alchemy-kubernetes-addons 0.1.0-alpha.0

package/dist/index.mjs

@@ -0,0 +1,1600 @@
+import { RandomProvider, Resource, Stack, Stage, isResolved, makeRandom } from "alchemy";
+import * as Output from "alchemy/Output";
+import * as Provider from "alchemy/Provider";
+import * as Kubernetes from "alchemy/Kubernetes";
+import { findClusterAdapter, toConnection } from "alchemy/Kubernetes";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Duration from "effect/Duration";
+import { request } from "node:http";
+import { request as request$1 } from "node:https";
+import { createHash } from "node:crypto";
+import * as Cloudflare from "alchemy/Cloudflare";
+import { encodeBase64, hashSync, truncates } from "bcryptjs";
+//#region src/client.ts
+var KubernetesApiError = class extends Error {
+	statusCode;
+	body;
+	name = "KubernetesApiError";
+	constructor(statusCode, body) {
+		super(`Kubernetes API returned ${String(statusCode)}`);
+		this.statusCode = statusCode;
+		this.body = body;
+	}
+};
+const connectCluster = Effect.fn(function* (cluster) {
+	const connection = toConnection(cluster);
+	return {
+		connection,
+		transport: yield* (yield* findClusterAdapter(connection.auth.kind)).connect(connection)
+	};
+});
+const plurals = /* @__PURE__ */ new Map([
+	["v1/Secret", "secrets"],
+	["apiextensions.k8s.io/v1/CustomResourceDefinition", "customresourcedefinitions"],
+	["apps/v1/Deployment", "deployments"],
+	["apps/v1/DaemonSet", "daemonsets"],
+	["apps/v1/StatefulSet", "statefulsets"],
+	["batch/v1/Job", "jobs"],
+	["cert-manager.io/v1/ClusterIssuer", "clusterissuers"]
+]);
+const clusterScopedKinds = /* @__PURE__ */ new Set(["CustomResourceDefinition", "ClusterIssuer"]);
+const objectPath = (object) => {
+	const plural = plurals.get(`${object.apiVersion}/${object.kind}`);
+	if (plural === void 0) throw new Error(`Readiness is not implemented for ${object.apiVersion}/${object.kind}`);
+	return `${object.apiVersion === "v1" ? "/api/v1" : `/apis/${object.apiVersion}`}${clusterScopedKinds.has(object.kind) ? "" : `/namespaces/${encodeURIComponent(object.namespace ?? "default")}`}/${plural}/${encodeURIComponent(object.name)}`;
+};
+const requestJson = Effect.fn(function* ({ transport, method, path, body, timeoutMs = 3e4 }) {
+	const headers = yield* transport.headers;
+	const url = new URL(path, transport.endpoint);
+	if (url.protocol !== "http:" && url.protocol !== "https:") return yield* Effect.fail(/* @__PURE__ */ new Error(`Unsupported Kubernetes API protocol: ${url.protocol}`));
+	if (url.protocol === "http:" && ![
+		"127.0.0.1",
+		"::1",
+		"localhost"
+	].includes(url.hostname)) return yield* Effect.fail(/* @__PURE__ */ new Error("Refusing to send Kubernetes credentials over remote HTTP"));
+	const payload = body === void 0 ? void 0 : JSON.stringify(body);
+	return yield* Effect.tryPromise({
+		try: () => new Promise((resolve, reject) => {
+			const request$2 = (url.protocol === "https:" ? request$1 : request)({
+				protocol: url.protocol,
+				hostname: url.hostname,
+				port: url.port || void 0,
+				path: `${url.pathname}${url.search}`,
+				method,
+				headers: {
+					...headers,
+					Accept: "application/json",
+					...payload === void 0 ? {} : {
+						"Content-Type": "application/apply-patch+yaml",
+						"Content-Length": Buffer.byteLength(payload)
+					}
+				},
+				...url.protocol === "https:" && transport.certificateAuthorityData !== void 0 ? { ca: Buffer.from(transport.certificateAuthorityData, "base64").toString("utf8") } : {},
+				...url.protocol === "https:" && transport.clientCert !== void 0 ? {
+					cert: transport.clientCert.certificate,
+					key: transport.clientCert.key
+				} : {},
+				...url.protocol === "https:" && transport.insecureSkipTlsVerify ? { rejectUnauthorized: false } : {}
+			}, (response) => {
+				const chunks = [];
+				response.on("data", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+				response.on("end", () => {
+					const responseBody = Buffer.concat(chunks).toString("utf8");
+					const statusCode = response.statusCode ?? 500;
+					if (statusCode < 200 || statusCode >= 300) {
+						reject(new KubernetesApiError(statusCode, responseBody));
+						return;
+					}
+					if (responseBody.trim().length === 0) {
+						resolve(void 0);
+						return;
+					}
+					try {
+						resolve(JSON.parse(responseBody));
+					} catch {
+						reject(/* @__PURE__ */ new Error("Kubernetes API returned invalid JSON"));
+					}
+				});
+			});
+			request$2.setTimeout(timeoutMs, () => request$2.destroy(/* @__PURE__ */ new Error("Kubernetes API request timed out")));
+			request$2.on("error", reject);
+			if (payload !== void 0) request$2.write(payload);
+			request$2.end();
+		}),
+		catch: (error) => error instanceof KubernetesApiError ? error : /* @__PURE__ */ new Error("Kubernetes API request failed")
+	});
+});
+const conditionSummary = (conditions) => conditions.filter(({ type }) => [
+	"Established",
+	"NamesAccepted",
+	"Progressing",
+	"Available",
+	"ReplicaFailure",
+	"Complete",
+	"Failed",
+	"FailureTarget",
+	"SuccessCriteriaMet",
+	"Suspended",
+	"Ready"
+].includes(type ?? "")).map(({ type, status }) => `${type}=${[
+	"True",
+	"False",
+	"Unknown"
+].includes(status ?? "") ? status : "Unknown"}`).join(", ") || "none";
+const count = (value) => {
+	if (typeof value !== "number" || !Number.isFinite(value)) return 0;
+	return value;
+};
+const kubernetesObjectReadiness = (object) => {
+	const value = object;
+	const generation = count(value.metadata?.generation);
+	const observed = count(value.status?.observedGeneration);
+	const conditions = value.status?.conditions ?? [];
+	const summary = conditionSummary(conditions);
+	if (value.kind === "CustomResourceDefinition") return {
+		ready: conditions.some(({ type, status }) => type === "Established" && status === "True"),
+		terminal: conditions.some(({ type, status }) => type === "NamesAccepted" && status === "False"),
+		detail: `conditions: ${summary}`
+	};
+	if (value.kind === "Deployment") {
+		const desired = value.spec?.replicas === void 0 ? 1 : count(value.spec.replicas);
+		const available = count(value.status?.availableReplicas);
+		return {
+			ready: observed >= generation && available >= desired,
+			terminal: conditions.some(({ type, status, reason }) => type === "Progressing" && status === "False" && reason === "ProgressDeadlineExceeded"),
+			detail: `observedGeneration=${String(observed)}/${String(generation)}, availableReplicas=${String(available)}/${String(desired)}, conditions: ${summary}`
+		};
+	}
+	if (value.kind === "DaemonSet") {
+		const desired = count(value.status?.desiredNumberScheduled);
+		const available = count(value.status?.numberAvailable);
+		return {
+			ready: observed >= generation && available >= desired,
+			terminal: false,
+			detail: `observedGeneration=${String(observed)}/${String(generation)}, numberAvailable=${String(available)}/${String(desired)}, conditions: ${summary}`
+		};
+	}
+	if (value.kind === "StatefulSet") {
+		const desired = value.spec?.replicas === void 0 ? 1 : count(value.spec.replicas);
