@r8s/recipes 0.1.0

package/dist/auth.js

@@ -0,0 +1,302 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Auth = Auth;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const crds_1 = require("@r8s/crds");
+const database_1 = require("./database");
+const endpoint_1 = require("./endpoint");
+const components_1 = require("./auth/components");
+/**
+ * Identity and access management — Keycloak with database, TLS, and routing.
+ *
+ * @title Auth
+ * @category Security & Identity
+ *
+ * Composes Keycloak (identity provider), CNPG (PostgreSQL database),
+ * cert-manager (TLS), and routing (Ingress/Gateway) into a single
+ * identity solution with good defaults.
+ *
+ * The database is auto-wired: Keycloak connects to its own PostgreSQL
+ * cluster. Credentials are managed by CNPG's bootstrap secret.
+ *
+ * @example
+ * // Simple Keycloak instance
+ * import { Auth } from '@r8s/recipes'
+ *
+ * export default <Auth name="auth" host="auth.example.com" />
+ *
+ * @example
+ * // Keycloak with custom storage and TLS
+ * import { Auth } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Auth
+ *     name="auth"
+ *     host="auth.example.com"
+ *     instances={2}
+ *     storage="20Gi"
+ *     tls={{ secretName: 'auth-tls', clusterIssuer: 'letsencrypt-prod' }}
+ *   />
+ * )
+ *
+ * @example
+ * // Keycloak with realms and clients
+ * import { Auth } from '@r8s/recipes'
+ * import { Realms, Realm, Clients, Client } from '@r8s/recipes/auth'
+ *
+ * export default (
+ *   <Auth name="auth" host="auth.example.com">
+ *     <Realms>
+ *       <Realm id="company" displayName="Company">
+ *         <Clients>
+ *           <Client id="web" type="public" redirectUris={['https://app.example.com/*']} />
+ *           <Client id="api" type="bearer-only" />
+ *         </Clients>
+ *       </Realm>
+ *     </Realms>
+ *   </Auth>
+ * )
+ *
+ * @example
+ * // Keycloak with EntraID federation
+ * import { Auth } from '@r8s/recipes'
+ * import { Realms, Realm, Clients, Client, EntraID } from '@r8s/recipes/auth'
+ *
+ * export default (
+ *   <Auth name="auth" host="auth.example.com">
+ *     <Realms>
+ *       <Realm id="company" displayName="Company">
+ *         <EntraID
+ *           tenantId="your-tenant-id"
+ *           clientId="your-client-id"
+ *           clientSecret="${env:ENTRA_CLIENT_SECRET}"
+ *         />
+ *         <Clients>
+ *           <Client id="web" type="public" redirectUris={['https://app.example.com/*']} />
+ *         </Clients>
+ *       </Realm>
+ *     </Realms>
+ *   </Auth>
+ * )
+ */
+function Auth(props) {
+    const { name, host, namespace: namespaceProp, instances = 1, storage = '10Gi', tls, children, } = props;
+    // Inherit namespace from <Platform> context if not explicitly set
+    const contextNamespace = (0, core_1.useContext)(defaults_1.Namespace);
+    const namespace = namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default';
+    const sharedOperators = (0, core_1.useContext)(defaults_1.OperatorContext);
+    const hasKeycloak = sharedOperators.some((op) => op.name === 'keycloak-operator');
+    const hasCNPG = sharedOperators.some((op) => op.name === 'cnpg');
+    const resources = [];
+    // Declare operators if not already provided
+    if (!hasKeycloak) {
+        resources.push((0, core_1.declareOperator)(crds_1.operators['keycloak-operator']()));
+    }
+    if (!hasCNPG) {
+        resources.push((0, core_1.declareOperator)(crds_1.operators['cnpg']()));
+    }
+    // Database for Keycloak — auto-wired via DatabaseContext.
+    // Credentials are managed by the secrets backend configured on the Platform.
+    resources.push((0, core_1.jsx)(database_1.Database, {
+        name: `${name}-db`,
+        namespace,
+        storage,
+        children: (0, core_1.jsx)('Keycloak', {
+            apiVersion: 'k8s.keycloak.org/v2alpha1',
+            kind: 'Keycloak',
+            metadata: { name, namespace },
+            spec: {
+                instances,
+                hostname: {
+                    hostname: host,
+                    strict: false,
+                    strictBackchannel: false,
+                },
+                proxy: {
+                    headers: 'xforwarded',
+                },
+                ingress: {
+                    enabled: false, // We use our own Endpoint for routing
+                },
+                transaction: {
+                    xaEnabled: false,
+                },
+            },
+        }),
+    }));
+    // Endpoint for public access
+    resources.push((0, core_1.jsx)(endpoint_1.Endpoint, {
+        name: `${name}-endpoint`,
+        namespace,
+        host,
+        serviceName: `${name}-service`,
