typekro 0.7.0 → 0.9.0

package/dist/core/serialization/core.js

@@ -4,17 +4,22 @@
  * This module provides the main serialization functions to convert
  * TypeScript resource definitions to Kro ResourceGraphDefinition YAML manifests.
  */
+import { createCompositionContext, getCurrentCompositionContext, runInStatusBuilderContext, runWithCompositionContext, } from '../composition/context.js';
 import { createDirectResourceFactory } from '../deployment/direct-factory.js';
 import { createKroResourceFactory } from '../deployment/kro-factory.js';
 import { ensureError, ValidationError } from '../errors.js';
+import { CEL_EXPRESSION_BRAND, KUBERNETES_REF_MARKER_SOURCE } from '../../shared/brands.js';
 import { analyzeCompositionBody, applyAnalysisToResources, } from '../expressions/composition/composition-analyzer.js';
+import { remapResourceStatusReferences } from '../expressions/composition/composition-analyzer-helpers.js';
 import { StatusBuilderAnalyzer } from '../expressions/factory/status-builder-analyzer.js';
 import { getComponentLogger } from '../logging/index.js';
-import { setResourceId } from '../metadata/index.js';
+import { getMetadataField, setResourceId } from '../metadata/index.js';
 import { createExternalRefWithoutRegistration, createSchemaProxy } from '../references/index.js';
 import { getKindInfo, getSemanticCandidateKinds } from '../resources/factory-registry.js';
 import { validateResourceGraphDefinition } from '../validation/cel-validator.js';
 import { optimizeStatusMappings } from './cel-optimizer.js';
+import { finalizeCelForKro } from './cel-references.js';
+import { applyTernaryConditionalsToResources } from './kro-post-processing.js';
 import { generateKroSchemaFromArktype } from './schema.js';
 import { runStatusAnalysisPipeline } from './status-analysis-pipeline.js';
 import { serializeResourceGraphToYaml } from './yaml.js';
@@ -236,16 +241,170 @@ function analyzeAndConvertStatusMappings(definition, statusBuilder, schema, reso
  *
  * @internal Exported for testing only
  */
-function processCompositionBodyAnalysis(statusMappings, resourcesWithKeys, analyzedStatusMappings, serializationLogger) {
+function processCompositionBodyAnalysis(statusMappings, resourcesWithKeys, analyzedStatusMappings, serializationLogger, schemaDefinition) {
     let compositionAnalysis = null;
-    const analysisState = { appliedToResources: false };
+    const analysisState = { appliedToResources: false, ternaryAndOmitApplied: false };
     const originalCompositionFnForAnalysis = statusMappings
         ?.__originalCompositionFn;
     if (originalCompositionFnForAnalysis) {
         try {
             const resourceIds = new Set(Object.keys(resourcesWithKeys));
-            compositionAnalysis = analyzeCompositionBody(originalCompositionFnForAnalysis, resourceIds);
-            // Create stub resources for factory calls that weren't registered at runtime
+            const specJson = schemaDefinition?.spec?.json;
+            const optionalFieldNames = specJson ? collectOptionalSpecPaths(specJson) : undefined;
+            const nestedStatusDescriptor = Object.getOwnPropertyDescriptor(statusMappings, '__nestedStatusCel');
+            const nestedStatusCel = nestedStatusDescriptor?.value;
+            compositionAnalysis = analyzeCompositionBody(originalCompositionFnForAnalysis, resourceIds, optionalFieldNames);
+            // Differential execution to capture untaken-branch resources.
+            //
+            // When a composition uses plain JS control flow (`if (!spec.optional) { ... }`),
+            // the truthy proxy pass takes the OPPOSITE branch because `!proxy === false`,
+            // which means the resource inside the branch is never registered at runtime.
+            // We re-execute the composition with optional fields set to `undefined`
+            // (where `!undefined === true` triggers those branches) in an ISOLATED
+            // composition context and merge any resources captured there into the main
+            // resource map. The AST analyzer has already recorded the correct
+            // `includeWhen` for each such resource, and `applyAnalysisToResources`
+            // (called later during toYaml()) attaches that metadata — so the final
+            // RGD emits the resource with a CEL `has()` / `!has()` conditional
+            // derived from the composition's native `if`/`else` statements.
+            //
+            // Prerequisites: we need the schema definition to know which fields
+            // are optional (so we set them to undefined) and which are required
+            // (so we set them to a sentinel that prevents the composition from
+            // dereferencing undefined). Both runs use the same composition
+            // function, so resource IDs and factory calls are deterministic.
+            //
+            // SKIP when this composition is being executed as a nested call
+            // (`context.isNestedCall === true`). The inner composition's own
+            // definition-time pass already captured its hybrid-branch analysis
+            // with the INNER schema proxy. Re-running that hybrid capture here —
+            // against the fresh inner schema proxy that `captureHybridRunResources`
+            // creates — would emit differential CEL conditionals that reference
+            // inner-schema fields (e.g., `has(schema.spec.secretKeyRef)`) which
+            // don't exist in the outer RGD. The outer composition is the
+            // authority on branch conditions for its own calls; the inner's
+            // branch shape is driven by what the outer passed in.
+            // ── Resource-status ternary compilation (Phases 3+4) ────────────
+            //
+            // When the AST detects ternaries conditioned on resource status
+            // fields (e.g., `cache.status.ready ? 'redis' : 'memory'`), proxy
+            // JS evaluation does not necessarily match CEL truth evaluation.
+            // To emit the CEL conditional, re-execute explicit true and false
+            // branches using `liveStatusMap`, then diff those branch outputs.
+            //
+            // To avoid false positives (other fields changing due to the status
+            // flip), direct factory calls diff only `callSiteResourceId`; nested
+            // composition call arguments diff only resources registered under known
+            // nested composition base IDs.
+            const resourceStatusTernaries = compositionAnalysis.resourceStatusTernaries;
+            // Deduplicate by call site and condition. Conditionalization is scoped to
+            // one callSiteResourceId, so two resources using the same status condition
+            // must both be processed.
+            const seenConditions = new Set();
+            const uniqueTernaries = resourceStatusTernaries.filter((t) => {
+                const key = `${t.callSiteResourceId}:${t.variableName}:${t.conditionExpression ?? t.statusField}`;
+                if (seenConditions.has(key))
+                    return false;
+                seenConditions.add(key);
+                return true;
+            });
+            // Process EACH resource-status ternary independently to avoid
+            // cross-contamination: flip ONE condition → run → diff → apply.
+            // Multiple ternaries on the same resource get independent conditionals.
+            for (const ternary of uniqueTernaries) {
+                const resId = compositionAnalysis.variableToResourceId.get(ternary.variableName) ??
