@r8s/recipes 0.1.0 → 0.2.1

package/dist/endpoint.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Endpoint = Endpoint;
 const core_1 = require("@r8s/core");
 const defaults_1 = require("@r8s/core/defaults");
+const defaults_2 = require("@r8s/core/defaults");
 const endpoint_provider_1 = require("./endpoint-provider");
 const operators_1 = require("./operators");
 const crds_1 = require("@r8s/crds");
@@ -37,18 +38,38 @@ const dns_provider_1 = require("./dns-provider");
  * )
  */
 function Endpoint(props) {
-    const { name, namespace = 'default', host, serviceName, servicePort = 80, tls, annotations = {}, dns, dnsTtl = 300, } = props;
-    const routing = (0, core_1.useContext)(defaults_1.RoutingContext);
+    const { name, namespace: namespaceProp, host, serviceName, servicePort = 80, path, pathType, tls, annotations = {}, dns, dnsTtl = 300, sharedGateway, } = props;
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const routing = (0, core_1.useContext)(defaults_2.RoutingContext);
     const endpointConfig = (0, core_1.useContext)(endpoint_provider_1.EndpointContext);
-    const sharedOperators = (0, core_1.useContext)(defaults_1.OperatorContext);
+    const sharedOperators = (0, core_1.useContext)(defaults_2.OperatorContext);
     const dnsConfig = (0, core_1.useContext)(dns_provider_1.DnsContext);
     // DNS defaults to true when DnsProvider is set, unless explicitly disabled
     const createDnsRecord = dns ?? dnsConfig !== null;
+    // Custom route provisioner hook: a RoutingConfig carrying route() owns the
+    // whole render for this endpoint (custom ingress controllers / L7 stacks)
+    if (routing.route) {
+        const el = routing.route({
+            name,
+            namespace,
+            host,
+            serviceName,
+            servicePort,
+            pathPrefix: path,
+            annotations,
+            tls,
+        });
+        return Array.isArray(el) ? (0, core_1.jsx)(core_1.Fragment, { children: el }) : el;
+    }
+    // Mode resolution: the Platform RoutingContext describes the cluster, but
+    // an explicit EndpointProvider with <EnvoyGateway /> opts this endpoint
+    // into Gateway API even without a Platform (or CLI route-level default)
+    const gatewayMode = routing.mode === 'gateway' || endpointConfig.provider === 'envoy-gateway';
     const resources = [];
-    if (routing.mode === 'gateway') {
-        const gatewayClassName = routing.gatewayClassName || 'eg';
+    if (gatewayMode) {
+        const gatewayClassName = endpointConfig.settings?.gatewayClassName ?? routing.gatewayClassName ?? 'eg';
         const secretName = tls?.secretName || `${name}-tls`;
-        const issuerName = tls?.clusterIssuer || 'letsencrypt-prod';
+        const issuerName = tls?.clusterIssuer ?? endpointConfig.settings?.tls?.clusterIssuer ?? 'letsencrypt-prod';
         const hasCertManager = sharedOperators.some((op) => op.name === 'cert-manager');
         const hasEnvoyGateway = sharedOperators.some((op) => op.name === 'envoy-gateway');
         if (tls && !hasCertManager) {
@@ -77,46 +98,77 @@ function Endpoint(props) {
         }
         // HTTPS listener with TLS, HTTP listener without
         const useHttps = !!tls;
-        resources.push((0, core_1.jsx)('Gateway', {
+        // Only create a Gateway when no sharedGateway is provided.
+        // When sharedGateway is set, attach an HTTPRoute to the existing
+        // gateway instead of allocating a new LoadBalancer IP.
+        if (!sharedGateway) {
+            resources.push((0, core_1.jsx)('Gateway', {
+                apiVersion: 'gateway.networking.k8s.io/v1',
+                kind: 'Gateway',
+                metadata: {
+                    name: `${name}-gateway`,
+                    namespace,
+                    // ExternalDNS gateway source picks up hostnames from this annotation
+                    ...(createDnsRecord && {
+                        annotations: {
+                            'external-dns.alpha.kubernetes.io/hostname': host,
+                        },
+                    }),
+                },
+                spec: {
+                    gatewayClassName,
+                    listeners: [
+                        {
+                            name: useHttps ? 'https' : 'http',
+                            protocol: useHttps ? 'HTTPS' : 'HTTP',
+                            port: useHttps ? 443 : 80,
+                            hostname: host,
+                            ...(tls && {
+                                tls: {
+                                    mode: 'Terminate',
+                                    certificateRefs: [{ name: secretName }],
+                                },
+                            }),
+                        },
+                    ],
+                },
+            }));
+        }
+        const parentRef = sharedGateway
+            ? {
+                name: sharedGateway.name,
+                ...(sharedGateway.namespace && { namespace: sharedGateway.namespace }),
+            }
+            : { name: `${name}-gateway` };
+        resources.push((0, core_1.jsx)('HTTPRoute', {
             apiVersion: 'gateway.networking.k8s.io/v1',
-            kind: 'Gateway',
+            kind: 'HTTPRoute',
             metadata: {
-                name: `${name}-gateway`,
+                name: `${name}-route`,
                 namespace,
-                // ExternalDNS gateway source picks up hostnames from this annotation
-                ...(createDnsRecord && {
+                // ExternalDNS picks up hostnames from HTTPRoute annotations
+                ...(createDnsRecord &&
+                    sharedGateway && {
                     annotations: {
                         'external-dns.alpha.kubernetes.io/hostname': host,
                     },
                 }),
             },
             spec: {
-                gatewayClassName,
-                listeners: [
-                    {
-                        name: useHttps ? 'https' : 'http',
-                        protocol: useHttps ? 'HTTPS' : 'HTTP',
-                        port: useHttps ? 443 : 80,
-                        hostname: host,
-                        ...(tls && {
-                            tls: {
-                                mode: 'Terminate',
-                                certificateRefs: [{ name: secretName }],
-                            },
-                        }),
-                    },
-                ],
-            },
-        }));
-        resources.push((0, core_1.jsx)('HTTPRoute', {
-            apiVersion: 'gateway.networking.k8s.io/v1',
-            kind: 'HTTPRoute',
-            metadata: { name: `${name}-route`, namespace },
-            spec: {
-                parentRefs: [{ name: `${name}-gateway` }],
+                parentRefs: [parentRef],
                 hostnames: [host],
                 rules: [
                     {
+                        ...(path && {
+                            matches: [
+                                {
+                                    path: {
+                                        type: 'PathPrefix',
+                                        value: path,
+                                    },
+                                },
+                            ],
+                        }),
                         backendRefs: [{ name: serviceName, port: servicePort }],
                     },
                 ],
@@ -139,7 +191,10 @@ function Endpoint(props) {
                 name,
                 namespace,
                 annotations: {
-                    'nginx.ingress.kubernetes.io/rewrite-target': '/',
+                    // NOTE: no rewrite-target on host-level routes — setting it to
+                    // '/' rewrites EVERY request path to '/' and breaks path-based
+                    // upstreams (webhooks, APIs, OAuth callbacks). Set annotations
+                    // explicitly when a captured-regex path needs one.
                     // ExternalDNS ingress source picks up hostnames from this annotation
                     ...(createDnsRecord ? { 'external-dns.alpha.kubernetes.io/hostname': host } : {}),
                     ...(tls?.clusterIssuer
@@ -158,8 +213,8 @@ function Endpoint(props) {
                         http: {
                             paths: [
                                 {
-                                    path: '/',
-                                    pathType: 'Prefix',
+                                    path: path ?? '/',
+                                    pathType: pathType ?? 'Prefix',
                                     backend: {
                                         service: {
                                             name: serviceName,

