typekro 0.8.0 → 0.10.0

package/dist/core/deployment/crd-manager.js

@@ -190,15 +190,17 @@ export class CRDManager {
                     metadata: { name: crdName },
                 }), abortSignal);
                 const crdItem = crdStatus;
+                const deletionTimestamp = crdItem?.metadata?.deletionTimestamp;
                 const conditions = crdItem?.status?.conditions || [];
                 const establishedCondition = conditions.find((c) => c.type === 'Established');
-                if (establishedCondition?.status === 'True') {
+                if (establishedCondition?.status === 'True' && !deletionTimestamp) {
                     logger.debug('CRD exists and is established', { crdName });
                     return;
                 }
                 logger.debug('CRD exists but not yet established, waiting...', {
                     crdName,
                     establishedStatus: establishedCondition?.status || 'unknown',
+                    deleting: deletionTimestamp !== undefined,
                 });
             }
             catch (error) {
@@ -223,5 +225,81 @@ export class CRDManager {
         }
         throw new DeploymentTimeoutError(`Timeout waiting for CRD ${crdName} to be established after ${timeout}ms`, 'CustomResourceDefinition', crdName || 'unknown', timeout, 'crd-establishment');
     }
+    /**
+     * Wait for a CRD to be created and established, discovered by (group, kind)
+     * rather than a pre-computed name.
+     *
+     * This is the correct path for KRO RGDs because KRO's server-side
+     * pluralization may not match any client-side heuristic. For example,
+     * already-plural kind names don't get an extra "s" suffix — only
+     * the CRD's `spec.names.plural` is authoritative.
+     *
+     * The method polls the full CRD list looking for one whose
+     * `spec.group` and `spec.names.kind` match, then delegates to
+     * {@link waitForCRDEstablishment} with the discovered name.
+     *
+     * @param kind - The resource kind (e.g., "WebAppWithProcessing")
+     * @param group - The CRD group (e.g., "kro.run")
+     * @param deploymentMode - The deployment mode for logging
+     * @param timeout - Max milliseconds to wait for the CRD to exist AND be established
+     * @param abortSignal - Optional abort signal for cancellation
+     * @throws {DeploymentTimeoutError} if the CRD is never discovered or never becomes Established within the timeout
+     */
+    async waitForCRDByKindAndGroup(kind, group, deploymentMode, timeout = DEFAULT_CRD_READY_TIMEOUT, abortSignal) {
+        const logger = this.logger.child({ kind, group, timeout });
+        const startTime = Date.now();
+        const pollInterval = DEFAULT_POLL_INTERVAL;
+        logger.debug('Discovering CRD by kind and group');
+        // Phase 1: discover the CRD's actual name by listing CRDs and matching
+        // on (group, kind). KRO creates the CRD asynchronously after the RGD
+        // is accepted, so we poll.
+        let crdName;
+        let plural;
+        while (Date.now() - startTime < timeout) {
+            if (abortSignal?.aborted) {
+                throw new DOMException('Operation aborted', 'AbortError');
+            }
+            try {
+                const crds = await this.withAbortSignal(this.k8sApi.list('apiextensions.k8s.io/v1', 'CustomResourceDefinition'), abortSignal);
+                const crdList = crds;
+                const match = crdList?.items?.find((crd) => {
+                    const spec = crd.spec;
+                    return spec?.group === group && spec?.names?.kind === kind && !crd.metadata?.deletionTimestamp;
+                });
+                if (match?.metadata?.name && match.spec?.names?.plural) {
+                    crdName = match.metadata.name;
+                    plural = match.spec.names.plural;
+                    logger.debug('CRD discovered', { crdName, plural });
+                    break;
+                }
+            }
+            catch (error) {
+                if (error instanceof DOMException &&
+                    (error.name === 'AbortError' || error.name === 'TimeoutError')) {
+                    throw error;
+                }
+                logger.debug('CRD list failed, retrying...', {
+                    error: ensureError(error).message,
+                });
+            }
+            try {
+                await this.abortableDelay(pollInterval, abortSignal);
+            }
+            catch (error) {
+                if (error instanceof DOMException &&
+                    (error.name === 'AbortError' || error.name === 'TimeoutError')) {
+                    throw error;
+                }
+            }
+        }
+        if (!crdName || !plural) {
+            throw new DeploymentTimeoutError(`Timeout discovering CRD for kind "${kind}" in group "${group}" after ${timeout}ms`, 'CustomResourceDefinition', `${kind}.${group}`, timeout, 'crd-discovery');
+        }
+        // Phase 2: wait for the discovered CRD to become Established. Pass
+        // along the remaining timeout budget so total wait is bounded.