+                    ternary.variableName;
+                if (!resourceIds.has(resId))
+                    continue;
+                const conditionCel = ternary.conditionExpression
+                    ? remapResourceStatusReferences(ternary.conditionExpression, new Map(compositionAnalysis.variableToResourceId).set(ternary.variableName, resId))
+                    : `${resId}.status.${ternary.statusField}`;
+                const trueCtx = runResourceStatusBranch(originalCompositionFnForAnalysis, schemaDefinition, compositionAnalysis, ternary, true);
+                const falseCtx = runResourceStatusBranch(originalCompositionFnForAnalysis, schemaDefinition, compositionAnalysis, ternary, false);
+                // Diff ONLY the targeted resource(s)
+                const targetIds = ternary.callSiteResourceId && ternary.callSiteResourceId !== '__non_factory_call__'
+                    ? [ternary.callSiteResourceId]
+                    : getNestedResourceStatusTargetIds(trueCtx.resources, trueCtx.nestedCompositionIds);
+                for (const id of targetIds) {
+                    const targetRes = resourcesWithKeys[id];
+                    const trueRes = trueCtx.resources[id];
+                    const falseRes = falseCtx.resources[id];
+                    if (targetRes && trueRes && falseRes) {
+                        applyResourceStatusBranchDiff(targetRes, trueRes, falseRes, conditionCel, nestedStatusCel, resourceIds);
+                    }
+                }
+                serializationLogger.debug('Resource-status branch runs applied', {
+                    conditionCel,
+                    targetIds,
+                });
+            }
+            const currentCtx = getCurrentCompositionContext();
+            const skipHybridCapture = currentCtx?.isNestedCall === true;
+            if (!skipHybridCapture &&
+                schemaDefinition &&
+                (compositionAnalysis.unregisteredFactories.length > 0 ||
+                    collectOverridableOptionalFields(schemaDefinition, compositionAnalysis).size > 0)) {
+                const { captured, overriddenFields, overrideConditions } = captureHybridRunResources(originalCompositionFnForAnalysis, schemaDefinition, compositionAnalysis);
+                // (a) Merge resources that exist ONLY in the hybrid run — these
+                // come from branches the proxy run didn't take (e.g., `if (!spec.x)`).
+                // The AST analyzer has already attached the appropriate includeWhen.
+                for (const [id, resource] of Object.entries(captured)) {
+                    if (!resourceIds.has(id)) {
+                        resourcesWithKeys[id] = resource;
+                        resourceIds.add(id);
+                        serializationLogger.debug('Captured resource from untaken branch', {
+                            resourceId: id,
+                        });
+                    }
+                }
+                // (b) For resources that exist in BOTH runs, walk them in parallel
+                // and detect field-level differences. Each differing leaf becomes
+                // a CEL `has(...) ? <proxy value> : <hybrid value>` conditional
+                // applied in place on the proxy-run resource. This covers the
+                // "ternary inside a custom factory's internal transformation" case
+                // where the AST analyzer can't see the final template path, since
+                // the comparison works on the emitted resource structure directly.
+                //
+                // MUTATION SAFETY: this step replaces LEAF values (strings, numbers,
+                // KubernetesRef proxies) inside the proxy-run resources with CEL
+                // conditional strings. It runs after status analysis has captured
+                // its own references (so status builders see the pre-mutation state)
+                // and before YAML serialization (so the mutated state is what gets
+                // emitted). The tree structure is preserved; only leaves change.
+                // `processCompositionBodyAnalysis` is called exactly once per
+                // `toResourceGraph` invocation, and the walk itself is idempotent
+                // (a second pass finds `leafEquals` true for every leaf and no-ops),
+                // so multiple `toYaml()` calls on the resulting TypedResourceGraph
+                // all see a consistent final state.
+                if (overriddenFields.size > 0) {
+                    const baselineResources = Object.fromEntries(Object.entries(resourcesWithKeys).map(([id, resource]) => [
+                        id,
+                        cloneResourceTree(resource),
+                    ]));
+                    const differentialFields = collectDifferentialOptionalFields(compositionAnalysis);
+                    const fieldsToDiff = Array.from(differentialFields).filter((field) => overriddenFields.has(field));
+                    for (const field of fieldsToDiff) {
+                        const singleFieldSet = new Set([field]);
+                        const { captured: fieldCaptured } = captureHybridRunResources(originalCompositionFnForAnalysis, schemaDefinition, compositionAnalysis, singleFieldSet);
+                        const fieldConditions = new Map();
+                        const explicitCondition = overrideConditions.get(field);
+                        if (explicitCondition) {
+                            fieldConditions.set(field, explicitCondition);
+                        }
+                        for (const id of Object.keys(resourcesWithKeys)) {
+                            const proxyRes = resourcesWithKeys[id];
+                            const baselineRes = baselineResources[id];
+                            const hybridRes = fieldCaptured[id];
+                            if (proxyRes && baselineRes && hybridRes) {
+                                applyDifferentialFieldConditionals(proxyRes, baselineRes, hybridRes, singleFieldSet, fieldConditions, nestedStatusCel, resourceIds);
+                            }
+                        }
+                    }
+                }
+            }
+            // Create stub resources for factory calls that STILL weren't registered
+            // (e.g., branches the differential run also didn't take because they
+            // required a different condition to be truthy).
             for (const unregistered of compositionAnalysis.unregisteredFactories) {
                 if (!resourceIds.has(unregistered.resourceId)) {
                     const stub = createStubResource(unregistered.factoryName, unregistered.resourceId);
@@ -276,6 +435,752 @@ function processCompositionBodyAnalysis(statusMappings, resourcesWithKeys, analy
     }
     return { compositionAnalysis, analysisState };
 }
+/**
+ * Collect the top-level optional spec fields that should be overridden
+ * when running the composition for differential branch/field capture.
+ *
+ * We only override fields that the AST analyzer observed being TESTED
+ * in a condition — `if (spec.x)`, `spec.x ? a : b`, or similar.
+ * Overriding fields that the composition only READS unconditionally
+ * (e.g., `spec.server.secret_key` inside a ConfigMap's stringData) is
+ * counterproductive: it would replace those proxy references with
+ * `undefined` in the hybrid run, producing incorrect captured
+ * resources.
+ *
+ * The tested fields are extracted from the AST analyzer's recorded
+ * `includeWhen` expressions (which, after the `conditionToCel` fix,
+ * wrap bare truthiness checks with `has(...)`) by scanning for
+ * `schema.spec.<field>` paths.
