@mcpg-dev/pulumi 0.1.0-beta.11

package/bin/mcpgStack.js

@@ -0,0 +1,58 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpgStack = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const operator_1 = require("./operator");
+const gateway_1 = require("./gateway");
+const trustBootstrap_1 = require("./trustBootstrap");
+/** Convenience composition: operator + cluster trust + one gateway. */
+class McpgStack extends pulumi.ComponentResource {
+    constructor(name, args, opts) {
+        super("mcpg:index:McpgStack", name, {}, opts);
+        this.operator = new operator_1.Operator(`${name}-operator`, args.operator, { parent: this });
+        if (args.trust !== false) {
+            new trustBootstrap_1.TrustBootstrap(`${name}-trust`, {}, { parent: this, dependsOn: this.operator });
+        }
+        if (args.gateway) {
+            this.gateway = new gateway_1.Gateway(`${name}-gateway`, {
+                ...args.gateway,
+                namespace: args.gateway.namespace ?? this.operator.namespace,
+            }, { parent: this, dependsOn: this.operator });
+        }
+        this.registerOutputs({});
+    }
+}
+exports.McpgStack = McpgStack;

package/bin/oci.d.ts

@@ -0,0 +1,8 @@
+/** The resolved `<host>/<namespace>[/<path>]` base. */
+export declare function ociBase(env?: NodeJS.ProcessEnv): string;
+/** Helm OCI repository the charts publish to (`repositoryOpts.repo`). */
+export declare function ociChartRepo(env?: NodeJS.ProcessEnv): string;
+/** Container image repository for a project's `release.docker.imageName`. */
+export declare function ociImageRepo(imageName: string, env?: NodeJS.ProcessEnv): string;
+/** Registry a bare `oci:` plugin reference resolves against. */
+export declare function ociPluginRegistry(env?: NodeJS.ProcessEnv): string;

package/bin/oci.js

@@ -0,0 +1,41 @@
+"use strict";
+// Registry coordinates every MCPG artefact hangs off. The defaults mirror the
+// `internal` channel of tools/release/oci-registry.json — the manifest the
+// publish steps read — and tools/ci/selftest-oci-registry.sh asserts the two
+// still agree.
+//
+// A Pulumi program overrides per component (`chartRepo`, an explicit image
+// repository) or, for a whole stack, through the same environment contract the
+// shell and Node publish helpers honour:
+//
+//   MCPG_OCI_HOST       registry host       (default: ghcr.io)
+//   MCPG_OCI_NAMESPACE  org / user segment  (default: mcpg-dev)
+//   MCPG_OCI_PATH       repository path segment (default: source-code)
+//
+// MCPG_OCI_PATH set-but-empty means "no path segment" — the shape the public
+// channel takes — so it is read by presence, not by truthiness.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ociBase = ociBase;
+exports.ociChartRepo = ociChartRepo;
+exports.ociImageRepo = ociImageRepo;
+exports.ociPluginRegistry = ociPluginRegistry;
+const trim = (s) => s.replace(/^\/+|\/+$/g, "");
+/** The resolved `<host>/<namespace>[/<path>]` base. */
+function ociBase(env = process.env) {
+    const host = trim(env.MCPG_OCI_HOST ?? "ghcr.io");
+    const namespace = trim(env.MCPG_OCI_NAMESPACE ?? "mcpg-dev");
+    const path = trim("MCPG_OCI_PATH" in env ? (env.MCPG_OCI_PATH ?? "") : "source-code");
+    return [host, namespace, path].filter(Boolean).join("/");
+}
+/** Helm OCI repository the charts publish to (`repositoryOpts.repo`). */
+function ociChartRepo(env = process.env) {
+    return `oci://${ociBase(env)}/charts`;
+}
+/** Container image repository for a project's `release.docker.imageName`. */
+function ociImageRepo(imageName, env = process.env) {
+    return `${ociBase(env)}/${trim(imageName)}`;
+}
+/** Registry a bare `oci:` plugin reference resolves against. */
+function ociPluginRegistry(env = process.env) {
+    return `${ociBase(env)}/plugins`;
+}

