typekro 0.5.0 → 0.8.0

package/dist/core/containers/registries/ecr.js

@@ -0,0 +1,118 @@
+/**
+ * Amazon ECR Registry Handler
+ *
+ * Uses the AWS SDK's credential provider chain for all authentication.
+ * Supports env vars, profiles, SSO sessions, instance roles, and role
+ * assumption — all through the SDK's standard mechanisms.
+ */
+import { CreateRepositoryCommand, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, } from '@aws-sdk/client-ecr';
+import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
+import { getComponentLogger } from '../../logging/index.js';
+import { ContainerBuildError } from '../errors.js';
+import { execDocker } from '../exec.js';
+const logger = getComponentLogger('container-registry-ecr');
+export class EcrRegistryHandler {
+    config;
+    resolvedAccountId;
+    resolvedRegion;
+    credentialProvider;
+    ecrClient;
+    constructor(config) {
+        this.config = config;
+        this.resolvedRegion = config.region
+            ?? process.env.AWS_REGION
+            ?? process.env.AWS_DEFAULT_REGION
+            ?? 'us-east-1';
+        this.credentialProvider = fromNodeProviderChain(config.credentials ?? {});
+        this.ecrClient = new ECRClient({
+            region: this.resolvedRegion,
+            credentials: this.credentialProvider,
+        });
+    }
+    async resolveImageUri(imageName, tag) {
+        const accountId = await this.getAccountId();
+        return `${accountId}.dkr.ecr.${this.resolvedRegion}.amazonaws.com/${imageName}:${tag}`;
+    }
+    async authenticate() {
+        try {
+            const authResponse = await this.ecrClient.send(new GetAuthorizationTokenCommand({}));
+            const authData = authResponse.authorizationData?.[0];
+            if (!authData?.authorizationToken || !authData.proxyEndpoint) {
+                throw new Error('ECR returned empty authorization data');
+            }
+            const decoded = Buffer.from(authData.authorizationToken, 'base64').toString();
+            const colonIndex = decoded.indexOf(':');
+            if (colonIndex === -1)
+                throw new Error('Failed to decode ECR authorization token');
+            const password = decoded.slice(colonIndex + 1);
+            await execDocker(['login', '--username', 'AWS', '--password-stdin', authData.proxyEndpoint], {
+                stdin: password,
+                quiet: true,
+            });
+            logger.info('Authenticated with ECR', { endpoint: authData.proxyEndpoint });
+            if (!this.resolvedAccountId) {
+                const match = authData.proxyEndpoint.match(/https?:\/\/(\d+)\.dkr\.ecr/);
+                if (match?.[1])
+                    this.resolvedAccountId = match[1];
+            }
+        }
+        catch (error) {
+            if (error instanceof ContainerBuildError)
+                throw error;
+            throw ContainerBuildError.ecrAuthFailed(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    async push(imageUri, imageName) {
+        if (this.config.createRepository !== false) {
+            await this.ensureRepositoryExists(imageName);
+        }
+        try {
+            await execDocker(['push', imageUri]);
+            logger.info('Image pushed to ECR', { imageUri });
+            return true;
+        }
+        catch (error) {
+            throw ContainerBuildError.pushFailed(imageUri, error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    async getAccountId() {
+        if (this.config.accountId)
+            return this.config.accountId;
+        if (this.resolvedAccountId)
+            return this.resolvedAccountId;
+        try {
+            const sts = new STSClient({
+                region: this.resolvedRegion,
+                credentials: this.credentialProvider,
+            });
+            const identity = await sts.send(new GetCallerIdentityCommand({}));
+            if (!identity.Account)
+                throw new Error('STS returned no account ID');
+            this.resolvedAccountId = identity.Account;
+            return identity.Account;
+        }
+        catch (error) {
+            throw ContainerBuildError.ecrAuthFailed(new Error(`Cannot determine AWS account ID. Provide accountId explicitly or ensure valid AWS credentials.\n` +
+                `Cause: ${error instanceof Error ? error.message : String(error)}`));
+        }
+    }
+    async ensureRepositoryExists(repoName) {
+        try {
+            await this.ecrClient.send(new DescribeRepositoriesCommand({ repositoryNames: [repoName] }));
+        }
+        catch (error) {
+            if (error.name === 'RepositoryNotFoundException') {
+                logger.info('Creating ECR repository', { repoName });
+                await this.ecrClient.send(new CreateRepositoryCommand({ repositoryName: repoName }));
+            }
+            else {
+                throw new ContainerBuildError(`ECR repository check failed for "${repoName}": ${error instanceof Error ? error.message : String(error)}`, 'ECR_REPOSITORY_ERROR', [
+                    `Check IAM permissions: ecr:DescribeRepositories and ecr:CreateRepository are required.`,
+                    `Or set createRepository: false and create the repository manually.`,
+                ], error instanceof Error ? error : undefined);
+            }
+        }
+    }
+}
+//# sourceMappingURL=ecr.js.map

