typekro 0.42.0 → 0.44.0

package/dist/core/deployment/kro-instance-safety.d.ts

@@ -1,237 +0,0 @@
-import type { KubernetesResource } from '../types/kubernetes.js';
-import type { KroCompatibleType } from '../types/serialization.js';
-type ResourceCollection = Record<string, KubernetesResource> | readonly KubernetesResource[];
-export interface KroInstanceNamespaceSafetyInput<TSpec extends KroCompatibleType> {
-    readonly compositionName: string;
-    readonly instanceNamespace: string;
-    readonly spec: TSpec;
-    readonly resources?: ResourceCollection;
-    readonly compositionFn?: (spec: TSpec) => unknown;
-    /**
-     * Namespace names the factory has HOISTED out of the RGD graph (emitted as
-     * SIBLING resources OUTSIDE the graph, created deps-first). typekro NEVER emits a
-     * Namespace into RGD YAML: every owned Namespace is applied as a sibling before
-     * the RGD and torn down after it, so KRO never owns a namespace and can never
-     * garbage-collect one when the instance CR is deleted — the finalizer-stranding
-     * concern this guard protects against is structurally resolved for typekro's own
-     * factories. The guard therefore treats an owned namespace that has been hoisted
-     * as SAFE, even though it still appears in the composition's resources. It remains
-     * a defense-in-depth net for HAND-AUTHORED graphs that place a Namespace directly
-     * in an RGD (an owned namespace whose name can't be proven, or one the caller
-     * EXPLICITLY pinned the instance back into without hoisting) — those still throw.
-     */
-    readonly hoistedNamespaces?: ReadonlySet<string>;
-}
-export declare function resolveNamespaceName(value: unknown, spec: KroCompatibleType): string | undefined;
-/**
- * Resolve a Namespace METADATA value (a label or annotation VALUE) to its concrete
- * string form (finding #5).
- *
- * Unlike {@link resolveNamespaceName} — which resolves a namespace NAME and is
- * correctly restricted to DNS-label shape — metadata values are UNRESTRICTED strings:
- * `Team_A`, free text with spaces, arbitrary annotation content. The old path routed
- * these through `resolveNamespaceName`, whose DNS-label short-circuit only accepts a
- * CEL body matching a DNS label and then hands anything else to the CEL evaluator,
- * which throws / returns undefined for a plain literal like `Team_A` or `some text` —
- * silently DROPPING valid metadata.
- *
- * A concrete re-execution collapses a schema-derived value into a CEL whose BODY is
- * the resolved literal. So for a CEL value we:
- *   - first try evaluating it (handles genuine expressions — `has()`, `orValue()`,
- *     concatenations); if that yields a primitive, use it;
- *   - otherwise the body is a concrete literal that is not a valid standalone CEL
- *     program (e.g. `Team_A`, `some text`) — return it VERBATIM as the concrete value,
- *     with NO DNS-label restriction.
- * Numbers / booleans are stringified; refs resolve against the spec; plain strings and
- * marker-embedded strings defer to {@link resolveNamespaceName} (which returns them
- * verbatim / resolves the marker). Returns `undefined` only for a genuinely
- * unresolvable value (an unresolved schema ref), so the caller drops just those.
- */
-export declare function resolveConcreteMetadataValue(value: unknown, spec: KroCompatibleType): string | undefined;
-export declare function isActiveOwnedResource(resource: KubernetesResource, spec: KroCompatibleType): boolean;
-/**
- * The concrete Namespaces a composition actively creates and OWNS as graph
- * children, resolved against the concrete instance spec.
- *
- * `owned` holds the resolved names; `unresolved` holds the resource ids of owned
- * Namespaces whose name cannot be evaluated from the spec (so their safety
- * cannot be proven). This is the single detection primitive shared by the
- * ownership GUARD ({@link assertKroInstanceNamespaceOwnershipSafe}) and the
- * workload-namespace HOISTING logic in the KRO factory: a composition owns its
- * instance namespace exactly when the resolved instance namespace is in `owned`.
- */
-export interface OwnedNamespaceDetection {
-    readonly owned: ReadonlySet<string>;
-    readonly unresolved: readonly string[];
-}
-/**
- * Per-resource detection: for each actively-owned Namespace, its resource id
- * mapped to its resolved concrete name. `unresolved` holds the ids of owned
- * Namespaces whose name cannot be evaluated from the spec.