+ */
+function collectOverridableOptionalFields(schemaDefinition, analysis) {
+    const specJson = schemaDefinition.spec.json;
+    if (!specJson)
+        return new Set();
+    const differentialFields = collectDifferentialOptionalFields(analysis);
+    return new Set(Array.from(collectOptionalSpecPaths(specJson))
+        .filter((field) => differentialFields.has(field)));
+}
+function collectOptionalSpecPaths(schemaJson, prefix = '') {
+    const paths = new Set();
+    if (!schemaJson || typeof schemaJson !== 'object')
+        return paths;
+    const node = schemaJson;
+    for (const entry of node.optional ?? []) {
+        if (!entry.key)
+            continue;
+        const path = prefix ? `${prefix}.${entry.key}` : entry.key;
+        paths.add(path);
+        for (const childPath of collectOptionalSpecPaths(entry.value, path)) {
+            paths.add(childPath);
+        }
+    }
+    for (const entry of node.required ?? []) {
+        if (!entry.key)
+            continue;
+        const path = prefix ? `${prefix}.${entry.key}` : entry.key;
+        for (const childPath of collectOptionalSpecPaths(entry.value, path)) {
+            paths.add(childPath);
+        }
+    }
+    return paths;
+}
+function collectDifferentialOptionalFields(analysis) {
+    const fields = new Set(analysis.hybridOverrideConditions.keys());
+    for (const field of analysis.differentialConditionFields) {
+        fields.add(field);
+    }
+    for (const controlFlow of analysis.resources.values()) {
+        for (const condition of controlFlow.includeWhen) {
+            const expression = condition.expression;
+            const matches = expression.matchAll(/schema\.spec\.([a-zA-Z0-9_]+(?:\.[a-zA-Z0-9_]+)*)/g);
+            for (const match of matches) {
+                const field = match[1];
+                if (field) {
+                    fields.add(field);
+                }
+            }
+        }
+    }
+    return fields;
+}
+function collectHybridOverrideValues(analysis) {
+    const overrideValues = new Map();
+    for (const [field, expression] of analysis.hybridOverrideConditions.entries()) {
+        const match = expression.match(/^schema\.spec\.([a-zA-Z0-9_.]+)\s*!=\s*false$/);
+        const path = match?.[1];
+        if (!path || path !== field || overrideValues.has(field))
+            continue;
+        overrideValues.set(field, false);
+    }
+    return overrideValues;
+}
+function collectHybridOverrideConditions(analysis) {
+    return new Map(analysis.hybridOverrideConditions);
+}
+/**
+ * Re-execute the composition function in an isolated composition context
+ * with a HYBRID schema spec — the original schema proxy for most fields
+ * (so `spec.name`, `spec.server.secret_key`, etc. still produce
+ * `KubernetesRef` proxy values that serialize into CEL references) but
+ * with specific top-level optional fields overridden to `undefined` so
+ * that `if (!spec.x)`, `if (spec.x === undefined)`, and similar
+ * field-presence tests take the opposite branch from the proxy run.
+ *
+ * Used by {@link processCompositionBodyAnalysis} to capture BOTH:
+ *   (a) resources registered inside branches that the main proxy run
+ *       skipped because `!proxy === false`
+ *   (b) resources that exist in both runs but with field-level
+ *       differences caused by ternary/fallback logic that depends on
+ *       the overridden fields — used for differential CEL conditional
+ *       emission by {@link applyDifferentialFieldConditionals}
+ *
+ * The branches run with real proxy values for every field EXCEPT the
+ * overridden ones, so the captured resources contain the correct CEL
+ * references just like the proxy-run resources.
+ *
+ * Composition functions with external side effects will fire those
+ * effects a second time during this re-execution — see integration-skill
+ * rule #30 for the full contract.
+ */
+function captureHybridRunResources(compositionFn, schemaDefinition, analysis, fieldsToOverride) {
+    try {
+        const allOverriddenFields = collectOverridableOptionalFields(schemaDefinition, analysis);
+        const overriddenFields = fieldsToOverride
+            ? new Set(Array.from(allOverriddenFields).filter((field) => fieldsToOverride.has(field)))
+            : allOverriddenFields;
+        if (overriddenFields.size === 0) {
+            return { captured: {}, overriddenFields, overrideConditions: new Map() };
+        }
+        const overrideValues = new Map(Array.from(collectHybridOverrideValues(analysis)).filter(([field]) => overriddenFields.has(field)));
+        const overrideConditions = new Map(Array.from(collectHybridOverrideConditions(analysis)).filter(([field]) => overriddenFields.has(field)));
+        // Build the hybrid spec: the real schema proxy (so all other field
+        // accesses produce KubernetesRef values) wrapped in a Proxy that
+        // intercepts the overridden keys and returns `undefined`. Accessing
+        // an overridden key's sub-property (e.g., `spec.secretKeyRef.name`)
+        // will throw — but that's exactly the code path the override is
+        // meant to skip, so the thrown access lives inside the `else`
+        // branch that this run intentionally does not execute.
+        const realSchema = createSchemaProxy(schemaDefinition.spec?.json, schemaDefinition.status?.json);
+        const hybridSpec = createHybridSpecProxy(realSchema.spec, overriddenFields, overrideValues);
+        const tempCtx = createCompositionContext('hybrid-capture');
+        runWithCompositionContext(tempCtx, () => {
+            compositionFn(hybridSpec);
+        });
+        return {
+            captured: tempCtx.resources,
+            overriddenFields,
+            overrideConditions,
+        };
+    }
+    catch {
+        // Best-effort: compositions that throw when running with a hybrid spec
+        // degrade gracefully — stub resources still cover the missing factories
+        // and the proxy-run resources are used as-is.
+        return { captured: {}, overriddenFields: new Set(), overrideConditions: new Map() };
+    }
+}
+function createHybridSpecProxy(target, overriddenFields, overrideValues, pathPrefix = '') {
+    return new Proxy(target, {
+        get(proxyTarget, prop, receiver) {
+            if (typeof prop !== 'string') {
+                return Reflect.get(proxyTarget, prop, receiver);
+            }
+            const path = pathPrefix ? `${pathPrefix}.${prop}` : prop;
+            if (overriddenFields.has(path)) {
+                return overrideValues.has(path) ? overrideValues.get(path) : undefined;
+            }
+            const hasNestedOverride = Array.from(overriddenFields).some((field) => field.startsWith(`${path}.`));
+            const value = Reflect.get(proxyTarget, prop, receiver);
+            if (hasNestedOverride && value && (typeof value === 'object' || typeof value === 'function')) {
+                return createHybridSpecProxy(value, overriddenFields, overrideValues, path);
+            }
+            return value;
+        },
+        has(proxyTarget, prop) {
+            if (typeof prop !== 'string') {
+                return Reflect.has(proxyTarget, prop);
+            }
+            const path = pathPrefix ? `${pathPrefix}.${prop}` : prop;
+            if (overriddenFields.has(path)) {
+                return overrideValues.has(path);
+            }
+            return Reflect.has(proxyTarget, prop);
+        },
+    });
+}
+function cloneResourceTree(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => cloneResourceTree(item));
+    }
+    if (isPlainObject(value)) {
+        return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, cloneResourceTree(entryValue)]));
+    }
+    return value;
+}
+function structuralEquals(a, b) {
+    if (isLeafValue(a) || isLeafValue(b)) {
+        return leafEquals(a, b);
+    }
+    if (Array.isArray(a) && Array.isArray(b)) {
+        return a.length === b.length && a.every((item, index) => structuralEquals(item, b[index]));
+    }
+    if (isWalkableRecord(a) && isWalkableRecord(b)) {
+        const keys = new Set([...Object.keys(a), ...Object.keys(b)]);
+        for (const key of keys) {
+            if (!structuralEquals(a[key], b[key])) {
+                return false;
+            }
+        }
+        return true;
+    }
+    return a === b;
+}
+/**
+ * Walk `proxyRes` and `hybridRes` in parallel and replace any leaf value
+ * in `proxyRes` that differs from the corresponding leaf in `hybridRes`
+ * with a CEL `has(...) ? <proxy value> : <hybrid value>` conditional.