+		const ready = count(value.status?.readyReplicas);
+		return {
+			ready: observed >= generation && ready >= desired,
+			terminal: false,
+			detail: `observedGeneration=${String(observed)}/${String(generation)}, readyReplicas=${String(ready)}/${String(desired)}, conditions: ${summary}`
+		};
+	}
+	if (value.kind === "Job") return {
+		ready: conditions.some(({ type, status }) => type === "Complete" && status === "True"),
+		terminal: conditions.some(({ type, status }) => type === "Failed" && status === "True"),
+		detail: `conditions: ${summary}`
+	};
+	if (value.kind === "ClusterIssuer") return {
+		ready: conditions.some(({ type, status }) => type === "Ready" && status === "True"),
+		terminal: false,
+		detail: `conditions: ${summary}`
+	};
+	return {
+		ready: true,
+		terminal: false,
+		detail: "no readiness gate"
+	};
+};
+const waitedKinds = /* @__PURE__ */ new Set([
+	"CustomResourceDefinition",
+	"Deployment",
+	"DaemonSet",
+	"StatefulSet",
+	"Job",
+	"ClusterIssuer"
+]);
+const objectLabel = (object) => `${object.apiVersion}/${object.kind} ${object.namespace ? `${object.namespace}/` : ""}${object.name}`;
+var KubernetesReadinessError = class extends Error {
+	object;
+	timedOut;
+	name = "KubernetesReadinessError";
+	constructor(message, object, timedOut) {
+		super(message);
+		this.object = object;
+		this.timedOut = timedOut;
+	}
+};
+const waitForObjectsReady = Effect.fn(function* ({ transport, objects, timeoutSeconds }) {
+	if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) return yield* Effect.fail(/* @__PURE__ */ new Error("Kubernetes readiness timeoutSeconds must be greater than zero"));
+	const waiting = objects.filter(({ kind }) => waitedKinds.has(kind));
+	if (waiting.length === 0) return;
+	const deadline = Date.now() + timeoutSeconds * 1e3;
+	let lastPending;
+	while (true) {
+		if (Date.now() >= deadline) {
+			const pending = lastPending ?? {
+				object: waiting[0],
+				readiness: { detail: "deadline reached" }
+			};
+			return yield* Effect.fail(new KubernetesReadinessError(`Timed out waiting for ${objectLabel(pending.object)}: ${pending.readiness.detail}`, pending.object, true));
+		}
+		lastPending = void 0;
+		for (const object of waiting) {
+			const remaining = deadline - Date.now();
+			if (remaining <= 0) break;
+			const observed = yield* requestJson({
+				transport,
+				method: "GET",
+				path: objectPath(object),
+				timeoutMs: Math.min(3e4, remaining)
+			}).pipe(Effect.catchIf((error) => error instanceof KubernetesApiError && error.statusCode === 404, () => Effect.succeed(void 0)), Effect.mapError((error) => new KubernetesReadinessError(`Failed to inspect ${objectLabel(object)}${error instanceof KubernetesApiError ? `: Kubernetes API returned ${String(error.statusCode)}` : ""}`, object, false)));
+			const readiness = observed === void 0 ? {
+				ready: false,
+				terminal: false,
+				detail: "object not found"
+			} : kubernetesObjectReadiness(observed);
+			if (readiness.terminal) return yield* Effect.fail(new KubernetesReadinessError(`${objectLabel(object)} reached a terminal failure: ${readiness.detail}`, object, false));
+			if (!readiness.ready && lastPending === void 0) lastPending = {
+				object,
+				readiness
+			};
+		}
+		if (lastPending === void 0 && Date.now() < deadline) return;
+		if (Date.now() >= deadline) {
+			const pending = lastPending ?? {
+				object: waiting[0],
+				readiness: { detail: "deadline reached" }
+			};
+			return yield* Effect.fail(new KubernetesReadinessError(`Timed out waiting for ${objectLabel(pending.object)}: ${pending.readiness.detail}`, pending.object, true));
+		}
+		yield* Effect.sleep(Duration.millis(Math.min(2e3, deadline - Date.now())));
+	}
+});
+//#endregion
+//#region src/cloudflare-external-dns.ts
+const EXTERNAL_DNS_CHART_VERSION = "1.21.1";
+const EXTERNAL_DNS_IMAGE_REPOSITORY = "registry.k8s.io/external-dns/external-dns";
+const EXTERNAL_DNS_IMAGE_TAG = `v0.21.0@sha256:f53faaf71cb270d1ca9dce6ea0c94bfebf1a18696263487f0fbc74b9bf2bd7ff`;
+const EXTERNAL_DNS_IMAGE = `${EXTERNAL_DNS_IMAGE_REPOSITORY}:${EXTERNAL_DNS_IMAGE_TAG}`;
+const kubernetesName$5 = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
+const cloudflareExternalDnsOwnerId = (stack, stage, logicalId) => {
+	const identity = `${stack}/${stage}/${logicalId}`;
+	return `${identity.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 48) || "external-dns"}-${createHash("sha256").update(identity).digest("hex").slice(0, 12)}`;
+};
+const cloudflareExternalDnsTokenPolicies = (zoneId) => [{
+	effect: "allow",
+	permissionGroups: [
+		"Zone Read",
+		"DNS Read",
+		"DNS Write"
+	],
+	resources: { [`com.cloudflare.api.account.zone.${zoneId}`]: "*" }
+}];
+const validateCloudflareExternalDnsProps = (props) => {
+	const namespace = props.namespace ?? "external-dns";
+	const releaseName = props.releaseName ?? "external-dns";
+	if (!kubernetesName$5.test(namespace) || namespace.length > 63) throw new Error(`Invalid ExternalDNS namespace: ${namespace}`);
+	if (!kubernetesName$5.test(releaseName) || releaseName.length > 53) throw new Error(`Invalid ExternalDNS release name: ${releaseName}`);
+	if (props.policy !== "sync" && props.policy !== "upsert-only") throw new Error("ExternalDNS policy must be explicitly set to sync or upsert-only");
+	if (typeof props.tokenRevision === "string" && props.tokenRevision.trim() === "") throw new Error("ExternalDNS tokenRevision must not be empty");
+	if (props.timeoutSeconds !== void 0 && (!Number.isFinite(props.timeoutSeconds) || props.timeoutSeconds <= 0)) throw new Error("ExternalDNS timeoutSeconds must be greater than zero");
+};
+const planCloudflareExternalDns = ({ zoneId, domain, policy, proxied, releaseName, txtOwnerId, secretName, namespaceRevision, secretRevision, tokenRevision }) => ({ values: {
+	fullnameOverride: releaseName,
+	image: {
+		repository: EXTERNAL_DNS_IMAGE_REPOSITORY,
+		tag: EXTERNAL_DNS_IMAGE_TAG,
+		pullPolicy: "IfNotPresent"
+	},
+	replicaCount: 1,
+	deploymentStrategy: { type: "Recreate" },
+	provider: { name: "cloudflare" },
+	sources: ["service", "ingress"],
+	policy,
+	registry: "txt",
+	txtOwnerId,
+	domainFilters: [domain],
+	triggerLoopOnEvent: true,
+	extraArgs: {
+		"zone-id-filter": zoneId,
+		"cloudflare-proxied": proxied,
+		"cloudflare-dns-records-per-page": 5e3
+	},
+	env: [{
+		name: "CF_API_TOKEN",
+		valueFrom: { secretKeyRef: {
+			name: secretName,
+			key: "api-token"
+		} }
+	}],
+	serviceAccount: {
+		create: true,
+		automountServiceAccountToken: true
+	},
+	automountServiceAccountToken: true,
+	rbac: { create: true },
+	namespaced: false,
+	service: { enabled: true },
+	serviceMonitor: { enabled: false },
+	resources: {
+		requests: {
+			cpu: "10m",
+			memory: "64Mi"
+		},
+		limits: { memory: "128Mi" }
+	},
+	podSecurityContext: {
+		runAsNonRoot: true,
+		fsGroup: 65534,
+		seccompProfile: { type: "RuntimeDefault" }
+	},
+	securityContext: {
+		privileged: false,
+		allowPrivilegeEscalation: false,
+		readOnlyRootFilesystem: true,
+		runAsNonRoot: true,
+		runAsUser: 65532,
+		runAsGroup: 65532,
+		capabilities: { drop: ["ALL"] }