package/dist/core/containers/registries/ecr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecr.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/ecr.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,SAAS,EACT,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;AAE5D,MAAM,OAAO,kBAAkB;IAMA;IALrB,iBAAiB,CAAqB;IACtC,cAAc,CAAS;IACvB,kBAAkB,CAAgC;IAClD,SAAS,CAAY;IAE7B,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;QACpD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM;eAC9B,OAAO,CAAC,GAAG,CAAC,UAAU;eACtB,OAAO,CAAC,GAAG,CAAC,kBAAkB;eAC9B,WAAW,CAAC;QACjB,IAAI,CAAC,kBAAkB,GAAG,qBAAqB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC;YAC7B,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,WAAW,EAAE,IAAI,CAAC,kBAAkB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,GAAW;QAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,GAAG,SAAS,YAAY,IAAI,CAAC,cAAc,kBAAkB,SAAS,IAAI,GAAG,EAAE,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ,EAAE,kBAAkB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,UAAU,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YAE/C,MAAM,UAAU,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE;gBAC3F,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;YAE5E,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBACzE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB;gBAAE,MAAM,KAAK,CAAC;YACtD,MAAM,mBAAmB,CAAC,aAAa,CACrC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,SAAiB;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,mBAAmB,CAAC,UAAU,CAClC,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;gBACxB,MAAM,EAAE,IAAI,CAAC,cAAc;gBAC3B,WAAW,EAAE,IAAI,CAAC,kBAAkB;aACrC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACrE,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC1C,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,mBAAmB,CAAC,aAAa,CACrC,IAAI,KAAK,CACP,kGAAkG;gBAClG,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,QAAgB;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAK,KAA2B,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAC3B,oCAAoC,QAAQ,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1G,sBAAsB,EACtB;oBACE,wFAAwF;oBACxF,oEAAoE;iBACrE,EACD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/core/containers/registries/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Registry Resolver
+ *
+ * Maps a RegistryConfig to its handler implementation.
+ */
+import type { RegistryConfig, RegistryHandler } from './types.js';
+export declare function resolveRegistry(config: RegistryConfig): RegistryHandler;
+export type { RegistryConfig, RegistryHandler } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/containers/registries/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElE,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,CAavE;AAED,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/core/containers/registries/index.js

@@ -0,0 +1,23 @@
+/**
+ * Registry Resolver
+ *
+ * Maps a RegistryConfig to its handler implementation.
+ */
+import { ContainerBuildError } from '../errors.js';
+import { EcrRegistryHandler } from './ecr.js';
+import { OrbstackRegistryHandler } from './orbstack.js';
+export function resolveRegistry(config) {
+    switch (config.type) {
+        case 'orbstack':
+            return new OrbstackRegistryHandler();
+        case 'ecr':
+            return new EcrRegistryHandler(config);
+        case 'gcr':
+            throw ContainerBuildError.registryNotSupported('gcr');
+        case 'acr':
+            throw ContainerBuildError.registryNotSupported('acr');
+        default:
+            throw ContainerBuildError.registryNotSupported(String(config.type));
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/core/containers/registries/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAGxD,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,IAAI,uBAAuB,EAAE,CAAC;QACvC,KAAK,KAAK;YACR,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,KAAK,KAAK;YACR,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxD,KAAK,KAAK;YACR,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxD;YACE,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,MAAM,CAAE,MAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC"}