+        const remaining = Math.max(timeout - (Date.now() - startTime), pollInterval);
+        await this.waitForCRDReady(crdName, deploymentMode, remaining, abortSignal);
+        return { crdName, plural };
+    }
 }
 //# sourceMappingURL=crd-manager.js.map

package/dist/core/deployment/crd-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"crd-manager.js","sourceRoot":"","sources":["../../../src/core/deployment/crd-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,iBAAiB;IACvB,SAAS;IACT,oBAAoB;IACpB,sBAAsB;IACtB,WAAW;IACX,8BAA8B;IAC9B,mBAAmB;IACnB,yBAAyB,EAAE,kBAAkB;IAC7C,iCAAiC;IACjC,2BAA2B;IAC3B,0BAA0B;IAC1B,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,UAAU;IACV,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,kBAAkB;IAClB,sCAAsC;IACtC,gBAAgB;IAChB,sBAAsB;CACvB,CAAC;AAEF,MAAM,OAAO,UAAU;IAKX;IACA;IACA;IACA;IAPF,oBAAoB,GAAyB,IAAI,CAAC;IAClD,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEnD,YACU,MAA+B,EAC/B,UAA0B,EAC1B,cAAmE,EACnE,eAA+E;QAH/E,WAAM,GAAN,MAAM,CAAyB;QAC/B,eAAU,GAAV,UAAU,CAAgB;QAC1B,mBAAc,GAAd,cAAc,CAAqD;QACnE,oBAAe,GAAf,eAAe,CAAgE;IACtF,CAAC;IAEJ;;OAEG;IACH,gBAAgB,CAAC,QAA4B;QAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,QAA4B;QACtD,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0EAA0E;QAC1E,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,CAAC,qCAAqC;QACpD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,CAAC;YAE3F,MAAM,OAAO,GAAG,IAA+C,CAAC;YAChE,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,GAAiC,EAAE,EAAE;gBAC7E,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;gBACzB,OAAO,OAAO,EAAE,KAAK,KAAK,KAAK,IAAI,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;YAC5E,CAAC,CAAC,CAAC;YAEH,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;gBAChF,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;aACrB,CAAC,CAAC;QACL,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;QACtD,OAAO,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,QAA4B,EAAE,OAA0B;QAC5E,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,KAAK,KAAK,CAAC;QAC3D,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CACzB,OAA0B,EAC1B,MAA6C;QAE7C,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,oBAAoB,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC;YACrD,MAAM,CAAC,QAAQ,CAAC,CAAC,0DAA0D,CAAC,CAAC;YAE7E,IAAI,CAAC;gBACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;gBAClF,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,gCAAgC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;gBACjC,MAAM,CAAC,IAAI,CACT,iFAAiF,EACjF;oBACE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;oBACjC,UAAU,EAAE,uEAAuE;iBACpF,CACF,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,0BAA0B,CAC9B,QAA4B,EAC5B,OAA0B,EAC1B,MAA6C,EAC7C,WAAyB;QAEzB,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBAC9D,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE;YACtE,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,uBAAuB,CAChC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAC/B,OAAO,EACP,MAAM,EACN,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;YAC1E,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,cAAsB,EACtB,UAAkB,yBAAyB,EAC3C,WAAyB;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAsB;YACjC,IAAI,EAAE,cAAuD;YAC7D,OAAO;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,uBAAuB,CAChC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAC/B,OAAO,EACP,MAAM,EACN,WAAW,CACZ,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,GAAqC,EACrC,OAA0B,EAC1B,MAA6C,EAC7C,WAAyB;QAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,0BAA0B,CAAC;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,qBAAqB,CAAC;QAE3C,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAElF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;YACxC,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,UAAU,EAAE,yBAAyB;oBACrC,IAAI,EAAE,0BAA0B;oBAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;iBACM,CAAC,EACpC,WAAW,CACZ,CAAC;gBAEF,MAAM,OAAO,GAAG,SAAoD,CAAC;gBACrE,MAAM,UAAU,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC;gBACrD,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAC1C,CAAC,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CACrD,CAAC;gBAEF,IAAI,oBAAoB,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC5C,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC3D,OAAO;gBACT,CAAC;gBAED,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;oBAC7D,OAAO;oBACP,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,IAAI,SAAS;iBAC7D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IACE,KAAK,YAAY,YAAY;oBAC7B,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,EAC9D,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;oBACjE,OAAO;oBACP,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;iBAClC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IACE,KAAK,YAAY,YAAY;oBAC7B,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,EAC9D,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,sBAAsB,CAC9B,2BAA2B,OAAO,4BAA4B,OAAO,IAAI,EACzE,0BAA0B,EAC1B,OAAO,IAAI,SAAS,EACpB,OAAO,EACP,mBAAmB,CACpB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"crd-manager.js","sourceRoot":"","sources":["../../../src/core/deployment/crd-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,iBAAiB;IACvB,SAAS;IACT,oBAAoB;IACpB,sBAAsB;IACtB,WAAW;IACX,8BAA8B;IAC9B,mBAAmB;IACnB,yBAAyB,EAAE,kBAAkB;IAC7C,iCAAiC;IACjC,2BAA2B;IAC3B,0BAA0B;IAC1B,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,UAAU;IACV,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,kBAAkB;IAClB,sCAAsC;IACtC,gBAAgB;IAChB,sBAAsB;CACvB,CAAC;AAEF,MAAM,OAAO,UAAU;IAKX;IACA;IACA;IACA;IAPF,oBAAoB,GAAyB,IAAI,CAAC;IAClD,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEnD,YACU,MAA+B,EAC/B,UAA0B,EAC1B,cAAmE,EACnE,eAA+E;QAH/E,WAAM,GAAN,MAAM,CAAyB;QAC/B,eAAU,GAAV,UAAU,CAAgB;QAC1B,mBAAc,GAAd,cAAc,CAAqD;QACnE,oBAAe,GAAf,eAAe,CAAgE;IACtF,CAAC;IAEJ;;OAEG;IACH,gBAAgB,CAAC,QAA4B;QAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