@r8s/core 0.1.0

package/dist/context.d.ts

@@ -0,0 +1,17 @@
+export interface Context<T> {
+    Provider: (props: {
+        value: T;
+        children?: unknown;
+    }) => unknown;
+    _defaultValue: T;
+    _contextId: symbol;
+}
+export declare function createContext<T>(defaultValue: T): Context<T>;
+export declare function getContextValue<T>(context: Context<T>): T;
+export declare function pushContextValue<T>(context: Context<T>, value: T): void;
+export declare function setContextValue<T>(contextId: symbol, value: T): void;
+export declare function hasContextValue(contextId: symbol): boolean;
+export declare function getContextValueById<T>(contextId: symbol): T | undefined;
+export declare function restoreContextValue(contextId: symbol, hadPrevious: boolean, previousValue: unknown): void;
+export declare function clearContextStack(): void;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,OAAO,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAA;IAC9D,aAAa,EAAE,CAAC,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAc5D;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAKzD;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAEvE;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAEpE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAEvE;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,OAAO,EACpB,aAAa,EAAE,OAAO,GACrB,IAAI,CAMN;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}

package/dist/context.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createContext = createContext;
+exports.getContextValue = getContextValue;
+exports.pushContextValue = pushContextValue;
+exports.setContextValue = setContextValue;
+exports.hasContextValue = hasContextValue;
+exports.getContextValueById = getContextValueById;
+exports.restoreContextValue = restoreContextValue;
+exports.clearContextStack = clearContextStack;
+// Context stack — shared across all context operations.
+// Uses a Symbol.for() key on globalThis so that createContext and useContext
+// reference the same Map even when @r8s/core and @r8s/core/defaults are
+// bundled as separate module instances by esbuild.
+const CONTEXT_STACK_KEY = Symbol.for('r8s.contextStack');
+const contextStack = (globalThis[CONTEXT_STACK_KEY] ??= new Map());
+function createContext(defaultValue) {
+    const contextId = Symbol('r8s.context');
+    return {
+        Provider: ({ value, children }) => {
+            return {
+                type: Symbol.for('r8s.context.provider'),
+                props: { contextId, value, children },
+                key: null,
+            };
+        },
+        _defaultValue: defaultValue,
+        _contextId: contextId,
+    };
+}
+function getContextValue(context) {
+    if (contextStack.has(context._contextId)) {
+        return contextStack.get(context._contextId);
+    }
+    return context._defaultValue;
+}
+function pushContextValue(context, value) {
+    contextStack.set(context._contextId, value);
+}
+function setContextValue(contextId, value) {
+    contextStack.set(contextId, value);
+}
+function hasContextValue(contextId) {
+    return contextStack.has(contextId);
+}
+function getContextValueById(contextId) {
+    return contextStack.get(contextId);
+}
+function restoreContextValue(contextId, hadPrevious, previousValue) {
+    if (hadPrevious) {
+        contextStack.set(contextId, previousValue);
+    }
+    else {
+        contextStack.delete(contextId);
+    }
+}
+function clearContextStack() {
+    contextStack.clear();
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":";;AAaA,sCAcC;AAED,0CAKC;AAED,4CAEC;AAED,0CAEC;AAED,0CAEC;AAED,kDAEC;AAED,kDAUC;AAED,8CAEC;AAlED,wDAAwD;AACxD,6EAA6E;AAC7E,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;AACxD,MAAM,YAAY,GAAyB,CAAE,UAAkB,CAAC,iBAAiB,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAA;AAQjG,SAAgB,aAAa,CAAI,YAAe;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;IAEvC,OAAO;QACL,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAoC,EAAE,EAAE;YAClE,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBACxC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE;gBACrC,GAAG,EAAE,IAAI;aACV,CAAA;QACH,CAAC;QACD,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,SAAS;KACtB,CAAA;AACH,CAAC;AAED,SAAgB,eAAe,CAAI,OAAmB;IACpD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,OAAO,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAM,CAAA;IAClD,CAAC;IACD,OAAO,OAAO,CAAC,aAAa,CAAA;AAC9B,CAAC;AAED,SAAgB,gBAAgB,CAAI,OAAmB,EAAE,KAAQ;IAC/D,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;AAC7C,CAAC;AAED,SAAgB,eAAe,CAAI,SAAiB,EAAE,KAAQ;IAC5D,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AACpC,CAAC;AAED,SAAgB,eAAe,CAAC,SAAiB;IAC/C,OAAO,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AACpC,CAAC;AAED,SAAgB,mBAAmB,CAAI,SAAiB;IACtD,OAAO,YAAY,CAAC,GAAG,CAAC,SAAS,CAAkB,CAAA;AACrD,CAAC;AAED,SAAgB,mBAAmB,CACjC,SAAiB,EACjB,WAAoB,EACpB,aAAsB;IAEtB,IAAI,WAAW,EAAE,CAAC;QAChB,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAC5C,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED,SAAgB,iBAAiB;IAC/B,YAAY,CAAC,KAAK,EAAE,CAAA;AACtB,CAAC"}