package/dist/endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../src/endpoint.tsx"],"names":[],"mappings":";;AAmDA,4BAqNC;AAxQD,oCAAsE;AAGtE,iDAAoE;AACpE,2DAAqD;AACrD,2CAAkD;AAClD,oCAAqC;AACrC,uDAA4D;AAC5D,iDAA2C;AAe3C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAgB,QAAQ,CAAC,KAAoB;IAC3C,MAAM,EACJ,IAAI,EACJ,SAAS,GAAG,SAAS,EACrB,IAAI,EACJ,WAAW,EACX,WAAW,GAAG,EAAE,EAChB,GAAG,EACH,WAAW,GAAG,EAAE,EAChB,GAAG,EACH,MAAM,GAAG,GAAG,GACb,GAAG,KAAK,CAAA;IAET,MAAM,OAAO,GAAG,IAAA,iBAAU,EAAC,yBAAc,CAAC,CAAA;IAC1C,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,mCAAe,CAAC,CAAA;IAClD,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,IAAA,iBAAU,EAAC,yBAAU,CAAC,CAAA;IAExC,2EAA2E;IAC3E,MAAM,eAAe,GAAG,GAAG,IAAI,SAAS,KAAK,IAAI,CAAA;IAEjD,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAA;QACzD,MAAM,UAAU,GAAG,GAAG,EAAE,UAAU,IAAI,GAAG,IAAI,MAAM,CAAA;QACnD,MAAM,UAAU,GAAG,GAAG,EAAE,aAAa,IAAI,kBAAkB,CAAA;QAE3D,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;QAC/E,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAA;QAEjF,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/D,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACR,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,aAAa,EAAE;gBACjB,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE;oBACR,IAAI,EAAE,GAAG,IAAI,MAAM;oBACnB,SAAS;iBACV;gBACD,IAAI,EAAE;oBACJ,UAAU;oBACV,QAAQ,EAAE,CAAC,IAAI,CAAC;oBAChB,SAAS,EAAE;wBACT,IAAI,EAAE,UAAU;wBAChB,IAAI,EAAE,eAAe;qBACtB;iBACF;aACF,CAAC,CACH,CAAA;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAA;QACtB,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,SAAS,EAAE;YACb,UAAU,EAAE,8BAA8B;YAC1C,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR,IAAI,EAAE,GAAG,IAAI,UAAU;gBACvB,SAAS;gBACT,qEAAqE;gBACrE,GAAG,CAAC,eAAe,IAAI;oBACrB,WAAW,EAAE;wBACX,2CAA2C,EAAE,IAAI;qBAClD;iBACF,CAAC;aACH;YACD,IAAI,EAAE;gBACJ,gBAAgB;gBAChB,SAAS,EAAE;oBACT;wBACE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;wBACjC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;wBACrC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;wBACzB,QAAQ,EAAE,IAAI;wBACd,GAAG,CAAC,GAAG,IAAI;4BACT,GAAG,EAAE;gCACH,IAAI,EAAE,WAAW;gCACjB,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;6BACxC;yBACF,CAAC;qBACH;iBACF;aACF;SACF,CAAC,CACH,CAAA;QAED,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,WAAW,EAAE;YACf,UAAU,EAAE,8BAA8B;YAC1C,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,QAAQ,EAAE,SAAS,EAAE;YAC9C,IAAI,EAAE;gBACJ,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,CAAC;gBACzC,SAAS,EAAE,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE;oBACL;wBACE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;qBACxD;iBACF;aACF;SACF,CAAC,CACH,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAA;QACjF,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;QAE/E,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,IAAA,gCAAoB,GAAE,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,OAAO,GAAY;YACvB,UAAU,EAAE,sBAAsB;YAClC,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR,IAAI;gBACJ,SAAS;gBACT,WAAW,EAAE;oBACX,4CAA4C,EAAE,GAAG;oBACjD,qEAAqE;oBACrE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,GAAG,EAAE,aAAa;wBACpB,CAAC,CAAC;4BACE,gCAAgC,EAAE,GAAG,CAAC,aAAa;yBACpD;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,WAAW;iBACf;aACF;YACD,IAAI,EAAE;gBACJ,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE,gBAAgB,IAAI,OAAO;gBACtE,KAAK,EAAE;oBACL;wBACE,IAAI;wBACJ,IAAI,EAAE;4BACJ,KAAK,EAAE;gCACL;oCACE,IAAI,EAAE,GAAG;oCACT,QAAQ,EAAE,QAAQ;oCAClB,OAAO,EAAE;wCACP,OAAO,EAAE;4CACP,IAAI,EAAE,WAAW;4CACjB,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;yCAC9B;qCACF;iCACF;6BACF;yBACF;qBACF;iBACF;gBACD,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI;oBACrB,GAAG,EAAE;wBACH;4BACE,KAAK,EAAE,CAAC,IAAI,CAAC;4BACb,UAAU,EAAE,GAAG,CAAC,UAAU;yBAC3B;qBACF;iBACF,CAAC;aACH;SACF,CAAA;QAED,SAAS,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IACzC,CAAC;IAED,8BAA8B;IAC9B,EAAE;IACF,aAAa;IACb,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,UAAU,GAAG,SAAS,EAAE,QAAQ,EAAE,OAA+B,CAAA;IACvE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;QAC/E,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC;QAED,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS,CAAC,IAAI,CACZ,IAAA,kCAAoB,EAAC;gBACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,SAAS,EAAE;gBAC5C,IAAI,EAAE;oBACJ,SAAS,EAAE;wBACT;4BACE,OAAO,EAAE,IAAI;4BACb,UAAU,EAAE,GAAG;4BACf,OAAO,EAAE,UAAU;4BACnB,SAAS,EAAE,MAAM;yBAClB;qBACF;iBACF;aACF,CAAC,CACH,CAAA;QACH,CAAC;QACD,8DAA8D;QAC9D,mEAAmE;IACrE,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../src/endpoint.tsx"],"names":[],"mappings":";;AAkEA,4BAoRC;AAtVD,oCAAsE;AACtE,iDAAiD;AAGjD,iDAAoE;AACpE,2DAAqD;AACrD,2CAAkD;AAClD,oCAAqC;AACrC,uDAA4D;AAC5D,iDAA2C;AA6B3C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAgB,QAAQ,CAAC,KAAoB;IAC3C,MAAM,EACJ,IAAI,EACJ,SAAS,EAAE,aAAa,EACxB,IAAI,EACJ,WAAW,EACX,WAAW,GAAG,EAAE,EAChB,IAAI,EACJ,QAAQ,EACR,GAAG,EACH,WAAW,GAAG,EAAE,EAChB,GAAG,EACH,MAAM,GAAG,GAAG,EACZ,aAAa,GACd,GAAG,KAAK,CAAA;IAET,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,IAAA,iBAAU,EAAC,yBAAc,CAAC,CAAA;IAC1C,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,mCAAe,CAAC,CAAA;IAClD,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,IAAA,iBAAU,EAAC,yBAAU,CAAC,CAAA;IAExC,2EAA2E;IAC3E,MAAM,eAAe,GAAG,GAAG,IAAI,SAAS,KAAK,IAAI,CAAA;IAEjD,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;YACvB,IAAI;YACJ,SAAS;YACT,IAAI;YACJ,WAAW;YACX