,QAA4B;QACtD,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0EAA0E;QAC1E,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,CAAC,qCAAqC;QACpD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,CAAC;YAE3F,MAAM,OAAO,GAAG,IAA+C,CAAC;YAChE,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,GAAiC,EAAE,EAAE;gBAC7E,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;gBACzB,OAAO,OAAO,EAAE,KAAK,KAAK,KAAK,IAAI,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;YAC5E,CAAC,CAAC,CAAC;YAEH,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;gBAChF,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;aACrB,CAAC,CAAC;QACL,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;QACtD,OAAO,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,QAA4B,EAAE,OAA0B;QAC5E,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,KAAK,KAAK,CAAC;QAC3D,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CACzB,OAA0B,EAC1B,MAA6C;QAE7C,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,oBAAoB,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC;YACrD,MAAM,CAAC,QAAQ,CAAC,CAAC,0DAA0D,CAAC,CAAC;YAE7E,IAAI,CAAC;gBACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;gBAClF,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,gCAAgC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;gBACjC,MAAM,CAAC,IAAI,CACT,iFAAiF,EACjF;oBACE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;oBACjC,UAAU,EAAE,uEAAuE;iBACpF,CACF,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,0BAA0B,CAC9B,QAA4B,EAC5B,OAA0B,EAC1B,MAA6C,EAC7C,WAAyB;QAEzB,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBAC9D,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE;YACtE,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,uBAAuB,CAChC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAC/B,OAAO,EACP,MAAM,EACN,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;YAC1E,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,cAAsB,EACtB,UAAkB,yBAAyB,EAC3C,WAAyB;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAsB;YACjC,IAAI,EAAE,cAAuD;YAC7D,OAAO;SACR,CAAC;QAEF,MAAM,IAAI,CAAC,uBAAuB,CAChC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAC/B,OAAO,EACP,MAAM,EACN,WAAW,CACZ,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,GAAqC,EACrC,OAA0B,EAC1B,MAA6C,EAC7C,WAAyB;QAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,0BAA0B,CAAC;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,qBAAqB,CAAC;QAE3C,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAElF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;YACxC,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,UAAU,EAAE,yBAAyB;oBACrC,IAAI,EAAE,0BAA0B;oBAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;iBACM,CAAC,EACpC,WAAW,CACZ,CAAC;gBAEF,MAAM,OAAO,GAAG,SAAoD,CAAC;gBACrE,MAAM,iBAAiB,GAAG,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC;gBAC/D,MAAM,UAAU,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC;gBACrD,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAC1C,CAAC,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CACrD,CAAC;gBAEF,IAAI,oBAAoB,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAClE,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC3D,OAAO;gBACT,CAAC;gBAED,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;oBAC7D,OAAO;oBACP,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,IAAI,SAAS;oBAC5D,QAAQ,EAAE,iBAAiB,KAAK,SAAS;iBAC1C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IACE,KAAK,YAAY,YAAY;oBAC7B,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,EAC9D,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;oBACjE,OAAO;oBACP,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;iBAClC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IACE,KAAK,YAAY,YAAY;oBAC7B,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,EAC9D,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,sBAAsB,CAC9B,2BAA2B,OAAO,4BAA4B,OAAO,IAAI,EACzE,0BAA0B,EAC1B,OAAO,IAAI,SAAS,EACpB,OAAO,EACP,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,wBAAwB,CAC5B,IAAY,EACZ,KAAa,EACb,cAAsB,EACtB,UAAkB,yBAAyB,EAC3C,WAAyB;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,qBAAqB,CAAC;QAE3C,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAElD,uEAAuE;QACvE,qEAAqE;QACrE,2BAA2B;QAC3B,IAAI,OAA2B,CAAC;QAChC,IAAI,MAA0B,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;YACxC,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,EACvE,WAAW,CACZ,CAAC;gBACF,MAAM,OAAO,GAAG,IAA+C,CAAC;gBAChE,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,GAAiC,EAAE,EAAE;oBACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;oBACtB,OAAO,IAAI,EAAE,KAAK,KAAK,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACjG,CAAC,CAAC,CAAC;gBACH,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;oBACvD,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC9B,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACjC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;oBACpD,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IACE,KAAK,YAAY,YAAY;oBAC7B,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,EAC9D,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC3C,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;iBAClC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IACE,KAAK,YAAY,YAAY;oBAC7B,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,EAC9D,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,sBAAsB,CAC9B,qCAAqC,IAAI,eAAe,KAAK,WAAW,OAAO,IAAI,EACnF,0BAA0B,EAC1B,GAAG,IAAI,IAAI,KAAK,EAAE,EAClB,OAAO,EACP,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7E,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAE5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/core/deployment/deployment-state-discovery.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Deployment State Discovery
+ *
+ * Reconstructs a DeploymentStateRecord for a factory+instance by querying
+ * the cluster for resources labeled with typekro ownership metadata.