+        servicePort: 8080,
+        tls,
+    }));
+    // Process children (Realms) to create KeycloakRealmImport resources
+    const realms = collectRealms(children);
+    for (const realm of realms) {
+        resources.push((0, core_1.jsx)('KeycloakRealmImport', {
+            apiVersion: 'k8s.keycloak.org/v2alpha1',
+            kind: 'KeycloakRealmImport',
+            metadata: { name: `${name}-${realm.id}`, namespace },
+            spec: {
+                keycloakCRName: name,
+                realm: {
+                    realm: realm.id,
+                    displayName: realm.displayName,
+                    enabled: realm.enabled ?? true,
+                    identityProviders: realm.identityProviders?.map((idp) => ({
+                        alias: idp.alias,
+                        displayName: idp.displayName,
+                        providerId: idp.providerId,
+                        enabled: idp.enabled ?? true,
+                        trustEmail: idp.trustEmail ?? false,
+                        config: idp.config,
+                    })),
+                    clients: realm.clients?.map((client) => ({
+                        clientId: client.id,
+                        name: client.name ?? client.id,
+                        publicClient: client.type === 'public',
+                        standardFlowEnabled: client.type === 'public',
+                        bearerOnly: client.type === 'bearer-only',
+                        serviceAccountsEnabled: client.type === 'confidential' ? true : undefined,
+                        secret: client.secret,
+                        redirectUris: client.redirectUris,
+                        webOrigins: client.webOrigins,
+                        directAccessGrantsEnabled: client.directAccessGrantsEnabled ?? false,
+                    })),
+                },
+            },
+        }));
+    }
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources });
+}
+/** Collect Realm configurations from children */
+function collectRealms(children) {
+    const realms = [];
+    if (!children)
+        return realms;
+    const childArray = Array.isArray(children) ? children : [children];
+    for (const child of childArray) {
+        if (child && typeof child === 'object' && 'type' in child) {
+            if (child.type === components_1.Realms) {
+                const realmsProps = child.props;
+                const realmChildren = Array.isArray(realmsProps.children)
+                    ? realmsProps.children
+                    : [realmsProps.children];
+                for (const realmChild of realmChildren) {
+                    if (realmChild &&
+                        typeof realmChild === 'object' &&
+                        'type' in realmChild &&
+                        realmChild.type === components_1.Realm) {
+                        const realmProps = realmChild.props;
+                        const clients = collectClients(realmProps.children);
+                        // Merge identity providers from both prop and child components
+                        const identityProviders = [
+                            ...(realmProps.identityProviders ?? []),
+                            ...collectIdentityProviders(realmProps.children),
+                        ];
+                        realms.push({
+                            id: realmProps.id,
+                            displayName: realmProps.displayName,
+                            enabled: realmProps.enabled,
+                            identityProviders,
+                            clients,
+                        });
+                    }
+                }
+            }
+            else if (child.type === components_1.Realm) {
+                const realmProps = child.props;
+                const clients = collectClients(realmProps.children);
+                // Merge identity providers from both prop and child components
+                const identityProviders = [
+                    ...(realmProps.identityProviders ?? []),
+                    ...collectIdentityProviders(realmProps.children),
+                ];
+                realms.push({
+                    id: realmProps.id,
+                    displayName: realmProps.displayName,
+                    enabled: realmProps.enabled,
+                    identityProviders,
+                    clients,
+                });
+            }
+        }
+    }
+    return realms;
+}
+/** Collect Client configurations from children */
+function collectClients(children) {
+    const clients = [];
+    if (!children)
+        return clients;
+    const childArray = Array.isArray(children) ? children : [children];