package/bin/operator.d.ts

@@ -0,0 +1,28 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+export interface OperatorArgs {
+    namespace?: pulumi.Input<string>;
+    chartVersion: pulumi.Input<string>;
+    chartName?: pulumi.Input<string>;
+    /** Helm repository. Unset composes `oci://<ociBase()>/charts`. */
+    chartRepo?: pulumi.Input<string>;
+    /** Path to the split-by-kind CRD YAMLs (the generated schema snapshot). */
+    crdsDir?: string;
+    /** Restrict the operator to a single namespace (operator.watchNamespace → --watch-namespace). */
+    watchNamespace?: pulumi.Input<string>;
+    /** Extra chart values deep-merged last. */
+    values?: {
+        [key: string]: any;
+    };
+}
+/**
+ * Installs the MCPG operator via Helm with the CRDs managed as first-class
+ * resources (chart `crd.install=false`) so they upgrade independently — closing
+ * the Helm-doesn't-upgrade-CRDs hazard. Pulumi's K8s provider does SSA by
+ * default and awaits readiness.
+ */
+export declare class Operator extends pulumi.ComponentResource {
+    readonly namespace: pulumi.Output<string>;
+    readonly chart: k8s.helm.v4.Chart;
+    constructor(name: string, args: OperatorArgs, opts?: pulumi.ComponentResourceOptions);
+}

package/bin/operator.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Operator = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const oci_1 = require("./oci");
+/**
+ * Installs the MCPG operator via Helm with the CRDs managed as first-class
+ * resources (chart `crd.install=false`) so they upgrade independently — closing
+ * the Helm-doesn't-upgrade-CRDs hazard. Pulumi's K8s provider does SSA by
+ * default and awaits readiness.
+ */
+class Operator extends pulumi.ComponentResource {
+    constructor(name, args, opts) {
+        super("mcpg:index:Operator", name, {}, opts);
+        const ns = pulumi.output(args.namespace ?? "mcpg-system");
+        const crdsDir = args.crdsDir ?? "../../codegen/schemas/v1alpha1/crds";
+        const crds = new k8s.yaml.v2.ConfigGroup(`${name}-crds`, {
+            files: [`${crdsDir}/*.yaml`],
+        }, { parent: this });
+        this.chart = new k8s.helm.v4.Chart(name, {
+            chart: args.chartName ?? "mcpg-operator",
+            version: args.chartVersion,
+            namespace: ns,
+            repositoryOpts: {
+                repo: args.chartRepo ?? (0, oci_1.ociChartRepo)(),
+            },
+            // The chart ships CRDs under crds/ (Helm install-only, value-ungated);
+            // the ConfigGroup above owns them as first-class resources, so skip the
+            // chart's copy to avoid two Pulumi resources managing the same CRDs.
+            skipCrds: true,
+            // Secure default: the admission webhook fails closed, so it needs real
+            // TLS. cert-manager templates a self-signed Issuer + Certificate and
+            // injects the caBundle. Requires cert-manager in the cluster; override
+            // via values.certManager (e.g. { enabled: false } for BYO TLS Secret).
+            values: {
+                crd: { install: false },
+                certManager: { enabled: true },
+                ...(args.watchNamespace ? { operator: { watchNamespace: args.watchNamespace } } : {}),
+                ...(args.values ?? {}),
+            },
+        }, { parent: this, dependsOn: crds });
+        this.namespace = ns;
+        this.registerOutputs({ namespace: this.namespace });
+    }
+}
+exports.Operator = Operator;

package/bin/pluginSet.d.ts

@@ -0,0 +1,16 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+export interface PluginSetArgs {
+    namespace: pulumi.Input<string>;
+    entries: any[];
+    capabilityGrants?: any[];
+    labels?: {
+        [key: string]: string;
+    };
+    resourceName?: string;
+}
+export declare class PluginSet extends pulumi.ComponentResource {
+    readonly pluginSet: mcpg.v1alpha1.MCPGPluginSet;
+    readonly name: pulumi.Output<string>;
+    constructor(name: string, args: PluginSetArgs, opts?: pulumi.ComponentResourceOptions);
+}