package/dist/core/containers/registries/orbstack.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Orbstack Registry Handler
+ *
+ * Orbstack makes locally-built Docker images automatically available to its
+ * built-in Kubernetes cluster. No push step is needed — `docker build` is
+ * sufficient.
+ */
+import type { RegistryHandler } from './types.js';
+export declare class OrbstackRegistryHandler implements RegistryHandler {
+    resolveImageUri(imageName: string, tag: string): Promise<string>;
+    authenticate(): Promise<void>;
+    push(_imageUri: string, _imageName: string): Promise<boolean>;
+}
+//# sourceMappingURL=orbstack.d.ts.map

package/dist/core/containers/registries/orbstack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orbstack.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/orbstack.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,qBAAa,uBAAwB,YAAW,eAAe;IACvD,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAKpE"}

package/dist/core/containers/registries/orbstack.js

@@ -0,0 +1,24 @@
+/**
+ * Orbstack Registry Handler
+ *
+ * Orbstack makes locally-built Docker images automatically available to its
+ * built-in Kubernetes cluster. No push step is needed — `docker build` is
+ * sufficient.
+ */
+import { getComponentLogger } from '../../logging/index.js';
+const logger = getComponentLogger('container-registry-orbstack');
+export class OrbstackRegistryHandler {
+    async resolveImageUri(imageName, tag) {
+        return `${imageName}:${tag}`;
+    }
+    async authenticate() {
+        // No authentication needed — Orbstack uses the local Docker daemon.
+        logger.debug('Orbstack registry: no authentication needed');
+    }
+    async push(_imageUri, _imageName) {
+        // No push needed — images built locally are auto-available to Orbstack K8s.
+        logger.debug('Orbstack registry: skipping push (images auto-available to local K8s)');
+        return false;
+    }
+}
+//# sourceMappingURL=orbstack.js.map