+    for (const child of childArray) {
+        if (child && typeof child === 'object' && 'type' in child) {
+            if (child.type === components_1.Clients) {
+                const clientsProps = child.props;
+                const clientChildren = Array.isArray(clientsProps.children)
+                    ? clientsProps.children
+                    : [clientsProps.children];
+                for (const clientChild of clientChildren) {
+                    if (clientChild &&
+                        typeof clientChild === 'object' &&
+                        'type' in clientChild &&
+                        clientChild.type === components_1.Client) {
+                        clients.push(clientChild.props);
+                    }
+                }
+            }
+            else if (child.type === components_1.Client) {
+                clients.push(child.props);
+            }
+        }
+    }
+    return clients;
+}
+/** Collect IdentityProvider configurations from children */
+function collectIdentityProviders(children) {
+    const identityProviders = [];
+    if (!children)
+        return identityProviders;
+    const childArray = Array.isArray(children) ? children : [children];
+    for (const child of childArray) {
+        if (child && typeof child === 'object' && 'type' in child) {
+            if (child.type === components_1.EntraID) {
+                const entraProps = child.props;
+                identityProviders.push({
+                    alias: 'entra-id',
+                    displayName: entraProps.displayName ?? 'Entra ID',
+                    providerId: 'oidc',
+                    enabled: entraProps.enabled ?? true,
+                    trustEmail: entraProps.trustEmail ?? true,
+                    config: {
+                        clientId: entraProps.clientId,
+                        clientSecret: entraProps.clientSecret,
+                        tokenUrl: `https://login.microsoftonline.com/${entraProps.tenantId}/oauth2/v2.0/token`,
+                        authorizationUrl: `https://login.microsoftonline.com/${entraProps.tenantId}/oauth2/v2.0/authorize`,
+                    },
+                });
+            }
+            else if (child.type === components_1.Google) {
+                const googleProps = child.props;
+                identityProviders.push({
+                    alias: 'google',
+                    displayName: googleProps.displayName ?? 'Google',
+                    providerId: 'oidc',
+                    enabled: googleProps.enabled ?? true,
+                    trustEmail: googleProps.trustEmail ?? true,
+                    config: {
+                        clientId: googleProps.clientId,
+                        clientSecret: googleProps.clientSecret,
+                    },
+                });
+            }
+        }
+    }
+    return identityProviders;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.tsx"],"names":[],"mappings":";;AA4GA,oBAmHC;AA/ND,oCAAsE;AACtE,iDAA+D;AAC/D,oCAAqC;AACrC,yCAAqC;AACrC,yCAAqC;AAErC,kDAU0B;AAmB1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,SAAgB,IAAI,CAAC,KAAgB;IACnC,MAAM,EACJ,IAAI,EACJ,IAAI,EACJ,SAAS,EAAE,aAAa,EACxB,SAAS,GAAG,CAAC,EACb,OAAO,GAAG,MAAM,EAChB,GAAG,EACH,QAAQ,GACT,GAAG,KAAK,CAAA;IAET,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAA,iBAAU,EAAC,oBAAS,CAAC,CAAA;IAC9C,MAAM,SAAS,GACb,aAAa,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAA;IAE/F,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IACnD,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAA;IACjF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;IAEhE,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,4CAA4C;IAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,0DAA0D;IAC1D,6EAA6E;IAC7E,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,mBAAQ,EAAE;QACZ,IAAI,EAAE,GAAG,IAAI,KAAK;QAClB,SAAS;QACT,OAAO;QACP,QAAQ,EAAE,IAAA,UAAG,EAAC,UAAU,EAAE;YACxB,UAAU,EAAE,2BAA2B;YACvC,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7B,IAAI,EAAE;gBACJ,SAAS;gBACT,QAAQ,EAAE;oBACR,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,KAAK;oBACb,iBAAiB,EAAE,KAAK;iBACzB;gBACD,KAAK,EAAE;oBACL,OAAO,EAAE,YAAY;iBACtB;gBACD,OAAO,EAAE;oBACP,OAAO,EAAE,KAAK,EAAE,sCAAsC;iBACvD;gBACD,WAAW,EAAE;oBACX,SAAS,EAAE,KAAK;iBACjB;aACF;SACF,CAAC;KACH,CAAC,CACH,CAAA;IAED,6BAA6B;IAC7B,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,mBAAQ,EAAE;QACZ,IAAI,EAAE,GAAG,IAAI,WAAW;QACxB,SAAS;QACT,IAAI;QACJ,WAAW,EAAE,GAAG,IAAI,UAAU;QAC9B,WAAW,EAAE,IAAI;QACjB,GAAG;KACJ,CAAC,CACH,CAAA;IAED,oEAAoE;IACpE,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,qBAAqB,EAAE;YACzB,UAAU,EAAE,2BAA2B;YACvC,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE;YACpD,IAAI,EAAE;gBACJ,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,KAAK,EAAE,KAAK,CAAC,EAAE;oBACf,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;oBAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;wBACxD,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,WAAW,EAAE,GAAG,CAAC,WAAW;wBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;wBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;wBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,KAAK;wBACnC,MAAM,EAAE,GAAG,CAAC,MAAM;qBACnB,CAAC,CAAC;oBACH,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;wBACvC,QAAQ,EAAE,MAAM,CAAC,EAAE;wBACnB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE;wBAC9B,YAAY,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ;wBACtC,mBAAmB,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ;wBAC7C,UAAU,EAAE,MAAM,CAAC,IAAI,KAAK,aAAa;wBACzC,sBAAsB,EAAE,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;wBACzE,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,yBAAyB,EAAE,MAAM,CAAC,yBAAyB,IAAI,KAAK;qBACrE,CAAC,CAAC;iBACJ;aACF;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED,iDAAiD;AACjD,SAAS,aAAa,CAAC,QAAiB;IACtC,MAAM,MAAM,GAAkB,EAAE,CAAA;IAEhC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAA;IAE5B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAM,EAAE,CAAC;gBAC1B,MAAM,WAAW,GAAI,KAAa,CAAC,KAAK,CAAA;gBACxC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC;oBACvD,CAAC,CAAC,WAAW,CAAC,QAAQ;oBACtB,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;gBAC1B,KAAK,MAAM,UAAU,IAAI,aAAa,EAAE,CAAC;oBACvC,IACE,UAAU;wBACV,OAAO,UAAU,KAAK,QAAQ;wBAC9B,MAAM,IAAI,UAAU;wBACpB,UAAU,CAAC,IAAI,KAAK,kBAAK,EACzB,CAAC;wBACD,MAAM,UAAU,GAAI,UAAkB,CAAC,KAAK,CAAA;wBAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;wBACnD,+DAA+D;wBAC/D,MAAM,iBAAiB,GAAG;4BACxB,GAAG,CAAC,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAC;4BACvC,GAAG,wBAAwB,CAAC,UAAU,CAAC,QAAQ,CAAC;yBACjD,CAAA;wBACD,MAAM,CAAC,IAAI,CAAC;4BACV,EAAE,EAAE,UAAU,CAAC,EAAE;4BACjB,WAAW,EAAE,UAAU,CAAC,WAAW;4BACnC,OAAO,EAAE,UAAU,CAAC,OAAO;4BAC3B,iBAAiB;4BACjB,OAAO;yBACR,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAK,EAAE,CAAC;gBAChC,MAAM,UAAU,GAAI,KAAa,CAAC,KAAK,CAAA;gBACvC,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;gBACnD,+DAA+D;gBAC/D,MAAM,iBAAiB,GAAG;oBACxB,GAAG,CAAC,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAC;oBACvC,GAAG,wBAAwB,CAAC,UAAU,CAAC,QAAQ,CAAC;iBACjD,CAAA;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,UAAU,CAAC,EAAE;oBACjB,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,iBAAiB;oBACjB,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,kDAAkD;AAClD,SAAS,cAAc,CAAC,QAAiB;IACvC,MAAM,OAAO,GAAmB,EAAE,CAAA;IAElC,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAA;IAE7B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAO,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAI,KAAa,CAAC,KAAK,CAAA;gBACzC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC;oBACzD,CAAC,CAAC,YAAY,CAAC,QAAQ;oBACvB,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;gBAC3B,KAAK,MAAM,WAAW,IAAI,cAAc,EAAE,CAAC;oBACzC,IACE,WAAW;wBACX,OAAO,WAAW,KAAK,QAAQ;wBAC/B,MAAM,IAAI,WAAW;wBACrB,WAAW,CAAC,IAAI,KAAK,mBAAM,EAC3B,CAAC;wBACD,OAAO,CAAC,IAAI,CAAE,WAAmB,CAAC,KAAK,CAAC,CAAA;oBAC1C,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAM,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAE,KAAa,CAAC,KAAK,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,4DAA4D;AAC5D,SAAS,wBAAwB,CAAC,QAAiB;IACjD,MAAM,iBAAiB,GAA6B,EAAE,CAAA;IAEtD,IAAI,CAAC,QAAQ;QAAE,OAAO,iBAAiB,CAAA;IAEvC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAO,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAI,KAAa,CAAC,KAAK,CAAA;gBACvC,iBAAiB,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE,UAAU;oBACjB,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,UAAU;oBACjD,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI;oBACnC,UAAU,EAAE,UAAU,CAAC,UAAU,IAAI,IAAI;oBACzC,MAAM,EAAE;wBACN,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;wBACrC,QAAQ,EAAE,qCAAqC,UAAU,CAAC,QAAQ,oBAAoB;wBACtF,gBAAgB,EAAE,qCAAqC,UAAU,CAAC,QAAQ,wBAAwB;qBACnG;iBACF,CAAC,CAAA;YACJ,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAM,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAI,KAAa,CAAC,KAAK,CAAA;gBACxC,iBAAiB,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE,QAAQ;oBACf,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,QAAQ;oBAChD,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,IAAI;oBACpC,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,IAAI;oBAC1C,MAAM,EAAE;wBACN,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;qBACvC;iBACF,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,CAAA;AAC1B,CAAC"}