+ *
+ * This is how differential field-level branch detection works: when a
+ * composition writes `spec.x ? foo(spec.y) : bar()` at a deep nested
+ * location inside a custom factory's emitted resource, the proxy run
+ * produces one leaf and the hybrid run (with `spec.x` overridden to
+ * `undefined`) produces the other. Comparing the two resource trees
+ * field-by-field surfaces the divergence and lets us emit the correct
+ * KRO CEL conditional without needing to thread AST information through
+ * the factory's internal transformations.
+ *
+ * Assumptions and caveats:
+ *   - Both resources come from the same factory call with the same
+ *     resource ID, so their structures are shape-compatible.
+ *   - The `overriddenFields` set drives the `has(...)` check — with a
+ *     single overridden field we can emit a direct `has(schema.spec.X)`
+ *     test. With multiple fields, we use the first one that appears in
+ *     either leaf value; this is a heuristic, but in practice
+ *     compositions rarely have multiple optional fields driving the
+ *     same leaf.
+ *   - Marker strings (`__KUBERNETES_REF__...__`) and CEL expressions
+ *     are converted to their dollar-wrapped forms before embedding in
+ *     the conditional.
+ */
+function applyDifferentialFieldConditionals(currentRes, baselineRes, hybridRes, overriddenFields, overrideConditions, nestedStatusCel, resourceIds) {
+    walkAndConditionalize(currentRes, baselineRes, hybridRes, overriddenFields, overrideConditions, nestedStatusCel, resourceIds);
+}
+function walkAndConditionalize(current, baseline, hybrid, overriddenFields, overrideConditions, nestedStatusCel, resourceIds) {
+    if (Array.isArray(current) && Array.isArray(baseline) && Array.isArray(hybrid)) {
+        if (baseline.length !== hybrid.length) {
+            return structuralEquals(current, baseline)
+                ? buildCelConditional(baseline, hybrid, overriddenFields, overrideConditions, nestedStatusCel, resourceIds)
+                : current;
+        }
+        const maxLen = Math.max(current.length, hybrid.length);
+        for (let i = 0; i < maxLen; i++) {
+            const c = current[i];
+            const b = baseline[i];
+            const h = hybrid[i];
+            if (i >= current.length) {
+                // New element added by hybrid run — copy it over.
+                current.push(h);
+                continue;
+            }
+            if (i >= hybrid.length) {
+                // Element removed in hybrid — leave the proxy value as-is.
+                continue;
+            }
+            if (isLeafValue(b) && isLeafValue(h)) {
+                if (!leafEquals(b, h) && leafEquals(c, b)) {
+                    current[i] = buildCelConditional(b, h, overriddenFields, overrideConditions, nestedStatusCel, resourceIds);
+                }
+            }
+            else {
+                const conditionalized = walkAndConditionalize(c, b, h, overriddenFields, overrideConditions, nestedStatusCel, resourceIds);
+                if (conditionalized !== c) {
+                    current[i] = conditionalized;
+                }
+            }
+        }
+        return current;
+    }
+    if (isWalkableRecord(current) && isWalkableRecord(baseline) && isWalkableRecord(hybrid)) {
+        const keys = new Set([...Object.keys(current), ...Object.keys(baseline), ...Object.keys(hybrid)]);
+        for (const key of keys) {
+            const c = current[key];
+            const b = baseline[key];
+            const h = hybrid[key];
+            if (!(key in hybrid)) {
+                continue;
+            }
+            if (!(key in current)) {
+                current[key] = h;
+                continue;
+            }
+            if (isLeafValue(b) && isLeafValue(h)) {
+                if (!leafEquals(b, h) && leafEquals(c, b)) {
+                    current[key] = buildCelConditional(b, h, overriddenFields, overrideConditions, nestedStatusCel, resourceIds);
+                }
+            }
+            else {
+                const conditionalized = walkAndConditionalize(c, b, h, overriddenFields, overrideConditions, nestedStatusCel, resourceIds);
+                if (conditionalized !== c) {
+                    current[key] = conditionalized;
+                }
+            }
+        }
+        return current;
+    }
+    return current;
+}
+function isLeafValue(v) {
+    return (v === null ||
+        v === undefined ||
+        typeof v === 'string' ||
+        typeof v === 'number' ||
+        typeof v === 'boolean' ||
+        isCelExpressionLike(v) ||
+        // KubernetesRef proxies register as functions (typeof fn is 'function')
+        typeof v === 'function');
+}
+function runResourceStatusBranch(compositionFn, schemaDefinition, analysis, ternary, desiredConditionValue) {
+    const branchCtx = createCompositionContext('resource-status-branch', {
+        isReExecution: true,
+    });
+    branchCtx.liveStatusMap = createResourceStatusBranchMap(analysis, ternary, desiredConditionValue);
+    const branchSchema = createSchemaProxy(schemaDefinition?.spec?.json, schemaDefinition?.status?.json);
+    const specOverrides = createSpecConditionOverrideMap(ternary.conditionExpression, desiredConditionValue);
+    const branchSpec = specOverrides.size > 0
+        ? createSpecOverrideProxy(branchSchema.spec, specOverrides)
+        : branchSchema.spec;
+    runWithCompositionContext(branchCtx, () => {
+        runInStatusBuilderContext(() => {
+            compositionFn(branchSpec);
+        });
+    });
+    return branchCtx;
+}
+function createResourceStatusBranchMap(analysis, ternary, desiredConditionValue) {
+    const conditionExpression = ternary.conditionExpression ?? `${ternary.variableName}.status.${ternary.statusField}`;
+    const statusRefs = collectStatusRefs(conditionExpression);
+    if (statusRefs.length === 0) {
+        statusRefs.push({ variableName: ternary.variableName, statusField: ternary.statusField });
+    }
+    const statusMap = new Map();
+    for (const statusRef of statusRefs) {
+        const resourceId = analysis.variableToResourceId.get(statusRef.variableName) ?? statusRef.variableName;
+        const existing = statusMap.get(resourceId) ?? {};
+        setNestedBranchStatusValue(existing, statusRef.statusField, getBranchStatusValue(conditionExpression, `${statusRef.variableName}.status.${statusRef.statusField}`, desiredConditionValue));
+        statusMap.set(resourceId, existing);
+    }
+    return statusMap;
+}
+function setNestedBranchStatusValue(target, statusField, value) {
+    const parts = statusField.split('.').filter(Boolean);
+    if (parts.length === 0)
+        return;
+    let cursor = target;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const part = parts[i];
+        if (!part)
+            continue;
+        const next = cursor[part];
+        if (!isPlainObject(next)) {
+            cursor[part] = {};
+        }
+        cursor = cursor[part];
+    }
+    const leaf = parts[parts.length - 1];
+    if (leaf) {
+        cursor[leaf] = value;
+    }
+}
+function collectStatusRefs(conditionExpression) {
+    const refs = [];
+    const seen = new Set();
+    const statusRefPattern = /\b([A-Za-z_$][\w$]*)\.status\.([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
+    for (const match of conditionExpression.matchAll(statusRefPattern)) {
+        const variableName = match[1];
+        const statusField = match[2];
+        if (!variableName || !statusField)
