@mcpg-dev/pulumi 0.1.0-beta.11

package/BUILD.bazel

@@ -0,0 +1,24 @@
+load("@aspect_rules_js//js:defs.bzl", "js_library")
+load("@npm//:defs.bzl", "npm_link_all_packages")
+
+# This package's npm dependencies, linked the way node resolves them.
+npm_link_all_packages(name = "node_modules")
+
+# Every workspace package needs a `pkg` target: npm_link_all_packages resolves
+# a `workspace:*` dependency to one, and the root link covers the whole
+# workspace — so a package without it breaks the graph for everyone, not just
+# for itself.
+js_library(
+    name = "pkg",
+    srcs = glob(
+        ["**/*"],
+        allow_empty = True,
+        exclude = [
+            "node_modules/**",
+            "dist/**",
+            ".next/**",
+            "BUILD.bazel",
+        ],
+    ),
+    visibility = ["//visibility:public"],
+)

package/README.md

@@ -0,0 +1,169 @@
+# @mcpg/pulumi
+
+Opinionated Pulumi components for running MCPG on Kubernetes: the operator, the
+CRDs, cluster trust, gateways, plugin sets, routes, and tenants. Each component
+wraps a piece of the platform that is easy to get subtly wrong — CRD lifecycle,
+gateway configuration shape, tenant isolation — behind typed TypeScript inputs.
+Built on `@mcpg/pulumi-crds` (the generated, typed CRD SDK) and
+`@pulumi/kubernetes`.
+
+Reach for it when your MCPG deployment lives in a Pulumi program and you would
+rather express "one operator, one gateway, three tenants" than assemble Helm
+releases and raw custom resources by hand.
+
+## Prerequisites
+
+- Pulumi with the TypeScript runtime, and a Kubernetes provider configured for
+  the target cluster.
+- cert-manager in the cluster, unless you turn it off. The operator's admission
+  webhook fails closed and needs real TLS, so `Operator` sets
+  `certManager.enabled=true` by default.
+
+## Quick start
+
+```ts
+import { McpgStack } from "@mcpg/pulumi";
+
+new McpgStack("prod", {
+  operator: { chartVersion: "<chart-version>" },
+  gateway: {
+    image: { repository: "ghcr.io/mcpg-dev/source-code/gateway", tag: "<tag>" },
+    governance: { audit: { sinks: [{ kind: "dev.mcpg.builtin.audit.local-file" }] } },
+  },
+});
+```
+
+`McpgStack` composes the common case: an `Operator`, a `TrustBootstrap` seeding
+the cluster-default revocation list (set `trust: false` to skip it), and — when
+`gateway` is given — one `Gateway` in the operator's namespace. Both of the
+latter depend on the operator being installed first.
+
+The package is built from this workspace:
+
+```bash
+pnpm --filter ./iac/pulumi/components run build       # tsc → bin/
+pnpm --filter ./iac/pulumi/components exec tsc -b --noEmit   # tsc --noEmit
+```
+
+## Components
+
+| Component | Creates |
+|---|---|
+| `Operator` | The operator Helm release plus the CRDs as first-class resources. |
+| `Gateway` | An `MCPGGateway`, with `spec.config` assembled by the config builder. |
+| `PluginSet` | An `MCPGPluginSet` — plugin entries and optional capability grants. |
+| `TrustBootstrap` | The cluster-default `MCPGRevocationList`, and carries the signing-key reference. |
+| `Cluster` | An `MCPGCluster` — the coordination backend a gateway's `clusterRef` points at. |
+| `Route` | An `MCPGRoute` — a tool subset bound into a shared gateway with identity, policy, and audit chains. |
+| `TenantCR` | An `MCPGTenant` — declarative tenant governance. |
+| `Tenant` | A namespace with isolation, and optionally a plugin set and a gateway. |
+| `McpgStack` | Operator plus trust plus one gateway. |
+
+### Operator and CRD lifecycle
+
+Helm installs the files under a chart's `crds/` directory once and never
+upgrades or deletes them. `Operator` sidesteps that by applying the CRDs as a
+`ConfigGroup` it owns — server-side applied, upgraded like any other resource —
+and telling the chart to stand back with `skipCrds` plus `crd.install=false`.
+`crdsDir` points at the CRD YAMLs (default `../../codegen/schemas/v1alpha1/crds`,
+resolved from the Pulumi program's directory).
+
+The release defaults to namespace `mcpg-system`, chart `mcpg-operator` from
+`ociChartRepo()`, and cert-manager enabled. Set `watchNamespace` to restrict the
+operator to a single namespace. Anything in `values` is spread over those
+defaults, so a key you supply replaces the corresponding default block.
+
+`ociChartRepo()` composes `oci://<base>/charts` from the registry coordinates in
+`src/oci.ts`, whose defaults mirror `tools/release/oci-registry.json`. Override