+	},
+	podAnnotations: {
+		"alchemy.run/namespace-revision": namespaceRevision,
+		"alchemy.run/secret-revision": secretRevision,
+		...tokenRevision === void 0 ? {} : { "alchemy.run/token-revision": tokenRevision }
+	}
+} });
+/** Install a zone-scoped Cloudflare ExternalDNS controller. */
+const CloudflareExternalDns = (id, props) => Effect.gen(function* () {
+	yield* Effect.try(() => validateCloudflareExternalDnsProps(props));
+	const stack = yield* Stack;
+	const stage = yield* Stage;
+	const namespaceName = props.namespace ?? "external-dns";
+	const releaseName = props.releaseName ?? "external-dns";
+	const txtOwnerId = cloudflareExternalDnsOwnerId(stack.name, stage, id);
+	const secretName = `${releaseName}-token`;
+	const namespace = yield* Kubernetes.Manifest(`${id}Namespace`, {
+		cluster: props.cluster,
+		manifest: {
+			apiVersion: "v1",
+			kind: "Namespace",
+			metadata: { name: namespaceName }
+		}
+	});
+	let token;
+	if (props.token === void 0) token = (yield* Cloudflare.ApiToken.AccountApiToken(`${id}Token`, {
+		accountId: props.zone.accountId,
+		policies: Output.map(props.zone.zoneId, (zoneId) => cloudflareExternalDnsTokenPolicies(zoneId))
+	})).value;
+	else token = props.token;
+	const secret = yield* Secret(`${id}Secret`, {
+		cluster: props.cluster,
+		namespace: namespace.name,
+		name: secretName,
+		stringData: { "api-token": token }
+	});
+	const namespaceRevision = Output.map(namespace.uid, (uid) => uid ?? "created");
+	const secretRevision = Output.map(secret.resourceVersion, (resourceVersion) => resourceVersion ?? "unknown");
+	const plan = planCloudflareExternalDns({
+		zoneId: props.zone.zoneId,
+		domain: props.zone.name,
+		policy: props.policy,
+		proxied: props.proxied ?? false,
+		releaseName,
+		txtOwnerId,
+		secretName,
+		namespaceRevision,
+		secretRevision,
+		tokenRevision: props.tokenRevision
+	});
+	yield* ReadyHelmChart(`${id}Chart`, {
+		cluster: props.cluster,
+		chart: "external-dns",
+		repo: "https://kubernetes-sigs.github.io/external-dns/",
+		version: EXTERNAL_DNS_CHART_VERSION,
+		releaseName,
+		namespace: namespaceName,
+		createNamespace: false,
+		timeoutSeconds: props.timeoutSeconds ?? 300,
+		values: plan.values
+	});
+	return {
+		zone: props.zone,
+		zoneId: props.zone.zoneId,
+		domain: props.zone.name,
+		namespace: namespaceName,
+		releaseName,
+		txtOwnerId,
+		tokenManaged: props.token === void 0
+	};
+});
+//#endregion
+//#region src/cert-manager.ts
+const CERT_MANAGER_CHART = "oci://quay.io/jetstack/charts/cert-manager";
+const CERT_MANAGER_CHART_VERSION = "v1.21.1";
+const CERT_MANAGER_IMAGE_VERSION = "v1.21.1";
+const kubernetesName$4 = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
+const validateCertManagerProps = (props) => {
+	const namespace = props.namespace ?? "cert-manager";
+	const releaseName = props.releaseName ?? "cert-manager";
+	if (!kubernetesName$4.test(namespace) || namespace.length > 63) throw new Error(`Invalid cert-manager namespace: ${namespace}`);
+	if (!kubernetesName$4.test(releaseName) || releaseName.length > 53) throw new Error(`Invalid cert-manager release name: ${releaseName}`);
+	if (props.timeoutSeconds !== void 0 && (!Number.isFinite(props.timeoutSeconds) || props.timeoutSeconds <= 0)) throw new Error("cert-manager timeoutSeconds must be greater than zero");
+};
+const certManagerHelmValues = (namespace, namespaceRevision) => ({
+	crds: {
+		enabled: true,
+		keep: true
+	},
+	startupapicheck: { enabled: false },
+	global: {
+		leaderElection: { namespace },
+		rbac: {
+			create: true,
+			aggregateClusterRoles: false
+		}
+	},
+	image: {
+		tag: CERT_MANAGER_IMAGE_VERSION,
+		pullPolicy: "IfNotPresent"
+	},
+	acmesolver: { image: {
+		tag: CERT_MANAGER_IMAGE_VERSION,
+		pullPolicy: "IfNotPresent"
+	} },
+	replicaCount: 1,
+	automountServiceAccountToken: true,
+	podAnnotations: { "alchemy.run/namespace-revision": namespaceRevision },
+	resources: {
+		requests: {
+			cpu: "10m",
+			memory: "64Mi"
+		},
+		limits: { memory: "256Mi" }
+	},
+	securityContext: {
+		runAsNonRoot: true,
+		seccompProfile: { type: "RuntimeDefault" }
+	},
+	containerSecurityContext: {
+		privileged: false,
+		allowPrivilegeEscalation: false,
+		readOnlyRootFilesystem: true,
+		capabilities: { drop: ["ALL"] }
+	},
+	webhook: {
+		replicaCount: 1,
+		timeoutSeconds: 10,
+		automountServiceAccountToken: true,
+		image: {
+			tag: CERT_MANAGER_IMAGE_VERSION,
+			pullPolicy: "IfNotPresent"
+		},
+		podAnnotations: { "alchemy.run/namespace-revision": namespaceRevision },
+		resources: {
+			requests: {
+				cpu: "10m",
+				memory: "32Mi"
+			},
+			limits: { memory: "128Mi" }
+		},
+		securityContext: {
+			runAsNonRoot: true,
+			seccompProfile: { type: "RuntimeDefault" }
+		},
+		containerSecurityContext: {
+			privileged: false,
+			allowPrivilegeEscalation: false,
+			readOnlyRootFilesystem: true,
+			capabilities: { drop: ["ALL"] }
+		}
+	},
+	cainjector: {
+		enabled: true,
+		replicaCount: 1,
+		automountServiceAccountToken: true,
+		image: {
+			tag: CERT_MANAGER_IMAGE_VERSION,
+			pullPolicy: "IfNotPresent"
+		},
+		podAnnotations: { "alchemy.run/namespace-revision": namespaceRevision },
+		resources: {
+			requests: {
+				cpu: "10m",
+				memory: "64Mi"
+			},
+			limits: { memory: "256Mi" }
+		},
+		securityContext: {
+			runAsNonRoot: true,
+			seccompProfile: { type: "RuntimeDefault" }
+		},
+		containerSecurityContext: {
+			privileged: false,
+			allowPrivilegeEscalation: false,
+			readOnlyRootFilesystem: true,
+			capabilities: { drop: ["ALL"] }
+		}
+	},
+	prometheus: {
+		enabled: true,
+		servicemonitor: { enabled: false }
+	}
+});
+/** Install cert-manager and wait for its CRDs and control plane. */
+const CertManager = (id, props) => Effect.gen(function* () {
+	yield* Effect.try(() => validateCertManagerProps(props));
+	const namespaceName = props.namespace ?? "cert-manager";
+	const releaseName = props.releaseName ?? "cert-manager";
+	const namespace = yield* Kubernetes.Manifest(`${id}Namespace`, {
+		cluster: props.cluster,
+		manifest: {
+			apiVersion: "v1",
+			kind: "Namespace",
+			metadata: { name: namespaceName }
+		}
+	});
+	const namespaceRevision = Output.map(namespace.uid, (uid) => uid ?? "created");
+	const chart = yield* Kubernetes.HelmChart(`${id}Chart`, {
+		cluster: props.cluster,
+		chart: CERT_MANAGER_CHART,
+		version: CERT_MANAGER_CHART_VERSION,
+		releaseName,
+		namespace: namespace.name,
+		createNamespace: false,
+		includeCrds: true,
+		values: certManagerHelmValues(namespaceName, namespaceRevision)
+	});
+	const readiness = yield* Readiness(`${id}Readiness`, {
+		cluster: chart.connection,
+		objects: chart.objects,
+		revision: chart.code.hash,
+		timeoutSeconds: props.timeoutSeconds ?? 300
+	});
+	return {
+		namespace: namespace.name,
+		clusterResourceNamespace: namespace.name,
+		releaseName,
+		chart,
+		readiness
+	};
+});
+//#endregion
+//#region src/cloudflare-acme-issuer.ts
+const LETSENCRYPT_STAGING_URL = "https://acme-staging-v02.api.letsencrypt.org/directory";