,WAAW;YACX,UAAU,EAAE,IAAI;YAChB,WAAW;YACX,GAAG;SACJ,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,QAAQ,KAAK,eAAe,CAAA;IAE7F,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,gBAAgB,GACpB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAA;QAC/E,MAAM,UAAU,GAAG,GAAG,EAAE,UAAU,IAAI,GAAG,IAAI,MAAM,CAAA;QACnD,MAAM,UAAU,GACd,GAAG,EAAE,aAAa,IAAI,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,IAAI,kBAAkB,CAAA;QAEzF,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;QAC/E,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAA;QAEjF,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/D,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACR,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,aAAa,EAAE;gBACjB,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE;oBACR,IAAI,EAAE,GAAG,IAAI,MAAM;oBACnB,SAAS;iBACV;gBACD,IAAI,EAAE;oBACJ,UAAU;oBACV,QAAQ,EAAE,CAAC,IAAI,CAAC;oBAChB,SAAS,EAAE;wBACT,IAAI,EAAE,UAAU;wBAChB,IAAI,EAAE,eAAe;qBACtB;iBACF;aACF,CAAC,CACH,CAAA;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAA;QAEtB,2DAA2D;QAC3D,iEAAiE;QACjE,uDAAuD;QACvD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,SAAS,EAAE;gBACb,UAAU,EAAE,8BAA8B;gBAC1C,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE;oBACR,IAAI,EAAE,GAAG,IAAI,UAAU;oBACvB,SAAS;oBACT,qEAAqE;oBACrE,GAAG,CAAC,eAAe,IAAI;wBACrB,WAAW,EAAE;4BACX,2CAA2C,EAAE,IAAI;yBAClD;qBACF,CAAC;iBACH;gBACD,IAAI,EAAE;oBACJ,gBAAgB;oBAChB,SAAS,EAAE;wBACT;4BACE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;4BACjC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;4BACrC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;4BACzB,QAAQ,EAAE,IAAI;4BACd,GAAG,CAAC,GAAG,IAAI;gCACT,GAAG,EAAE;oCACH,IAAI,EAAE,WAAW;oCACjB,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;iCACxC;6BACF,CAAC;yBACH;qBACF;iBACF;aACF,CAAC,CACH,CAAA;QACH,CAAC;QAED,MAAM,SAAS,GAAG,aAAa;YAC7B,CAAC,CAAC;gBACE,IAAI,EAAE,aAAa,CAAC,IAAI;gBACxB,GAAG,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC;aACvE;YACH,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,CAAA;QAE/B,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,WAAW,EAAE;YACf,UAAU,EAAE,8BAA8B;YAC1C,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE;gBACR,IAAI,EAAE,GAAG,IAAI,QAAQ;gBACrB,SAAS;gBACT,4DAA4D;gBAC5D,GAAG,CAAC,eAAe;oBACjB,aAAa,IAAI;oBACf,WAAW,EAAE;wBACX,2CAA2C,EAAE,IAAI;qBAClD;iBACF,CAAC;aACL;YACD,IAAI,EAAE;gBACJ,UAAU,EAAE,CAAC,SAAS,CAAC;gBACvB,SAAS,EAAE,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE;oBACL;wBACE,GAAG,CAAC,IAAI,IAAI;4BACV,OAAO,EAAE;gCACP;oCACE,IAAI,EAAE;wCACJ,IAAI,EAAE,YAAY;wCAClB,KAAK,EAAE,IAAI;qCACZ;iCACF;6BACF;yBACF,CAAC;wBACF,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;qBACxD;iBACF;aACF;SACF,CAAC,CACH,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAA;QACjF,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;QAE/E,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,IAAA,gCAAoB,GAAE,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,OAAO,GAAY;YACvB,UAAU,EAAE,sBAAsB;YAClC,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR,IAAI;gBACJ,SAAS;gBACT,WAAW,EAAE;oBACX,+DAA+D;oBAC/D,+DAA+D;oBAC/D,+DAA+D;oBAC/D,mDAAmD;oBACnD,qEAAqE;oBACrE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,GAAG,EAAE,aAAa;wBACpB,CAAC,CAAC;4BACE,gCAAgC,EAAE,GAAG,CAAC,aAAa;yBACpD;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,WAAW;iBACf;aACF;YACD,IAAI,EAAE;gBACJ,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE,gBAAgB,IAAI,OAAO;gBACtE,KAAK,EAAE;oBACL;wBACE,IAAI;wBACJ,IAAI,EAAE;4BACJ,KAAK,EAAE;gCACL;oCACE,IAAI,EAAE,IAAI,IAAI,GAAG;oCACjB,QAAQ,EAAE,QAAQ,IAAI,QAAQ;oCAC9B,OAAO,EAAE;wCACP,OAAO,EAAE;4CACP,IAAI,EAAE,WAAW;4CACjB,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;yCAC9B;qCACF;iCACF;6BACF;yBACF;qBACF;iBACF;gBACD,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI;oBACrB,GAAG,EAAE;wBACH;4BACE,KAAK,EAAE,CAAC,IAAI,CAAC;4BACb,UAAU,EAAE,GAAG,CAAC,UAAU;yBAC3B;qBACF;iBACF,CAAC;aACH;SACF,CAAA;QAED,SAAS,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IACzC,CAAC;IAED,8BAA8B;IAC9B,EAAE;IACF,aAAa;IACb,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,UAAU,GAAG,SAAS,EAAE,QAAQ,EAAE,OAA+B,CAAA;IACvE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;QAC/E,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC;QAED,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS,CAAC,IAAI,CACZ,IAAA,kCAAoB,EAAC;gBACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,SAAS,EAAE;gBAC5C,IAAI,EAAE;oBACJ,SAAS,EAAE;wBACT;4BACE,OAAO,EAAE,IAAI;4BACb,UAAU,EAAE,GAAG;4BACf,OAAO,EAAE,UAAU;4BACnB,SAAS,EAAE,MAAM;yBAClB;qBACF;iBACF;aACF,CAAC,CACH,CAAA;QACH,CAAC;QACD,8DAA8D;QAC9D,mEAAmE;IACrE,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;AAC/C,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Actionable errors for the recurring "app needs secrets but no
+ * provisioning backend exists" case. Packages reference this factory
+ * instead of hand-writing the same 15-line guidance block per app —
+ * the advice lives in one place.
+ */
+export interface SecretsRequiredOptions {
+    /** Prop that carries the fallback pre-created Secret name */
+    propName?: string;
+    /** Example Secret name to suggest */
+    exampleValue?: string;
+    /** Expected keys on the pre-created Secret */
+    keys?: string[];
+}
+export declare function secretsRequiredError(app: string, resourceName: string, what: string, opts?: SecretsRequiredOptions): Error;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,sBAA2B,GAChC,KAAK,CAgBP"}