package/dist/core/containers/registries/orbstack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orbstack.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/orbstack.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAG5D,MAAM,MAAM,GAAG,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;AAEjE,MAAM,OAAO,uBAAuB;IAClC,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,GAAW;QAClD,OAAO,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,oEAAoE;QACpE,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,UAAkB;QAC9C,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/core/containers/registries/types.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Container Registry Types
+ *
+ * Defines the registry configuration interface and the internal handler
+ * contract. New registries (GCR, ACR, etc.) are added by:
+ * 1. Adding a config variant to RegistryConfig
+ * 2. Implementing RegistryHandler
+ * 3. Registering in the resolver
+ */
+export interface OrbstackRegistryConfig {
+    type: 'orbstack';
+}
+/**
+ * ECR registry configuration.
+ *
+ * Credential options are passed directly to the AWS SDK's
+ * `fromNodeProviderChain`, which handles env vars, profiles,
+ * SSO sessions, instance roles, web identity tokens, and role
+ * assumption. Any option accepted by the SDK's DefaultProviderInit
+ * can be passed via `credentials`.
+ */
+export interface EcrRegistryConfig {
+    type: 'ecr';
+    /** AWS account ID. Auto-detected from STS if omitted. */
+    accountId?: string;
+    /** AWS region. Falls back to AWS_REGION / AWS_DEFAULT_REGION env vars. */
+    region?: string;
+    /** Create the ECR repository if it doesn't exist (default: true). */
+    createRepository?: boolean;
+    /**
+     * AWS credential options passed to `fromNodeProviderChain`.
+     * Common options: `profile`, `roleArn`, `roleSessionName`,
+     * `mfaCodeProvider`, `configFilepath`.
+     * Omit to use the default credential chain (env vars, profiles, SSO, etc.).
+     */
+    credentials?: import('@aws-sdk/credential-provider-node').DefaultProviderInit;
+}
+export interface GcrRegistryConfig {
+    type: 'gcr';
+    projectId: string;
+}
+export interface AcrRegistryConfig {
+    type: 'acr';
+    registryName: string;
+}
+/** Discriminated union of all supported container registries. */
+export type RegistryConfig = OrbstackRegistryConfig | EcrRegistryConfig | GcrRegistryConfig | AcrRegistryConfig;
+export interface ContainerBuildOptions {
+    /** Path to the build context directory (contains the Dockerfile). */
+    context: string;
+    /** Dockerfile path relative to context (default: 'Dockerfile'). */
+    dockerfile?: string;
+    /** Image name without registry prefix or tag (e.g., 'my-app'). */
+    imageName: string;
+    /** Tag: explicit string, 'content-hash' for SHA-based, or undefined for 'latest'. */
+    tag?: string;
+    /** Target platform (e.g., 'linux/amd64'). Omit for native platform. */
+    platform?: string;
+    /** Additional Docker build arguments. */
+    buildArgs?: Record<string, string>;
+    /** Docker build target for multi-stage builds. */
+    target?: string;
+    /** Suppress build output — only log on error. */
+    quiet?: boolean;
+    /** Build timeout in milliseconds (default: 300_000 = 5 minutes). */
+    timeout?: number;
+    /**
+     * Extra Docker CLI arguments appended to the build command.
+     * Escape hatch for --secret, --ssh, --cache-from, etc.
+     */
+    extraDockerArgs?: string[];
+    /** Registry to push the built image to. */
+    registry: RegistryConfig;
+}
+export interface ContainerBuildResult {
+    /** Full image URI (e.g., '123456.dkr.ecr.us-east-1.amazonaws.com/app:sha-abc123'). */
+    imageUri: string;
+    /** The tag that was applied. */
+    tag: string;
+    /** Build duration in milliseconds. */
+    duration: number;
+    /** Whether the image was pushed to a remote registry. */
+    pushed: boolean;
+}
+/** Internal interface that each registry implementation fulfills. */
+export interface RegistryHandler {
+    /** Compute the full image URI (registry prefix + name + tag). */
+    resolveImageUri(imageName: string, tag: string): Promise<string>;
+    /** Authenticate with the registry. No-op for local registries. */
+    authenticate(): Promise<void>;
+    /** Push the image to the registry. Returns true if pushed, false for local registries. */
+    push(imageUri: string, imageName: string): Promise<boolean>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/containers/registries/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,UAAU,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,KAAK,CAAC;IACZ,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,mCAAmC,EAAE,mBAAmB,CAAC;CAC/E;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,KAAK,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,KAAK,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,iEAAiE;AACjE,MAAM,MAAM,cAAc,GACtB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,CAAC;AAMtB,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,2CAA2C;IAC3C,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,EAAE,OAAO,CAAC;CACjB;AAMD,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,kEAAkE;IAClE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,0FAA0F;IAC1F,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D"}

package/dist/core/containers/registries/types.js

@@ -0,0 +1,11 @@
+/**
+ * Container Registry Types
+ *
+ * Defines the registry configuration interface and the internal handler
+ * contract. New registries (GCR, ACR, etc.) are added by:
+ * 1. Adding a config variant to RegistryConfig
+ * 2. Implementing RegistryHandler
+ * 3. Registering in the resolver
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/containers/registries/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/core/dependencies/graph.d.ts

@@ -8,6 +8,10 @@ import type { DependencyNode } from '../types/dependencies.js';
 import type { DeployableK8sResource, Enhanced } from '../types/kubernetes.js';
 export declare class DependencyGraph {
     private nodes;
+    /**
+     * Check if a node exists in the graph
+     */
+    hasNode(id: string): boolean;
     /**
      * Add a node to the dependency graph
      */