package/dist/defaults.d.ts

@@ -0,0 +1,205 @@
+import type { Operator } from '@r8s/k8s-types';
+/** Database connection info passed via context */
+export interface DatabaseConnection {
+    host: string;
+    port: number;
+    database: string;
+    username: string;
+    passwordSecret: {
+        name: string;
+        key: string;
+    };
+    /** Key for the password within the secret (defaults to 'password') */
+    passwordKey?: string;
+    vendor?: string;
+}
+/** Secret provider configuration */
+export interface SecretProvider {
+    backend: 'vault' | 'openbao' | 'sealed-secrets' | 'manual-secrets';
+    mount?: string;
+    path?: string;
+    authRef?: string;
+}
+/**
+ * Default contexts for shared infrastructure properties.
+ *
+ * These contexts allow properties to be inherited down the component tree,
+ * eliminating the need to pass the same values to every component.
+ *
+ * @example
+ * ```tsx
+ * import { Namespace, Labels } from '@r8s/core/defaults';
+ *
+ * export default function App() {
+ *   return (
+ *     <Namespace.Provider value="production">
+ *       <Labels.Provider value={{ app: 'myapp', team: 'platform' }}>
+ *         <Database name="app-db" />
+ *         <WebService name="api" image="myapp/api:v1" />
+ *       </Labels.Provider>
+ *     </Namespace.Provider>
+ *   );
+ * }
+ * ```
+ */
+/** Inherits namespace to all child resources */
+export declare const Namespace: import("./context").Context<string>;
+/** Inherits labels to all child resources */
+export declare const Labels: import("./context").Context<Record<string, string>>;
+/** Inherits annotations to all child resources */
+export declare const Annotations: import("./context").Context<Record<string, string>>;
+/** Inherits environment variables to all child containers */
+export declare const Environment: import("./context").Context<{
+    name: string;
+    value: string;
+}[]>;
+/** Inherits resource requests/limits to all child containers */
+export declare const Resources: import("./context").Context<{
+    requests?: Record<string, string>;
+    limits?: Record<string, string>;
+}>;
+/** Inherits service account name to all child pods */
+export declare const ServiceAccount: import("./context").Context<string>;
+/** Inherits image registry prefix (e.g., 'ghcr.io/myorg') */
+export declare const ImageRegistry: import("./context").Context<string>;
+/** Inherits domain suffix for ingresses */
+export declare const Domain: import("./context").Context<string>;
+/** Inherits TLS configuration */
+export declare const TLS: import("./context").Context<{
+    enabled: boolean;
+    issuer?: string;
+    secretName?: string;
+}>;
+/**
+ * Cluster context for shared PostgreSQL clusters.
+ *
+ * When multiple databases should share the same CNPG cluster,
+ * wrap them in a Cluster component. Each Database reads this
+ * context and reuses the shared cluster's connection info instead
+ * of creating a dedicated cluster.
+ *
+ * @example
+ * ```tsx
+ * import { Cluster } from '@r8s/recipes';
+ *
+ * <Cluster name="main" storage="100Gi">
+ *   <Database name="user-db" />
+ *   <Database name="order-db" />
+ * </Cluster>
+ * ```
+ */
+export interface ClusterConfig {
+    name: string;
+    namespace: string;
+    storage: string;
+    host: string;
+    secretName: string;
+    /**
+     * Reference to the Kubernetes Secret holding the shared cluster's password.
+     * Optional because the `Cluster` component itself does not create a Secret —
+     * CNPG provisions secrets automatically with its own naming. Consumers that
+     * need an explicit reference should set this when they know the secret name
+     * (e.g. when a `<Database />` child creates its own credentials secret).
+     */
+    passwordSecret?: {