package/dist/errors.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.secretsRequiredError = secretsRequiredError;
+function secretsRequiredError(app, resourceName, what, opts = {}) {
+    const { propName = 'secretsName', exampleValue = `${resourceName}-secrets`, keys } = opts;
+    return new Error(`${app} "${resourceName}" requires ${what}\n` +
+        `\n` +
+        `Secrets must never be rendered as plaintext.\n` +
+        `\n` +
+        `Fix: configure a provisioning secrets backend on the Platform\n` +
+        `(openbao, vault, or any provider with a provision() hook):\n` +
+        `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
+        `    <${app} name="${resourceName}" />\n` +
+        `  </Platform>\n` +
+        `\n` +
+        `Or reference a pre-created Secret${keys ? ` (keys: ${keys.join(', ')})` : ''}:\n` +
+        `  ${propName}: "${exampleValue}"`);
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;AAeA,oDAqBC;AArBD,SAAgB,oBAAoB,CAClC,GAAW,EACX,YAAoB,EACpB,IAAY,EACZ,OAA+B,EAAE;IAEjC,MAAM,EAAE,QAAQ,GAAG,aAAa,EAAE,YAAY,GAAG,GAAG,YAAY,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;IACzF,OAAO,IAAI,KAAK,CACd,GAAG,GAAG,KAAK,YAAY,cAAc,IAAI,IAAI;QAC3C,IAAI;QACJ,gDAAgD;QAChD,IAAI;QACJ,iEAAiE;QACjE,8DAA8D;QAC9D,4EAA4E;QAC5E,QAAQ,GAAG,UAAU,YAAY,QAAQ;QACzC,iBAAiB;QACjB,IAAI;QACJ,oCAAoC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK;QAClF,KAAK,QAAQ,MAAM,YAAY,GAAG,CACrC,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { Platform, type PlatformProps, type RoutingMode } from './platform';
+export { R8sCluster, type R8sClusterProps } from './r8s-cluster';
 export { App, type AppProps } from './app';
 export { Database, type DatabaseProps } from './database';
 export { Endpoint, type EndpointProps } from './endpoint';
@@ -6,9 +7,12 @@ export { WebService, type WebServiceProps, type SecretRef, type VaultSecretRef,
 export { Auth, type AuthProps } from './auth';
 export { Monitoring, type MonitoringProps } from './monitoring';
 export { Backup, type BackupProps } from './backup';
-export { SecretProvider, type SecretProviderProps, type SecretProviderValue, OpenBao, type OpenBaoProps, Vault, type VaultProps, SealedSecrets, type SealedSecretsProps, ManualSecrets, type ManualSecretsProps, } from './secret-provider';
+export { SecretProvider, type SecretProviderProps, type SecretProviderValue, OpenBao, type OpenBaoProps, Vault, type VaultProps, SealedSecrets, type SealedSecretsProps, ManualSecrets, type ManualSecretsProps, provisionerForSecretProvider, canProvisionSecrets, } from './secret-provider';
 export { DnsProvider, type DnsProviderProps, type DnsProviderValue, type DnsConfig, DnsContext, ExternalDns, type ExternalDnsProps, } from './dns-provider';
 export { EndpointProvider, type EndpointProviderProps, type EndpointProviderValue, type EndpointConfig, EndpointContext, Nginx, type NginxProps, EnvoyGateway, type EnvoyGatewayProps, } from './endpoint-provider';
 export { CertProvider, type CertProviderProps, type CertProviderValue, type CertConfig, CertContext, CertManager, type CertManagerProps, } from './cert-provider';
 export { cnpgOperator, nginxIngressOperator, vaultSecretsOperator } from './operators';
+export { StaticSecret, type StaticSecretProps } from './static-secret';
+export { useOperators, maybeOperator } from './operators';
+export { secretsRequiredError, type SecretsRequiredOptions } from './errors';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,EAAE,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,OAAO,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EACL,UAAU,EACV,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,IAAI,EAAE,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAGnD,OAAO,EACL,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,OAAO,EACP,KAAK,YAAY,EACjB,KAAK,EACL,KAAK,UAAU,EACf,aAAa,EACb,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,UAAU,EACV,WAAW,EACX,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,eAAe,EACf,KAAK,EACL,KAAK,UAAU,EACf,YAAY,EACZ,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,WAAW,EACX,WAAW,EACX,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAChE,OAAO,EAAE,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,OAAO,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EACL,UAAU,EACV,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,IAAI,EAAE,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAGnD,OAAO,EACL,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,OAAO,EACP,KAAK,YAAY,EACjB,KAAK,EACL,KAAK,UAAU,EACf,aAAa,EACb,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,kBAAkB,EACvB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,UAAU,EACV,WAAW,EACX,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,eAAe,EACf,KAAK,EACL,KAAK,UAAU,EACf,YAAY,EACZ,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,WAAW,EACX,WAAW,EACX,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEtF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAGtE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -4,9 +4,11 @@
 // with good defaults. Named after what the user wants to achieve, not the
 // underlying tools.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.vaultSecretsOperator = exports.nginxIngressOperator = exports.cnpgOperator = exports.CertManager = exports.CertContext = exports.CertProvider = exports.EnvoyGateway = exports.Nginx = exports.EndpointContext = exports.EndpointProvider = exports.ExternalDns = exports.DnsContext = exports.DnsProvider = exports.ManualSecrets = exports.SealedSecrets = exports.Vault = exports.OpenBao = exports.SecretProvider = exports.Backup = exports.Monitoring = exports.Auth = exports.WebService = exports.Endpoint = exports.Database = exports.App = exports.Platform = void 0;