package/dist/core/dependencies/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/core/dependencies/graph.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAE9E,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAAqC;IAElD;;OAEG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI;IAiBtF;;;;OAIG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAuBxD;;OAEG;IACH,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC;IAIvC;;OAEG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI/C;;OAEG;IACH,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE;IAKrC;;OAEG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE;IAKnC;;OAEG;IACH,SAAS,IAAI,OAAO;IASpB;;OAEG;IACH,UAAU,IAAI,MAAM,EAAE,EAAE;IAyCxB;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IA4C/B;;OAEG;IACH,YAAY,IAAI,MAAM,EAAE;IAMxB;;OAEG;IACH,YAAY,IAAI,MAAM,EAAE;IAMxB;;OAEG;IACH,KAAK,IAAI,eAAe;IAkBxB;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,eAAe;CA0BhD"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../src/core/dependencies/graph.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAE9E,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAAqC;IAElD;;OAEG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI5B;;OAEG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI;IAiBtF;;;;OAIG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAuBxD;;OAEG;IACH,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC;IAIvC;;OAEG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI/C;;OAEG;IACH,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE;IAKrC;;OAEG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE;IAKnC;;OAEG;IACH,SAAS,IAAI,OAAO;IASpB;;OAEG;IACH,UAAU,IAAI,MAAM,EAAE,EAAE;IAyCxB;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IA4C/B;;OAEG;IACH,YAAY,IAAI,MAAM,EAAE;IAMxB;;OAEG;IACH,YAAY,IAAI,MAAM,EAAE;IAMxB;;OAEG;IACH,KAAK,IAAI,eAAe;IAkBxB;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,eAAe;CA0BhD"}

package/dist/core/dependencies/graph.js

@@ -7,6 +7,12 @@
 import { CircularDependencyError, TypeKroError } from '../errors.js';
 export class DependencyGraph {
     nodes = new Map();
+    /**
+     * Check if a node exists in the graph
+     */
+    hasNode(id) {
+        return this.nodes.has(id);
+    }
     /**
      * Add a node to the dependency graph
      */

package/dist/core/dependencies/graph.js.map

@@ -1 +1 @@
-{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../../src/core/dependencies/graph.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAIrE,MAAM,OAAO,eAAe;IAClB,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAElD;;OAEG;IACH,OAAO,CAAC,EAAU,EAAE,QAA2D;QAC7E,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EAAE,sCAAsC,EACzD,sBAAsB,EACtB,EAAE,MAAM,EAAE,EAAE,EAAE,CACf,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;YACjB,EAAE;YACF,QAAQ;YACR,YAAY,EAAE,IAAI,GAAG,EAAE;YACvB,UAAU,EAAE,IAAI,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,WAAmB,EAAE,YAAoB;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,YAAY,CACpB,mBAAmB,WAAW,sBAAsB,EACpD,sBAAsB,EACtB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAC3C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CACpB,oBAAoB,YAAY,sBAAsB,EACtD,sBAAsB,EACtB,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAC7C,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,EAAU;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,EAAU;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,SAAS;QACP,IAAI,CAAC;YACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,KAAK,YAAY,uBAAuB,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,MAAM,MAAM,GAAe,EAAE,CAAC;QAE9B,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,IAAc,EAAQ,EAAE;YACnD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,gBAAgB;gBAChB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAElB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBAC7C,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,mBAAmB;QACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,6BAA6B;QAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM;gBAAE,MAAM;YACnB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1C,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,eAAe,KAAK,SAAS;oBAAE,SAAS;gBAC5C,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,CAAC;gBACxC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAEvC,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAAC,iCAAiC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;aACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,gBAAgB;QAChB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,gBAAgB;QAChB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7C,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAAiB;QAC3B,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAEnC,6CAA6C;QAC7C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;wBAChC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;oBACzC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,4DAA4D"}
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../../src/core/dependencies/graph.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAIrE,MAAM,OAAO,eAAe;IAClB,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAElD;;OAEG;IACH,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,EAAU,EAAE,QAA2D;QAC7E,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,YAAY,CACpB,iBAAiB,EAAE,sCAAsC,EACzD,sBAAsB,EACtB,EAAE,MAAM,EAAE,EAAE,EAAE,CACf,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;YACjB,EAAE;YACF,QAAQ;YACR,YAAY,EAAE,IAAI,GAAG,EAAE;YACvB,UAAU,EAAE,IAAI,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,WAAmB,EAAE,YAAoB;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,YAAY,CACpB,mBAAmB,WAAW,sBAAsB,EACpD,sBAAsB,EACtB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAC3C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CACpB,oBAAoB,YAAY,sBAAsB,EACtD,sBAAsB,EACtB,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAC7C,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,EAAU;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,EAAU;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,SAAS;QACP,IAAI,CAAC;YACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,KAAK,YAAY,uBAAuB,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,MAAM,MAAM,GAAe,EAAE,CAAC;QAE9B,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,IAAc,EAAQ,EAAE;YACnD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,gBAAgB;gBAChB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAElB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBAC7C,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,mBAAmB;QACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,6BAA6B;QAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM;gBAAE,MAAM;YACnB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1C,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,eAAe,KAAK,SAAS;oBAAE,SAAS;gBAC5C,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,CAAC;gBACxC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAEvC,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAAC,iCAAiC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;aACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,gBAAgB;QAChB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,gBAAgB;QAChB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7C,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAAiB;QAC3B,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAEnC,6CAA6C;QAC7C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;wBAChC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;oBACzC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,4DAA4D"}