+const LETSENCRYPT_PRODUCTION_URL = "https://acme-v02.api.letsencrypt.org/directory";
+const kubernetesName$3 = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
+const cloudflareAcmeIssuerName = (id, environment) => {
+	const suffix = `-${environment}`;
+	return `${(id.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "letsencrypt").slice(0, 63 - suffix.length).replace(/-$/g, "")}${suffix}`;
+};
+const cloudflareAcmeIssuerTokenPolicies = (zoneId) => [{
+	effect: "allow",
+	permissionGroups: ["Zone Read", "DNS Write"],
+	resources: { [`com.cloudflare.api.account.zone.${zoneId}`]: "*" }
+}];
+const validateCloudflareAcmeIssuerProps = (props) => {
+	const name = props.name ?? cloudflareAcmeIssuerName("letsencrypt", props.environment);
+	if (!kubernetesName$3.test(name) || name.length > 63) throw new Error(`Invalid Cloudflare ACME issuer name: ${name}`);
+	if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(props.email)) throw new Error("Cloudflare ACME issuer email must be valid");
+	if (props.environment !== "staging" && props.environment !== "production") throw new Error("Cloudflare ACME environment must be staging or production");
+	if (props.timeoutSeconds !== void 0 && (!Number.isFinite(props.timeoutSeconds) || props.timeoutSeconds <= 0)) throw new Error("Cloudflare ACME timeoutSeconds must be greater than zero");
+};
+const cloudflareAcmeIssuerManifest = ({ name, email, environment, domain, tokenSecretName, accountKeySecretName, certManagerRevision, tokenSecretRevision }) => ({
+	apiVersion: "cert-manager.io/v1",
+	kind: "ClusterIssuer",
+	metadata: {
+		name,
+		annotations: {
+			"alchemy.run/cert-manager-revision": certManagerRevision,
+			"alchemy.run/token-secret-revision": tokenSecretRevision
+		}
+	},
+	spec: { acme: {
+		email,
+		server: environment === "staging" ? LETSENCRYPT_STAGING_URL : LETSENCRYPT_PRODUCTION_URL,
+		privateKeySecretRef: { name: accountKeySecretName },
+		solvers: [{
+			selector: { dnsZones: [domain] },
+			dns01: { cloudflare: { apiTokenSecretRef: {
+				name: tokenSecretName,
+				key: "api-token"
+			} } }
+		}]
+	} }
+});
+/** Create a zone-scoped Cloudflare DNS-01 ClusterIssuer. */
+const CloudflareAcmeIssuer = (id, props) => Effect.gen(function* () {
+	yield* Effect.try(() => validateCloudflareAcmeIssuerProps(props));
+	const name = props.name ?? cloudflareAcmeIssuerName(id, props.environment);
+	const tokenSecretName = `${name}-cloudflare`;
+	const accountKeySecretName = `${name}-account-key`;
+	let token;
+	if (props.token === void 0) token = (yield* Cloudflare.ApiToken.AccountApiToken(`${id}Token`, {
+		accountId: props.zone.accountId,
+		policies: Output.map(props.zone.zoneId, (zoneId) => cloudflareAcmeIssuerTokenPolicies(zoneId))
+	})).value;
+	else token = props.token;
+	const secret = yield* Secret(`${id}Secret`, {
+		cluster: props.cluster,
+		namespace: props.certManager.clusterResourceNamespace,
+		name: tokenSecretName,
+		stringData: { "api-token": token }
+	});
+	const tokenSecretRevision = Output.map(secret.resourceVersion, (resourceVersion) => resourceVersion ?? "unknown");
+	const issuer = yield* Kubernetes.Manifest(`${id}Issuer`, {
+		cluster: props.cluster,
+		manifest: cloudflareAcmeIssuerManifest({
+			name,
+			email: props.email,
+			environment: props.environment,
+			domain: props.zone.name,
+			tokenSecretName,
+			accountKeySecretName,
+			certManagerRevision: props.certManager.readiness.revision,
+			tokenSecretRevision
+		})
+	});
+	const readiness = yield* Readiness(`${id}Readiness`, {
+		cluster: issuer.connection,
+		objects: [issuer.ref],
+		revision: Output.map(issuer.uid, (uid) => uid ?? "applied"),
+		timeoutSeconds: props.timeoutSeconds ?? 300
+	});
+	const readyName = Output.map(readiness.revision, () => name);
+	return {
+		name: readyName,
+		issuerRef: {
+			name: readyName,
+			kind: "ClusterIssuer",
+			group: "cert-manager.io"
+		},
+		environment: props.environment,
+		tokenManaged: props.token === void 0,
+		tokenSecretName,
+		accountKeySecretName,
+		readiness
+	};
+});
+//#endregion
+//#region src/otel-collector.ts
+const OTEL_COLLECTOR_CHART_VERSION = "0.171.0";
+const OTEL_COLLECTOR_IMAGE_REPOSITORY = "otel/opentelemetry-collector-contrib";
+const OTEL_COLLECTOR_IMAGE_TAG = "0.158.0";
+const OTEL_COLLECTOR_IMAGE_DIGEST = "sha256:c5918f78992ee73b0d6f0e599423ac5ec52dd5d9726733114d6eca53d5a32ed5";
+const OTEL_COLLECTOR_IMAGE = `${OTEL_COLLECTOR_IMAGE_REPOSITORY}@${OTEL_COLLECTOR_IMAGE_DIGEST}`;
+const kubernetesName$2 = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
+const httpHeaderName = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const signals = [
+	"traces",
+	"logs",
+	"metrics"
+];
+const validateOtelCollectorProps = (props) => {
+	const authenticationNamespace = props.destination.authentication?.secretRef.namespace;
+	const namespace = props.namespace ?? authenticationNamespace ?? "otel-collector";
+	const releaseName = props.releaseName ?? "otel-collector";
+	const createNamespace = props.createNamespace ?? authenticationNamespace === void 0;
+	if (!kubernetesName$2.test(namespace) || namespace.length > 63) throw new Error(`Invalid OTEL collector namespace: ${namespace}`);
+	if (!kubernetesName$2.test(releaseName) || releaseName.length > 55) throw new Error(`Invalid OTEL collector release name: ${releaseName}`);
+	if (authenticationNamespace !== void 0 && namespace !== authenticationNamespace) throw new Error("OTEL collector and its authentication Secret must use the same namespace");
+	if (authenticationNamespace !== void 0 && createNamespace) throw new Error("OTEL collector cannot own a namespace that already contains its authentication Secret");
+	if (props.timeoutSeconds !== void 0 && (!Number.isFinite(props.timeoutSeconds) || props.timeoutSeconds <= 0)) throw new Error("OTEL collector timeoutSeconds must be greater than zero");
+	const endpoints = props.destination.endpoints;
+	if (endpoints.url === void 0 && endpoints.traces === void 0 && endpoints.logs === void 0 && endpoints.metrics === void 0) throw new Error("OTEL collector destination must configure at least one signal");
+	for (const signal of signals) {
+		const signalOptions = endpoints[signal];
+		if (typeof signalOptions?.url === "string" && signalOptions.url.trim() === "") throw new Error(`OTEL collector ${signal} endpoint must not be empty`);
+		const headers = signalOptions?.headers ?? endpoints.headers ?? {};
+		const lowerNames = /* @__PURE__ */ new Set();
+		for (const name of Object.keys(headers)) {
+			if (!httpHeaderName.test(name)) throw new Error(`Invalid OTEL ${signal} header name: ${name}`);
+			const lowerName = name.toLowerCase();
+			if (lowerNames.has(lowerName)) throw new Error(`Duplicate OTEL ${signal} header name: ${name}`);
+			lowerNames.add(lowerName);
+			if (lowerName === "authorization" && props.destination.authentication?.type === "basic") throw new Error(`OTEL ${signal} headers cannot override Basic authentication`);
+		}
+	}
+};
+const planOtelCollector = ({ releaseName, destination, namespaceRevision, headerSecretName, headerSecretRevision, basicSecretRevision }) => {