package/bin/pluginSet.js

@@ -0,0 +1,55 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PluginSet = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const pulumi_crds_1 = require("@mcpg-dev/pulumi-crds");
+class PluginSet extends pulumi.ComponentResource {
+    constructor(name, args, opts) {
+        super("mcpg:index:PluginSet", name, {}, opts);
+        const psName = args.resourceName ?? name;
+        const spec = { entries: args.entries };
+        if (args.capabilityGrants && args.capabilityGrants.length > 0) {
+            spec.capabilityGrants = args.capabilityGrants;
+        }
+        this.pluginSet = new pulumi_crds_1.mcpg.v1alpha1.MCPGPluginSet(psName, {
+            metadata: { name: psName, namespace: args.namespace, labels: args.labels },
+            spec: spec,
+        }, { parent: this });
+        this.name = pulumi.output(psName);
+        this.registerOutputs({ name: this.name });
+    }
+}
+exports.PluginSet = PluginSet;

package/bin/route.d.ts

@@ -0,0 +1,35 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+export interface RouteArgs {
+    namespace: pulumi.Input<string>;
+    /** Shared gateway this route binds into: { name } (non-empty). */
+    gatewayRef: {
+        name: string;
+    };
+    /** Tool matcher: { tools: [{ id }] } — at least one unique, non-empty id. */
+    match: {
+        tools: {
+            id: string;
+        }[];
+    };
+    identityChain?: string[];
+    policyChain?: string[];
+    auditChain?: string[];
+    /** e.g. { tenant: "team-a" }. Omit only for a single-tenant gateway (else reachable by any caller). */
+    attributes?: {
+        [key: string]: any;
+    };
+    labels?: {
+        [key: string]: string;
+    };
+    resourceName?: string;
+}
+/**
+ * An MCPGRoute (namespaced): binds a tenant's tool subset into a SHARED gateway
+ * with identity/policy/audit chains — the soft-multi-tenancy primitive.
+ */
+export declare class Route extends pulumi.ComponentResource {
+    readonly route: mcpg.v1alpha1.MCPGRoute;
+    readonly name: pulumi.Output<string>;
+    constructor(name: string, args: RouteArgs, opts?: pulumi.ComponentResourceOptions);
+}

package/bin/route.js

@@ -0,0 +1,64 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Route = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const pulumi_crds_1 = require("@mcpg-dev/pulumi-crds");
+/**
+ * An MCPGRoute (namespaced): binds a tenant's tool subset into a SHARED gateway
+ * with identity/policy/audit chains — the soft-multi-tenancy primitive.
+ */
+class Route extends pulumi.ComponentResource {
+    constructor(name, args, opts) {
+        super("mcpg:index:Route", name, {}, opts);
+        const rName = args.resourceName ?? name;
+        const spec = { gatewayRef: args.gatewayRef, match: args.match };
+        if (args.identityChain && args.identityChain.length > 0)
+            spec.identityChain = args.identityChain;
+        if (args.policyChain && args.policyChain.length > 0)
+            spec.policyChain = args.policyChain;
+        if (args.auditChain && args.auditChain.length > 0)
+            spec.auditChain = args.auditChain;
+        if (args.attributes)
+            spec.attributes = args.attributes;
+        this.route = new pulumi_crds_1.mcpg.v1alpha1.MCPGRoute(rName, {
+            metadata: { name: rName, namespace: args.namespace, labels: args.labels },
+            spec: spec,
+        }, { parent: this });
+        this.name = pulumi.output(rName);
+        this.registerOutputs({ name: this.name });
+    }
+}
+exports.Route = Route;