package/dist/backup.d.ts

@@ -0,0 +1,45 @@
+export interface BackupProps {
+    /** Resource name */
+    name: string;
+    /** Default namespace to back up (used when `namespaces` is not set) */
+    namespace?: string;
+    /** Cron schedule for backups (defaults to daily at 2 AM) */
+    schedule?: string;
+    /** Namespaces to include in backups (defaults to the current namespace) */
+    namespaces?: string[];
+    /** Velero storage location name (defaults to 'default') */
+    storageLocation?: string;
+    /** Backup retention (e.g., '720h' for 30 days) */
+    ttl?: string;
+}
+/**
+ * Backup — scheduled cluster backups with Velero.
+ *
+ * @title Backup
+ * @category Security & Identity
+ *
+ * Creates a Velero Schedule that backs up your namespaces on a cron
+ * schedule. Pair with a BackupStorageLocation (S3/GCS/Azure) for
+ * off-cluster storage.
+ *
+ * The Velero operator is declared as a dependency.
+ *
+ * @example
+ * import { Backup } from '@r8s/recipes'
+ *
+ * export default <Backup name="daily" />
+ *
+ * @example
+ * import { Backup } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Backup
+ *     name="weekly"
+ *     schedule="0 3 * * 0"
+ *     namespaces={['production', 'staging']}
+ *     ttl="720h"
+ *   />
+ * )
+ */
+export declare function Backup(props: BackupProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=backup.d.ts.map

package/dist/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../src/backup.tsx"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,kCAoCxC"}