+exports.secretsRequiredError = exports.maybeOperator = exports.useOperators = exports.StaticSecret = exports.vaultSecretsOperator = exports.nginxIngressOperator = exports.cnpgOperator = exports.CertManager = exports.CertContext = exports.CertProvider = exports.EnvoyGateway = exports.Nginx = exports.EndpointContext = exports.EndpointProvider = exports.ExternalDns = exports.DnsContext = exports.DnsProvider = exports.canProvisionSecrets = exports.provisionerForSecretProvider = exports.ManualSecrets = exports.SealedSecrets = exports.Vault = exports.OpenBao = exports.SecretProvider = exports.Backup = exports.Monitoring = exports.Auth = exports.WebService = exports.Endpoint = exports.Database = exports.App = exports.R8sCluster = exports.Platform = void 0;
 var platform_1 = require("./platform");
 Object.defineProperty(exports, "Platform", { enumerable: true, get: function () { return platform_1.Platform; } });
+var r8s_cluster_1 = require("./r8s-cluster");
+Object.defineProperty(exports, "R8sCluster", { enumerable: true, get: function () { return r8s_cluster_1.R8sCluster; } });
 var app_1 = require("./app");
 Object.defineProperty(exports, "App", { enumerable: true, get: function () { return app_1.App; } });
 var database_1 = require("./database");
@@ -28,6 +30,8 @@ Object.defineProperty(exports, "OpenBao", { enumerable: true, get: function () {
 Object.defineProperty(exports, "Vault", { enumerable: true, get: function () { return secret_provider_1.Vault; } });
 Object.defineProperty(exports, "SealedSecrets", { enumerable: true, get: function () { return secret_provider_1.SealedSecrets; } });
 Object.defineProperty(exports, "ManualSecrets", { enumerable: true, get: function () { return secret_provider_1.ManualSecrets; } });
+Object.defineProperty(exports, "provisionerForSecretProvider", { enumerable: true, get: function () { return secret_provider_1.provisionerForSecretProvider; } });
+Object.defineProperty(exports, "canProvisionSecrets", { enumerable: true, get: function () { return secret_provider_1.canProvisionSecrets; } });
 var dns_provider_1 = require("./dns-provider");
 Object.defineProperty(exports, "DnsProvider", { enumerable: true, get: function () { return dns_provider_1.DnsProvider; } });
 Object.defineProperty(exports, "DnsContext", { enumerable: true, get: function () { return dns_provider_1.DnsContext; } });
@@ -46,4 +50,12 @@ var operators_1 = require("./operators");
 Object.defineProperty(exports, "cnpgOperator", { enumerable: true, get: function () { return operators_1.cnpgOperator; } });
 Object.defineProperty(exports, "nginxIngressOperator", { enumerable: true, get: function () { return operators_1.nginxIngressOperator; } });
 Object.defineProperty(exports, "vaultSecretsOperator", { enumerable: true, get: function () { return operators_1.vaultSecretsOperator; } });
+var static_secret_1 = require("./static-secret");
+Object.defineProperty(exports, "StaticSecret", { enumerable: true, get: function () { return static_secret_1.StaticSecret; } });
+// Composition helpers — loose building blocks for packages
+var operators_2 = require("./operators");
+Object.defineProperty(exports, "useOperators", { enumerable: true, get: function () { return operators_2.useOperators; } });
+Object.defineProperty(exports, "maybeOperator", { enumerable: true, get: function () { return operators_2.maybeOperator; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "secretsRequiredError", { enumerable: true, get: function () { return errors_1.secretsRequiredError; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,wDAAwD;AACxD,4EAA4E;AAC5E,0EAA0E;AAC1E,oBAAoB;;;AAEpB,uCAA2E;AAAlE,oGAAA,QAAQ,OAAA;AACjB,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,uCAAyD;AAAhD,oGAAA,QAAQ,OAAA;AACjB,uCAAyD;AAAhD,oGAAA,QAAQ,OAAA;AACjB,6CAKsB;AAJpB,yGAAA,UAAU,OAAA;AAKZ,+BAA6C;AAApC,4FAAA,IAAI,OAAA;AACb,2CAA+D;AAAtD,wGAAA,UAAU,OAAA;AACnB,mCAAmD;AAA1C,gGAAA,MAAM,OAAA;AAEf,wEAAwE;AACxE,qDAY0B;AAXxB,iHAAA,cAAc,OAAA;AAGd,0GAAA,OAAO,OAAA;AAEP,wGAAA,KAAK,OAAA;AAEL,gHAAA,aAAa,OAAA;AAEb,gHAAA,aAAa,OAAA;AAGf,+CAQuB;AAPrB,2GAAA,WAAW,OAAA;AAIX,0GAAA,UAAU,OAAA;AACV,2GAAA,WAAW,OAAA;AAGb,yDAU4B;AAT1B,qHAAA,gBAAgB,OAAA;AAIhB,oHAAA,eAAe,OAAA;AACf,0GAAA,KAAK,OAAA;AAEL,iHAAA,YAAY,OAAA;AAGd,iDAQwB;AAPtB,6GAAA,YAAY,OAAA;AAIZ,4GAAA,WAAW,OAAA;AACX,4GAAA,WAAW,OAAA;AAIb,uDAAuD;AACvD,yCAAsF;AAA7E,yGAAA,YAAY,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAAE,iHAAA,oBAAoB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,wDAAwD;AACxD,4EAA4E;AAC5E,0EAA0E;AAC1E,oBAAoB;;;AAEpB,uCAA2E;AAAlE,oGAAA,QAAQ,OAAA;AACjB,6CAAgE;AAAvD,yGAAA,UAAU,OAAA;AACnB,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,uCAAyD;AAAhD,oGAAA,QAAQ,OAAA;AACjB,uCAAyD;AAAhD,oGAAA,QAAQ,OAAA;AACjB,6CAKsB;AAJpB,yGAAA,UAAU,OAAA;AAKZ,+BAA6C;AAApC,4FAAA,IAAI,OAAA;AACb,2CAA+D;AAAtD,wGAAA,UAAU,OAAA;AACnB,mCAAmD;AAA1C,gGAAA,MAAM,OAAA;AAEf,wEAAwE;AACxE,qDAc0B;AAbxB,iHAAA,cAAc,OAAA;AAGd,0GAAA,OAAO,OAAA;AAEP,wGAAA,KAAK,OAAA;AAEL,gHAAA,aAAa,OAAA;AAEb,gHAAA,aAAa,OAAA;AAEb,+HAAA,4BAA4B,OAAA;AAC5B,sHAAA,mBAAmB,OAAA;AAErB,+CAQuB;AAPrB,2GAAA,WAAW,OAAA;AAIX,0GAAA,UAAU,OAAA;AACV,2GAAA,WAAW,OAAA;AAGb,yDAU4B;AAT1B,qHAAA,gBAAgB,OAAA;AAIhB,oHAAA,eAAe,OAAA;AACf,0GAAA,KAAK,OAAA;AAEL,iHAAA,YAAY,OAAA;AAGd,iDAQwB;AAPtB,6GAAA,YAAY,OAAA;AAIZ,4GAAA,WAAW,OAAA;AACX,4GAAA,WAAW,OAAA;AAIb,uDAAuD;AACvD,yCAAsF;AAA7E,yGAAA,YAAY,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAEjE,iDAAsE;AAA7D,6GAAA,YAAY,OAAA;AAErB,2DAA2D;AAC3D,yCAAyD;AAAhD,yGAAA,YAAY,OAAA;AAAE,0GAAA,aAAa,OAAA;AACpC,mCAA4E;AAAnE,8GAAA,oBAAoB,OAAA"}