+	const hasBase = destination.endpoints.url !== void 0;
+	const enabledSignals = signals.filter((signal) => hasBase || destination.endpoints[signal] !== void 0);
+	const headerBindings = [];
+	for (const signal of enabledSignals) {
+		const headers = destination.endpoints[signal]?.headers ?? destination.endpoints.headers ?? {};
+		for (const [index, [name, value]] of Object.entries(headers).sort(([left], [right]) => left.localeCompare(right)).entries()) headerBindings.push({
+			signal,
+			name,
+			value,
+			secretKey: `${signal}-${String(index)}`,
+			envName: `OTEL_DESTINATION_${signal.toUpperCase()}_HEADER_${String(index)}`
+		});
+	}
+	const basic = destination.authentication;
+	const exporters = {};
+	const pipelines = {};
+	for (const signal of enabledSignals) {
+		const signalOptions = destination.endpoints[signal];
+		const exporterName = `otlp_http/${signal}`;
+		const headers = Object.fromEntries(headerBindings.filter((binding) => binding.signal === signal).map((binding) => [binding.name, "${env:" + binding.envName + "}"]));
+		exporters[exporterName] = {
+			...signalOptions === void 0 ? { endpoint: destination.endpoints.url } : { [`${signal}_endpoint`]: signalOptions.url },
+			encoding: destination.encoding ?? "json",
+			compression: "gzip",
+			...Object.keys(headers).length === 0 ? {} : { headers },
+			...basic === void 0 ? {} : { auth: { authenticator: "basicauth/destination" } },
+			retry_on_failure: {
+				enabled: true,
+				initial_interval: "1s",
+				max_interval: "30s",
+				max_elapsed_time: "0s"
+			},
+			sending_queue: {
+				enabled: true,
+				num_consumers: 4,
+				queue_size: 1e4
+			}
+		};
+		pipelines[signal] = {
+			receivers: ["otlp"],
+			processors: ["memory_limiter", "batch"],
+			exporters: [exporterName]
+		};
+	}
+	const extensions = { health_check: { endpoint: "${env:MY_POD_IP}:13133" } };
+	if (basic !== void 0) extensions["basicauth/destination"] = { client_auth: {
+		username: "${env:OTEL_DESTINATION_USERNAME}",
+		password: "${env:OTEL_DESTINATION_PASSWORD}"
+	} };
+	const extraEnvs = headerBindings.map((binding) => ({
+		name: binding.envName,
+		valueFrom: { secretKeyRef: {
+			name: headerSecretName,
+			key: binding.secretKey
+		} }
+	}));
+	if (basic !== void 0) extraEnvs.push({
+		name: "OTEL_DESTINATION_USERNAME",
+		valueFrom: { secretKeyRef: {
+			name: basic.secretRef.name,
+			key: basic.secretRef.usernameKey
+		} }
+	}, {
+		name: "OTEL_DESTINATION_PASSWORD",
+		valueFrom: { secretKeyRef: {
+			name: basic.secretRef.name,
+			key: basic.secretRef.passwordKey
+		} }
+	});
+	return {
+		signals: [...enabledSignals],
+		headerSecretData: Object.fromEntries(headerBindings.map((binding) => [binding.secretKey, binding.value])),
+		values: {
+			fullnameOverride: releaseName,
+			mode: "deployment",
+			replicaCount: 1,
+			image: {
+				repository: OTEL_COLLECTOR_IMAGE_REPOSITORY,
+				tag: OTEL_COLLECTOR_IMAGE_TAG,
+				digest: OTEL_COLLECTOR_IMAGE_DIGEST,
+				pullPolicy: "IfNotPresent"
+			},
+			command: { name: "otelcol-contrib" },
+			alternateConfig: {
+				extensions,
+				receivers: { otlp: { protocols: { http: { endpoint: "${env:MY_POD_IP}:4318" } } } },
+				processors: {
+					memory_limiter: {
+						check_interval: "1s",
+						limit_percentage: 75,
+						spike_limit_percentage: 15
+					},
+					batch: {}
+				},
+				exporters,
+				service: {
+					extensions: Object.keys(extensions),
+					pipelines,
+					telemetry: { logs: { level: "info" } }
+				}
+			},
+			extraEnvs,
+			ports: {
+				otlp: { enabled: false },
+				"otlp-http": {
+					enabled: true,
+					containerPort: 4318,
+					servicePort: 4318,
+					hostPort: null,
+					protocol: "TCP"
+				},
+				"jaeger-compact": { enabled: false },
+				"jaeger-thrift": { enabled: false },
+				"jaeger-grpc": { enabled: false },
+				zipkin: { enabled: false },
+				metrics: { enabled: false }
+			},
+			service: { type: "ClusterIP" },
+			ingress: { enabled: false },
+			serviceAccount: {
+				create: true,
+				automountServiceAccountToken: false
+			},
+			clusterRole: { create: false },
+			resources: {
+				requests: {
+					cpu: "100m",
+					memory: "128Mi"
+				},
+				limits: { memory: "512Mi" }
+			},
+			podSecurityContext: {
+				runAsNonRoot: true,
+				runAsUser: 10001,
+				runAsGroup: 10001,
+				fsGroup: 10001,
+				seccompProfile: { type: "RuntimeDefault" }
+			},
+			securityContext: {
+				allowPrivilegeEscalation: false,
+				readOnlyRootFilesystem: true,
+				capabilities: { drop: ["ALL"] }
+			},
+			podAnnotations: {
+				"alchemy.run/namespace-revision": namespaceRevision,
+				...headerSecretRevision === void 0 ? {} : { "alchemy.run/header-secret-revision": headerSecretRevision },
+				...basicSecretRevision === void 0 ? {} : { "alchemy.run/basic-secret-revision": basicSecretRevision }
+			}
+		}
+	};
+};
+const otelCollectorEndpoints = (serviceName, namespace) => {
+	const otelEndpoint = `http://${serviceName}.${namespace}.svc.cluster.local:4318`;
+	return {
+		otelEndpoint,
+		otelTracesEndpoint: `${otelEndpoint}/v1/traces`,
+		otelLogsEndpoint: `${otelEndpoint}/v1/logs`,
+		otelMetricsEndpoint: `${otelEndpoint}/v1/metrics`,
+		otlp: { url: otelEndpoint }
+	};
+};
+/** Deploy a minimal OTLP/HTTP gateway for one downstream destination. */
+const OtelCollector = (id, props) => Effect.gen(function* () {
+	yield* Effect.try(() => validateOtelCollectorProps(props));
+	const authenticationNamespace = props.destination.authentication?.secretRef.namespace;
+	const namespaceName = props.namespace ?? authenticationNamespace ?? "otel-collector";
+	const releaseName = props.releaseName ?? "otel-collector";
+	const createNamespace = props.createNamespace ?? authenticationNamespace === void 0;
+	let namespaceRevision = "external";
+	let secretNamespace = namespaceName;
+	if (createNamespace) {
+		const namespace = yield* Kubernetes.Manifest(`${id}Namespace`, {
+			cluster: props.cluster,
+			manifest: {
+				apiVersion: "v1",
+				kind: "Namespace",
+				metadata: { name: namespaceName }
+			}
+		});
+		namespaceRevision = Output.map(namespace.uid, (uid) => uid ?? "created");
+		secretNamespace = namespace.name;
+	}
+	const preliminary = planOtelCollector({
+		releaseName,
+		destination: props.destination,
+		namespaceRevision,
+		headerSecretName: `${releaseName}-headers`
+	});
+	let headerSecretRevision;
+	if (Object.keys(preliminary.headerSecretData).length > 0) {
+		const headerSecret = yield* Secret(`${id}Headers`, {
+			cluster: props.cluster,
+			namespace: secretNamespace,
+			name: `${releaseName}-headers`,
+			stringData: preliminary.headerSecretData
+		});
+		headerSecretRevision = Output.map(headerSecret.resourceVersion, (resourceVersion) => resourceVersion ?? "unknown");
+	}
+	const basicSecretRevision = props.destination.authentication?.secretRef.resourceVersion;
+	const plan = planOtelCollector({
+		releaseName,
+		destination: props.destination,
+		namespaceRevision,
+		headerSecretName: `${releaseName}-headers`,
+		headerSecretRevision,
+		basicSecretRevision
+	});
+	yield* ReadyHelmChart(`${id}Chart`, {
+		cluster: props.cluster,
