-                    hasCustomStatusFields,
-                    statusKeys,
-                });
-                // Resource is ready when it's active, synced, and has custom status fields populated
-                if (isActive && isSynced && hasCustomStatusFields) {
-                    readinessLogger.info('Kro instance is ready', { instanceName });
-                    return;
-                }
-                // Check for failure states
-                if (state === 'FAILED') {
-                    const failedCondition = conditions.find((c) => c.status === 'False');
-                    const errorMessage = failedCondition?.message || 'Unknown error';
-                    throw new Error(`Kro instance deployment failed: ${errorMessage}`);
-                }
-                readinessLogger.debug('Kro instance not ready yet, continuing to wait', {
-                    instanceName,
-                    state,
-                    isSynced,
-                    hasCustomStatusFields,
-                });
-            }
-            catch (error) {
-                const k8sError = error;
-                if (k8sError.statusCode !== 404) {
-                    throw error;
-                }
-                // Instance not found yet, continue waiting
-                readinessLogger.debug('Instance not found yet, continuing to wait', { instanceName });
-            }
-            // Wait before checking again - use shorter intervals for faster response
-            await new Promise((resolve) => setTimeout(resolve, 1000));
-        }
-        const elapsed = Date.now() - startTime;
-        throw new Error(`Timeout waiting for Kro instance ${instanceName} to be ready after ${elapsed}ms (timeout: ${timeout}ms). This usually means the Kro controller is not running or the RGD deployment failed. Check Kro controller logs: kubectl logs -n kro-system deployment/kro`);
+        const apiVersion = this.schemaDefinition.apiVersion.includes('/')
+            ? this.schemaDefinition.apiVersion
+            : `kro.run/${this.schemaDefinition.apiVersion}`;
+        const kubeConfig = this.getKubeConfig();
+        const k8sApi = createBunCompatibleKubernetesObjectApi(kubeConfig);
+        return waitForKroInstanceReadyShared({
+            instanceName,
+            timeout,
+            k8sApi,
+            customObjectsApi: this.getCustomObjectsApi(),
+            namespace: this.namespace,
+            apiVersion,
+            kind: this.schemaDefinition.kind,
+            rgdName: this.name,
+            factoryContext: this.name,
+        });
     }
     /**
      * Hydrate dynamic status fields by evaluating CEL expressions against live Kro resource data
@@ -755,7 +898,8 @@ ${Object.entries(spec)
         const apiVersion = this.schemaDefinition.apiVersion.includes('/')
             ? this.schemaDefinition.apiVersion
             : `kro.run/${this.schemaDefinition.apiVersion}`;
-        const k8sApi = this.getKubeConfig().makeApiClient(k8s.KubernetesObjectApi);
+        const kubeConfig = this.getKubeConfig();
+        const k8sApi = createBunCompatibleKubernetesObjectApi(kubeConfig);
         const response = await k8sApi.read({
             apiVersion,
             kind: this.schemaDefinition.kind,
@@ -764,7 +908,8 @@ ${Object.entries(spec)
                 namespace: this.namespace,
             },
         });
-        const liveInstance = response.body;
+        // In the new API, methods return objects directly (no .body wrapper)
+        const liveInstance = response;
         if (!liveInstance.status) {
             dynamicLogger.warn('No status found in live instance, returning empty dynamic fields');
             return {};