+        name: string;
+        key: string;
+    };
+}
+export declare const ClusterContext: import("./context").Context<ClusterConfig | null>;
+/**
+ * Database connection context for component composition.
+ *
+ * When a Database component renders, it sets this context so that
+ * downstream components can automatically wire up their connections.
+ *
+ * @example
+ * ```tsx
+ * import { DatabaseContext } from '@r8s/core/defaults';
+ *
+ * export default function Platform() {
+ *   return (
+ *     <Database name="keycloak-db" storage="10Gi">
+ *       <KeycloakInstance name="keycloak" hostname="auth.example.com" />
+ *     </Database>
+ *   );
+ * }
+ * ```
+ */
+export declare const DatabaseContext: import("./context").Context<DatabaseConnection | null>;
+/**
+ * Secret provider context for pluggable secret management.
+ *
+ * Components read this to determine how credentials should be stored:
+ * - Vault: Creates VaultStaticSecret + VaultAuth (VSO)
+ * - OpenBao: Creates OpenBaoStaticSecret + OpenBaoAuth
+ * - Kubernetes: Plain Kubernetes Secret
+ *
+ * @example
+ * ```tsx
+ * import { SecretContext } from '@r8s/core/defaults';
+ *
+ * // Use Vault for all secrets in this subtree
+ * <SecretContext.Provider value={{ backend: 'vault', mount: 'secret', path: 'app/db', authRef: 'vault-auth' }}>
+ *   <Database name="app-db" storage="10Gi" />
+ *   <KeycloakInstance name="keycloak" hostname="auth.example.com" />
+ * </SecretContext.Provider>
+ * ```
+ */
+export declare const SecretContext: import("./context").Context<SecretProvider | null>;
+/**
+ * Operator context for declaring Kubernetes operator dependencies.
+ *
+ * Components that require operators (CNPG, cert-manager, etc.) can either:
+ * 1. Read operators from this context (shared operators)
+ * 2. Create their own operator instances and return them as resources
+ *
+ * The renderer collects all operators so the deployment pipeline can
+ * install them before applying application resources.
+ *
+ * @example
+ * ```tsx
+ * import { OperatorContext } from '@r8s/core/defaults';
+ * import { cnpgOperator } from '@r8s/recipes';
+ * import { certManagerOperator } from '@r8s/cert-manager';
+ *
+ * // Shared operators for entire stack
+ * <OperatorContext.Provider value={[
+ *   cnpgOperator('1.22.5'),
+ *   certManagerOperator('1.14.0'),
+ * ]}>
+ *   <Database name="app-db" storage="10Gi" />
+ *   <App name="myapp" host="myapp.example.com" tls={{ secretName: "myapp-tls", clusterIssuer: "letsencrypt" }} />
+ * </OperatorContext.Provider>
+ * ```
+ */
+export declare const OperatorContext: import("./context").Context<Operator[]>;
+/**
+ * Routing context for cluster-wide routing implementation.
+ *
+ * Set this once at the top of the tree to tell <Endpoint /> and <App />
+ * whether the cluster uses nginx Ingress or Envoy Gateway (Gateway API).
+ * Components read this and render the appropriate resources.
+ *
+ * @example
+ * ```tsx
+ * import { RoutingContext } from '@r8s/core/defaults';
+ *
+ * // Envoy Gateway cluster
+ * <RoutingContext.Provider value={{ mode: 'gateway', gatewayClassName: 'eg' }}>
+ *   <App name="myapp" host="myapp.example.com" />
+ * </RoutingContext.Provider>
+ *
+ * // nginx Ingress cluster (default, no provider needed)
+ * <App name="myapp" host="myapp.example.com" />
+ * ```
+ */
+export interface RoutingConfig {
+    /** Routing implementation: 'ingress' (nginx) or 'gateway' (Envoy Gateway API) */
+    mode: 'ingress' | 'gateway';
+    /** Gateway class name (only used when mode='gateway', default: 'eg') */
+    gatewayClassName?: string;
+}
+export declare const RoutingContext: import("./context").Context<RoutingConfig>;
+export { createContext } from './context';
+//# sourceMappingURL=defaults.d.ts.map