package/dist/operators.d.ts

@@ -1,5 +1,19 @@
+import { declareOperator } from '@r8s/core';
+import type { Operator } from '@r8s/k8s-types';
+/**
+ * Read the operators already declared by the Platform tree. Packages call
+ * this once (unconditionally) and pass the result to maybeOperator() —
+ * no sharedOperators.some(...) boilerplate in every package.
+ */
+export declare function useOperators(): Operator[];
+/**
+ * Declare an operator unless the Platform already provides it. Returns
+ * [] (nothing to add) or a one-element array — spread into resources:
+ * `resources_.push(...maybeOperator('redis-operator', shared))`
+ */
+export declare function maybeOperator(name: string, shared: Operator[], version?: string): ReturnType<typeof declareOperator>[];
 /** CloudNativePG operator declaration */
-export declare const cnpgOperator: (version?: string) => import("@r8s/k8s-types").Operator;
+export declare const cnpgOperator: (version?: string) => Operator;
 /** NGINX Ingress Controller operator declaration (not in operators.yaml — nginx-specific) */
 export declare const nginxIngressOperator: (version?: string) => {
     name: string;
@@ -15,5 +29,5 @@ export declare const nginxIngressOperator: (version?: string) => {
     installCommand: string;
 };
 /** Vault Secrets Operator declaration */
-export declare const vaultSecretsOperator: (version?: string) => import("@r8s/k8s-types").Operator;
+export declare const vaultSecretsOperator: (version?: string) => Operator;
 //# sourceMappingURL=operators.d.ts.map

package/dist/operators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operators.d.ts","sourceRoot":"","sources":["../src/operators.ts"],"names":[],"mappings":"AAQA,yCAAyC;AACzC,eAAO,MAAM,YAAY,yDAAoB,CAAA;AAE7C,6FAA6F;AAC7F,eAAO,MAAM,oBAAoB,GAAI,gBAAkB;;;;;;;;;;;;CAYrD,CAAA;AAEF,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,yDAAsC,CAAA"}
+{"version":3,"file":"operators.d.ts","sourceRoot":"","sources":["../src/operators.ts"],"names":[],"mappings":"AAOA,OAAO,EAAc,eAAe,EAAE,MAAM,WAAW,CAAA;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,QAAQ,EAAE,CAEzC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,QAAQ,EAAE,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,UAAU,CAAC,OAAO,eAAe,CAAC,EAAE,CAMtC;AAED,yCAAyC;AACzC,eAAO,MAAM,YAAY,gCAAoB,CAAA;AAE7C,6FAA6F;AAC7F,eAAO,MAAM,oBAAoB,GAAI,gBAAkB;;;;;;;;;;;;CAYrD,CAAA;AAEF,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,gCAAsC,CAAA"}