+ *
+ * This module implements the "cluster IS the state" model: there is no
+ * separate state backend (ConfigMap, database, etc). Every typekro-managed
+ * resource is tagged at deploy time with labels and annotations via
+ * {@link applyTypekroTags}, and at delete time we walk the cluster to
+ * find those resources and rebuild the graph from their annotations.
+ *
+ * ## Discovery strategy
+ *
+ * To cover every GVK a typekro composition might have touched, we:
+ *
+ *   1. Issue label-filtered list calls against a hardcoded set of
+ *      built-in GVKs (Deployments, Services, Namespaces, etc.).
+ *   2. List all CRDs on the cluster, extract their (group, version, kind,
+ *      scope) tuples, and issue label-filtered list calls against each.
+ *   3. Merge the results.
+ *
+ * Each list is scoped by a label selector, so even on large clusters the
+ * response from a GVK with no matching resources is a near-empty payload.
+ * The main cost is the number of list calls, which is bounded by
+ * (built-in GVKs) + (CRDs on cluster) — typically 30-150 requests total
+ * for a fresh discovery. Requests are issued with bounded parallelism.
+ *
+ * ## Why not use /apis discovery?
+ *
+ * The Kubernetes discovery API (`/apis`, `/api/v1`) gives a complete
+ * list of API resources, but client-node 1.x doesn't expose a typed
+ * helper for walking it, and we'd need to issue one request per group-
+ * version anyway to get the `resources[]` list for each. Listing CRDs
+ * directly is simpler and covers every custom kind; the hardcoded
+ * built-in list covers the rest.
+ *
+ * ## Graph reconstruction
+ *
+ * Each discovered resource carries a `typekro.io/depends-on` annotation
+ * containing a JSON array of composition-local ids it depends on. We
+ * walk the discovered resources twice: first pass adds every id as a
+ * graph node, second pass adds edges. Dangling edges (pointing to a
+ * resource that no longer exists on the cluster) are silently dropped
+ * — that's the expected state after a partial delete.
+ */
+import type * as k8s from '@kubernetes/client-node';
+import type { DeploymentStateRecord } from '../types/deployment.js';
+/**
+ * GVK tuple used for per-kind list calls.
+ *
+ * `namespaced` is currently unused — all list calls use a cluster-wide
+ * scan (namespace=undefined) because typekro compositions can span
+ * multiple namespaces. The field is retained for a planned optimization
+ * where namespace-scoped listing could reduce API server load on large
+ * clusters by only querying namespaces the factory has touched.
+ */
+export interface GvkTarget {
+    apiVersion: string;
+    kind: string;
+    namespaced: boolean;
+}
+/**
+ * Built-in Kubernetes GVKs that typekro compositions commonly deploy.
+ * Kept intentionally narrow: adding entries here costs one list call
+ * per delete, so we only include kinds that are actually used by typekro
+ * factories.
+ *
+ * If a user deploys a built-in kind not on this list (e.g., a
+ * NetworkPolicy) and then deletes across processes, the resource will
+ * be missed by discovery. The fix is to add it here. A broader
+ * solution (full /apis walk) would be a follow-up optimization.
+ *
+ * With the `knownGvks` hint from the factory (see
+ * `discoverDeployedResourcesByInstance`), this list is only used as a
+ * fallback when the composition's resource templates are unavailable.
+ *
+ * Last audited: 2026-04-06.
+ */
+export declare const BUILT_IN_GVKS: readonly GvkTarget[];
+/**
+ * Enumerate every GVK typekro might need to query on this cluster:
+ * hardcoded built-ins + every active CRD version.