package/dist/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AAChD,eAAO,MAAM,SAAS,qCAAmC,CAAA;AAEzD,6CAA6C;AAC7C,eAAO,MAAM,MAAM,qDAA4C,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,WAAW,qDAA4C,CAAA;AAEpE,6DAA6D;AAC7D,eAAO,MAAM,WAAW;UAA+B,MAAM;WAAS,MAAM;IAAQ,CAAA;AAEpF,gEAAgE;AAChE,eAAO,MAAM,SAAS;eACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;aACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;EAC3B,CAAA;AAEN,sDAAsD;AACtD,eAAO,MAAM,cAAc,qCAAmC,CAAA;AAE9D,6DAA6D;AAC7D,eAAO,MAAM,aAAa,qCAA4B,CAAA;AAEtD,2CAA2C;AAC3C,eAAO,MAAM,MAAM,qCAA4B,CAAA;AAE/C,iCAAiC;AACjC,eAAO,MAAM,GAAG;aACL,OAAO;aACP,MAAM;iBACF,MAAM;EACC,CAAA;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/C;AAED,eAAO,MAAM,cAAc,mDAA4C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,eAAe,wDAAiD,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,oDAA6C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,eAAe,yCAAgC,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,IAAI,EAAE,SAAS,GAAG,SAAS,CAAA;IAC3B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,eAAO,MAAM,cAAc,4CAAoD,CAAA;AAG/E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA"}