+            continue;
+        const key = `${variableName}:${statusField}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        refs.push({ variableName, statusField });
+    }
+    return refs;
+}
+function createSpecConditionOverrideMap(conditionExpression, desiredConditionValue) {
+    const overrides = new Map();
+    if (!conditionExpression)
+        return overrides;
+    const specRefPattern = /\b(?:schema\.)?spec\.([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
+    for (const match of conditionExpression.matchAll(specRefPattern)) {
+        const specPath = match[1];
+        const fullRef = match[0];
+        if (!specPath || !fullRef || overrides.has(specPath))
+            continue;
+        overrides.set(specPath, getBranchStatusValue(conditionExpression, fullRef, desiredConditionValue));
+    }
+    return overrides;
+}
+function createSpecOverrideProxy(target, overrides, path = []) {
+    return new Proxy(target, {
+        get(obj, prop, receiver) {
+            if (typeof prop !== 'string')
+                return Reflect.get(obj, prop, receiver);
+            const fullPath = [...path, prop].join('.');
+            if (overrides.has(fullPath))
+                return overrides.get(fullPath);
+            const hasNestedOverride = [...overrides.keys()].some((key) => key.startsWith(`${fullPath}.`));
+            const value = Reflect.get(obj, prop, receiver);
+            if (hasNestedOverride && value && (typeof value === 'object' || typeof value === 'function')) {
+                return createSpecOverrideProxy(value, overrides, [...path, prop]);
+            }
+            return value;
+        },
+        ownKeys: (obj) => Reflect.ownKeys(obj),
+        getOwnPropertyDescriptor: (obj, prop) => Reflect.getOwnPropertyDescriptor(obj, prop),
+    });
+}
+function getBranchStatusValue(conditionExpression, statusRefExpression, desiredConditionValue) {
+    const escapedRef = statusRefExpression.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const comparison = conditionExpression.match(new RegExp(`${escapedRef}\\s*(>=|>|<=|<|==|!=)\\s*(-?\\d+(?:\\.\\d+)?)`));
+    if (comparison?.[1] && comparison[2] !== undefined) {
+        const operator = comparison[1];
+        const numberValue = Number(comparison[2]);
+        if (operator === '>=')
+            return desiredConditionValue ? numberValue : numberValue - 1;
+        if (operator === '>')
+            return desiredConditionValue ? numberValue + 1 : numberValue;
+        if (operator === '<=')
+            return desiredConditionValue ? numberValue : numberValue + 1;
+        if (operator === '<')
+            return desiredConditionValue ? numberValue - 1 : numberValue;
+        if (operator === '==')
+            return desiredConditionValue ? numberValue : numberValue + 1;
+        if (operator === '!=')
+            return desiredConditionValue ? numberValue + 1 : numberValue;
+    }
+    const stringComparison = conditionExpression.match(new RegExp(`${escapedRef}\\s*(==|!=)\\s*(['"])(.*?)\\2`));
+    if (stringComparison?.[1] && stringComparison[3] !== undefined) {
+        const operator = stringComparison[1];
+        const stringValue = stringComparison[3];
+        if (operator === '==')
+            return desiredConditionValue ? stringValue : `__typekro_not_${stringValue}`;
+        if (operator === '!=')
+            return desiredConditionValue ? `__typekro_not_${stringValue}` : stringValue;
+    }
+    const booleanComparison = conditionExpression.match(new RegExp(`${escapedRef}\\s*(==|!=)\\s*(true|false)`));
+    if (booleanComparison?.[1] && booleanComparison[2] !== undefined) {
+        const operator = booleanComparison[1];
+        const booleanValue = booleanComparison[2] === 'true';
+        if (operator === '==')
+            return desiredConditionValue ? booleanValue : !booleanValue;
+        if (operator === '!=')
+            return desiredConditionValue ? !booleanValue : booleanValue;
+    }
+    const negatedRef = new RegExp(`!\\s*${escapedRef}(?![A-Za-z0-9_$.])`).test(conditionExpression);
+    return negatedRef ? !desiredConditionValue : desiredConditionValue;
+}
+function applyResourceStatusBranchDiff(targetRes, trueRes, falseRes, conditionCel, nestedStatusCel, resourceIds) {
+    for (const key of new Set([...Object.keys(trueRes), ...Object.keys(falseRes)])) {
+        if (key === '__resourceId' || key === 'id' || key.startsWith('__'))
+            continue;
+        const tv = trueRes[key];
+        const fv = falseRes[key];
+        if (tv === undefined && fv !== undefined) {
+            const falseRepr = celValueRepr(fv, nestedStatusCel, resourceIds);
+            targetRes[key] = `\${${conditionCel} ? omit() : ${falseRepr}}`;
+            continue;
+        }
+        if (fv === undefined && tv !== undefined) {
+            const trueRepr = celValueRepr(tv, nestedStatusCel, resourceIds);
+            targetRes[key] = `\${${conditionCel} ? ${trueRepr} : omit()}`;
+            continue;
+        }
+        if (tv === undefined || fv === undefined)
+            continue;
+        if (isCelExpressionLike(tv) || isCelExpressionLike(fv)) {
+            if (!leafEquals(tv, fv)) {
+                const trueRepr = celValueRepr(tv, nestedStatusCel, resourceIds);
+                const falseRepr = celValueRepr(fv, nestedStatusCel, resourceIds);
+                targetRes[key] = `\${${conditionCel} ? ${trueRepr} : ${falseRepr}}`;
+            }
+            continue;
+        }
+        const targetValue = targetRes[key];
+        if (isPlainObject(tv) && isPlainObject(fv)) {
+            if (!isPlainObject(targetValue))
+                targetRes[key] = {};
+            applyResourceStatusBranchDiff(targetRes[key], tv, fv, conditionCel, nestedStatusCel, resourceIds);
+        }
+        else if (Array.isArray(tv) && Array.isArray(fv) && tv.length === fv.length) {
+            if (!Array.isArray(targetValue))
+                targetRes[key] = [...tv];
+            const targetArray = targetRes[key];
+            for (let i = 0; i < tv.length; i++) {
+                if (isPlainObject(tv[i]) && isPlainObject(fv[i])) {
+                    if (!isPlainObject(targetArray[i]))
+                        targetArray[i] = {};
+                    applyResourceStatusBranchDiff(targetArray[i], tv[i], fv[i], conditionCel, nestedStatusCel, resourceIds);
+                }
+                else if (!leafEquals(tv[i], fv[i])) {
+                    const trueRepr = celValueRepr(tv[i], nestedStatusCel, resourceIds);
+                    const falseRepr = celValueRepr(fv[i], nestedStatusCel, resourceIds);
+                    targetArray[i] = `\${${conditionCel} ? ${trueRepr} : ${falseRepr}}`;
+                }
+            }
+        }
+        else if (Array.isArray(tv) && Array.isArray(fv) && tv.length !== fv.length) {
+            const trueRepr = celValueRepr(tv, nestedStatusCel, resourceIds);
+            const falseRepr = celValueRepr(fv, nestedStatusCel, resourceIds);
+            targetRes[key] = `\${${conditionCel} ? ${trueRepr} : ${falseRepr}}`;
+        }
+        else if (!leafEquals(tv, fv)) {
+            const trueRepr = celValueRepr(tv, nestedStatusCel, resourceIds);
+            const falseRepr = celValueRepr(fv, nestedStatusCel, resourceIds);
+            targetRes[key] = `\${${conditionCel} ? ${trueRepr} : ${falseRepr}}`;
+        }
+    }
+}
+function leafEquals(a, b) {
+    // For KubernetesRef proxies, compare their string coercions (marker tokens).