package/dist/core/dependencies/resolver.d.ts

@@ -24,6 +24,19 @@ export declare class DependencyResolver {
      * Extract all references from a resource
      */
     private extractReferences;
+    /**
+     * Parse embedded KubernetesRef marker strings from serialized values.
+     *
+     * When a KubernetesRef proxy is used in a template literal (e.g.,
+     * `postgresql://${database.status.writeService}:5432/mydb`), the
+     * Symbol.toPrimitive handler produces a marker string:
+     *   __KUBERNETES_REF_{resourceId}_{fieldPath}__
+     *
+     * This method extracts those markers so the dependency resolver can
+     * detect references to other resources embedded in string values.
+     * The same marker format is used by schema-proxy.ts.
+     */
+    private parseMarkerReferences;
     /**
      * Parse CEL expressions to extract resource references
      */
@@ -32,6 +45,21 @@ export declare class DependencyResolver {
      * Analyze deployment order and identify parallelizable resources
      */
     analyzeDeploymentOrder(graph: DependencyGraph): DeploymentPlan;
+    /**
+     * Analyze deletion order — reverse of deployment levels.
+     *
+     * Returns parallelizable levels where the LAST deployment level (leaf
+     * resources with the most dependencies) is deleted FIRST. This ensures
+     * dependents are removed before their dependencies (e.g., App before
+     * Database, Database before Namespace).
+     *
+     * Resources with `lifecycle: 'shared'` are excluded from the deletion plan.
+     */
+    analyzeDeletionOrder(graph: DependencyGraph, sharedResourceIds?: Set<string>): DeploymentPlan;
+    /**
+     * Build a subgraph excluding shared resources for deletion planning.
+     */
+    private buildDeletionSubgraph;
     /**
      * Get rollback order (reverse of deployment order)
      */

package/dist/core/dependencies/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/core/dependencies/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAA6C;IAE3D;;OAEG;IACH,oBAAoB,CAClB,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,GAC7D,eAAe;IAgClB;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE;IAIrD;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAS9C;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+BzB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAuB1B;;OAEG;IACH,sBAAsB,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc;IA0C9D;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE;IAKlD;;OAEG;IACH,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE;IAI1D;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE;CAGxD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/core/dependencies/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAA6C;IAE3D;;OAEG;IACH,oBAAoB,CAClB,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,GAC7D,eAAe;IAkFlB;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE;IAIrD;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAS9C;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAoCzB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;IAsB7B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAuB1B;;OAEG;IACH,sBAAsB,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc;IA0C9D;;;;;;;;;OASG;IACH,oBAAoB,CAClB,KAAK,EAAE,eAAe,EACtB,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAC9B,cAAc;IAejB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAyB7B;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE;IAKlD;;OAEG;IACH,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE;IAI1D;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE;CAGxD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB"}

