@crewhaus/helm-chart 0.5.0 → 0.5.1

package/dist/embedded.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Template filename → body. Insertion order is the sorted order
+ * `readdirSync().sort()` used to produce, so `templateFiles()` keeps returning
+ * the same sequence and rendered output stays byte-stable across this change.
+ */
+export declare const TEMPLATE_BODIES: Readonly<Record<string, string>>;

package/dist/embedded.js

@@ -0,0 +1,54 @@
+/**
+ * Compile-time-embedded bodies of the chart's `helm/crewhaus/templates/*`
+ * files.
+ *
+ * The `with { type: "text" }` import attribute makes Bun inline each file's
+ * text: on the interpreter path (`bun`/`bunx`) it reads the file from disk at
+ * module load, and under `bun build --compile` it bakes the text into the
+ * standalone binary's `/$bunfs` image. Either way, no `readdirSync`/
+ * `readFileSync` of a package-relative path runs at render time.
+ *
+ * That runtime read is exactly what broke `crewhaus cloud deploy` on every
+ * PUBLISHED channel, in two different ways at once:
+ *
+ *   - the compiled binary derived `TEMPLATES_DIR` from `import.meta.url`,
+ *     which resolves under `/$bunfs` where the chart was never present, so
+ *     rendering threw `templates directory missing at
+ *     /$bunfs/helm/crewhaus/templates`;
+ *   - the npm tarball omitted the directory outright, because this package's
+ *     `files` array listed only `src`, so the same read failed against a real
+ *     but absent `node_modules/@crewhaus/helm-chart/helm/`.
+ *
+ * Neither reproduced in CI, which runs from a source checkout where
+ * `packages/helm-chart/helm/` is on disk — the same blind spot that let the
+ * `default-skills` ENOENT ship in 0.3.0.
+ *
+ * The checked-in chart files stay the single source of truth; this module only
+ * re-exports their text keyed by filename, so there is no second copy to
+ * drift. `helm/` is now also in `files`, so a published consumer can still
+ * `helm install` the real chart from `chartRoot()` — that path is for humans
+ * and tooling, and is no longer what rendering depends on.
+ */
+import helpersTpl from "../helm/crewhaus/templates/_helpers.tpl" with { type: "text" };
+import deploymentYaml from "../helm/crewhaus/templates/deployment.yaml" with { type: "text" };
+import ingressYaml from "../helm/crewhaus/templates/ingress.yaml" with { type: "text" };
+import otelCollectorYaml from "../helm/crewhaus/templates/otel-collector.yaml" with {
+    type: "text"
+};
+import serviceYaml from "../helm/crewhaus/templates/service.yaml" with { type: "text" };
+import serviceMonitorYaml from "../helm/crewhaus/templates/servicemonitor.yaml" with {
+    type: "text"
+};
+/**
+ * Template filename → body. Insertion order is the sorted order
+ * `readdirSync().sort()` used to produce, so `templateFiles()` keeps returning
+ * the same sequence and rendered output stays byte-stable across this change.
+ */
+export const TEMPLATE_BODIES = {
+    "_helpers.tpl": helpersTpl,
+    "deployment.yaml": deploymentYaml,
+    "ingress.yaml": ingressYaml,
+    "otel-collector.yaml": otelCollectorYaml,
+    "service.yaml": serviceYaml,
+    "servicemonitor.yaml": serviceMonitorYaml,
+};

package/dist/index.d.ts

@@ -24,7 +24,23 @@ export declare class HelmChartError extends CrewhausError {
     readonly name = "HelmChartError";
     constructor(message: string, cause?: unknown);
 }
+/**
+ * On-disk location of the chart, for humans and for tooling that wants to run
+ * `helm install … <chartRoot()>` directly. Present in a source checkout and in
+ * a published npm install (`helm/` is in this package's `files`), but NOT in
+ * the compiled binary, where the chart exists only as embedded text. Rendering
+ * never reads it — use {@link renderChart}.
+ */
 export declare function chartRoot(): string;
+/**
+ * The chart's template filenames, in the same sorted order the old
+ * `readdirSync().sort()` produced.
+ *
+ * Served from {@link TEMPLATE_BODIES} rather than the filesystem: the previous
+ * package-relative read failed on BOTH published channels — under `/$bunfs` in
+ * the compiled binary, and against an absent `helm/` in the npm tarball. See
+ * `embedded.ts`.
+ */
 export declare function templateFiles(): readonly string[];
 export declare function readTemplate(name: string): string;
 export type ChartValues = {