+one chart with `chartRepo`, or a whole stack with `MCPG_OCI_HOST` /
+`MCPG_OCI_NAMESPACE` / `MCPG_OCI_PATH` — the same environment contract the shell
+and Node publish helpers honour. `ociImageRepo(name)` and `ociPluginRegistry()`
+compose image and plugin references off the same base.
+
+### Gateway readiness
+
+`Gateway` annotates the resource with `pulumi.com/waitFor: condition=Ready`, so
+`pulumi up` waits on the operator reporting the gateway ready rather than on the
+custom resource merely existing. Pass `waitForReady: false` to skip the wait.
+
+### Tenancy: two different things
+
+`Tenant` is an imperative fan-out — it creates the namespace, a default-deny
+cross-tenant ingress `NetworkPolicy` (unless `networkPolicy: false`), and
+optionally a plugin set and a gateway inside it. Instantiate it in a loop to
+build a fleet. It does **not** create an `MCPGTenant`, so it does not engage the
+operator's tenant governance.
+
+`TenantCR` creates the `MCPGTenant` custom resource: the plugin allowlist,
+per-namespace quotas, replica ceilings, and exclusive namespace ownership the
+operator enforces at admission. Use it when tenant boundaries must be enforced
+rather than merely arranged, alongside or instead of `Tenant`.
+
+### Cluster credentials
+
+`Cluster` accepts `credentialRefs` naming pre-existing Secrets, and
+`credentials`, where an entry carrying `data` makes the component create the
+Secret in `operatorNamespace` (default `mcpg-system`) and wire the reference for
+you. Both forms surface to the gateway as `cred://cluster/<name>`.
+`TrustBootstrap` takes a signing-key Secret reference the same way: only the
+reference travels, never the key bytes, so no signing material lands in Pulumi
+state.
+
+## Configuration
+
+`Gateway` builds the gateway's `spec.config` from typed sections. The operator
+passes that document through untouched, and the gateway parses it strictly —
+unknown keys are a boot-time error, which makes the shape worth getting right.
+
+```ts
+import { Gateway } from "@mcpg/pulumi";
+
+new Gateway("orders", {
+  namespace: "mcpg-system",
+  image: { repository: "ghcr.io/mcpg-dev/source-code/gateway", tag: "<tag>" },
+  server: { bind_address: "0.0.0.0:8080" },
+  governance: { audit: { sinks: [{ kind: "dev.mcpg.builtin.audit.local-file" }] } },
+  plugins: [
+    { id: "dev.mcpg.backend.sql", source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-sql:protocol-1" } },
+  ],
+  extraConfig: { mcp: { capabilities: { tools: [] } } },
+});
+```
+
+| Field | Type | Default | Description |
+|---|---|---|---|
+| `server` | object | omitted | Emitted at `config.gateway.server`, under the `gateway:` umbrella — a top-level `server` key is rejected by the gateway's parser. |
+| `governance` | object | omitted | Emitted at `config.governance`. Audit sinks are a list (`audit.sinks[]`), not a scalar. |
+| `observability` | object | omitted | Emitted at `config.observability`. |
+| `mcp` | object | omitted | Emitted at `config.mcp`. |
+| `plugins` | array | omitted | Emitted at `config.plugins`, and only when non-empty. Each entry carries `id` and a `source` declaring exactly one of `path` or `oci`; the per-entry toggle is `disabled`, not `enabled`. |
+| `extraConfig` | object | `{}` | An arbitrary configuration fragment merged last, so its top-level keys win. The escape hatch for anything the typed sections do not cover. |
+
+The same last-wins rule applies one level up: `extraSpec` on `Gateway` is merged
+over the assembled `spec`, after the typed passthrough blocks
+(`acceptedRouteNamespaces`, `podAnnotations`, `podLabels`, `resources`,
+`service`, `ingress`, `autoscaling`, `monitoring`, `networkPolicy`,
+`podDisruptionBudget`, `workloadIdentity`, `scheduling`, `probes`,
+`imagePullSecrets`).
+
+The config builder's semantics are covered by unit tests that need no
+dependencies beyond Node itself:
+
+```bash
+pnpm --filter ./iac/pulumi/components run build
+node --test iac/pulumi/components/bin/config.test.js
+```
+
+## Licence
+
+Apache-2.0.
+
+## See also
+
+- <https://mcpg.dev/docs/self-hosting/pulumi> — deploying MCPG with Pulumi.
+- <https://mcpg.dev/docs/reference/operator-crds> — the custom resources these
+  components create.
+- <https://mcpg.dev/docs/reference/configuration> — the full gateway
+  configuration schema behind `spec.config`.
+- `iac/pulumi/crds` (the typed CRD SDK) and `iac/pulumi/policy` (the CrossGuard
+  policy pack that validates these resources at preview time).