package/dist/backup.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Backup = Backup;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const crds_1 = require("@r8s/crds");
+/**
+ * Backup — scheduled cluster backups with Velero.
+ *
+ * @title Backup
+ * @category Security & Identity
+ *
+ * Creates a Velero Schedule that backs up your namespaces on a cron
+ * schedule. Pair with a BackupStorageLocation (S3/GCS/Azure) for
+ * off-cluster storage.
+ *
+ * The Velero operator is declared as a dependency.
+ *
+ * @example
+ * import { Backup } from '@r8s/recipes'
+ *
+ * export default <Backup name="daily" />
+ *
+ * @example
+ * import { Backup } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Backup
+ *     name="weekly"
+ *     schedule="0 3 * * 0"
+ *     namespaces={['production', 'staging']}
+ *     ttl="720h"
+ *   />
+ * )
+ */
+function Backup(props) {
+    const { name, namespace = 'default', schedule = '0 2 * * *', namespaces, storageLocation = 'default', ttl = '720h', } = props;
+    const sharedOperators = (0, core_1.useContext)(defaults_1.OperatorContext);
+    const hasVelero = sharedOperators.some((op) => op.name === 'velero');
+    const resources = [];
+    if (!hasVelero) {
+        resources.push((0, core_1.declareOperator)(crds_1.operators['velero']()));
+    }
+    resources.push((0, core_1.jsx)('Schedule', {
+        apiVersion: 'velero.io/v1',
+        kind: 'Schedule',
+        metadata: { name, namespace: 'velero' },
+        spec: {
+            schedule,
+            template: {
+                includedNamespaces: namespaces ?? [namespace],
+                storageLocation,
+                ttl,
+            },
+        },
+    }));
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources });
+}
+//# sourceMappingURL=backup.js.map

package/dist/backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../src/backup.tsx"],"names":[],"mappings":";;AAgDA,wBAoCC;AApFD,oCAAsE;AACtE,iDAAoD;AACpD,oCAAqC;AAiBrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,MAAM,CAAC,KAAkB;IACvC,MAAM,EACJ,IAAI,EACJ,SAAS,GAAG,SAAS,EACrB,QAAQ,GAAG,WAAW,EACtB,UAAU,EACV,eAAe,GAAG,SAAS,EAC3B,GAAG,GAAG,MAAM,GACb,GAAG,KAAK,CAAA;IAET,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAA;IAEpE,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,UAAU,EAAE;QACd,UAAU,EAAE,cAAc;QAC1B,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;QACvC,IAAI,EAAE;YACJ,QAAQ;YACR,QAAQ,EAAE;gBACR,kBAAkB,EAAE,UAAU,IAAI,CAAC,SAAS,CAAC;gBAC7C,eAAe;gBACf,GAAG;aACJ;SACF;KACF,CAAC,CACH,CAAA;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;AAC/C,CAAC"}