- *
- * The resource ids are stable across the re-execution used here (dedup + explicit
- * `id`s), so a factory can match them back to its own `resources` to HOIST the
- * owned namespace out of the RGD graph. Re-execution is also what resolves the
- * schema-driven names to concrete values (the built `resources` carry `${...}`
- * KRO templates that can't be evaluated directly).
- */
-export declare function detectOwnedNamespaceResources<TSpec extends KroCompatibleType>(input: Omit<KroInstanceNamespaceSafetyInput<TSpec>, 'instanceNamespace'>): {
-    ownedById: Map<string, string>;
-    unresolved: string[];
-};
-export declare function detectOwnedNamespaces<TSpec extends KroCompatibleType>(input: Omit<KroInstanceNamespaceSafetyInput<TSpec>, 'instanceNamespace'>): OwnedNamespaceDetection;
-/**
- * The CONCRETE (re-executed against the spec) resource objects for each
- * actively-owned Namespace, keyed by resource id. Unlike
- * {@link detectOwnedNamespaceResources} (which returns only the resolved names),
- * this returns the full concrete metadata — labels (incl. Pod Security),
- * annotations, name — so the KRO factory can PRESERVE the original Namespace
- * configuration when it hoists the Namespace out of the graph and re-emits it as
- * a sibling resource (finding #5), rather than synthesizing a bare Namespace.
- */
-export declare function concreteOwnedNamespaceResources<TSpec extends KroCompatibleType>(input: Omit<KroInstanceNamespaceSafetyInput<TSpec>, 'instanceNamespace'>): Map<string, KubernetesResource>;
-/**
- * Concrete active resources owned by one KRO instance, excluding external
- * observations. This is used after the owner CR disappears to prove that KRO's
- * asynchronous child deletes have actually reached 404 before shared
- * definitions are removed or teardown is reported successful.
- */
-export declare function concreteActiveOwnedResources<TSpec extends KroCompatibleType>(input: Omit<KroInstanceNamespaceSafetyInput<TSpec>, 'instanceNamespace'>): Map<string, KubernetesResource>;
-/**
- * Select EVERY Namespace to HOIST out of the RGD graph — the new, UNCONDITIONAL
- * model: typekro NEVER emits a Namespace into RGD YAML. Selection is trivially
- * `kind === 'Namespace'` (excluding `__externalRef` observed namespaces, which are
- * not owned graph children), NOT the old structural "name tracks spec.namespace"
- * detection. Every owned Namespace becomes a sibling resource applied before the
- * RGD and torn down after it, so KRO never owns a namespace.
- *
- * Returns a map from each hoisted Namespace's resource id to its RAW
- * `metadata.name` VALUE (a schema `KubernetesRef`, a `CelExpression`, or a plain
- * string). The name value is what {@link rewriteHoistedNamespaceReferences} /
- * {@link rewriteHoistedNamespaceRefsInValue} rewrite dangling references TO — a
- * reference to a hoisted Namespace's `metadata.name` becomes that Namespace's own
- * concrete name expression. The map is a STABLE STRUCTURAL property of the graph
- * (spec-independent), so the shared RGD's shape is identical for every instance.
- *
- * Deliberately does NOT filter on `includeWhen`: a namespace's ACTIVITY is
- * spec-dependent, but whether a resource is a Namespace is not. A namespace that is
- * inactive for a given spec is simply not created as a sibling; removing it from the
- * RGD is harmless (it was not going to be created there either).
- */
-export declare function selectHoistedNamespaces(resources: ResourceCollection): Map<string, unknown>;
-/**
- * Rewrite every reference to a HOISTED Namespace's `metadata.name` — ANYWHERE it
- * appears in a value — to that Namespace's CONCRETE name expression (findings
- * #3 + #6).
- *
- * `hoisted` maps each hoisted Namespace's resource id to its RAW `metadata.name`
- * value (see {@link selectHoistedNamespaces}). When a Namespace is hoisted OUT of
- * the RGD graph, any other value that still refers to it would leave a live
- * reference to a resource KRO no longer knows about, and KRO rejects the whole
- * graph. Each reference is rewritten to the referenced Namespace's own name
- * expression — for a Namespace named `${schema.spec.namespace}` that is
- * `schema.spec.namespace` (as before); for a literally-named Namespace `"foo"`
- * that is the constant `foo` — which is exactly the value the removed resource
- * would have produced.