+ *
+ * CRD listing failures (RBAC, transient errors) are logged and the
+ * built-in list is returned alone so discovery can still make progress.
+ */
+export declare function discoverClusterGvks(k8sApi: k8s.KubernetesObjectApi): Promise<GvkTarget[]>;
+/**
+ * Discover the full set of resources belonging to a factory+instance and
+ * rebuild a {@link DeploymentStateRecord} ready to feed into
+ * {@link DirectDeploymentEngine.rollbackRecord}.
+ *
+ * Returns `undefined` if no resources match — legitimate state when the
+ * instance has already been cleaned up, was never deployed, or was
+ * deployed by a typekro version that did not tag resources.
+ *
+ * Resources are queried cluster-wide (namespace undefined) because
+ * typekro compositions can span multiple namespaces (e.g., a webapp
+ * composition may deploy operator resources in `cnpg-system` and
+ * application resources in `default`). The label selector makes this
+ * cheap even on large clusters.
+ */
+export declare function discoverDeployedResourcesByInstance(k8sApi: k8s.KubernetesObjectApi, opts: {
+    factoryName: string;
+    instanceName: string;
+    /**
+     * GVK hint from the factory's resource templates. When provided,
+     * only these kinds are queried — dropping a typical delete from
+     * 100+ list calls to 5-10. Falls back to full cluster GVK
+     * enumeration when omitted (e.g., bare engine calls without a
+     * composition in hand).
+     */
+    knownGvks?: GvkTarget[];
+}): Promise<DeploymentStateRecord | undefined>;
+//# sourceMappingURL=deployment-state-discovery.d.ts.map

package/dist/core/deployment/deployment-state-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-state-discovery.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/deployment-state-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAIpD,OAAO,KAAK,EAAoB,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAatF;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,SAAS,EA6B7C,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,GAAG,CAAC,mBAAmB,GAC9B,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AA4BD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mCAAmC,CACvD,MAAM,EAAE,GAAG,CAAC,mBAAmB,EAC/B,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB,GACA,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAmG5C"}

package/dist/core/deployment/deployment-state-discovery.js

@@ -0,0 +1,400 @@
+/**
+ * Deployment State Discovery
+ *
+ * Reconstructs a DeploymentStateRecord for a factory+instance by querying
+ * the cluster for resources labeled with typekro ownership metadata.
+ *
+ * This module implements the "cluster IS the state" model: there is no
+ * separate state backend (ConfigMap, database, etc). Every typekro-managed
+ * resource is tagged at deploy time with labels and annotations via
+ * {@link applyTypekroTags}, and at delete time we walk the cluster to
+ * find those resources and rebuild the graph from their annotations.
+ *
+ * ## Discovery strategy
+ *
+ * To cover every GVK a typekro composition might have touched, we:
+ *
+ *   1. Issue label-filtered list calls against a hardcoded set of
+ *      built-in GVKs (Deployments, Services, Namespaces, etc.).
+ *   2. List all CRDs on the cluster, extract their (group, version, kind,
+ *      scope) tuples, and issue label-filtered list calls against each.
+ *   3. Merge the results.
+ *
+ * Each list is scoped by a label selector, so even on large clusters the
+ * response from a GVK with no matching resources is a near-empty payload.
+ * The main cost is the number of list calls, which is bounded by
+ * (built-in GVKs) + (CRDs on cluster) — typically 30-150 requests total
+ * for a fresh discovery. Requests are issued with bounded parallelism.
+ *
+ * ## Why not use /apis discovery?
+ *
+ * The Kubernetes discovery API (`/apis`, `/api/v1`) gives a complete
+ * list of API resources, but client-node 1.x doesn't expose a typed
+ * helper for walking it, and we'd need to issue one request per group-
+ * version anyway to get the `resources[]` list for each. Listing CRDs
+ * directly is simpler and covers every custom kind; the hardcoded
+ * built-in list covers the rest.
+ *
+ * ## Graph reconstruction
+ *
+ * Each discovered resource carries a `typekro.io/depends-on` annotation
+ * containing a JSON array of composition-local ids it depends on. We
+ * walk the discovered resources twice: first pass adds every id as a
+ * graph node, second pass adds edges. Dangling edges (pointing to a
+ * resource that no longer exists on the cluster) are silently dropped
+ * — that's the expected state after a partial delete.
+ */
+import { DependencyGraph } from '../dependencies/graph.js';
+import { getComponentLogger } from '../logging/index.js';
+import { setMetadataField } from '../metadata/index.js';
+import { buildFactoryInstanceSelector, extractTypekroTags, } from './resource-tagging.js';
+const logger = getComponentLogger('deployment-state-discovery');
+/**
+ * Built-in Kubernetes GVKs that typekro compositions commonly deploy.