package/bin/tenant.d.ts

@@ -0,0 +1,32 @@
+import * as pulumi from "@pulumi/pulumi";
+import { Gateway, GatewayArgs } from "./gateway";
+import { PluginSet } from "./pluginSet";
+export interface TenantArgs {
+    tenantName: string;
+    namespace?: string;
+    labels?: {
+        [key: string]: string;
+    };
+    /** Default true → default-deny cross-tenant ingress NetworkPolicy. */
+    networkPolicy?: boolean;
+    pluginSet?: {
+        entries: any[];
+        capabilityGrants?: any[];
+    };
+    gateway?: Omit<GatewayArgs, "namespace">;
+}
+/**
+ * One tenant as an imperative fan-out: namespace + NetworkPolicy isolation +
+ * (optional) plugin-set + gateway. Instantiate in a loop to fan out a fleet.
+ *
+ * NB: this does NOT create an MCPGTenant CR, so it does NOT engage the
+ * operator's tenant GOVERNANCE (plugin allowlist, ResourceQuota, replica caps,
+ * exclusive namespace ownership). For declarative governance use {@link TenantCR}
+ * (the MCPGTenant CR) — alongside or instead of this helper.
+ */
+export declare class Tenant extends pulumi.ComponentResource {
+    readonly namespace: pulumi.Output<string>;
+    readonly gateway?: Gateway;
+    readonly pluginSet?: PluginSet;
+    constructor(name: string, args: TenantArgs, opts?: pulumi.ComponentResourceOptions);
+}

package/bin/tenant.js

@@ -0,0 +1,95 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Tenant = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const gateway_1 = require("./gateway");
+const pluginSet_1 = require("./pluginSet");
+/**
+ * One tenant as an imperative fan-out: namespace + NetworkPolicy isolation +
+ * (optional) plugin-set + gateway. Instantiate in a loop to fan out a fleet.
+ *
+ * NB: this does NOT create an MCPGTenant CR, so it does NOT engage the
+ * operator's tenant GOVERNANCE (plugin allowlist, ResourceQuota, replica caps,
+ * exclusive namespace ownership). For declarative governance use {@link TenantCR}
+ * (the MCPGTenant CR) — alongside or instead of this helper.
+ */
+class Tenant extends pulumi.ComponentResource {
+    constructor(name, args, opts) {
+        super("mcpg:index:Tenant", name, {}, opts);
+        const nsName = args.namespace ?? args.tenantName;
+        const ns = new k8s.core.v1.Namespace(`${name}-ns`, {
+            metadata: {
+                name: nsName,
+                labels: {
+                    "app.kubernetes.io/managed-by": "pulumi-mcpg",
+                    "mcpg.dev/tenant": args.tenantName,
+                    ...(args.labels ?? {}),
+                },
+            },
+        }, { parent: this });
+        if (args.networkPolicy !== false) {
+            new k8s.networking.v1.NetworkPolicy(`${name}-isolation`, {
+                metadata: { name: "mcpg-tenant-isolation", namespace: nsName },
+                spec: {
+                    podSelector: {},
+                    policyTypes: ["Ingress"],
+                    ingress: [{ from: [{ namespaceSelector: { matchLabels: { "mcpg.dev/tenant": args.tenantName } } }] }],
+                },
+            }, { parent: this, dependsOn: ns });
+        }
+        const setName = `${args.tenantName}-set`;
+        if (args.pluginSet) {
+            this.pluginSet = new pluginSet_1.PluginSet(`${name}-set`, {
+                namespace: nsName,
+                entries: args.pluginSet.entries,
+                capabilityGrants: args.pluginSet.capabilityGrants,
+                resourceName: setName,
+            }, { parent: this, dependsOn: ns });
+        }
+        if (args.gateway) {
+            this.gateway = new gateway_1.Gateway(`${name}-gw`, {
+                ...args.gateway,
+                namespace: nsName,
+                pluginSetRef: args.pluginSet ? setName : args.gateway.pluginSetRef,
+                resourceName: args.gateway.resourceName ?? args.tenantName,
+            }, { parent: this, dependsOn: ns });
+        }
+        this.namespace = pulumi.output(nsName);
+        this.registerOutputs({ namespace: this.namespace });
+    }
+}
+exports.Tenant = Tenant;