package/dist/defaults.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createContext = exports.RoutingContext = exports.OperatorContext = exports.SecretContext = exports.DatabaseContext = exports.ClusterContext = exports.TLS = exports.Domain = exports.ImageRegistry = exports.ServiceAccount = exports.Resources = exports.Environment = exports.Annotations = exports.Labels = exports.Namespace = void 0;
+const context_1 = require("./context");
+/**
+ * Default contexts for shared infrastructure properties.
+ *
+ * These contexts allow properties to be inherited down the component tree,
+ * eliminating the need to pass the same values to every component.
+ *
+ * @example
+ * ```tsx
+ * import { Namespace, Labels } from '@r8s/core/defaults';
+ *
+ * export default function App() {
+ *   return (
+ *     <Namespace.Provider value="production">
+ *       <Labels.Provider value={{ app: 'myapp', team: 'platform' }}>
+ *         <Database name="app-db" />
+ *         <WebService name="api" image="myapp/api:v1" />
+ *       </Labels.Provider>
+ *     </Namespace.Provider>
+ *   );
+ * }
+ * ```
+ */
+/** Inherits namespace to all child resources */
+exports.Namespace = (0, context_1.createContext)('default');
+/** Inherits labels to all child resources */
+exports.Labels = (0, context_1.createContext)({});
+/** Inherits annotations to all child resources */
+exports.Annotations = (0, context_1.createContext)({});
+/** Inherits environment variables to all child containers */
+exports.Environment = (0, context_1.createContext)([]);
+/** Inherits resource requests/limits to all child containers */
+exports.Resources = (0, context_1.createContext)({});
+/** Inherits service account name to all child pods */
+exports.ServiceAccount = (0, context_1.createContext)('default');
+/** Inherits image registry prefix (e.g., 'ghcr.io/myorg') */
+exports.ImageRegistry = (0, context_1.createContext)('');
+/** Inherits domain suffix for ingresses */
+exports.Domain = (0, context_1.createContext)('');
+/** Inherits TLS configuration */
+exports.TLS = (0, context_1.createContext)({ enabled: false });
+exports.ClusterContext = (0, context_1.createContext)(null);
+/**
+ * Database connection context for component composition.
+ *
+ * When a Database component renders, it sets this context so that
+ * downstream components can automatically wire up their connections.
+ *
+ * @example
+ * ```tsx
+ * import { DatabaseContext } from '@r8s/core/defaults';
+ *
+ * export default function Platform() {
+ *   return (
+ *     <Database name="keycloak-db" storage="10Gi">
+ *       <KeycloakInstance name="keycloak" hostname="auth.example.com" />
+ *     </Database>
+ *   );
+ * }
+ * ```
+ */
+exports.DatabaseContext = (0, context_1.createContext)(null);
+/**
+ * Secret provider context for pluggable secret management.
+ *
+ * Components read this to determine how credentials should be stored:
+ * - Vault: Creates VaultStaticSecret + VaultAuth (VSO)
+ * - OpenBao: Creates OpenBaoStaticSecret + OpenBaoAuth
+ * - Kubernetes: Plain Kubernetes Secret
+ *
+ * @example
+ * ```tsx
+ * import { SecretContext } from '@r8s/core/defaults';
+ *
+ * // Use Vault for all secrets in this subtree
+ * <SecretContext.Provider value={{ backend: 'vault', mount: 'secret', path: 'app/db', authRef: 'vault-auth' }}>
+ *   <Database name="app-db" storage="10Gi" />
+ *   <KeycloakInstance name="keycloak" hostname="auth.example.com" />
+ * </SecretContext.Provider>
+ * ```
+ */
+exports.SecretContext = (0, context_1.createContext)(null);
+/**
+ * Operator context for declaring Kubernetes operator dependencies.
+ *
+ * Components that require operators (CNPG, cert-manager, etc.) can either:
+ * 1. Read operators from this context (shared operators)
+ * 2. Create their own operator instances and return them as resources
+ *
+ * The renderer collects all operators so the deployment pipeline can
+ * install them before applying application resources.
+ *
+ * @example
+ * ```tsx
+ * import { OperatorContext } from '@r8s/core/defaults';
+ * import { cnpgOperator } from '@r8s/recipes';
+ * import { certManagerOperator } from '@r8s/cert-manager';
+ *
+ * // Shared operators for entire stack
+ * <OperatorContext.Provider value={[
+ *   cnpgOperator('1.22.5'),
+ *   certManagerOperator('1.14.0'),
+ * ]}>
+ *   <Database name="app-db" storage="10Gi" />
+ *   <App name="myapp" host="myapp.example.com" tls={{ secretName: "myapp-tls", clusterIssuer: "letsencrypt" }} />
+ * </OperatorContext.Provider>
+ * ```
+ */
+exports.OperatorContext = (0, context_1.createContext)([]);
+exports.RoutingContext = (0, context_1.createContext)({ mode: 'ingress' });
+// Re-export createContext for provider components in recipes
+var context_2 = require("./context");
+Object.defineProperty(exports, "createContext", { enumerable: true, get: function () { return context_2.createContext; } });
+//# sourceMappingURL=defaults.js.map

package/dist/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":";;;AAAA,uCAAyC;AAuBzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AACnC,QAAA,SAAS,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAEzD,6CAA6C;AAChC,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAE/D,kDAAkD;AACrC,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAEpE,6DAA6D;AAChD,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyC,EAAE,CAAC,CAAA;AAEpF,gEAAgE;AACnD,QAAA,SAAS,GAAG,IAAA,uBAAa,EAGnC,EAAE,CAAC,CAAA;AAEN,sDAAsD;AACzC,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAE9D,6DAA6D;AAChD,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAEtD,2CAA2C;AAC9B,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAE/C,iCAAiC;AACpB,QAAA,GAAG,GAAG,IAAA,uBAAa,EAI7B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AAoCT,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAuB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAA4B,IAAI,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAwB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAAa,EAAE,CAAC,CAAA;AA6B/C,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;AAE/E,6DAA6D;AAC7D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA"}

package/dist/fetch-operators.d.ts

@@ -0,0 +1,7 @@
+import type { Operator } from '@r8s/k8s-types';
+/**
+ * Fetch operator manifests from their source URLs.
+ * Returns YAML strings that can be prepended to rendered output.
+ */
+export declare function fetchOperatorManifests(operators: Operator[]): Promise<string[]>;
+//# sourceMappingURL=fetch-operators.d.ts.map