+ * Kept intentionally narrow: adding entries here costs one list call
+ * per delete, so we only include kinds that are actually used by typekro
+ * factories.
+ *
+ * If a user deploys a built-in kind not on this list (e.g., a
+ * NetworkPolicy) and then deletes across processes, the resource will
+ * be missed by discovery. The fix is to add it here. A broader
+ * solution (full /apis walk) would be a follow-up optimization.
+ *
+ * With the `knownGvks` hint from the factory (see
+ * `discoverDeployedResourcesByInstance`), this list is only used as a
+ * fallback when the composition's resource templates are unavailable.
+ *
+ * Last audited: 2026-04-06.
+ */
+export const BUILT_IN_GVKS = [
+    // Core API (v1)
+    { apiVersion: 'v1', kind: 'Namespace', namespaced: false },
+    { apiVersion: 'v1', kind: 'ConfigMap', namespaced: true },
+    { apiVersion: 'v1', kind: 'Secret', namespaced: true },
+    { apiVersion: 'v1', kind: 'Service', namespaced: true },
+    { apiVersion: 'v1', kind: 'ServiceAccount', namespaced: true },
+    { apiVersion: 'v1', kind: 'PersistentVolumeClaim', namespaced: true },
+    { apiVersion: 'v1', kind: 'PersistentVolume', namespaced: false },
+    // Apps
+    { apiVersion: 'apps/v1', kind: 'Deployment', namespaced: true },
+    { apiVersion: 'apps/v1', kind: 'StatefulSet', namespaced: true },
+    { apiVersion: 'apps/v1', kind: 'DaemonSet', namespaced: true },
+    { apiVersion: 'apps/v1', kind: 'ReplicaSet', namespaced: true },
+    // Batch
+    { apiVersion: 'batch/v1', kind: 'Job', namespaced: true },
+    { apiVersion: 'batch/v1', kind: 'CronJob', namespaced: true },
+    // Networking
+    { apiVersion: 'networking.k8s.io/v1', kind: 'Ingress', namespaced: true },
+    { apiVersion: 'networking.k8s.io/v1', kind: 'NetworkPolicy', namespaced: true },
+    // RBAC
+    { apiVersion: 'rbac.authorization.k8s.io/v1', kind: 'Role', namespaced: true },
+    { apiVersion: 'rbac.authorization.k8s.io/v1', kind: 'RoleBinding', namespaced: true },
+    { apiVersion: 'rbac.authorization.k8s.io/v1', kind: 'ClusterRole', namespaced: false },
+    { apiVersion: 'rbac.authorization.k8s.io/v1', kind: 'ClusterRoleBinding', namespaced: false },
+    // Autoscaling
+    { apiVersion: 'autoscaling/v2', kind: 'HorizontalPodAutoscaler', namespaced: true },
+    // Policy
+    { apiVersion: 'policy/v1', kind: 'PodDisruptionBudget', namespaced: true },
+];
+/**
+ * Enumerate every GVK typekro might need to query on this cluster:
+ * hardcoded built-ins + every active CRD version.
+ *
+ * CRD listing failures (RBAC, transient errors) are logged and the
+ * built-in list is returned alone so discovery can still make progress.
+ */
+export async function discoverClusterGvks(k8sApi) {
+    const targets = [...BUILT_IN_GVKS];
+    try {
+        const crdList = (await k8sApi.list('apiextensions.k8s.io/v1', 'CustomResourceDefinition'));
+        for (const crd of crdList.items ?? []) {
+            const crdTargets = gvkTargetsFromCrd(crd);
+            targets.push(...crdTargets);
+        }
+    }
+    catch (err) {
+        logger.warn('Failed to list CRDs during discovery — proceeding with built-in GVKs only', { error: err instanceof Error ? err.message : String(err) });
+    }
+    return targets;
+}
+/**
+ * Extract GVK targets from a single CRD. A CRD may have multiple served
+ * versions; we include each served version as its own target because
+ * older resources may still exist at a non-storage version.
+ */
+function gvkTargetsFromCrd(crd) {
+    const group = crd.spec?.group;
+    const kind = crd.spec?.names?.kind;
+    // CRD spec.scope is "Namespaced" | "Cluster". The typed interface in
+    // typekro has [key: string]: unknown on spec, so cast to read it.
+    const scope = crd.spec?.scope;
+    if (!group || !kind)
+        return [];
+    const versions = crd.spec?.versions ?? [];
+    const namespaced = scope !== 'Cluster';
+    const targets = [];
+    for (const v of versions) {
+        if (!v.served || !v.name)
+            continue;
+        targets.push({
+            apiVersion: `${group}/${v.name}`,
+            kind,
+            namespaced,
+        });
+    }
+    return targets;
+}
+/**
+ * Discover the full set of resources belonging to a factory+instance and
+ * rebuild a {@link DeploymentStateRecord} ready to feed into
+ * {@link DirectDeploymentEngine.rollbackRecord}.