package/dist/index.js

@@ -1,4 +1,3 @@
-import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { TARGET_SHAPES, isTargetShape } from "@crewhaus/docker-images";
@@ -23,6 +22,7 @@ import { TARGET_SHAPES, isTargetShape } from "@crewhaus/docker-images";
  * helm/crewhaus -f values.yaml`.
  */
 import { CrewhausError } from "@crewhaus/errors";
+import { TEMPLATE_BODIES } from "./embedded";
 export class HelmChartError extends CrewhausError {
     name = "HelmChartError";
     constructor(message, cause) {
@@ -31,27 +31,37 @@ export class HelmChartError extends CrewhausError {
 }
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const CHART_ROOT = join(PACKAGE_ROOT, "helm", "crewhaus");
-const TEMPLATES_DIR = join(CHART_ROOT, "templates");
+/**
+ * On-disk location of the chart, for humans and for tooling that wants to run
+ * `helm install … <chartRoot()>` directly. Present in a source checkout and in
+ * a published npm install (`helm/` is in this package's `files`), but NOT in
+ * the compiled binary, where the chart exists only as embedded text. Rendering
+ * never reads it — use {@link renderChart}.
+ */
 export function chartRoot() {
     return CHART_ROOT;
 }
+/**
+ * The chart's template filenames, in the same sorted order the old
+ * `readdirSync().sort()` produced.
+ *
+ * Served from {@link TEMPLATE_BODIES} rather than the filesystem: the previous
+ * package-relative read failed on BOTH published channels — under `/$bunfs` in
+ * the compiled binary, and against an absent `helm/` in the npm tarball. See
+ * `embedded.ts`.
+ */
 export function templateFiles() {
-    if (!existsSync(TEMPLATES_DIR)) {
-        throw new HelmChartError(`templates directory missing at ${TEMPLATES_DIR}`);
-    }
-    return readdirSync(TEMPLATES_DIR)
-        .filter((f) => /\.(ya?ml|tpl)$/.test(f))
-        .sort();
+    return Object.keys(TEMPLATE_BODIES);
 }
 export function readTemplate(name) {
     if (name.includes("/") || name.includes("..")) {
         throw new HelmChartError(`invalid template name: ${name}`);
     }
-    const path = join(TEMPLATES_DIR, name);
-    if (!existsSync(path)) {
+    const body = TEMPLATE_BODIES[name];
+    if (body === undefined) {
         throw new HelmChartError(`template not found: ${name}`);
     }
-    return readFileSync(path, "utf8");
+    return body;
 }
 export function defaultValues() {
     return {

package/helm/crewhaus/Chart.yaml

@@ -0,0 +1,16 @@
+apiVersion: v2
+name: crewhaus
+description: CrewHaus Factory — modular meta-harness for compiling agent specs into deployable runtimes
+type: application
+version: 0.1.0
+appVersion: "1.0.0"
+home: https://github.com/crewhaus/factory
+sources:
+  - https://github.com/crewhaus/factory
+maintainers:
+  - name: CrewHaus
+    email: maintainers@crewhaus.ai
+keywords:
+  - llm
+  - agents
+  - meta-harness

package/helm/crewhaus/templates/_helpers.tpl

@@ -0,0 +1,21 @@
+{{/*
+Helpers for the crewhaus chart. Kept deliberately simple so both
+real Helm and the in-process renderChart() (used by tests in
+@crewhaus/helm-chart) produce equivalent output.
+*/}}
+
+{{- define "crewhaus.name" -}}
+crewhaus
+{{- end -}}
+
+{{- define "crewhaus.fullname" -}}
+{{ .Release.Name }}-crewhaus
+{{- end -}}
+
+{{- define "crewhaus.labels" -}}
+app.kubernetes.io/name: {{ include "crewhaus.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+crewhaus.ai/target: {{ .Values.target | quote }}
+{{- end -}}