package/bin/cluster.d.ts

@@ -0,0 +1,44 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+export interface ClusterCredential {
+    /** cred://cluster/<name>. */
+    name: string;
+    secretName: string;
+    key?: string;
+    /** When set, the component CREATES the Secret in operatorNamespace; else it is assumed to pre-exist. */
+    data?: {
+        [key: string]: string;
+    };
+}
+export interface ClusterArgs {
+    /** single_node (default) | redis | nats | consul | etcd. */
+    backend?: string;
+    /** Per-backend connection config. MUST be empty for single_node, non-empty otherwise. */
+    config?: {
+        [key: string]: any;
+    };
+    /** Optional { name } of the cluster-scoped MCPGPlugin supplying the cdylib. */
+    pluginRef?: {
+        name: string;
+    };
+    /** Optional [{ name, secretName, key? }] referencing PRE-EXISTING Secrets, surfaced as cred://cluster/<name>. */
+    credentialRefs?: any[];
+    /** Backend credentials this component manages — creates the Secret (when `data` is set) in operatorNamespace + wires the ref. */
+    credentials?: ClusterCredential[];
+    /** Namespace the operator runs in — where credential Secrets must live. */
+    operatorNamespace?: pulumi.Input<string>;
+    labels?: {
+        [key: string]: string;
+    };
+    resourceName?: string;
+}
+/**
+ * An MCPGCluster (cluster-scoped): the coordination backend a gateway's
+ * `clusterRef` points at. `single_node` takes no config; external backends
+ * require a non-empty connection block.
+ */
+export declare class Cluster extends pulumi.ComponentResource {
+    readonly cluster: mcpg.v1alpha1.MCPGCluster;
+    readonly name: pulumi.Output<string>;
+    constructor(name: string, args?: ClusterArgs, opts?: pulumi.ComponentResourceOptions);
+}