+ *
+ * Returns `undefined` if no resources match — legitimate state when the
+ * instance has already been cleaned up, was never deployed, or was
+ * deployed by a typekro version that did not tag resources.
+ *
+ * Resources are queried cluster-wide (namespace undefined) because
+ * typekro compositions can span multiple namespaces (e.g., a webapp
+ * composition may deploy operator resources in `cnpg-system` and
+ * application resources in `default`). The label selector makes this
+ * cheap even on large clusters.
+ */
+export async function discoverDeployedResourcesByInstance(k8sApi, opts) {
+    const labelSelector = buildFactoryInstanceSelector(opts);
+    const discoveredGvks = await discoverClusterGvks(k8sApi);
+    const gvkTargets = opts.knownGvks?.length
+        ? mergeGvkTargets([...opts.knownGvks, ...discoveredGvks])
+        : discoveredGvks;
+    const usingHint = !!opts.knownGvks?.length;
+    logger.debug('Discovering deployed resources by label', {
+        factoryName: opts.factoryName,
+        instanceName: opts.instanceName,
+        gvkCount: gvkTargets.length,
+        source: usingHint ? 'knownGvks hint' : 'full cluster enumeration',
+        labelSelector,
+    });
+    // Issue list calls with bounded parallelism. Unbounded parallelism
+    // can flood the API server on large clusters; 8 concurrent lists is
+    // a reasonable default.
+    const discoveryStart = Date.now();
+    const matches = await listWithConcurrency(gvkTargets, 8, async (target) => {
+        try {
+            const result = await k8sApi.list(target.apiVersion, target.kind, undefined, // namespace — cluster-wide scan
+            undefined, // pretty
+            undefined, // exact (deprecated)
+            undefined, // export (deprecated)
+            undefined, // fieldSelector
+            labelSelector);
+            // K8s list responses often omit apiVersion/kind on individual
+            // items — they're inferred from the list's metadata. Stamp
+            // each item with the target's GVK so downstream code (dedup,
+            // rollback) has the correct kind for API calls.
+            const items = result.items ?? [];
+            for (const item of items) {
+                if (!item.apiVersion)
+                    item.apiVersion = target.apiVersion;
+                if (!item.kind)
+                    item.kind = target.kind;
+                if (!target.namespaced) {
+                    setMetadataField(item, 'scope', 'cluster');
+                }
+            }
+            return items;
+        }
+        catch (err) {
+            // 404 on a GVK means the API server doesn't recognise that
+            // kind — expected for CRDs that were uninstalled mid-discovery.
+            // Log at debug so the noise doesn't drown out real errors.
+            logger.debug('List failed for GVK during discovery', {
+                apiVersion: target.apiVersion,
+                kind: target.kind,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return [];
+        }
+    });
+    const discoveryDuration = Date.now() - discoveryStart;
+    logger.info('Discovery list calls completed', {
+        factoryName: opts.factoryName,
+        instanceName: opts.instanceName,
+        gvkCount: gvkTargets.length,
+        source: usingHint ? 'knownGvks' : 'full-cluster',
+        durationMs: discoveryDuration,
+    });
+    // Flatten, deduplicate by (kind, namespace, name), and post-filter
+    // by raw annotation values. The label selector uses sanitized values
+    // which can collide (e.g., "my@factory" and "my#factory" both
+    // sanitize to "my-factory"). The raw factory/instance name stored in
+    // annotations is the authoritative match — reject resources whose
+    // annotation doesn't match the requested factory+instance.
+    const seen = new Set();
+    const uniqueResources = [];
+    for (const item of matches.flat()) {
+        const key = `${item.apiVersion}/${item.kind}/${item.metadata?.namespace ?? ''}/${item.metadata?.name ?? ''}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        // Post-filter: verify raw annotation matches requested identity
+        const tags = extractTypekroTags(item);
+        if (tags.factoryName && tags.factoryName !== opts.factoryName)
+            continue;
+        if (tags.instanceName && tags.instanceName !== opts.instanceName)
+            continue;
+        uniqueResources.push(item);
+    }
+    if (uniqueResources.length === 0) {
+        logger.debug('No resources found for instance', {
+            factoryName: opts.factoryName,
+            instanceName: opts.instanceName,
+        });
+        return undefined;
+    }
+    return buildRecordFromResources(uniqueResources, opts);
+}
+function mergeGvkTargets(targets) {
+    const merged = new Map();
+    for (const target of targets) {
+        const key = `${target.apiVersion}/${target.kind}`;
+        const existing = merged.get(key);
+        if (!existing) {
+            merged.set(key, target);
+            continue;
+        }
+        if (existing.namespaced && !target.namespaced) {
+            merged.set(key, target);
+        }
+    }
+    return Array.from(merged.values());
+}
+/**
+ * Convert a set of discovered live resources into a DeploymentStateRecord.