- *
- * The rewrite is STRUCTURAL, not exact-string (finding #6): it replaces the
- * reference TOKEN `<id>.metadata.name` wherever it occurs, so embedded /
- * concatenated (`ns-${string(id.metadata.name)}`), function-wrapped
- * (`string(id.metadata.name)`), and ternary (`... ? id.metadata.name : "x"`)
- * forms are all handled — in plain strings, CEL expressions, and raw
- * `__KUBERNETES_REF_*` markers alike. It applies to arbitrary values (resource
- * bodies AND status mappings). A reference whose target Namespace name has no
- * representable form is left as-is and caught by
- * {@link findDanglingHoistedReference}.
- */
-export declare function rewriteHoistedNamespaceRefsInValue<T>(value: T, hoisted: ReadonlyMap<string, unknown>): T;
-/**
- * The top-level STATUS field names whose value, once the owned Namespace is HOISTED
- * out of the RGD, can no longer be represented in the KRO status schema (finding #6).
- *
- * When a Namespace is hoisted OUT of the RGD, a status field that referenced its
- * `metadata.name` is rewritten to the Namespace's own name expression. KRO requires
- * every instance status field to reference at least one RESOURCE (KRO builder.go:
- * `instance status field must refer to a resource`), and its status CEL environment
- * has no `schema` identifier. So a rewritten value that references NO managed resource
- * is unrepresentable in the KRO status — in BOTH shapes:
- *   - schema-only (`schema.spec.namespace`, for a schema-named Namespace) — KRO
- *     status CEL cannot evaluate `schema`; and
- *   - a plain CONSTANT (for a literally-named Namespace) — a literal has zero resource
- *     dependencies, so KRO rejects it, AND typekro's own schema generation classifies
- *     a literal-only status as static and DROPS it from the emitted KRO status.
- * BOTH were previously handled inconsistently (schema-only rejected, literal silently
- * dropped). We now REJECT both consistently (see {@link assertNoHoistWeakenedStatusFields})
- * — the one behavior. A field that ALSO references a real managed resource stays
- * representable (KRO accepts it; a literal inside it is fine) and is NOT flagged.
- *
- * Returns only TOP-LEVEL status keys (the KRO status schema is a flat map of field →
- * CEL); a field is included iff rewriting its value CHANGED it (it referenced the
- * hoisted Namespace) AND the rewritten value references no managed resource (i.e. it
- * references `schema`, or is a pure constant).
- */
-export declare function hoistWeakenedStatusFields(statusMappings: Record<string, unknown> | undefined, hoisted: ReadonlyMap<string, unknown>): string[];
-/**
- * HONEST, CONSISTENT behavior for finding #6: REJECT (throw) a composition whose
- * status field(s) resolve ONLY to a hoisted owned Namespace's `metadata.name` — i.e.
- * once the Namespace leaves the RGD the field references no managed resource.
- *
- * KRO requires every instance status field to reference a resource and cannot
- * evaluate `schema` in status CEL, so such a field is unrepresentable in the emitted
- * KRO status whether the Namespace is schema-named (rewrites to `schema.spec.namespace`)
- * or literally-named (rewrites to a constant). Previously the schema case threw while
- * the literal case was silently dropped (schema generation classifies literal-only
- * status as static and excludes it) — the two code paths disagreed. Both are now
- * REJECTED the same way: FAIL LOUDLY at serialization, naming the field(s), so the
- * author restructures the status (derive the value from a managed resource, or drop
- * the field) instead of shipping a silently-weakened status API.
- */
-export declare function assertNoHoistWeakenedStatusFields(statusMappings: Record<string, unknown> | undefined, hoisted: ReadonlyMap<string, unknown>, compositionName: string): void;
-/**
- * Resource-map form of {@link rewriteHoistedNamespaceRefsInValue}: rewrite every
- * dangling reference to a hoisted Namespace across a resource collection.
- *
- * Only resources that actually contain such a reference are reconstructed; every
- * other resource is passed through by identity, so the common case (no reference
- * to the hoisted Namespace) is untouched. When a resource IS reconstructed, its
- * TypeKro metadata (WeakMap-stored `includeWhen` / `readinessEvaluator` /
- * `__resourceId` / readiness+iteration markers) is copied onto the new object via
- * {@link copyResourceMetadata} so the rewrite never silently drops it (finding #7).