+		chart: "opentelemetry-collector",
+		repo: "https://open-telemetry.github.io/opentelemetry-helm-charts",
+		version: OTEL_COLLECTOR_CHART_VERSION,
+		releaseName,
+		namespace: namespaceName,
+		createNamespace: false,
+		timeoutSeconds: props.timeoutSeconds ?? 300,
+		values: plan.values
+	});
+	const endpoints = otelCollectorEndpoints(releaseName, namespaceName);
+	return {
+		namespace: namespaceName,
+		releaseName,
+		serviceName: releaseName,
+		signals: plan.signals,
+		...endpoints
+	};
+});
+//#endregion
+//#region src/parseable.ts
+const PARSEABLE_CHART_VERSION = "3.2.1";
+const PARSEABLE_IMAGE_REPOSITORY = "quay.io/parseablehq/parseable";
+const PARSEABLE_IMAGE_TAG = "v3.1.0";
+const PARSEABLE_IMAGE = `${PARSEABLE_IMAGE_REPOSITORY}:${PARSEABLE_IMAGE_TAG}`;
+const kubernetesName$1 = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
+const hostname = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const validateParseableProps = (props) => {
+	const namespace = props.namespace ?? "parseable";
+	const releaseName = props.releaseName ?? "parseable";
+	if (!kubernetesName$1.test(namespace) || namespace.length > 63) throw new Error(`Invalid Parseable namespace: ${namespace}`);
+	if (!kubernetesName$1.test(releaseName) || releaseName.length > 44) throw new Error(`Invalid Parseable release name: ${releaseName}`);
+	if ((props.admin?.username ?? "admin").trim() === "") throw new Error("Parseable admin username must not be empty");
+	if ((props.staging?.size ?? "5Gi").trim() === "") throw new Error("Parseable staging size must not be empty");
+	if (Object.values({
+		logs: props.streams?.logs ?? "otel-logs",
+		traces: props.streams?.traces ?? "otel-traces",
+		metrics: props.streams?.metrics ?? "otel-metrics"
+	}).some((stream) => stream.trim() === "")) throw new Error("Parseable stream names must not be empty");
+	if (props.storage.sessionToken !== void 0) throw new Error("Parseable does not support S3 session tokens; use static bucket-scoped credentials");
+	if (props.ingress !== void 0 && !hostname.test(props.ingress.host)) throw new Error(`Invalid Parseable ingress host: ${props.ingress.host}`);
+	if (props.ingress?.className !== void 0 && !hostname.test(props.ingress.className)) throw new Error(`Invalid Parseable ingress class: ${props.ingress.className}`);
+	if (props.ingress?.tlsSecretName !== void 0 && !hostname.test(props.ingress.tlsSecretName)) throw new Error(`Invalid Parseable TLS Secret name: ${props.ingress.tlsSecretName}`);
+	if (props.timeoutSeconds !== void 0 && (!Number.isFinite(props.timeoutSeconds) || props.timeoutSeconds <= 0)) throw new Error("Parseable timeoutSeconds must be greater than zero");
+};
+const parseableHelmValues = ({ releaseName, secretName, secretResourceVersion, forcePathStyle, staging }) => ({ parseable: {
+	fullnameOverride: releaseName,
+	deploymentMode: "standalone",
+	image: {
+		repository: PARSEABLE_IMAGE_REPOSITORY,
+		tag: PARSEABLE_IMAGE_TAG,
+		pullPolicy: "IfNotPresent"
+	},
+	store: {
+		type: "s3-store",
+		secretName
+	},
+	standalone: { unified: {
+		env: {
+			P_CHECK_UPDATE: "false",
+			P_SEND_ANONYMOUS_USAGE_DATA: "false",
+			P_S3_PATH_STYLE: String(forcePathStyle ?? false)
+		},
+		persistence: {
+			data: { enabled: false },
+			staging: {
+				enabled: true,
+				storageClass: staging.storageClass ?? "",
+				accessMode: "ReadWriteOnce",
+				size: staging.size ?? "5Gi"
+			}
+		},
+		podAnnotations: { "alchemy.run/parseable-secret-resource-version": secretResourceVersion }
+	} }
+} });
+const parseableIngressManifest = (namespace, serviceName, ingress) => ({
+	apiVersion: "networking.k8s.io/v1",
+	kind: "Ingress",
+	metadata: {
+		name: serviceName,
+		namespace
+	},
+	spec: {
+		...ingress.className === void 0 ? {} : { ingressClassName: ingress.className },
+		...ingress.tlsSecretName === void 0 ? {} : { tls: [{
+			hosts: [ingress.host],
+			secretName: ingress.tlsSecretName
+		}] },
+		rules: [{
+			host: ingress.host,
+			http: { paths: [{
+				path: "/",
+				pathType: "Prefix",
+				backend: { service: {
+					name: serviceName,
+					port: { number: 80 }
+				} }
+			}] }
+		}]
+	}
+});
+const parseableOtlpEndpoints = (internalUrl, streams) => {
+	const otelTracesEndpoint = `${internalUrl}/v1/traces`;
+	const otelLogsEndpoint = `${internalUrl}/v1/logs`;
+	const otelMetricsEndpoint = `${internalUrl}/v1/metrics`;
+	return {
+		otelEndpoint: internalUrl,
+		otelTracesEndpoint,
+		otelLogsEndpoint,
+		otelMetricsEndpoint,
+		endpoints: {
+			url: internalUrl,
+			traces: {
+				url: otelTracesEndpoint,
+				headers: {
+					"X-P-Stream": streams.traces,
+					"X-P-Log-Source": "otel-traces"
+				}
+			},
+			logs: {
+				url: otelLogsEndpoint,
+				headers: {
+					"X-P-Stream": streams.logs,
+					"X-P-Log-Source": "otel-logs"
+				}
+			},
+			metrics: {
+				url: otelMetricsEndpoint,
+				headers: {
+					"X-P-Stream": streams.metrics,
+					"X-P-Log-Source": "otel-metrics"
+				}
+			}
+		}
+	};
+};
+/** Deploy Parseable OSS with S3 durability and its bundled web UI. */
+const Parseable = (id, props) => Effect.gen(function* () {
+	yield* Effect.try(() => validateParseableProps(props));
+	const namespaceName = props.namespace ?? "parseable";
+	const releaseName = props.releaseName ?? "parseable";
+	const serviceName = `${releaseName}-standalone-service`;
+	const streams = {
+		logs: props.streams?.logs ?? "otel-logs",
+		traces: props.streams?.traces ?? "otel-traces",
+		metrics: props.streams?.metrics ?? "otel-metrics"
+	};
+	const username = props.admin?.username ?? "admin";
+	const password = props.admin?.password ?? (yield* makeRandom(`${id}AdminPassword`));
+	const namespace = yield* Kubernetes.Manifest(`${id}Namespace`, {
+		cluster: props.cluster,
+		manifest: {
+			apiVersion: "v1",
+			kind: "Namespace",
+			metadata: { name: namespaceName }
+		}
+	});
+	const secret = yield* Secret(`${id}Credentials`, {
+		cluster: props.cluster,
+		namespace: namespace.name,
+		name: `${releaseName}-env`,
+		stringData: {
+			addr: "0.0.0.0:8000",
+			username,
+			password,
+			"s3.url": props.storage.endpoint,
+			"s3.access.key": props.storage.accessKeyId,
+			"s3.secret.key": props.storage.secretAccessKey,
+			"s3.bucket": props.storage.bucket,
+			"s3.region": props.storage.region
+		}
+	});
+	const chart = yield* ReadyHelmChart(`${id}Chart`, {
+		cluster: props.cluster,
+		chart: "parseable",
+		repo: "https://charts.parseable.com",
+		version: PARSEABLE_CHART_VERSION,
+		releaseName,
+		namespace: namespaceName,
+		createNamespace: false,
+		timeoutSeconds: props.timeoutSeconds ?? 300,
+		values: parseableHelmValues({
+			releaseName,
+			secretName: secret.name,
+			secretResourceVersion: Output.map(secret.resourceVersion, (resourceVersion) => resourceVersion ?? "unknown"),
+			forcePathStyle: props.storage.forcePathStyle,
+			staging: props.staging ?? {}
+		})
+	});
+	if (props.ingress !== void 0) yield* Kubernetes.Manifest(`${id}Ingress`, {
+		cluster: chart.connection,
+		manifest: parseableIngressManifest(namespaceName, serviceName, props.ingress)
+	});