package/dist/cert-provider.d.ts

@@ -0,0 +1,78 @@
+/**
+ * CertManager configuration component.
+ *
+ * Use as a value in CertProvider when you need custom configuration:
+ * ```tsx
+ * <CertProvider provider={<CertManager clusterIssuer="letsencrypt-prod" />}>
+ * ```
+ */
+export interface CertManagerProps {
+    /** Default ClusterIssuer for certificates (default: 'letsencrypt-prod') */
+    clusterIssuer?: string;
+    /** Default certificate duration (default: '2160h' = 90 days) */
+    duration?: string;
+    /** Default renew before expiry (default: '360h' = 15 days) */
+    renewBefore?: string;
+}
+export declare function CertManager(props: CertManagerProps): CertConfig;
+/** Certificate provider configuration */
+export interface CertConfig {
+    /** Certificate provider type */
+    provider: 'cert-manager';
+    /** Provider-specific settings */
+    settings: {
+        /** Default ClusterIssuer */
+        clusterIssuer: string;
+        /** Default certificate duration */
+        duration: string;
+        /** Default renew before expiry */
+        renewBefore: string;
+    };
+}
+/** Union of all cert provider configurations */
+export type CertProviderValue = 'cert-manager' | CertConfig;
+export declare const CertContext: import("../../core/src/context").Context<CertConfig | null>;
+export interface CertProviderProps {
+    /**
+     * Certificate provider — string for simple cases, component for advanced config.
+     *
+     * @example
+     * // Simple string
+     * <CertProvider provider="cert-manager">
+     *
+     * @example
+     * // Advanced component
+     * <CertProvider provider={<CertManager clusterIssuer="letsencrypt-staging" />}>
+     */
+    provider: CertProviderValue;
+    /** Child components */
+    children?: unknown;
+}
+/**
+ * CertProvider — cluster-level certificate management.
+ *
+ * Sets up cert-manager for TLS certificates. All Endpoint/App children
+ * automatically get TLS certificates when tls prop is set.
+ *
+ * @example
+ * // Simple string provider
+ * import { CertProvider, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <CertProvider provider="cert-manager">
+ *     <App name="api" image="myapp:v1" host="api.example.com" tls={{ secretName: 'api-tls' }} />
+ *   </CertProvider>
+ * )
+ *
+ * @example
+ * // Advanced component provider
+ * import { CertProvider, CertManager, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <CertProvider provider={<CertManager clusterIssuer="letsencrypt-staging" duration="168h" />}>
+ *     <App name="api" image="myapp:v1" host="api.example.com" tls={{ secretName: 'api-tls' }} />
+ *   </CertProvider>
+ * )
+ */
+export declare function CertProvider(props: CertProviderProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=cert-provider.d.ts.map

package/dist/cert-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-provider.d.ts","sourceRoot":"","sources":["../src/cert-provider.tsx"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAS/D;AAED,yCAAyC;AACzC,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,QAAQ,EAAE,cAAc,CAAA;IACxB,iCAAiC;IACjC,QAAQ,EAAE;QACR,4BAA4B;QAC5B,aAAa,EAAE,MAAM,CAAA;QACrB,mCAAmC;QACnC,QAAQ,EAAE,MAAM,CAAA;QAChB,kCAAkC;QAClC,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED,gDAAgD;AAChD,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,UAAU,CAAA;AAE3D,eAAO,MAAM,WAAW,6DAAyC,CAAA;AAEjE,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,kCA6BpD"}

package/dist/cert-provider.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertContext = void 0;
+exports.CertManager = CertManager;
+exports.CertProvider = CertProvider;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const defaults_2 = require("@r8s/core/defaults");
+const crds_1 = require("@r8s/crds");
+function CertManager(props) {
+    return {
+        provider: 'cert-manager',
+        settings: {
+            clusterIssuer: props.clusterIssuer ?? 'letsencrypt-prod',
+            duration: props.duration ?? '2160h',
+            renewBefore: props.renewBefore ?? '360h',
+        },
+    };
+}
+exports.CertContext = (0, defaults_1.createContext)(null);
+/**
+ * CertProvider — cluster-level certificate management.
+ *
+ * Sets up cert-manager for TLS certificates. All Endpoint/App children
+ * automatically get TLS certificates when tls prop is set.
+ *
+ * @example
+ * // Simple string provider
+ * import { CertProvider, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <CertProvider provider="cert-manager">
+ *     <App name="api" image="myapp:v1" host="api.example.com" tls={{ secretName: 'api-tls' }} />
+ *   </CertProvider>
+ * )
+ *
+ * @example
+ * // Advanced component provider
+ * import { CertProvider, CertManager, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <CertProvider provider={<CertManager clusterIssuer="letsencrypt-staging" duration="168h" />}>
+ *     <App name="api" image="myapp:v1" host="api.example.com" tls={{ secretName: 'api-tls' }} />
+ *   </CertProvider>
+ * )
+ */
+function CertProvider(props) {
+    const { provider, children } = props;
+    const sharedOperators = (0, core_1.useContext)(defaults_2.OperatorContext);
+    // Resolve provider config
+    const config = typeof provider === 'string'
+        ? {
+            provider,
+            settings: {
+                clusterIssuer: 'letsencrypt-prod',
+                duration: '2160h',
+                renewBefore: '360h',
+            },
+        }
+        : provider;
+    const resources = [];
+    // Declare cert-manager operator
+    const hasCertManager = sharedOperators.some((op) => op.name === 'cert-manager');
+    if (!hasCertManager) {
+        resources.push((0, core_1.declareOperator)(crds_1.operators['cert-manager']()));
+    }
+    return (0, core_1.jsx)(core_1.Fragment, {
+        children: [...resources, (0, core_1.jsx)(exports.CertContext.Provider, { value: config, children })],
+    });
+}
+//# sourceMappingURL=cert-provider.js.map