+ * Each resource's ownership metadata is pulled from its labels and
+ * annotations, and the dependency graph is reconstructed from the
+ * per-resource `depends-on` annotations.
+ */
+function buildRecordFromResources(resources, opts) {
+    const deployedResources = [];
+    const idToResource = new Map();
+    const dependenciesById = new Map();
+    // First pass: extract tags and build DeployedResource records
+    let deploymentId;
+    let earliestStart;
+    let factoryNamespace;
+    for (const resource of resources) {
+        const tags = extractTypekroTags(resource);
+        const id = tags.resourceId;
+        if (!id) {
+            // A resource with no resource-id annotation can't participate in
+            // graph reconstruction — it must have been tagged by a partial
+            // upgrade or external mutator. Skip rather than crash.
+            logger.debug('Skipping discovered resource with no resource-id annotation', {
+                kind: resource.kind,
+                name: resource.metadata?.name,
+            });
+            continue;
+        }
+        if (!deploymentId && tags.deploymentId)
+            deploymentId = tags.deploymentId;
+        if (!factoryNamespace && tags.factoryNamespace) {
+            factoryNamespace = tags.factoryNamespace;
+        }
+        const deployedAt = toDate(resource.metadata?.creationTimestamp);
+        if (deployedAt && (!earliestStart || deployedAt < earliestStart)) {
+            earliestStart = deployedAt;
+        }
+        const deployed = {
+            id,
+            kind: resource.kind ?? 'Unknown',
+            name: resource.metadata?.name ?? 'unknown',
+            namespace: resource.metadata?.namespace ?? '',
+            manifest: resource,
+            status: 'deployed',
+            deployedAt: deployedAt ?? new Date(),
+        };
+        deployedResources.push(deployed);
+        idToResource.set(id, deployed);
+        if (tags.dependencies.length > 0) {
+            dependenciesById.set(id, tags.dependencies);
+        }
+    }
+    // Second pass: rebuild the dependency graph
+    const dependencyGraph = new DependencyGraph();
+    for (const [id, deployed] of idToResource.entries()) {
+        // biome-ignore lint/suspicious/noExplicitAny: minimal plain manifest, not an Enhanced proxy
+        dependencyGraph.addNode(id, deployed.manifest);
+    }
+    for (const [from, deps] of dependenciesById.entries()) {
+        for (const to of deps) {
+            // Skip dangling edges — the dependency may have been deleted
+            // manually, or was never tagged (e.g., lifecycle: shared in an
+            // older typekro version that we now find via annotations only).
+            if (!idToResource.has(to))
+                continue;
+            try {
+                dependencyGraph.addEdge(from, to);
+            }
+            catch (err) {
+                logger.debug('Failed to add edge during discovery — skipping', {
+                    from,
+                    to,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+        }
+    }
+    return {
+        deploymentId: deploymentId ?? `discovered-${Date.now()}`,
+        resources: deployedResources,
+        dependencyGraph,
+        startTime: earliestStart ?? new Date(),
+        status: 'completed',
+        options: {
+            mode: 'direct',
+            ...(factoryNamespace && { namespace: factoryNamespace }),
+            factoryName: opts.factoryName,
+            instanceName: opts.instanceName,
+        },
+    };
+}
+/**
+ * Safely convert a Kubernetes `creationTimestamp` to a Date.
+ * The client-node deserializer returns a `Date` object, but defensive
+ * callers may receive strings from raw JSON or test mocks.
+ */
+function toDate(value) {
+    if (value instanceof Date)
+        return Number.isNaN(value.getTime()) ? undefined : value;
+    if (typeof value === 'string' || typeof value === 'number') {
+        const d = new Date(value);
+        return Number.isNaN(d.getTime()) ? undefined : d;
+    }
+    return undefined;
+}
+/**
+ * Run an async function over an array with bounded parallelism. Used to
+ * cap the number of simultaneous API requests during discovery.
+ */
+async function listWithConcurrency(items, concurrency, fn) {
+    const results = new Array(items.length);
+    let next = 0;
+    const workers = [];
+    const worker = async () => {
+        while (true) {
+            // Safe: JS is single-threaded — workers only yield at the `await`
+            // below, so `next++` can't be interleaved between workers.
+            const idx = next++;
+            if (idx >= items.length)
+                return;
+            const item = items[idx];
+            if (item === undefined)
+                return;
+            results[idx] = await fn(item);
+        }
+    };
+    for (let i = 0; i < Math.min(concurrency, items.length); i++) {
+        workers.push(worker());
+    }
+    await Promise.all(workers);
+    return results;
+}
+//# sourceMappingURL=deployment-state-discovery.js.map