+	const internalUrl = `http://${serviceName}.${namespaceName}.svc.cluster.local`;
+	const uiUrl = props.ingress === void 0 ? internalUrl : `${props.ingress.tlsSecretName === void 0 ? "http" : "https"}://${props.ingress.host}`;
+	const otlp = parseableOtlpEndpoints(internalUrl, streams);
+	return {
+		namespace: namespaceName,
+		releaseName,
+		serviceName,
+		streams,
+		internalUrl,
+		uiUrl,
+		otelEndpoint: otlp.otelEndpoint,
+		otelTracesEndpoint: otlp.otelTracesEndpoint,
+		otelLogsEndpoint: otlp.otelLogsEndpoint,
+		otelMetricsEndpoint: otlp.otelMetricsEndpoint,
+		admin: {
+			username,
+			password
+		},
+		credentialsSecretRef: {
+			namespace: namespaceName,
+			name: `${releaseName}-env`,
+			usernameKey: "username",
+			passwordKey: "password",
+			resourceVersion: secret.resourceVersion
+		},
+		endpoints: otlp.endpoints,
+		...props.ingress === void 0 ? {} : { ingress: {
+			host: props.ingress.host,
+			url: uiUrl,
+			tls: props.ingress.tlsSecretName !== void 0
+		} }
+	};
+});
+//#endregion
+//#region src/container-registry.ts
+const CONTAINER_REGISTRY_CHART = "oci://ghcr.io/project-zot/helm-charts/zot";
+const CONTAINER_REGISTRY_CHART_VERSION = "0.1.122";
+const CONTAINER_REGISTRY_IMAGE_REPOSITORY = "ghcr.io/project-zot/zot-minimal";
+const CONTAINER_REGISTRY_IMAGE_TAG = `v2.1.20@sha256:73f26433b341f4a319963f7c5e169858663a10565e4037e71605737daee202ee`;
+const CONTAINER_REGISTRY_IMAGE = `${CONTAINER_REGISTRY_IMAGE_REPOSITORY}:${CONTAINER_REGISTRY_IMAGE_TAG}`;
+const kubernetesName = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
+const dnsSubdomain = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const goDuration = /^(?:[1-9]\d*(?:\.\d+)?(?:ms|s|m|h))+$/;
+const utcWindow = /^(?:[01]\d|2[0-3]):[0-5]\d-(?:[01]\d|2[0-3]):[0-5]\d$/;
+const validateContainerRegistryProps = (props) => {
+	const namespace = props.namespace ?? "registry";
+	const releaseName = props.releaseName ?? "registry";
+	const username = props.credentials?.username ?? "registry";
+	const pullSecretName = props.pullSecrets?.name ?? `${releaseName}-pull`;
+	const storagePrefix = props.storagePrefix ?? "registry";
+	const garbageCollection = {
+		interval: props.garbageCollection?.interval ?? "24h",
+		delay: props.garbageCollection?.delay ?? "24h",
+		timeWindowUtc: props.garbageCollection?.timeWindowUtc ?? "02:00-04:00"
+	};
+	if (!kubernetesName.test(namespace) || namespace.length > 63) throw new Error(`Invalid container registry namespace: ${namespace}`);
+	if (!kubernetesName.test(releaseName) || releaseName.length > 53) throw new Error(`Invalid container registry release name: ${releaseName}`);
+	if (username.trim() === "" || username.includes(":") || username.includes("\n") || username.includes("\r")) throw new Error("Container registry username must be non-empty and contain no colon or newline");
+	if (props.credentials?.password !== void 0 && Redacted.value(props.credentials.password) === "") throw new Error("Container registry password must not be empty");
+	if (props.credentials?.password !== void 0 && truncates(Redacted.value(props.credentials.password))) throw new Error("Container registry password must not exceed 72 UTF-8 bytes");
+	if (!dnsSubdomain.test(props.ingress.host)) throw new Error(`Invalid container registry ingress host: ${props.ingress.host}`);
+	if (props.ingress.className !== void 0 && !dnsSubdomain.test(props.ingress.className)) throw new Error(`Invalid container registry ingress class: ${props.ingress.className}`);
+	if (!kubernetesName.test(props.ingress.tlsSecretName) || props.ingress.tlsSecretName.length > 63) throw new Error(`Invalid container registry TLS Secret name: ${props.ingress.tlsSecretName}`);
+	if (!kubernetesName.test(pullSecretName) || pullSecretName.length > 63) throw new Error(`Invalid container registry pull Secret name: ${pullSecretName}`);
+	const pullNamespaces = props.pullSecrets?.namespaces ?? [];
+	if (pullNamespaces.some((name) => !kubernetesName.test(name) || name.length > 63)) throw new Error("Invalid container registry pull Secret namespace");
+	if (new Set(pullNamespaces).size !== pullNamespaces.length) throw new Error("Container registry pull Secret namespaces must not contain duplicates");
+	if (storagePrefix === "" || storagePrefix.startsWith("/") || storagePrefix.endsWith("/") || storagePrefix.split("/").some((part) => part === "" || part === "." || part === "..") || !/^[A-Za-z0-9._/-]+$/.test(storagePrefix)) throw new Error("Container registry storagePrefix must be a safe relative S3 prefix");
+	if (props.storage.region.trim() === "" || props.storage.bucket.trim() === "" || props.storage.accessKeyId.trim() === "" || Redacted.value(props.storage.secretAccessKey) === "" || props.storage.sessionToken !== void 0 && Redacted.value(props.storage.sessionToken) === "") throw new Error("Container registry S3 access fields must not be empty");
+	let endpoint;
+	try {
+		endpoint = new URL(props.storage.endpoint);
+	} catch {
+		throw new Error("Container registry S3 endpoint must be a valid URL");
+	}
+	if (!["http:", "https:"].includes(endpoint.protocol) || endpoint.username !== "" || endpoint.password !== "" || endpoint.search !== "" || endpoint.hash !== "") throw new Error("Container registry S3 endpoint must be an HTTP(S) URL without credentials, query, or fragment");
+	if (!goDuration.test(garbageCollection.interval) || !goDuration.test(garbageCollection.delay)) throw new Error("Container registry garbage-collection interval and delay must be positive Go durations");
+	if (!utcWindow.test(garbageCollection.timeWindowUtc) || garbageCollection.timeWindowUtc.slice(0, 5) === garbageCollection.timeWindowUtc.slice(6)) throw new Error("Container registry garbage-collection window must be a non-empty UTC HH:MM-HH:MM range");
+	if (props.timeoutSeconds !== void 0 && (!Number.isFinite(props.timeoutSeconds) || props.timeoutSeconds <= 0)) throw new Error("Container registry timeoutSeconds must be greater than zero");
+};
+const containerRegistryHtpasswd = (username, password, saltSeed) => {
+	const plainPassword = Redacted.value(password);
+	if (truncates(plainPassword)) throw new Error("Container registry password must not exceed 72 UTF-8 bytes");
+	const plainSaltSeed = Redacted.value(saltSeed);
+	if (!/^[a-f0-9]{32}$/.test(plainSaltSeed)) throw new Error("Container registry bcrypt salt seed must be 16 bytes");
+	const salt = `$2b$12$${encodeBase64(Buffer.from(plainSaltSeed, "hex"), 16)}`;
+	return Redacted.make(`${username}:${hashSync(plainPassword, salt)}\n`);
+};
+const containerRegistryDockerConfig = (host, username, password) => {
+	const plainPassword = Redacted.value(password);
+	return Redacted.make(JSON.stringify({ auths: { [host]: {
+		username,
+		password: plainPassword,
+		auth: Buffer.from(`${username}:${plainPassword}`).toString("base64")
+	} } }));
+};
+const containerRegistryHelmValues = ({ releaseName, storage, storagePrefix, storageSecretName, storageSecretRevision, authSecretName, authSecretRevision, namespaceRevision, ingress, username, garbageCollection }) => {
+	const endpoint = new URL(storage.endpoint);
+	const configuration = {