package/dist/cert-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-provider.js","sourceRoot":"","sources":["../src/cert-provider.tsx"],"names":[],"mappings":";;;AAsBA,kCASC;AAiED,oCA6BC;AA7HD,oCAAsE;AACtE,iDAAkD;AAClD,iDAAoD;AACpD,oCAAqC;AAmBrC,SAAgB,WAAW,CAAC,KAAuB;IACjD,OAAO;QACL,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE;YACR,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,kBAAkB;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO;YACnC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM;SACzC;KACF,CAAA;AACH,CAAC;AAoBY,QAAA,WAAW,GAAG,IAAA,wBAAa,EAAoB,IAAI,CAAC,CAAA;AAmBjE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAgB,YAAY,CAAC,KAAwB;IACnD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAEpC,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IAEnD,0BAA0B;IAC1B,MAAM,MAAM,GACV,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC;YACE,QAAQ;YACR,QAAQ,EAAE;gBACR,aAAa,EAAE,kBAAkB;gBACjC,QAAQ,EAAE,OAAO;gBACjB,WAAW,EAAE,MAAM;aACpB;SACF;QACH,CAAC,CAAC,QAAQ,CAAA;IAEd,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,gCAAgC;IAChC,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;IAC/E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,IAAA,UAAG,EAAC,mBAAW,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;KACjF,CAAC,CAAA;AACJ,CAAC"}

package/dist/database.d.ts

@@ -0,0 +1,49 @@
+export interface DatabaseProps {
+    /** Resource name (also the default database name) */
+    name: string;
+    /** Kubernetes namespace (defaults to 'default') */
+    namespace?: string;
+    /** Storage size (e.g., '10Gi') for the dedicated cluster data volume */
+    storage?: string;
+    /** Operator version override. If not set, reads from OperatorContext or uses default. */
+    operatorVersion?: string;
+    /**
+     * Password for the database. Only needed when no secrets backend is
+     * configured on the Platform. When a secrets backend (openbao, vault,
+     * sealed-secrets) is active, credentials are managed automatically.
+     */
+    password?: string;
+    /** Child components rendered with this database's connection info in context */
+    children?: unknown;
+}
+/**
+ * CloudNativePG PostgreSQL database.
+ *
+ * @title Database
+ * @category Data & Analytics
+ *
+ * Creates a dedicated 3-instance HA CloudNativePG cluster for this database.
+ * When wrapped in a `<Database>` component, child components receive the
+ * connection info via DatabaseContext automatically.
+ *
+ * Credentials are managed by the secrets backend configured on the Platform.
+ * Without a secrets backend, CNPG manages the bootstrap secret automatically.
+ *
+ * @example
+ * import { Database } from '@r8s/recipes'
+ *
+ * export default <Database name="app-db" storage="10Gi" />
+ *
+ * @example
+ * import { Platform, Database, WebService } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao' }}>
+ *     <Database name="app-db" storage="10Gi">
+ *       <WebService name="api" image="myapp/api:v1" />
+ *     </Database>
+ *   </Platform>
+ * )
+ */
+export declare function Database(props: DatabaseProps): import("@r8s/core").r8sElement[];
+//# sourceMappingURL=database.d.ts.map

package/dist/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../src/database.tsx"],"names":[],"mappings":"AAWA,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,oCA6G5C"}