package/dist/operators.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.vaultSecretsOperator = exports.nginxIngressOperator = exports.cnpgOperator = void 0;
+exports.useOperators = useOperators;
+exports.maybeOperator = maybeOperator;
 /**
  * Operator declarations re-exported from @r8s/crds.
  *
@@ -8,6 +10,30 @@ exports.vaultSecretsOperator = exports.nginxIngressOperator = exports.cnpgOperat
  * exist for backwards compatibility with recipes that import from here.
  */
 const crds_1 = require("@r8s/crds");
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+/**
+ * Read the operators already declared by the Platform tree. Packages call
+ * this once (unconditionally) and pass the result to maybeOperator() —
+ * no sharedOperators.some(...) boilerplate in every package.
+ */
+function useOperators() {
+    return (0, core_1.useContext)(defaults_1.OperatorContext);
+}
+/**
+ * Declare an operator unless the Platform already provides it. Returns
+ * [] (nothing to add) or a one-element array — spread into resources:
+ * `resources_.push(...maybeOperator('redis-operator', shared))`
+ */
+function maybeOperator(name, shared, version) {
+    if (shared.some((op) => op.name === name))
+        return [];
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const factory = crds_1.operators[name];
+    if (!factory)
+        throw new Error(`Unknown operator '${name}' — check packages/crds/operators.yaml`);
+    return [(0, core_1.declareOperator)(factory(version))];
+}
 /** CloudNativePG operator declaration */
 exports.cnpgOperator = crds_1.operators['cnpg'];
 /** NGINX Ingress Controller operator declaration (not in operators.yaml — nginx-specific) */

package/dist/operators.js.map

@@ -1 +1 @@
-{"version":3,"file":"operators.js","sourceRoot":"","sources":["../src/operators.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,oCAAqC;AAErC,yCAAyC;AAC5B,QAAA,YAAY,GAAG,gBAAS,CAAC,MAAM,CAAC,CAAA;AAE7C,6FAA6F;AACtF,MAAM,oBAAoB,GAAG,CAAC,OAAO,GAAG,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,0BAA0B;IACvC,MAAM,EAAE;QACN,IAAI,EAAE,UAAmB;QACzB,GAAG,EAAE,0EAA0E,OAAO,2CAA2C;QACjI,OAAO;QACP,SAAS,EAAE,eAAe;KAC3B;IACD,OAAO;IACP,SAAS,EAAE,eAAe;IAC1B,cAAc,EAAE,yGAAyG,OAAO,2CAA2C;CAC5K,CAAC,CAAA;AAZW,QAAA,oBAAoB,wBAY/B;AAEF,yCAAyC;AAC5B,QAAA,oBAAoB,GAAG,gBAAS,CAAC,wBAAwB,CAAC,CAAA"}
+{"version":3,"file":"operators.js","sourceRoot":"","sources":["../src/operators.ts"],"names":[],"mappings":";;;AAgBA,oCAEC;AAOD,sCAUC;AAnCD;;;;;GAKG;AACH,oCAAqC;AACrC,oCAAuD;AACvD,iDAAoD;AAGpD;;;;GAIG;AACH,SAAgB,YAAY;IAC1B,OAAO,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,IAAY,EACZ,MAAkB,EAClB,OAAgB;IAEhB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IACpD,8DAA8D;IAC9D,MAAM,OAAO,GAAI,gBAAmE,CAAC,IAAI,CAAC,CAAA;IAC1F,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,wCAAwC,CAAC,CAAA;IAChG,OAAO,CAAC,IAAA,sBAAe,EAAC,OAAO,CAAC,OAAO,CAAU,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,yCAAyC;AAC5B,QAAA,YAAY,GAAG,gBAAS,CAAC,MAAM,CAAC,CAAA;AAE7C,6FAA6F;AACtF,MAAM,oBAAoB,GAAG,CAAC,OAAO,GAAG,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,0BAA0B;IACvC,MAAM,EAAE;QACN,IAAI,EAAE,UAAmB;QACzB,GAAG,EAAE,0EAA0E,OAAO,2CAA2C;QACjI,OAAO;QACP,SAAS,EAAE,eAAe;KAC3B;IACD,OAAO;IACP,SAAS,EAAE,eAAe;IAC1B,cAAc,EAAE,yGAAyG,OAAO,2CAA2C;CAC5K,CAAC,CAAA;AAZW,QAAA,oBAAoB,wBAY/B;AAEF,yCAAyC;AAC5B,QAAA,oBAAoB,GAAG,gBAAS,CAAC,wBAAwB,CAAC,CAAA"}

package/dist/platform.d.ts

@@ -11,6 +11,15 @@ export interface PlatformProps {
     routing?: RoutingMode;
     /** Gateway class name (only used when routing='gateway', default: 'eg') */
     gatewayClassName?: string;
+    /**
+     * Reference to a shared Gateway for all child endpoints.
+     * When set, App/Endpoint create only HTTPRoutes (no per-app Gateway),
+     * avoiding a new LoadBalancer IP per app.
+     */
+    sharedGateway?: {
+        name: string;
+        namespace?: string;
+    };
     /** Default namespace for all child resources */
     namespace?: string;
     /** Default labels applied to all child resources */

package/dist/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAOnE,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAA;AAE/C,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,+CAA+C;IAC/C,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;IACtB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,WA4D5C"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAOnE,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAA;AAE/C,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,+CAA+C;IAC/C,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;IACtB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,WA4D5C"}