+    if (typeof a === 'function' || typeof b === 'function') {
+        return String(a) === String(b);
+    }
+    return a === b;
+}
+function getNestedResourceStatusTargetIds(resources, nestedCompositionIds) {
+    if (!nestedCompositionIds || nestedCompositionIds.size === 0)
+        return [];
+    return Object.entries(resources)
+        .filter(([resourceId, resource]) => [...nestedCompositionIds].some((nestedId) => isNestedCompositionChild(resourceId, resource, nestedId)))
+        .map(([resourceId]) => resourceId);
+}
+function isNestedCompositionChild(resourceId, resource, nestedId) {
+    if (resourceId === nestedId)
+        return true;
+    const boundaryChar = resourceId[nestedId.length];
+    if (resourceId.startsWith(nestedId) && boundaryChar !== undefined && /[A-Z_-]/.test(boundaryChar)) {
+        return true;
+    }
+    const aliases = getMetadataField(resource, 'resourceAliases');
+    return aliases?.some((alias) => {
+        if (alias === nestedId)
+            return true;
+        const aliasBoundaryChar = alias[nestedId.length];
+        return alias.startsWith(nestedId) && aliasBoundaryChar !== undefined && /[A-Z_-]/.test(aliasBoundaryChar);
+    }) ?? false;
+}
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v) && !isCelExpressionLike(v);
+}
+function isWalkableRecord(v) {
+    if (isPlainObject(v)) {
+        return true;
+    }
+    return typeof v === 'function' && Object.keys(v).length > 0;
+}
+/** Duck-type check for CelExpression objects — avoids importing from cel.ts (cycle risk). */
+function isCelExpressionLike(v) {
+    if (typeof v !== 'object' || v === null)
+        return false;
+    // Plain Cel.expr() objects carry the symbol brand; template expressions also
+    // carry `__isTemplate`. Support both shapes without importing cel.ts.
+    return 'expression' in v && typeof v.expression === 'string'
+        && (v[CEL_EXPRESSION_BRAND] === true || '__isTemplate' in v);
+}
+/**
+ * Build a CEL conditional string from two diverging leaf values.
+ *
+ * Both values may be concrete primitives, marker strings (from template
+ * literals containing proxy references), or KubernetesRef proxies. The
+ * returned string is a KRO mixed-template value like
+ * `${has(schema.spec.X) ? <proxy repr> : <hybrid repr>}` that later
+ * serialization phases treat as a final CEL expression.
+ */
+function buildCelConditional(proxyValue, hybridValue, overriddenFields, overrideConditions, nestedStatusCel, resourceIds) {
+    const field = pickConditionField(proxyValue, hybridValue, overriddenFields);
+    const proxyRepr = celValueRepr(proxyValue, nestedStatusCel, resourceIds);
+    const hybridRepr = celValueRepr(hybridValue, nestedStatusCel, resourceIds);
+    const explicitCondition = overrideConditions.get(field);
+    if (explicitCondition) {
+        return `\${${explicitCondition} ? ${proxyRepr} : ${hybridRepr}}`;
+    }
+    // Chain has() guards when the proxy value references a sub-field deeper
+    // than the controlling optional field. A single has(schema.spec.X) is
+    // insufficient when the value accesses X.Y — the user may provide X: {}
+    // without Y, and KRO would fail with "no such key: Y".
+    const guardField = `schema.spec.${field}`;
+    let guard = `has(${guardField})`;
+    // Extract the full schema path from the proxy repr to check depth.
+    // proxyRepr may be a bare path like `schema.spec.cnpgOperator.version`
+    // or wrapped in string() like `string(schema.spec.cnpgOperator.version)`.
+    // Chain has() guards for ALL intermediate levels between the controlling
+    // field and the leaf. For `cnpgOperator.monitoring.enabled`, we need:
+    //   has(cnpgOperator) && has(cnpgOperator.monitoring) && has(cnpgOperator.monitoring.enabled)
+    const schemaPathMatch = proxyRepr.match(/schema\.spec\.([a-zA-Z0-9_.]+)/);
+    if (schemaPathMatch) {
+        const fullRefPath = schemaPathMatch[1]?.replace(/\.+$/, '');
+        if (!fullRefPath)
+            return `\${has(${guardField}) ? ${proxyRepr} : ${hybridRepr}}`;
+        const fullPath = `schema.spec.${fullRefPath}`;
+        if (fullPath !== guardField && fullPath.startsWith(`${guardField}.`)) {
+            const guardSegments = field.split('.').length;
+            const leafSegments = fullRefPath.split('.');
+            const guards = [`has(${guardField})`];
+            for (let j = guardSegments + 1; j <= leafSegments.length; j++) {
+                const intermediatePath = `schema.spec.${leafSegments.slice(0, j).join('.')}`;
+                guards.push(`has(${intermediatePath})`);
+            }
+            guard = guards.join(' && ');
+        }
+    }
+    return `\${${guard} ? ${proxyRepr} : ${hybridRepr}}`;
+}
+/**
+ * Pick the "controlling" optional field for a diverging leaf. If exactly
+ * one overridden field's marker appears in either value, use that. If
+ * neither appears explicitly, default to the first field in the set —
+ * this covers the common case of a single overridden field driving the
+ * whole divergence.