- */
-export declare function rewriteHoistedNamespaceReferences<T extends Record<string, KubernetesResource>>(resources: T, hoisted: ReadonlyMap<string, unknown>): T;
-/**
- * Scan an emitted RGD YAML for any leftover reference to a hoisted (removed)
- * resource id — either a CEL interpolation `${<id>.…}` or a raw
- * `__KUBERNETES_REF_<id>_…` marker. Returns the FIRST offending id, or
- * `undefined` when the RGD is clean.
- *
- * This is the shared post-serialization dangling-reference check applied to BOTH
- * the factory serialization path ({@link KroResourceFactoryImpl.buildRgdYaml})
- * and the graph/composition serialization path (`core.ts`). After hoisting an
- * owned Namespace out of the RGD, NO reference to it may remain anywhere in the
- * emitted RGD (resource templates, status CEL, nested CEL, overrides); otherwise
- * KRO rejects the graph at runtime with a dangling `${...}` reference. A negative
- * lookbehind avoids matching an id that is only a suffix of a longer identifier.
- */
-export declare function findDanglingHoistedReference(rgdYaml: string, hoistedIds: ReadonlySet<string>): string | undefined;
-/**
- * Reject a KRO instance that would own the Namespace containing its own CR.
- *
- * KRO deletes graph children before clearing the owner CR's finalizer. If a
- * child Namespace contains that CR, namespace termination can strand the
- * finalizer permanently. Re-executing with the concrete instance spec makes
- * this check survive nested compositions and schema-driven namespace names.
- *
- * The KRO factory now HOISTS every owned Namespace OUT of the RGD graph (emitting
- * it as a SIBLING resource created deps-first and torn down after the RGD) before
- * calling this guard, and passes the hoisted names in `hoistedNamespaces`. Because
- * a hoisted namespace is no longer a graph child, deleting the instance can't GC
- * it, so the common create-namespace-and-put-the-instance-in-it pattern is safe —
- * this guard skips it. The guard remains the defense-in-depth net for HAND-AUTHORED
- * graphs that hoisting does not cover: an owned Namespace whose name can't be proven
- * safe (fails closed), and a caller who places `instanceNamespace` on a namespace
- * the composition owns WITHOUT hoisting it (opts into the unsafe pattern).
- */
-export declare function assertKroInstanceNamespaceOwnershipSafe<TSpec extends KroCompatibleType>(input: KroInstanceNamespaceSafetyInput<TSpec>): void;
-export {};
-//# sourceMappingURL=kro-instance-safety.d.ts.map

package/dist/core/deployment/kro-instance-safety.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kro-instance-safety.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/kro-instance-safety.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAInE,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,SAAS,kBAAkB,EAAE,CAAC;AAE7F,MAAM,WAAW,+BAA+B,CAAC,KAAK,SAAS,iBAAiB;IAC9E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC;IAClD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClD;AAqBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAmChG;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,iBAAiB,GACtB,MAAM,GAAG,SAAS,CAkCpB;AA+CD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAQT;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,SAAS,iBAAiB,EAC3E,KAAK,EAAE,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,GACvE;IAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAe1D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,SAAS,iBAAiB,EACnE,KAAK,EAAE,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,GACvE,uBAAuB,CAGzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,SAAS,iBAAiB,EAC7E,KAAK,EAAE,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,GACvE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAQjC;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,SAAS,iBAAiB,EAC1E,KAAK,EAAE,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,GACvE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAOjC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,kBAAkB,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ3F;AAkFD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kCAAkC,CAAC,CAAC,EAClD,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,CAAC,CA6EH;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACnD,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,MAAM,EAAE,CAeV;AAiDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC,CAC/C,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACnD,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,eAAe,EAAE,MAAM,GACtB,IAAI,CAeN;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC5F,SAAS,EAAE,CAAC,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,CAAC,CAcH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAC9B,MAAM,GAAG,SAAS,CAQpB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uCAAuC,CAAC,KAAK,SAAS,iBAAiB,EACrF,KAAK,EAAE,+BAA+B,CAAC,KAAK,CAAC,GAC5C,IAAI,CAqCN"}

package/dist/core/deployment/nested-composition-status.d.ts

@@ -1,33 +0,0 @@
-/**
- * Nested Composition Status Synthesis
- *
- * When a composition contains nested compositions (e.g., inngestBootstrap inside
- * webAppWithProcessing), the deployment creates child resources with prefixed IDs.
- * After deployment, we need to synthesize a "ready" status for each nested
- * composition parent based on whether ALL its children are ready.