package/dist/core/dependencies/resolver.js

@@ -5,9 +5,10 @@
  * topological ordering for deployment.
  */
 import { isCelExpression, isKubernetesRef } from '../../utils/type-guards.js';
-import { KUBERNETES_REF_BRAND } from '../constants/brands.js';
+import { KUBERNETES_REF_BRAND, KUBERNETES_REF_MARKER_PATTERN } from '../constants/brands.js';
 import { CircularDependencyError, TypeKroError } from '../errors.js';
 import { getComponentLogger } from '../logging/index.js';
+import { getResourceId } from '../metadata/index.js';
 import { DependencyGraph } from './graph.js';
 export class DependencyResolver {
     logger = getComponentLogger('dependency-resolver');
@@ -16,9 +17,17 @@ export class DependencyResolver {
      */
     buildDependencyGraph(resources) {
         const graph = new DependencyGraph();
-        // Add all resources as nodes first
+        // Add all resources as nodes and build a reverse map from original
+        // composition IDs (e.g., 'database') to graph IDs (e.g., 'testappResource0Database').
+        // Marker strings in template literals use the original composition ID, but
+        // the graph nodes use the prefixed deployment ID.
+        const originalIdToGraphId = new Map();
         for (const resource of resources) {
             graph.addNode(resource.id, resource);
+            const originalId = getResourceId(resource);
+            if (originalId && originalId !== resource.id) {
+                originalIdToGraphId.set(originalId, resource.id);
+            }
         }
         // Analyze each resource for references and add edges
         for (const resource of resources) {
@@ -26,10 +35,19 @@ export class DependencyResolver {
             for (const ref of references) {
                 // Skip schema references (these are internal TypeKro references)
                 if (ref.resourceId !== '__schema__') {
-                    try {
-                        graph.addEdge(resource.id, ref.resourceId);
+                    // Resolve the reference ID: try graph ID first, then original ID mapping
+                    const targetId = graph.hasNode(ref.resourceId)
+                        ? ref.resourceId
+                        : originalIdToGraphId.get(ref.resourceId);
+                    if (targetId) {
+                        try {
+                            graph.addEdge(resource.id, targetId);
+                        }
+                        catch {
+                            // Edge already exists — safe to ignore
+                        }
                     }
-                    catch {
+                    else {
                         // Log warning if referenced resource doesn't exist in the graph
                         // This might be an external reference that will be resolved at runtime
                         this.logger.warn('Reference to unknown resource', {
@@ -40,6 +58,37 @@ export class DependencyResolver {
                 }
             }
         }
+        // Detect implicit namespace dependencies: if a resource has metadata.namespace
+        // matching the metadata.name of a Namespace resource in the graph, the resource
+        // depends on that Namespace being created first.
+        const namespaceResources = new Map(); // namespace name → resource graph ID
+        for (const resource of resources) {
+            if (resource.kind === 'Namespace' && resource.metadata?.name) {
+                namespaceResources.set(resource.metadata.name, resource.id);
+            }
+        }
+        if (namespaceResources.size > 0) {
+            for (const resource of resources) {
+                const ns = resource.metadata?.namespace;
+                if (ns && namespaceResources.has(ns)) {
+                    const nsResourceId = namespaceResources.get(ns);
+                    // Don't add self-dependency
+                    if (nsResourceId !== resource.id) {
+                        try {
+                            graph.addEdge(resource.id, nsResourceId);
+                            this.logger.debug('Added implicit namespace dependency', {
+                                resource: resource.id,
+                                namespace: ns,
+                                namespaceResource: nsResourceId,
+                            });
+                        }
+                        catch {
+                            // Edge already exists or other issue — safe to ignore
+                        }
+                    }
+                }