package/dist/fetch-operators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-operators.d.ts","sourceRoot":"","sources":["../src/fetch-operators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAwBrF"}

package/dist/fetch-operators.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchOperatorManifests = fetchOperatorManifests;
+/**
+ * Fetch operator manifests from their source URLs.
+ * Returns YAML strings that can be prepended to rendered output.
+ */
+async function fetchOperatorManifests(operators) {
+    const manifests = [];
+    for (const op of operators) {
+        if (op.source.type !== 'manifest' || !op.source.url) {
+            // Skip non-manifest operators (helm, olm, flux) — they need external tooling
+            continue;
+        }
+        try {
+            const response = await fetch(op.source.url);
+            if (!response.ok) {
+                throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+            }
+            const yaml = await response.text();
+            manifests.push(`# Operator: ${op.name} v${op.version}\n${yaml}`);
+        }
+        catch (error) {
+            throw new Error(`Failed to fetch operator manifest for ${op.name}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return manifests;
+}
+//# sourceMappingURL=fetch-operators.js.map

package/dist/fetch-operators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-operators.js","sourceRoot":"","sources":["../src/fetch-operators.ts"],"names":[],"mappings":";;AAMA,wDAwBC;AA5BD;;;GAGG;AACI,KAAK,UAAU,sBAAsB,CAAC,SAAqB;IAChE,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACpD,6EAA6E;YAC7E,SAAQ;QACV,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;YACpE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YAClC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,EAAE,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9G,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/guardrails.d.ts

@@ -0,0 +1,34 @@
+import { KubernetesResource } from '@r8s/k8s-types';
+import { ValidationError } from './validate';
+export interface GuardrailRule {
+    /** Unique rule identifier */
+    id: string;
+    /** Human-readable description */
+    description: string;
+    /** Severity level */
+    severity: 'error' | 'warning' | 'info';
+    /** Test function - returns empty array if rule passes, ValidationError[] if it fails */
+    test: (resources: KubernetesResource[]) => ValidationError[];
+}
+/** Check that all namespaces have NetworkPolicies */
+export declare const requireNetworkPolicies: GuardrailRule;
+/** Check that all Deployments have resource limits */
+export declare const requireResourceLimits: GuardrailRule;
+/** Check that all resources have required labels */
+export declare const requireLabels: (requiredLabels: string[]) => GuardrailRule;
+/** Check that no secrets contain plaintext passwords */
+export declare const noPlaintextSecrets: GuardrailRule;
+/** Check that Ingresses have TLS configured */
+export declare const requireTLS: GuardrailRule;
+/** Check that Pods don't run as root */
+export declare const noRootContainers: GuardrailRule;
+/** Default set of guardrails for production use */
+export declare const defaultGuardrails: GuardrailRule[];
+/** Run all guardrail rules against a set of resources */
+export declare function runGuardrails(resources: KubernetesResource[], rules?: GuardrailRule[]): {
+    passed: boolean;
+    errors: ValidationError[];
+    warnings: ValidationError[];
+    info: ValidationError[];
+};
+//# sourceMappingURL=guardrails.d.ts.map

package/dist/guardrails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACtC,wFAAwF;IACxF,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,CAAA;CAC7D;AAED,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,EAAE,aAgCpC,CAAA;AAED,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,EAAE,aAwCnC,CAAA;AAED,oDAAoD;AACpD,eAAO,MAAM,aAAa,GAAI,gBAAgB,MAAM,EAAE,KAAG,aAwBvD,CAAA;AAEF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,EAAE,aA8BhC,CAAA;AAED,+CAA+C;AAC/C,eAAO,MAAM,UAAU,EAAE,aAyBxB,CAAA;AAED,wCAAwC;AACxC,eAAO,MAAM,gBAAgB,EAAE,aA4C9B,CAAA;AAED,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,EAAE,aAAa,EAM5C,CAAA;AAED,yDAAyD;AACzD,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,EAAE,EAC/B,KAAK,GAAE,aAAa,EAAsB,GACzC;IACD,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,IAAI,EAAE,eAAe,EAAE,CAAA;CACxB,CAwBA"}