+ */
+function pickConditionField(proxyValue, hybridValue, overriddenFields) {
+    const proxyStr = String(proxyValue);
+    const hybridStr = String(hybridValue);
+    for (const field of overriddenFields) {
+        const marker = `__KUBERNETES_REF___schema___spec.${field}`;
+        if (proxyStr.includes(marker) || hybridStr.includes(marker)) {
+            return field;
+        }
+    }
+    // Fallback: first overridden field (iteration order = insertion order).
+    // Single-field overrides are the common case so this is usually correct;
+    // the explicit-marker check above handles the multi-field case. When the
+    // fallback fires, the emitted CEL may pick the wrong `has()` condition
+    // for compositions with multiple optional fields driving the same leaf —
+    // log it at debug level so the case is diagnosable if anyone reports
+    // incorrect CEL output.
+    const fallback = overriddenFields.values().next().value ?? '';
+    getComponentLogger('serialization').debug('pickConditionField fallback: no marker matched, using first overridden field', {
+        fallbackField: fallback,
+        overriddenFields: Array.from(overriddenFields),
+        proxyValuePreview: proxyStr.slice(0, 120),
+        hybridValuePreview: hybridStr.slice(0, 120),
+    });
+    return fallback;
+}
+/**
+ * Convert a leaf value into its CEL expression representation.
+ *
+ * - Marker strings become `schema.spec.X` paths (bare, no `${}`)
+ * - KubernetesRef proxies become their inner CEL path
+ * - String literals become double-quoted CEL string literals (with
+ *   embedded markers converted to string() concatenations so the
+ *   result is valid CEL, not just a raw string)
+ * - Numbers and booleans are emitted verbatim
+ */
+// Re-export from shared utility for local use. This was previously an
+// inline copy; the canonical implementation lives in utils/cel-escape.ts.
+import { escapeCelString as escapeCelLiteral } from '../../utils/cel-escape.js';
+function celValueRepr(value, nestedStatusCel, resourceIds) {
+    if (value === null || value === undefined)
+        return '""';
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    // CelExpression object — use the expression string directly.
+    if (isCelExpressionLike(value)) {
+        return unwrapKroExpression(finalizeCelForKro(value.expression, nestedStatusCel, createBranchCelContext(nestedStatusCel, resourceIds)));
+    }
+    if (typeof value === 'function') {
+        // KubernetesRef proxy — toString yields the marker token which we
+        // convert to a bare CEL path via the marker → CEL rules.
+        return markerStringToCelBare(String(value));
+    }
+    if (typeof value === 'string') {
+        if (value.includes('__KUBERNETES_REF_')) {
+            return markerStringToCelExpr(value);
+        }
+        // Plain string literal — escape for CEL embedding
+        return `"${escapeCelLiteral(value)}"`;
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => celValueRepr(item, nestedStatusCel, resourceIds)).join(', ')}]`;
+    }
+    if (isPlainObject(value)) {
+        return `{${Object.entries(value)
+            .map(([key, entryValue]) => `"${escapeCelLiteral(key)}": ${celValueRepr(entryValue, nestedStatusCel, resourceIds)}`)
+            .join(', ')}}`;
+    }
+    return '""';
+}
+function createBranchCelContext(nestedStatusCel, resourceIds) {
+    if (!nestedStatusCel && !resourceIds)
+        return undefined;
+    return {
+        celPrefix: '',
+        resourceIdStrategy: 'deterministic',
+        ...(nestedStatusCel ? { nestedStatusCel } : {}),
+        ...(resourceIds ? { resourceIds } : {}),
+    };
+}
+function unwrapKroExpression(value) {
+    if (value.startsWith('${') && value.endsWith('}') && value.indexOf('${', 2) === -1) {
+        return value.slice(2, -1);
+    }
+    return value;
+}
+/**
+ * Convert a single-marker string (the whole string is one marker) to
+ * its bare CEL path form: `schema.spec.X` or `resources.X.field`.
+ */
+function markerStringToCelBare(str) {
+    const m = str.match(new RegExp(`^${KUBERNETES_REF_MARKER_SOURCE}$`));
+    if (!m)
+        return markerStringToCelExpr(str);
+    const [, resourceId, fieldPath] = m;
+    return resourceId === '__schema__' ? `schema.${fieldPath}` : `${resourceId}.${fieldPath}`;
+}
+/**
+ * Convert a mixed string containing literal text and markers to a CEL
+ * concatenation expression using `string()` wrappers, suitable for
+ * embedding inside a CEL ternary.
+ */
+function markerStringToCelExpr(str) {
+    const markerSource = KUBERNETES_REF_MARKER_SOURCE;
+    // Fast path: whole string is a single marker
+    const singleMatch = str.match(new RegExp(`^${markerSource}$`));
+    if (singleMatch) {
+        const [, resourceId, fieldPath] = singleMatch;
+        return resourceId === '__schema__' ? `schema.${fieldPath}` : `${resourceId}.${fieldPath}`;
+    }
+    // Slow path: interleave literal text and markers via CEL string concatenation
+    const parts = [];
+    let lastIndex = 0;
+    const pattern = new RegExp(markerSource, 'g');
+    let m = pattern.exec(str);
+    while (m !== null) {
+        if (m.index > lastIndex) {
+            const literal = str.slice(lastIndex, m.index);
+            parts.push(`"${escapeCelLiteral(literal)}"`);
+        }
+        const resourceId = m[1];
+        const fieldPath = m[2];
+        if (!resourceId || !fieldPath) {
+            m = pattern.exec(str);
+            continue;
+        }
+        const celPath = resourceId === '__schema__' ? `schema.${fieldPath}` : `${resourceId}.${fieldPath}`;
+        parts.push(`string(${celPath})`);
+        lastIndex = m.index + m[0].length;
+        m = pattern.exec(str);
+    }
+    if (lastIndex < str.length) {
+        const literal = str.slice(lastIndex);
+        parts.push(`"${escapeCelLiteral(literal)}"`);
+    }
+    const [firstPart] = parts;
+    return parts.length === 1 && firstPart !== undefined ? firstPart : parts.join(' + ');
+}
 // =============================================================================
 // Extracted helper: Direct factory status re-analysis
 // =============================================================================
@@ -427,16 +1332,20 @@ function createTypedResourceGraph(definition, resourceBuilder, statusBuilder, op
     const schemaDefinition = {
         apiVersion: definition.apiVersion || 'v1alpha1',
         kind: definition.kind,
+        ...(definition.group && { group: definition.group }),
         spec: definition.spec,
         status: definition.status,
     };
-    const schema = createSchemaProxy();
+    // Pass the Arktype JSON so the proxy is shape-aware — spread
+    // (`{ ...spec.X }`) and `Object.keys(spec.X)` enumerate declared
+    // fields instead of returning an opaque empty object.