package/helm/crewhaus/templates/deployment.yaml

@@ -0,0 +1,119 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "crewhaus.fullname" . }}
+  labels:
+    {{- include "crewhaus.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicas }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "crewhaus.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        {{- include "crewhaus.labels" . | nindent 8 }}
+    spec:
+      {{- with .Values.image.pullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: crewhaus
+          # image.registry (default ghcr.io/crewhaus — where releases publish)
+          # prefixes the target-derived image name; image.digest pins by
+          # registry manifest digest, otherwise tag is used.
+          image: "{{ .Values.image.registry }}/{{ .Values.target }}{{ if .Values.image.digest }}@{{ .Values.image.digest }}{{ else }}:{{ .Values.image.tag }}{{ end }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          env:
+            - name: CREWHAUS_TARGET
+              value: {{ .Values.target | quote }}
+            {{- if .Values.secrets.anthropic }}
+            - name: ANTHROPIC_AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secrets.anthropic.secretName }}
+                  key: {{ .Values.secrets.anthropic.key }}
+            {{- end }}
+            {{- if eq .Values.target "channel" }}
+            - name: SLACK_SIGNING_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secrets.slack.signing.secretName }}
+                  key: {{ .Values.secrets.slack.signing.key }}
+            - name: SLACK_BOT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secrets.slack.bot.secretName }}
+                  key: {{ .Values.secrets.slack.bot.key }}
+            {{- end }}
+            {{- range .Values.secrets.provider }}
+            - name: {{ .name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .secretName }}
+                  key: {{ .key }}
+            {{- end }}
+            {{- range .Values.extraEnv }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+            {{- if .Values.otel.enabled }}
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: {{ .Values.otel.endpoint | quote }}
+            {{- if .Values.otel.headers }}
+            - name: OTEL_EXPORTER_OTLP_HEADERS
+              value: {{ .Values.otel.headers | quote }}
+            {{- end }}
+            {{- end }}
+          {{- if has .Values.target (list "channel" "managed" "crew" "voice" "browser") }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.targetPort }}
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 15
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 2
+            periodSeconds: 5
+          {{- else }}
+          # Process-liveness only: `doctor --liveness` exits 0 without
+          # credential/spec checks. Plain `doctor` always failed here —
+          # /app/crewhaus.yaml never exists in the image.
+          livenessProbe:
+            exec:
+              command: ["bun", "/app/crewhaus.js", "doctor", "--liveness"]
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          readinessProbe:
+            exec:
+              command: ["bun", "/app/crewhaus.js", "doctor", "--liveness"]
+            initialDelaySeconds: 2
+            periodSeconds: 10
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: spec
+              mountPath: /spec
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: spec
+          configMap:
+            name: {{ .Values.spec.configMap }}
+        - name: tmp
+          emptyDir: {}

package/helm/crewhaus/templates/ingress.yaml

@@ -0,0 +1,41 @@
+{{- if and .Values.ingress.enabled (has .Values.target (list "channel" "managed" "crew" "voice" "browser")) -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "crewhaus.fullname" . }}
+  labels:
+    {{- include "crewhaus.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "crewhaus.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

package/helm/crewhaus/templates/otel-collector.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.otel.enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "crewhaus.fullname" . }}-otel
+  labels:
+    {{- include "crewhaus.labels" . | nindent 4 }}
+data:
+  collector.yaml: |
+    receivers:
+      otlp:
+        protocols:
+          http:
+            endpoint: 0.0.0.0:4318
+    processors:
+      batch:
+        timeout: 5s
+        send_batch_size: 1000
+    exporters:
+      logging:
+        loglevel: info
+    service:
+      pipelines:
+        traces:
+          receivers: [otlp]
+          processors: [batch]
+          exporters: [logging]
+        metrics:
+          receivers: [otlp]
+          processors: [batch]
+          exporters: [logging]
+{{- end }}

package/helm/crewhaus/templates/service.yaml

@@ -0,0 +1,18 @@
+{{- if has .Values.target (list "channel" "managed" "crew" "voice" "browser") -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "crewhaus.fullname" . }}
+  labels:
+    {{- include "crewhaus.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: {{ include "crewhaus.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

package/helm/crewhaus/templates/servicemonitor.yaml

@@ -0,0 +1,20 @@
+{{- if .Values.serviceMonitor.enabled -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "crewhaus.fullname" . }}
+  labels:
+    {{- include "crewhaus.labels" . | nindent 4 }}
+    {{- with .Values.serviceMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "crewhaus.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: {{ .Values.serviceMonitor.interval }}
+{{- end }}