+            }
+        }
         return graph;
     }
     /**
@@ -76,6 +125,12 @@ export class DependencyResolver {
                 const celRefs = this.parseCelReferences(obj.expression);
                 refs.push(...celRefs);
             }
+            else if (typeof obj === 'string') {
+                // Detect embedded KubernetesRef marker strings from template literals.
+                // Format: __KUBERNETES_REF_{resourceId}_{fieldPath}__
+                const markerRefs = this.parseMarkerReferences(obj);
+                refs.push(...markerRefs);
+            }
             else if (Array.isArray(obj)) {
                 obj.forEach((item, index) => {
                     traverse(item, `${path}[${index}]`);
@@ -90,6 +145,37 @@ export class DependencyResolver {
         traverse(resource);
         return refs;
     }
+    /**
+     * Parse embedded KubernetesRef marker strings from serialized values.
+     *
+     * When a KubernetesRef proxy is used in a template literal (e.g.,
+     * `postgresql://${database.status.writeService}:5432/mydb`), the
+     * Symbol.toPrimitive handler produces a marker string:
+     *   __KUBERNETES_REF_{resourceId}_{fieldPath}__
+     *
+     * This method extracts those markers so the dependency resolver can
+     * detect references to other resources embedded in string values.
+     * The same marker format is used by schema-proxy.ts.
+     */
+    parseMarkerReferences(value) {
+        const refs = [];
+        // Match __KUBERNETES_REF_{resourceId}_{fieldPath}__
+        // resourceId: word chars, hyphens, digits (e.g., 'database', 'inngest-bootstrap1')
+        // fieldPath: word chars, dots, hyphens (e.g., 'status.writeService', 'metadata.name')
+        // Exclude __schema__ refs — those are schema proxy refs, not resource dependencies
+        const markerPattern = new RegExp(KUBERNETES_REF_MARKER_PATTERN.source, 'g');
+        let match = markerPattern.exec(value);
+        while (match !== null) {
+            const [, resourceId, fieldPath] = match;
+            refs.push({
+                [KUBERNETES_REF_BRAND]: true,
+                resourceId,
+                fieldPath,
+            });
+            match = markerPattern.exec(value);
+        }
+        return refs;
+    }
     /**
      * Parse CEL expressions to extract resource references
      */
@@ -143,6 +229,53 @@ export class DependencyResolver {
             maxParallelism: Math.max(...levels.map((level) => level.length)),
         };
     }
+    /**
+     * Analyze deletion order — reverse of deployment levels.
+     *
+     * Returns parallelizable levels where the LAST deployment level (leaf
+     * resources with the most dependencies) is deleted FIRST. This ensures
+     * dependents are removed before their dependencies (e.g., App before
+     * Database, Database before Namespace).
+     *
+     * Resources with `lifecycle: 'shared'` are excluded from the deletion plan.
+     */
+    analyzeDeletionOrder(graph, sharedResourceIds) {
+        // Build a subgraph excluding shared resources
+        const deletionGraph = sharedResourceIds
+            ? this.buildDeletionSubgraph(graph, sharedResourceIds)
+            : graph;
+        const deploymentPlan = this.analyzeDeploymentOrder(deletionGraph);
+        return {
+            levels: [...deploymentPlan.levels].reverse(),
+            totalResources: deploymentPlan.totalResources,
+            maxParallelism: deploymentPlan.maxParallelism,
+        };
+    }
+    /**
+     * Build a subgraph excluding shared resources for deletion planning.
+     */
+    buildDeletionSubgraph(graph, sharedResourceIds) {
+        const subgraph = new DependencyGraph();
+        for (const nodeId of graph.getTopologicalOrder()) {
+            if (sharedResourceIds.has(nodeId))
+                continue;
+            const node = graph.getNode(nodeId);
+            if (node)
+                subgraph.addNode(nodeId, node.resource);
+        }
+        for (const nodeId of graph.getTopologicalOrder()) {
+            if (sharedResourceIds.has(nodeId))
+                continue;
+            for (const dep of graph.getDependencies(nodeId)) {
+                if (sharedResourceIds.has(dep))
+                    continue;
+                if (subgraph.hasNode(dep)) {
+                    subgraph.addEdge(nodeId, dep);
+                }
+            }
+        }
+        return subgraph;
+    }
     /**
      * Get rollback order (reverse of deployment order)
      */