- *
- * This module is shared between direct and KRO deployment strategies.
- * It does NOT inspect resource-specific fields (Helm conditions, Namespace phase,
- * etc.) — it relies solely on deployment readiness, which is already determined
- * by factory-provided readiness evaluators.
- */
-import type { TypeKroLogger } from '../logging/index.js';
-import type { Enhanced } from '../types/index.js';
-/**
- * Synthesize status entries for nested compositions and return an enriched
- * live status map that includes both the original resource statuses and
- * synthesized nested composition statuses.
- *
- * @param probeResources - Resource map from a probe execution of the composition.
- *   Keys are full composition paths like "outer1-inngestBootstrap1-inngestHelmRelease".
- * @param liveStatusMap - Live status data keyed by short resource IDs (e.g., "inngestHelmRelease").
- *   All resources in this map are considered "ready" (they passed waitForReady).
- * @param logger - Logger instance for debug output.
- * @param knownNestedIds - Explicit set of known nested composition base IDs
- *   (e.g., "inngestBootstrap1") from the composition context. Required — without
- *   this, no synthesis is performed. The IDs are populated during composition
- *   execution by `executeNestedCompositionWithSpec`.
- * @returns Enriched map with additional entries for nested composition parent IDs.
- */
-export declare function synthesizeNestedCompositionStatus(probeResources: Record<string, Enhanced<unknown, unknown>>, liveStatusMap: Map<string, Record<string, unknown>>, logger: TypeKroLogger, knownNestedIds?: Set<string>, nestedStatusSnapshots?: Map<string, Record<string, unknown>>): Map<string, Record<string, unknown>>;
-//# sourceMappingURL=nested-composition-status.d.ts.map

package/dist/core/deployment/nested-composition-status.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"nested-composition-status.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/nested-composition-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AA0FlD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iCAAiC,CAC/C,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAC1D,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACnD,MAAM,EAAE,aAAa,EACrB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,qBAAqB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC3D,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAkEtC"}

package/dist/core/deployment/readiness-waiter.d.ts

@@ -1,60 +0,0 @@
-/**
- * Readiness Waiter
- *
- * Handles waiting for Kubernetes resources to become ready after deployment,
- * using factory-provided readiness evaluators with polling loops.
- */
-import type * as k8s from '@kubernetes/client-node';
-import type { TypeKroLogger } from '../logging/index.js';
-import type { DeploymentEvent, DeploymentOptions } from '../types/deployment.js';
-import type { DeployedResource } from '../types.js';
-import type { DebugLogger } from './debug-logger.js';
-import type { ResourceReadinessChecker } from './readiness.js';
-/**
- * Dependencies injected from the deployment engine
- */
-export interface ReadinessWaiterDeps {
-    abortableDelay: (ms: number, signal?: AbortSignal) => Promise<void>;
-    withAbortSignal: <T>(operation: Promise<T>, signal?: AbortSignal) => Promise<T>;
-    emitEvent: (options: DeploymentOptions, event: DeploymentEvent) => void;
-}
-/**
- * Handles readiness checking and waiting for deployed Kubernetes resources
- */
-export declare class ReadinessWaiter {
-    private k8sApi;
-    private readyResources;
-    private readinessChecker;
-    private logger;
-    private debugLogger?;
-    private deps?;
-    constructor(k8sApi: k8s.KubernetesObjectApi, readyResources: Set<string>, readinessChecker: ResourceReadinessChecker, logger: TypeKroLogger, debugLogger?: DebugLogger | undefined, deps?: ReadinessWaiterDeps | undefined);
-    /**
-     * Update the debug logger (e.g., when debug logging is enabled mid-deployment)
-     */
-    setDebugLogger(debugLogger: DebugLogger): void;
-    /**
-     * Check if a deployed resource is ready using the factory-provided readiness evaluator
-     */
-    isDeployedResourceReady(deployedResource: DeployedResource): Promise<boolean>;
-    /**
-     * Wait for a resource to be ready
-     * @param deployedResource - The deployed resource to wait for
-     * @param options - Deployment options
-     * @param abortSignal - Optional AbortSignal to cancel the wait
-     */
-    waitForResourceReady(deployedResource: DeployedResource, options: DeploymentOptions, abortSignal?: AbortSignal): Promise<void>;
-    /**