package/dist/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.tsx"],"names":[],"mappings":";;AAmIA,4BA4DC;AA/LD,oCAAqD;AACrD,iDAO2B;AAE3B,uDAA4E;AAC5E,iDAAmE;AACnE,2DAI4B;AA6C5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,SAAgB,QAAQ,CAAC,KAAoB;IAC3C,MAAM,EACJ,OAAO,GAAG,SAAS,EACnB,gBAAgB,GAAG,IAAI,EACvB,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,GAAG,EACH,QAAQ,GACT,GAAG,KAAK,CAAA;IAET,IAAI,MAAM,GAAY,QAAQ,CAAA;IAE9B,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,IAAA,UAAG,EAAC,eAAQ,EAAE;YACrB,QAAQ,EAAE;gBACR,IAAA,UAAG,EAAC,WAAW,EAAE;oBACf,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iBAC9B,CAAC;gBACF,MAAM;aACP;SACF,CAAC,CAAA;IACJ,CAAC;IAED,qFAAqF;IACrF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,IAAA,UAAG,EAAC,0BAAW,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,iEAAiE;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,IAAA,UAAG,EAAC,gCAAc,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,6CAA6C;IAC7C,MAAM,gBAAgB,GACpB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IACjG,MAAM,GAAG,IAAA,UAAG,EAAC,oCAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAEhF,0BAA0B;IAC1B,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,IAAA,UAAG,EAAC,0BAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,IAAA,UAAG,EAAC,iBAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,0BAA0B;IAC1B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,IAAA,UAAG,EAAC,oBAAS,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.tsx"],"names":[],"mappings":";;AAyIA,4BA4DC;AArMD,oCAAqD;AACrD,iDAO2B;AAE3B,uDAA4E;AAC5E,iDAAmE;AACnE,2DAI4B;AAmD5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,SAAgB,QAAQ,CAAC,KAAoB;IAC3C,MAAM,EACJ,OAAO,GAAG,SAAS,EACnB,gBAAgB,GAAG,IAAI,EACvB,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,GAAG,EACH,QAAQ,GACT,GAAG,KAAK,CAAA;IAET,IAAI,MAAM,GAAY,QAAQ,CAAA;IAE9B,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,IAAA,UAAG,EAAC,eAAQ,EAAE;YACrB,QAAQ,EAAE;gBACR,IAAA,UAAG,EAAC,WAAW,EAAE;oBACf,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iBAC9B,CAAC;gBACF,MAAM;aACP;SACF,CAAC,CAAA;IACJ,CAAC;IAED,qFAAqF;IACrF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,IAAA,UAAG,EAAC,0BAAW,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,iEAAiE;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,IAAA,UAAG,EAAC,gCAAc,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,6CAA6C;IAC7C,MAAM,gBAAgB,GACpB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IACjG,MAAM,GAAG,IAAA,UAAG,EAAC,oCAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAEhF,0BAA0B;IAC1B,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,IAAA,UAAG,EAAC,0BAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,IAAA,UAAG,EAAC,iBAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,0BAA0B;IAC1B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,IAAA,UAAG,EAAC,oBAAS,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/r8s-cluster.d.ts

@@ -0,0 +1,105 @@
+import type { Operator } from '@r8s/k8s-types';
+export interface R8sClusterProps {
+    /**
+     * OpenBao secrets backend configuration. VSO (Vault Secrets Operator)
+     * is declared automatically. This context is inherited by all
+     * children (App, Database, Auth, etc.) so credentials are managed
+     * by VSO — never plaintext.
+     */
+    secrets: {
+        /** OpenBao mount path (e.g., 'secret') */
+        mount: string;
+        /** OpenBao path prefix for this cluster (e.g., 'production') */
+        path: string;
+        /** Optional VSO auth reference name */
+        authRef?: string;
+    };
+    /**
+     * ExternalDNS configuration with TSIG for secure RFC 2136 updates.
+     * The external-dns operator is declared automatically, and a
+     * VaultStaticSecret is created for the TSIG key in the external-dns
+     * namespace.
+     */
+    dns: {
+        /** RFC 2136 DNS server (e.g., 'ns1.example.com') */
+        server: string;
+        /** DNS zone (e.g., 'example.com') */
+        zone: string;
+        /** TSIG key path in OpenBao (e.g., 'dns/tsig') */
+        tsigPath: string;
+        /** TSIG key name in the secret (default: 'secret') */
+        tsigKey?: string;
+    };
+    /**
+     * Gateway class name for Envoy Gateway (default: 'eg').
+     * The envoy-gateway operator is declared automatically.
+     */
+    gatewayClassName?: string;
+    /**
+     * Default labels applied to all resources.
+     */
+    labels?: Record<string, string>;
+    /**
+     * Pre-installed operators. R8sCluster won't re-declare these.
+     */
+    operators?: Operator[];
+    /**
+     * Namespace for LokiStack and logging resources (default: 'logging').
+     * This is separate from app namespaces — logging infra lives in
+     * its own namespace.
+     */
+    logsNamespace?: string;
+    /**
+     * Storage class for Loki logs (default: 'standard').
+     */
+    logsStorageClass?: string;
+    /**
+     * Application components (App, Database, Auth, etc.).
+     * Children inherit routing, secrets, and DNS contexts.
+     * Optional — R8sCluster can be used standalone to set up cluster
+     * infrastructure without any apps.
+     */
+    children?: unknown;
+}
+/**
+ * R8sCluster — opinionated cluster foundation with all recommended operators.
+ *
+ * @title R8sCluster
+ * @category Complete Solution
+ *
+ * Sets up a complete cluster foundation in one component:
+ * - **cert-manager** for TLS certificate automation
+ * - **external-dns** with TSIG for secure DNS updates
+ * - **Envoy Gateway** for Gateway API routing
+ * - **OpenBao VSO** for secrets management
+ * - **Prometheus** for metrics and alerting
+ * - **Loki + FluentBit** for log aggregation of all user pods
+ *
+ * All operators are declared automatically. Children inherit routing,
+ * secrets, and DNS contexts — just add your apps.
+ *
+ * R8sCluster is cluster-scoped — it does not take a namespace. Operators
+ * install to their own namespaces (cert-manager, external-dns, etc.).
+ * Logging infrastructure lives in a dedicated namespace (default:
+ * 'logging'). App namespaces are managed by Platform or the apps
+ * themselves.
+ *
+ * @example
+ * import { R8sCluster, Platform, App, Database } from '@r8s/recipes'
+ *
+ * export default (
+ *   <>
+ *     <R8sCluster
+ *       secrets={{ mount: 'secret', path: 'production' }}
+ *       dns={{ server: 'ns1.example.com', zone: 'example.com', tsigPath: 'dns/tsig' }}
+ *     >
+ *       <Platform namespace="production">
+ *         <Database name="api-db" storage="20Gi" />
+ *         <App name="api" image="api:v1" host="api.example.com" />
+ *       </Platform>
+ *     </R8sCluster>
+ *   </>
+ * )
+ */
+export declare function R8sCluster(props: R8sClusterProps): unknown;
+//# sourceMappingURL=r8s-cluster.d.ts.map

package/dist/r8s-cluster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r8s-cluster.d.ts","sourceRoot":"","sources":["../src/r8s-cluster.tsx"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,OAAO,EAAE;QACP,0CAA0C;QAC1C,KAAK,EAAE,MAAM,CAAA;QACb,gEAAgE;QAChE,IAAI,EAAE,MAAM,CAAA;QACZ,uCAAuC;QACvC,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;IACD;;;;;OAKG;IACH,GAAG,EAAE;QACH,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAA;QACd,qCAAqC;QACrC,IAAI,EAAE,MAAM,CAAA;QACZ,kDAAkD;QAClD,QAAQ,EAAE,MAAM,CAAA;QAChB,sDAAsD;QACtD,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;IACD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B;;OAEG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,WA2KhD"}