package/bin/cluster.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Cluster = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const pulumi_crds_1 = require("@mcpg-dev/pulumi-crds");
+/**
+ * An MCPGCluster (cluster-scoped): the coordination backend a gateway's
+ * `clusterRef` points at. `single_node` takes no config; external backends
+ * require a non-empty connection block.
+ */
+class Cluster extends pulumi.ComponentResource {
+    constructor(name, args = {}, opts) {
+        super("mcpg:index:Cluster", name, {}, opts);
+        const cName = args.resourceName ?? name;
+        const ns = args.operatorNamespace ?? "mcpg-system";
+        // Managed credential Secrets (operator namespace) + their refs.
+        const managedRefs = [];
+        const secretDeps = [];
+        for (const c of args.credentials ?? []) {
+            if (c.data) {
+                const sec = new k8s.core.v1.Secret(`${cName}-cred-${c.name}`, {
+                    metadata: { name: c.secretName, namespace: ns },
+                    stringData: c.data,
+                    type: "Opaque",
+                }, { parent: this });
+                secretDeps.push(sec);
+            }
+            managedRefs.push(c.key ? { name: c.name, secretName: c.secretName, key: c.key } : { name: c.name, secretName: c.secretName });
+        }
+        const credentialRefs = [...(args.credentialRefs ?? []), ...managedRefs];
+        const spec = { backend: args.backend ?? "single_node" };
+        if (args.config && Object.keys(args.config).length > 0)
+            spec.config = args.config;
+        if (args.pluginRef)
+            spec.pluginRef = args.pluginRef;
+        if (credentialRefs.length > 0)
+            spec.credentialRefs = credentialRefs;
+        this.cluster = new pulumi_crds_1.mcpg.v1alpha1.MCPGCluster(cName, {
+            metadata: { name: cName, labels: args.labels },
+            spec: spec,
+        }, { parent: this, dependsOn: secretDeps });
+        this.name = pulumi.output(cName);
+        this.registerOutputs({ name: this.name });
+    }
+}
+exports.Cluster = Cluster;

package/bin/config.d.ts

@@ -0,0 +1,30 @@
+export interface GatewayConfigInput {
+    /**
+     * Gateway server/listener config. Emitted at config.gateway.server (the
+     * `gateway:` AppConfig umbrella holds server/admin/control_plane), NOT a
+     * top-level `server` key — that trips AppConfig's deny_unknown_fields.
+     */
+    server?: any;
+    /**
+     * config.governance section (access / policy / approvals / audit). Audit
+     * sinks are a LIST, not a scalar:
+     * { audit: { sinks: [{ kind: "dev.mcpg.builtin.audit.local-file" }] } }.
+     * `dev.mcpg.builtin.audit.local-file` is the canonical built-in audit sink.
+     */
+    governance?: any;
+    /** config.observability section. */
+    observability?: any;
+    /** config.mcp section (capabilities, etc.). */
+    mcp?: any;
+    /**
+     * Ordered config.plugins list (AppConfig PluginEntryConfig). Each entry:
+     * { id, source: { path | oci }, class?, kind?, config?, enforce?, disabled? }.
+     * The toggle is `disabled` (bool, default false) — there is no `enabled`.
+     * A `source` declaring exactly one of path/oci is required.
+     */
+    plugins?: any[];
+    /** Arbitrary AppConfig fragment merged LAST into spec.config (wins). */
+    extraConfig?: Record<string, any>;
+}
+/** Assemble spec.config from typed sections + extraConfig (extraConfig wins). */
+export declare function buildConfig(input: GatewayConfigInput): Record<string, any>;

package/bin/config.js

@@ -0,0 +1,22 @@
+"use strict";
+// The gateway config builder: assemble spec.config (the preserve-unknown
+// AppConfig) from typed convenience sections plus an `extraConfig` escape hatch
+// deep-merged LAST so it wins. Mirrors the Terraform module's config builder.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildConfig = buildConfig;
+/** Assemble spec.config from typed sections + extraConfig (extraConfig wins). */
+function buildConfig(input) {
+    const cfg = {};
+    // `server` lives under the `gateway:` umbrella, not at the top level.
+    if (input.server)
+        cfg.gateway = { server: input.server };
+    if (input.governance)
+        cfg.governance = input.governance;
+    if (input.observability)
+        cfg.observability = input.observability;
+    if (input.mcp)
+        cfg.mcp = input.mcp;
+    if (input.plugins && input.plugins.length > 0)
+        cfg.plugins = input.plugins;
+    return { ...cfg, ...(input.extraConfig ?? {}) };
+}

package/bin/config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/bin/config.test.js