package/helm/crewhaus/values.yaml

@@ -0,0 +1,136 @@
+## Default values for the crewhaus chart.
+
+# One of: cli, workflow, channel, graph, managed, pipeline, crew, research,
+# batch, voice, browser, eval. Determines which Deployment template renders
+# and which Dockerfile-bundled image is used.
+target: channel
+
+image:
+  # Registry + namespace prefix for the per-shape images. The image NAME is
+  # always derived from `target` (<registry>/<target>), so this is the only
+  # knob needed to point at a mirror or private registry. The default matches
+  # where the release workflow actually publishes — nothing publishes to
+  # docker.io.
+  registry: ghcr.io/crewhaus
+  tag: latest
+  # Optional content-digest pin. When set to "sha256:<64 hex>" (a REGISTRY
+  # MANIFEST digest, as recorded in packages/docker-images/docker/digests.json
+  # by `crewhaus build-image --push` and the release workflow's docker-digests
+  # job — local --load builds record nothing pullable), the Deployment
+  # references <registry>/<target>@sha256:... and `tag` is ignored —
+  # reproducible, tamper-evident deploys.
+  # digest: "sha256:<digest>"
+  pullPolicy: IfNotPresent
+  pullSecrets: []
+
+replicas: 1
+
+# Spec ConfigMap source. The chart mounts this ConfigMap at /spec/crewhaus.yaml
+# inside every pod. Paths inside spec must use $VAR_NAME refs (Section 12) —
+# the chart wires them into env vars from `secrets` below.
+spec:
+  configMap: crewhaus-spec
+  fileName: crewhaus.yaml
+
+# Secret references. Each maps a CrewHaus env var to a Kubernetes Secret name +
+# key. Wires §27 secrets-manager to k8s Secret resources.
+secrets:
+  anthropic:
+    secretName: crewhaus-creds
+    key: ANTHROPIC_AUTH_TOKEN
+  slack:
+    signing:
+      secretName: crewhaus-creds
+      key: SLACK_SIGNING_SECRET
+    bot:
+      secretName: crewhaus-creds
+      key: SLACK_BOT_TOKEN
+  # Generic provider secret list — one entry per env var the spec's model
+  # provider needs, each sourced from a Kubernetes Secret. Use this for
+  # non-Anthropic models (the model-router grammar: openai/*, gemini/*,
+  # bedrock/*, local/<m>@<url>). Presets:
+  #
+  #   openai:   - name: OPENAI_API_KEY          # or OPENAI_BASE_URL for an
+  #                                             # OpenAI-compatible endpoint
+  #   gemini:   - name: GEMINI_API_KEY          # or GOOGLE_API_KEY; Vertex
+  #                                             # users set GOOGLE_CLOUD_PROJECT
+  #                                             # + GOOGLE_GENAI_USE_VERTEXAI
+  #                                             # via extraEnv below
+  #   bedrock:  - name: AWS_BEARER_TOKEN_BEDROCK # or AWS_ACCESS_KEY_ID +
+  #             - name: AWS_SECRET_ACCESS_KEY    # AWS_SECRET_ACCESS_KEY; the
+  #                                              # SDK default chain (IRSA,
+  #                                              # instance profile) needs none
+  #   local:    (no credentials)
+  #
+  # Example:
+  #   provider:
+  #     - name: OPENAI_API_KEY
+  #       secretName: crewhaus-creds
+  #       key: OPENAI_API_KEY
+  provider: []
+
+# Plain (non-secret) env vars appended to the container, e.g. provider
+# region/endpoint selectors:
+#   - name: AWS_REGION
+#     value: us-east-1
+#   - name: OPENAI_BASE_URL
+#     value: http://vllm.internal:8000/v1
+#   - name: GOOGLE_CLOUD_PROJECT
+#     value: my-project
+extraEnv: []
+
+# Service & Ingress (only rendered for daemon shapes: channel, managed, crew,
+# voice, browser).
+service:
+  type: ClusterIP
+  port: 80
+  targetPort: 3000
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts:
+    - host: crewhaus.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+
+# §20 gateway-server JWT issuance.
+gateway:
+  tls:
+    cert: ""
+    key: ""
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+
+# §15 OTel collector sidecar — emits trace events to a configured backend.
+otel:
+  enabled: true
+  endpoint: ""
+  headers: ""
+
+# Prometheus operator ServiceMonitor for §15 metrics-collector httpServer mode.
+serviceMonitor:
+  enabled: true
+  interval: 30s
+  labels: {}
+
+# Pod security context (mirrors the Dockerfile USER + read-only root).
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 10001
+  fsGroup: 10001
+
+securityContext:
+  readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/helm-chart",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "type": "module",
   "description": "Kubernetes Helm chart (templates + values schema + ServiceMonitor + OTel collector sidecar) plus an in-process renderChart() for tests (Section 32)",
   "main": "dist/index.js",
@@ -15,8 +15,8 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/docker-images": "0.5.0",
-    "@crewhaus/errors": "0.5.0"
+    "@crewhaus/docker-images": "0.5.1",
+    "@crewhaus/errors": "0.5.1"
   },
   "license": "Apache-2.0",
   "author": {
@@ -36,5 +36,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "helm", "README.md", "LICENSE", "NOTICE"]
 }