-     * Abortable delay - delegates to injected dependency or falls back to simple delay
-     */
-    private abortableDelay;
-    /**
-     * Wrap an async operation with abort signal handling - delegates to injected dependency
-     */
-    private withAbortSignal;
-    /**
-     * Emit deployment events - delegates to injected dependency
-     */
-    private emitEvent;
-}
-//# sourceMappingURL=readiness-waiter.d.ts.map

package/dist/core/deployment/readiness-waiter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"readiness-waiter.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/readiness-waiter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAGpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,eAAe,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAChF,SAAS,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CACzE;AAED;;GAEG;AACH,qBAAa,eAAe;IAExB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,gBAAgB;IACxB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,WAAW,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC;gBALL,MAAM,EAAE,GAAG,CAAC,mBAAmB,EAC/B,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,gBAAgB,EAAE,wBAAwB,EAC1C,MAAM,EAAE,aAAa,EACrB,WAAW,CAAC,EAAE,WAAW,YAAA,EACzB,IAAI,CAAC,EAAE,mBAAmB,YAAA;IAGpC;;OAEG;IACH,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI;IAI9C;;OAEG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuEnF;;;;;OAKG;IACG,oBAAoB,CACxB,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,IAAI,CAAC;IA6LhB;;OAEG;IACH,OAAO,CAAC,cAAc;IAOtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,SAAS;CAKlB"}

package/dist/core/deployment/resource-applier.d.ts

@@ -1,87 +0,0 @@
-/**
- * Resource Applier
- *
- * Handles the mechanics of applying Kubernetes resources to a cluster:
- * serialization, namespace application, patch construction, conflict resolution,
- * existence checking, reference resolution, and the main apply-with-retry loop.
- *
- * Extracted from DirectDeploymentEngine to separate resource-level K8s
- * operations from orchestration concerns.
- */
-import type * as k8s from '@kubernetes/client-node';
-import type { TypeKroLogger } from '../logging/index.js';
-import type { ArtifactApplyPolicy } from '../planning/artifacts.js';
-import type { ReferenceResolver } from '../references/index.js';
-import type { DeploymentOptions, ResolutionContext } from '../types/deployment.js';
-import type { DeployableK8sResource, Enhanced, KubernetesResource } from '../types.js';
-/** Host-neutral contract for applying one compiled Kubernetes artifact operation. */
-export interface ArtifactResourceApplier {
-    applyArtifactResource(resource: KubernetesResource, policy: ArtifactApplyPolicy | undefined, options: DeploymentOptions, resourceLogger: TypeKroLogger): Promise<k8s.KubernetesObject>;
-}
-export declare class ResourceApplier implements ArtifactResourceApplier {
-    private k8sApi;
-    private referenceResolver;
-    constructor(k8sApi: k8s.KubernetesObjectApi, referenceResolver: ReferenceResolver | undefined, _logger: TypeKroLogger);
-    private buildResourceIdentityMetadata;
-    private throwIfAborted;
-    private abortableDelay;
-    private isImmutableFieldError;
-    /**
-     * Serialize a resource for sending to the Kubernetes API.
-     * Calls toJSON() if available (to preserve arrays via custom implementation),
-     * then deep-clones via JSON to strip proxy wrappers, and removes internal fields.
-     */
-    serializeResourceForK8s(resource: KubernetesResource | Partial<KubernetesResource>): Record<string, unknown>;
-    /**
-     * Resolve all references in a resource, with timeout and fallback behavior.
-     * Falls back to the original resource if resolution fails.
-     */
-    resolveResourceReferences(resource: DeployableK8sResource<Enhanced<unknown, unknown>>, context: ResolutionContext, options: DeploymentOptions, resourceLogger: TypeKroLogger): Promise<KubernetesResource>;
-    /**
-     * Apply a namespace to a resource if one is specified and the resource doesn't already have one.
-     * Preserves non-enumerable properties (readinessEvaluator, __resourceId) on the new object.
-     */
-    applyNamespaceToResource(resource: KubernetesResource, namespace: string | undefined, resourceLogger: TypeKroLogger): KubernetesResource;
-    /**
-     * Apply typekro ownership metadata (labels + annotations) to a resource
-     * manifest right before it's serialized and sent to the cluster.
-     *
-     * No-op when the deployment isn't tagged with factoryName + instanceName
-     * — untagged deployments don't participate in cross-process discovery
-     * and would pollute their resources with partial ownership metadata.