@@ -0,0 +1,36 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Unit tests for the config builder. Uses node's built-in test runner +
+// assert (no extra deps). Run: `tsc && node --test bin/config.test.js`.
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const config_1 = require("./config");
+(0, node_test_1.test)("typed sections are included; absent ones omitted", () => {
+    const c = (0, config_1.buildConfig)({ governance: { audit: { sinks: [{ kind: "dev.mcpg.builtin.audit.local-file" }] } } });
+    strict_1.default.equal(c.governance.audit.sinks[0].kind, "dev.mcpg.builtin.audit.local-file");
+    strict_1.default.equal("gateway" in c, false);
+    strict_1.default.equal("observability" in c, false);
+});
+(0, node_test_1.test)("server nests under config.gateway.server (not a top-level server key)", () => {
+    const c = (0, config_1.buildConfig)({ server: { listen_addr: "0.0.0.0:8080" } });
+    strict_1.default.equal("server" in c, false);
+    strict_1.default.deepEqual(c.gateway.server, { listen_addr: "0.0.0.0:8080" });
+});
+(0, node_test_1.test)("plugins included only when non-empty", () => {
+    strict_1.default.equal("plugins" in (0, config_1.buildConfig)({ plugins: [] }), false);
+    strict_1.default.deepEqual((0, config_1.buildConfig)({ plugins: [{ id: "db.read" }] }).plugins, [{ id: "db.read" }]);
+});
+(0, node_test_1.test)("extraConfig is merged LAST and wins", () => {
+    const c = (0, config_1.buildConfig)({
+        governance: { a: 1 },
+        extraConfig: { governance: { b: 2 }, extra: true },
+    });
+    strict_1.default.deepEqual(c.governance, { b: 2 }); // extraConfig wins
+    strict_1.default.equal(c.extra, true);
+});
+(0, node_test_1.test)("empty input yields empty config", () => {
+    strict_1.default.deepEqual((0, config_1.buildConfig)({}), {});
+});

package/bin/gateway.d.ts

@@ -0,0 +1,52 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+import { GatewayConfigInput } from "./config";
+export interface GatewayArgs extends GatewayConfigInput {
+    namespace: pulumi.Input<string>;
+    /** Gateway image (CRD spec.image — e.g. { repository, tag }). Required. */
+    image: any;
+    replicas?: number;
+    pluginSetRef?: pulumi.Input<string>;
+    revocationListRef?: pulumi.Input<string>;
+    /** MCPGCluster coordination backend (spec.clusterRef.name) for HA gateways. */
+    clusterRef?: pulumi.Input<string>;
+    /** Soft-tenancy: namespaces whose MCPGRoutes this gateway accepts. */
+    acceptedRouteNamespaces?: string[];
+    podAnnotations?: {
+        [key: string]: string;
+    };
+    podLabels?: {
+        [key: string]: string;
+    };
+    resources?: any;
+    service?: any;
+    ingress?: any;
+    autoscaling?: any;
+    monitoring?: any;
+    networkPolicy?: any;
+    podDisruptionBudget?: any;
+    workloadIdentity?: any;
+    scheduling?: any;
+    probes?: any;
+    imagePullSecrets?: any;
+    /** Arbitrary spec-level fields merged LAST (for spec keys not yet typed). */
+    extraSpec?: {
+        [key: string]: any;
+    };
+    labels?: {
+        [key: string]: string;
+    };
+    /** Default true → annotate `pulumi.com/waitFor: condition=Ready`. */
+    waitForReady?: boolean;
+    /** MCPGGateway metadata.name (defaults to the component name). */
+    resourceName?: string;
+}
+/**
+ * An MCPGGateway built from typed inputs + the config builder. Readiness is the
+ * provider's built-in await via the `pulumi.com/waitFor` annotation.
+ */
+export declare class Gateway extends pulumi.ComponentResource {
+    readonly gateway: mcpg.v1alpha1.MCPGGateway;
+    readonly name: pulumi.Output<string>;
+    constructor(name: string, args: GatewayArgs, opts?: pulumi.ComponentResourceOptions);
+}