package/bin/tenantCr.d.ts

@@ -0,0 +1,32 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+export interface TenantCRArgs {
+    /** Namespaces this tenant owns (non-empty, unique). */
+    namespaces: string[];
+    /** Plugin allowlist: [{ name? , registryPrefix? }] (each sets ≥1 matcher; [] = deny-all). */
+    allowedPlugins?: any[];
+    /** { maxGateways?, maxPluginSets?, maxRoutes?, maxReplicasPerGateway? } — each ≥ 0. */
+    quotas?: {
+        [key: string]: number;
+    };
+    /** { key, ... } — key non-empty when set. */
+    identityAttribute?: {
+        [key: string]: any;
+    };
+    labels?: {
+        [key: string]: string;
+    };
+    resourceName?: string;
+}
+/**
+ * An MCPGTenant (cluster-scoped): the DECLARATIVE tenant governance boundary
+ * — plugin allowlist, per-namespace ResourceQuota, replica caps, and
+ * exclusive namespace ownership. Distinct from the {@link Tenant} component,
+ * which is an imperative namespace+RBAC+NetworkPolicy fan-out that does NOT
+ * engage tenant governance.
+ */
+export declare class TenantCR extends pulumi.ComponentResource {
+    readonly tenant: mcpg.v1alpha1.MCPGTenant;
+    readonly name: pulumi.Output<string>;
+    constructor(name: string, args: TenantCRArgs, opts?: pulumi.ComponentResourceOptions);
+}

package/bin/tenantCr.js

@@ -0,0 +1,65 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantCR = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const pulumi_crds_1 = require("@mcpg-dev/pulumi-crds");
+/**
+ * An MCPGTenant (cluster-scoped): the DECLARATIVE tenant governance boundary
+ * — plugin allowlist, per-namespace ResourceQuota, replica caps, and
+ * exclusive namespace ownership. Distinct from the {@link Tenant} component,
+ * which is an imperative namespace+RBAC+NetworkPolicy fan-out that does NOT
+ * engage tenant governance.
+ */
+class TenantCR extends pulumi.ComponentResource {
+    constructor(name, args, opts) {
+        super("mcpg:index:TenantCR", name, {}, opts);
+        const tName = args.resourceName ?? name;
+        const spec = { namespaces: args.namespaces };
+        if (args.allowedPlugins && args.allowedPlugins.length > 0)
+            spec.allowedPlugins = args.allowedPlugins;
+        if (args.quotas)
+            spec.quotas = args.quotas;
+        if (args.identityAttribute)
+            spec.identityAttribute = args.identityAttribute;
+        this.tenant = new pulumi_crds_1.mcpg.v1alpha1.MCPGTenant(tName, {
+            metadata: { name: tName, labels: args.labels },
+            spec: spec,
+        }, { parent: this });
+        this.name = pulumi.output(tName);
+        this.registerOutputs({ name: this.name });
+    }
+}
+exports.TenantCR = TenantCR;

package/bin/trustBootstrap.d.ts

@@ -0,0 +1,21 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+export interface SecretRef {
+    name: string;
+    key: string;
+}
+export interface TrustBootstrapArgs {
+    revocationListName?: string;
+    revocations?: any[];
+    issuedAt?: string;
+    /** Signing-key Secret reference, passed through to plugin trust. Bytes are
+     * never read into state (the no-secret-in-state invariant). */
+    signingKeySecretRef?: SecretRef;
+}
+/** Seeds the cluster-default MCPGRevocationList and carries the signing-key ref. */
+export declare class TrustBootstrap extends pulumi.ComponentResource {
+    readonly revocationList: mcpg.v1alpha1.MCPGRevocationList;
+    readonly revocationListName: pulumi.Output<string>;
+    readonly signingKeySecretRef?: SecretRef;
+    constructor(name: string, args?: TrustBootstrapArgs, opts?: pulumi.ComponentResourceOptions);
+}