+    const schema = createSchemaProxy(definition.spec?.json, definition.status?.json);
     const builderResult = resourceBuilder(schema);
     const { resources: resourcesWithKeys, closures } = separateResourcesAndClosures(builderResult);
     // 3. Analyze status builder and convert JS expressions to CEL
     const { statusMappings, analyzedStatusMappings, mappingAnalysis, phaseBStatusMappings } = analyzeAndConvertStatusMappings(definition, statusBuilder, schema, resourcesWithKeys, serializationLogger);
     // 4. Analyze composition body for control flow patterns (must run before validation)
-    const { compositionAnalysis, analysisState } = processCompositionBodyAnalysis(statusMappings, resourcesWithKeys, analyzedStatusMappings, serializationLogger);
+    const { compositionAnalysis, analysisState } = processCompositionBodyAnalysis(statusMappings, resourcesWithKeys, analyzedStatusMappings, serializationLogger, schemaDefinition);
     // 5. Validate resource IDs and CEL expressions
     const validation = validateResourceGraphDefinition(resourcesWithKeys, analyzedStatusMappings);
     if (!validation.isValid) {
@@ -455,6 +1364,18 @@ function createTypedResourceGraph(definition, resourceBuilder, statusBuilder, op
     // Evaluate and optimize CEL expressions
     const evaluationContext = { resources: resourcesWithKeys, schema };
     const { mappings: optimizedStatusMappings, optimizations } = optimizeStatusMappings(analyzedStatusMappings, evaluationContext);
+    for (const metadataKey of [
+        '__originalCompositionFn',
+        '__nestedCompositionFns',
+        '__nestedCompositionDefinitions',
+        '__nestedCompositionResources',
+        '__nestedCompositionSpecMappings',
+    ]) {
+        const descriptor = Object.getOwnPropertyDescriptor(statusMappings, metadataKey);
+        if (descriptor) {
+            Object.defineProperty(optimizedStatusMappings, metadataKey, descriptor);
+        }
+    }
     if (optimizations.length > 0) {
         serializationLogger.info('CEL expression optimizations applied', { optimizations });
     }
@@ -489,6 +1410,11 @@ function createTypedResourceGraph(definition, resourceBuilder, statusBuilder, op
                     statusMappings: directStatusMappings,
                     compositionFn: declarativeCompositionFn,
                     compositionDefinition: definition,
+                    ...(this._singletonDefinitions
+                        ? {
+                            singletonDefinitions: this._singletonDefinitions,
+                        }
+                        : {}),
                 });
             }
             else if (mode === 'kro') {
@@ -497,13 +1423,22 @@ function createTypedResourceGraph(definition, resourceBuilder, statusBuilder, op
                     closures,
                     factoryType: 'kro',
                     compositionFn: declarativeCompositionFn,
+                    compositionAnalysis,
+                    ...(this._singletonDefinitions
+                        ? {
+                            singletonDefinitions: this._singletonDefinitions,
+                        }
+                        : {}),
                 });
             }
             else {
                 throw new ValidationError(`Unsupported factory mode: ${mode}`, 'ResourceGraphDefinition', definition.name, 'mode', ['Use "kro" or "direct" as the factory mode']);
             }
         },
-        toYaml() {
+        toYaml(spec) {
+            if (spec !== undefined) {
+                return this.factory('kro').toYaml(spec);
+            }
             // Apply composition body analysis results (guard: only once)
             if (compositionAnalysis && !analysisState.appliedToResources) {
                 analysisState.appliedToResources = true;
@@ -520,10 +1455,13 @@ function createTypedResourceGraph(definition, resourceBuilder, statusBuilder, op
             // Collect nested composition status CEL mappings from the composition context.
             // These enable inlining the inner composition's real CEL expressions instead
             // of referencing virtual nested composition IDs.
-            // Extract nested composition status CEL mappings attached by executeCompositionCore.
-            // These are on the raw statusMappings (capturedStatus from the composition function),
-            // not on the optimizedStatusMappings (which is a processed copy).
-            const nestedStatusCel = statusMappings.__nestedStatusCel ?? {};
+            // Extract nested composition status CEL mappings attached by
+            // executeCompositionCore via Reflect.set. Must use
+            // Object.getOwnPropertyDescriptor to bypass the Enhanced proxy's
+            // get handler which would return a KubernetesRef instead of the
+            // actual Record<string, string>.
+            const nestedStatusDescriptor = Object.getOwnPropertyDescriptor(statusMappings, '__nestedStatusCel');
+            const nestedStatusCel = nestedStatusDescriptor?.value ?? {};
             serializationLogger.debug('Nested status CEL extraction', {
                 hasNestedStatusCel: Object.keys(nestedStatusCel).length > 0,
                 keys: Object.keys(nestedStatusCel),
@@ -533,6 +1471,17 @@ function createTypedResourceGraph(definition, resourceBuilder, statusBuilder, op
             if (definition.group) {
                 kroSchema.group = definition.group;
             }
+            // Attach nested status CEL mappings to the schema as a non-enumerable
+            // property (same pattern as __ternaryConditionals, __omitFields).
+            // Non-enumerable so it doesn't appear in the YAML output, but
+            // accessible via KroSimpleSchemaWithMetadata for the YAML serializer
+            // to resolve virtual composition IDs in resource templates.
+            if (Object.keys(nestedStatusCel).length > 0) {
+                Object.defineProperty(kroSchema, '__nestedStatusCel', {
+                    value: nestedStatusCel,
+                    enumerable: false,
+                });
+            }
             // Inject status overrides into schema status section.
             // Convert "..." to '...' in CEL string literals for YAML compatibility.
             const statusOverrides = compositionAnalysis?.statusOverrides ?? [];
@@ -545,6 +1494,18 @@ function createTypedResourceGraph(definition, resourceBuilder, statusBuilder, op
                     kroSchema.status[override.propertyPath] = yamlSafe;
                 }
             }
+            // Apply ternary conditionals (once only — guard prevents
+            // double-processing if toYaml() is called multiple times).
+            // Note: omit() wrapping for optional fields is no longer a
+            // post-processing step — it's applied inline during ref-to-CEL
+            // conversion via `SerializationContext.omitFields`, which reads
+            // from `kroSchema.__omitFields` inside `serializeResourceGraphToYaml`.
+            if (!analysisState.ternaryAndOmitApplied) {
+                analysisState.ternaryAndOmitApplied = true;
+                if (kroSchema.__ternaryConditionals?.length) {
+                    applyTernaryConditionalsToResources(resourcesWithKeys, kroSchema.__ternaryConditionals, kroSchema.__nestedStatusCel);
+                }
+            }
             return serializeResourceGraphToYaml(definition.name, resourcesWithKeys, options, kroSchema);
         },
     };