-     *
-     * Uses `getEffectiveScopes` from the tagging module as the single
-     * source of truth for scope computation — avoids duplicating the
-     * WeakMap + annotation + legacy-alias merge logic.
-     */
-    applyOwnershipTags(resource: KubernetesResource, options: DeploymentOptions, resourceId: string, context: ResolutionContext): void;
-    /**
-     * Build a patch payload from a resource, including special-cased fields for Secrets and RBAC resources.
-     */
-    buildPatchPayload(resource: KubernetesResource): Record<string, unknown>;
-    /**
-     * Handle a 409 Conflict error based on the configured conflict strategy.
-     * Returns the applied resource if the conflict was handled, or undefined if it wasn't.
-     */
-    handleConflictStrategy(resolvedResource: KubernetesResource, conflictStrategy: NonNullable<DeploymentOptions['conflictStrategy']>, resourceLogger: TypeKroLogger, abortSignal?: AbortSignal, timeout?: number): Promise<k8s.KubernetesObject | undefined>;
-    private createResource;
-    private patchResource;
-    private replaceResource;
-    private waitForResourceDeletion;
-    private serverSideApply;
-    private applyWithPolicy;
-    /**
-     * Apply a resource to the Kubernetes cluster with retry logic, conflict handling,
-     * and support for both create and patch operations.
-     */
-    applyResourceToCluster(resolvedResource: KubernetesResource, options: DeploymentOptions, resourceLogger: TypeKroLogger): Promise<k8s.KubernetesObject>;
-    /** Apply one compiled artifact operation through the canonical policy executor. */
-    applyArtifactResource(resolvedResource: KubernetesResource, applyPolicy: ArtifactApplyPolicy | undefined, options: DeploymentOptions, resourceLogger: TypeKroLogger): Promise<k8s.KubernetesObject>;
-    /**
-     * Check if a resource already exists in the cluster.
-     * Returns the existing resource if found, or undefined if it doesn't exist (404).
-     * Throws for unexpected errors (non-404).
-     */
-    checkResourceExists(resource: KubernetesResource, resourceLogger: TypeKroLogger): Promise<k8s.KubernetesObject | undefined>;
-}
-//# sourceMappingURL=resource-applier.d.ts.map

package/dist/core/deployment/resource-applier.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resource-applier.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/resource-applier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAUpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,QAAQ,EAER,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAiBrB,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,qBAAqB,CACnB,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;CAClC;AAED,qBAAa,eAAgB,YAAW,uBAAuB;IAE3D,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,iBAAiB;gBADjB,MAAM,EAAE,GAAG,CAAC,mBAAmB,EAC/B,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,EACxD,OAAO,EAAE,aAAa;IAGxB,OAAO,CAAC,6BAA6B;IAWrC,OAAO,CAAC,cAAc;YAIR,cAAc;IAqB5B,OAAO,CAAC,qBAAqB;IAS7B;;;;OAIG;IACH,uBAAuB,CACrB,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,GACzD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAgB1B;;;OAGG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAC3D,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,kBAAkB,CAAC;IAoD9B;;;OAGG;IACH,wBAAwB,CACtB,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,cAAc,EAAE,aAAa,GAC5B,kBAAkB;IAuCrB;;;;;;;;;;;OAWG;IACH,kBAAkB,CAChB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,GACzB,IAAI;IAwBP;;OAEG;IACH,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IA4CxE;;;OAGG;IACG,sBAAsB,CAC1B,gBAAgB,EAAE,kBAAkB,EACpC,gBAAgB,EAAE,WAAW,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EACpE,cAAc,EAAE,aAAa,EAC7B,WAAW,CAAC,EAAE,WAAW,EACzB,OAAO,SAA4B,GAClC,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,SAAS,CAAC;YAgG9B,cAAc;YAoBd,aAAa;YAkBb,eAAe;YAoBf,uBAAuB;YAyCvB,eAAe;YA+Bf,eAAe;IAgJ7B;;;OAGG;IACG,sBAAsB,CAC1B,gBAAgB,EAAE,kBAAkB,EACpC,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAShC,mFAAmF;IAC7E,qBAAqB,CACzB,gBAAgB,EAAE,kBAAkB,EACpC,WAAW,EAAE,mBAAmB,GAAG,SAAS,EAC5C,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IA2IhC;;;;OAIG;IACG,mBAAmB,CACvB,QAAQ,EAAE,kBAAkB,EAC5B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,SAAS,CAAC;CAoC7C"}