package/bin/gateway.js

@@ -0,0 +1,90 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Gateway = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const pulumi_crds_1 = require("@mcpg-dev/pulumi-crds");
+const config_1 = require("./config");
+/**
+ * An MCPGGateway built from typed inputs + the config builder. Readiness is the
+ * provider's built-in await via the `pulumi.com/waitFor` annotation.
+ */
+class Gateway extends pulumi.ComponentResource {
+    constructor(name, args, opts) {
+        super("mcpg:index:Gateway", name, {}, opts);
+        const gwName = args.resourceName ?? name;
+        const spec = {
+            image: args.image,
+            config: (0, config_1.buildConfig)(args),
+        };
+        if (args.replicas !== undefined)
+            spec.replicas = args.replicas;
+        if (args.pluginSetRef)
+            spec.pluginSetRef = { name: args.pluginSetRef };
+        if (args.revocationListRef)
+            spec.revocationListRef = { name: args.revocationListRef };
+        if (args.clusterRef)
+            spec.clusterRef = { name: args.clusterRef };
+        // Typed passthrough blocks (same spec surface as the TF gateway module).
+        const optional = {
+            acceptedRouteNamespaces: args.acceptedRouteNamespaces,
+            podAnnotations: args.podAnnotations,
+            podLabels: args.podLabels,
+            resources: args.resources,
+            service: args.service,
+            ingress: args.ingress,
+            autoscaling: args.autoscaling,
+            monitoring: args.monitoring,
+            networkPolicy: args.networkPolicy,
+            podDisruptionBudget: args.podDisruptionBudget,
+            workloadIdentity: args.workloadIdentity,
+            scheduling: args.scheduling,
+            probes: args.probes,
+            imagePullSecrets: args.imagePullSecrets,
+        };
+        for (const [k, v] of Object.entries(optional))
+            if (v !== undefined)
+                spec[k] = v;
+        Object.assign(spec, args.extraSpec ?? {}); // escape hatch wins (matches TF extra_spec)
+        const annotations = args.waitForReady === false ? {} : { "pulumi.com/waitFor": "condition=Ready" };
+        this.gateway = new pulumi_crds_1.mcpg.v1alpha1.MCPGGateway(gwName, {
+            metadata: { name: gwName, namespace: args.namespace, labels: args.labels, annotations },
+            spec: spec,
+        }, { parent: this });
+        this.name = pulumi.output(gwName);
+        this.registerOutputs({ name: this.name });
+    }
+}
+exports.Gateway = Gateway;

package/bin/index.d.ts

@@ -0,0 +1,11 @@
+export * from "./config";
+export * from "./oci";
+export * from "./operator";
+export * from "./gateway";
+export * from "./pluginSet";
+export * from "./trustBootstrap";
+export * from "./tenant";
+export * from "./cluster";
+export * from "./route";
+export * from "./tenantCr";
+export * from "./mcpgStack";

package/bin/index.js

@@ -0,0 +1,27 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./config"), exports);
+__exportStar(require("./oci"), exports);
+__exportStar(require("./operator"), exports);
+__exportStar(require("./gateway"), exports);
+__exportStar(require("./pluginSet"), exports);
+__exportStar(require("./trustBootstrap"), exports);
+__exportStar(require("./tenant"), exports);
+__exportStar(require("./cluster"), exports);
+__exportStar(require("./route"), exports);
+__exportStar(require("./tenantCr"), exports);
+__exportStar(require("./mcpgStack"), exports);

package/bin/mcpgStack.d.ts

@@ -0,0 +1,18 @@
+import * as pulumi from "@pulumi/pulumi";
+import { Operator, OperatorArgs } from "./operator";
+import { Gateway, GatewayArgs } from "./gateway";
+export interface McpgStackArgs {
+    operator: OperatorArgs;
+    /** Optional single gateway for the common case. */
+    gateway?: Omit<GatewayArgs, "namespace"> & {
+        namespace?: pulumi.Input<string>;
+    };
+    /** Seed the cluster-default revocation list (default true). */
+    trust?: boolean;
+}
+/** Convenience composition: operator + cluster trust + one gateway. */
+export declare class McpgStack extends pulumi.ComponentResource {
+    readonly operator: Operator;
+    readonly gateway?: Gateway;
+    constructor(name: string, args: McpgStackArgs, opts?: pulumi.ComponentResourceOptions);
+}