+		distSpecVersion: "1.1.1",
+		storage: {
+			rootDirectory: "/var/lib/registry",
+			dedupe: false,
+			gc: true,
+			gcDelay: garbageCollection.delay,
+			gcInterval: garbageCollection.interval,
+			gcTimeWindow: garbageCollection.timeWindowUtc,
+			fastRestart: false,
+			redirectBlobURL: false,
+			storageDriver: {
+				name: "s3",
+				region: storage.region,
+				bucket: storage.bucket,
+				regionendpoint: storage.endpoint,
+				rootdirectory: `/${storagePrefix}`,
+				forcepathstyle: storage.forcePathStyle ?? false,
+				secure: endpoint.protocol === "https:",
+				skipverify: false,
+				v4auth: true
+			}
+		},
+		http: {
+			address: "0.0.0.0",
+			port: "5000",
+			readTimeout: "15m",
+			writeTimeout: "15m",
+			auth: { htpasswd: { path: "/secrets/auth/htpasswd" } },
+			accessControl: {
+				repositories: { "**": { defaultPolicy: [] } },
+				adminPolicy: {
+					users: [username],
+					actions: [
+						"read",
+						"create",
+						"update",
+						"delete"
+					]
+				}
+			}
+		},
+		log: { level: "info" }
+	};
+	return {
+		fullnameOverride: releaseName,
+		replicaCount: 1,
+		image: {
+			repository: CONTAINER_REGISTRY_IMAGE_REPOSITORY,
+			tag: CONTAINER_REGISTRY_IMAGE_TAG,
+			pullPolicy: "IfNotPresent"
+		},
+		strategy: { type: "Recreate" },
+		service: {
+			type: "ClusterIP",
+			port: 5e3
+		},
+		ingress: {
+			enabled: true,
+			annotations: ingress.annotations ?? {},
+			className: ingress.className ?? "",
+			pathtype: "Prefix",
+			hosts: [{
+				host: ingress.host,
+				paths: [{ path: "/" }]
+			}],
+			tls: [{
+				secretName: ingress.tlsSecretName,
+				hosts: [ingress.host]
+			}]
+		},
+		mountConfig: true,
+		configFiles: { "config.json": JSON.stringify(configuration) },
+		externalSecrets: [{
+			secretName: authSecretName,
+			mountPath: "/secrets/auth"
+		}],
+		persistence: false,
+		env: [
+			{
+				name: "AWS_ACCESS_KEY_ID",
+				valueFrom: { secretKeyRef: {
+					name: storageSecretName,
+					key: "access-key-id"
+				} }
+			},
+			{
+				name: "AWS_SECRET_ACCESS_KEY",
+				valueFrom: { secretKeyRef: {
+					name: storageSecretName,
+					key: "secret-access-key"
+				} }
+			},
+			...storage.sessionToken === void 0 ? [] : [{
+				name: "AWS_SESSION_TOKEN",
+				valueFrom: { secretKeyRef: {
+					name: storageSecretName,
+					key: "session-token"
+				} }
+			}]
+		],
+		serviceAccount: {
+			create: false,
+			name: releaseName
+		},
+		resources: {
+			requests: {
+				cpu: "25m",
+				memory: "64Mi"
+			},
+			limits: { memory: "512Mi" }
+		},
+		podSecurityContext: {
+			runAsNonRoot: true,
+			runAsUser: 65532,
+			runAsGroup: 65532,
+			fsGroup: 65532,
+			fsGroupChangePolicy: "OnRootMismatch",
+			seccompProfile: { type: "RuntimeDefault" }
+		},
+		securityContext: {
+			privileged: false,
+			allowPrivilegeEscalation: false,
+			readOnlyRootFilesystem: true,
+			runAsNonRoot: true,
+			runAsUser: 65532,
+			runAsGroup: 65532,
+			capabilities: { drop: ["ALL"] }
+		},
+		extraVolumeMounts: [{
+			name: "tmp",
+			mountPath: "/tmp"
+		}],
+		extraVolumes: [{
+			name: "tmp",
+			emptyDir: {}
+		}],
+		metrics: {
+			enabled: false,
+			serviceMonitor: { enabled: false }
+		},
+		podAnnotations: {
+			"alchemy.run/namespace-revision": namespaceRevision,
+			"alchemy.run/storage-secret-revision": storageSecretRevision,
+			"alchemy.run/auth-secret-revision": authSecretRevision
+		}
+	};
+};
+/** Deploy a private, HTTPS-only, S3-backed OCI/Docker registry. */
+const ContainerRegistry = (id, props) => Effect.gen(function* () {
+	yield* Effect.try(() => validateContainerRegistryProps(props));
+	const namespaceName = props.namespace ?? "registry";
+	const releaseName = props.releaseName ?? "registry";
+	const createNamespace = props.createNamespace ?? true;
+	const username = props.credentials?.username ?? "registry";
+	const password = props.credentials?.password ?? (yield* makeRandom(`${id}RegistryPassword`));
+	const saltSeed = yield* makeRandom(`${id}RegistryBcryptSalt`, { bytes: 16 });
+	const htpasswd = Output.map(Output.all(Output.asOutput(password), Output.asOutput(saltSeed)), ([resolvedPassword, resolvedSaltSeed]) => containerRegistryHtpasswd(username, resolvedPassword, resolvedSaltSeed));
+	let namespaceRevision = "external";
+	let secretNamespace = namespaceName;
+	if (createNamespace) {
+		const namespace = yield* Kubernetes.Manifest(`${id}Namespace`, {
+			cluster: props.cluster,
+			manifest: {
+				apiVersion: "v1",
+				kind: "Namespace",
+				metadata: { name: namespaceName }
+			}
+		});
+		namespaceRevision = Output.map(namespace.uid, (uid) => uid ?? "created");
+		secretNamespace = namespace.name;
+	}
+	const storageSecretName = `${releaseName}-storage`;
+	const storageSecret = yield* Secret(`${id}StorageCredentials`, {
+		cluster: props.cluster,
+		namespace: secretNamespace,
+		name: storageSecretName,
+		stringData: {
+			"access-key-id": props.storage.accessKeyId,
+			"secret-access-key": props.storage.secretAccessKey,
+			...props.storage.sessionToken === void 0 ? {} : { "session-token": props.storage.sessionToken }
+		}
+	});
+	const authSecretName = `${releaseName}-auth`;
+	const authSecret = yield* Secret(`${id}Authentication`, {
+		cluster: props.cluster,
+		namespace: secretNamespace,
+		name: authSecretName,
+		stringData: { htpasswd }
+	});
+	const serviceAccount = yield* Kubernetes.Manifest(`${id}ServiceAccount`, {
+		cluster: authSecret.connection,
+		manifest: {
+			apiVersion: "v1",
+			kind: "ServiceAccount",
+			metadata: {
+				name: releaseName,
+				namespace: namespaceName
+			},
+			automountServiceAccountToken: false
+		}
+	});
+	const dockerConfig = Output.map(Output.asOutput(password), (resolved) => containerRegistryDockerConfig(props.ingress.host, username, resolved));
+	const pullSecretName = props.pullSecrets?.name ?? `${releaseName}-pull`;
+	const pullSecretRefs = [];
+	for (const targetNamespace of props.pullSecrets?.namespaces ?? []) {
+		const pullSecret = yield* Secret(`${id}PullSecret${targetNamespace}`, {
+			cluster: props.cluster,
+			namespace: targetNamespace,
+			name: pullSecretName,
+			type: "kubernetes.io/dockerconfigjson",
+			stringData: { ".dockerconfigjson": dockerConfig }
+		});
+		pullSecretRefs.push({
+			namespace: targetNamespace,
+			name: pullSecretName,
+			resourceVersion: pullSecret.resourceVersion
+		});
+	}
+	const values = containerRegistryHelmValues({
+		releaseName,
+		storage: props.storage,
+		storagePrefix: props.storagePrefix ?? "registry",
+		storageSecretName,
+		storageSecretRevision: Output.map(storageSecret.resourceVersion, (resourceVersion) => resourceVersion ?? "unknown"),
+		authSecretName,
+		authSecretRevision: Output.map(authSecret.resourceVersion, (resourceVersion) => resourceVersion ?? "unknown"),
+		namespaceRevision,
+		ingress: props.ingress,
+		username,
+		garbageCollection: {
+			interval: props.garbageCollection?.interval ?? "24h",
+			delay: props.garbageCollection?.delay ?? "24h",
+			timeWindowUtc: props.garbageCollection?.timeWindowUtc ?? "02:00-04:00"
+		}
+	});
+	yield* ReadyHelmChart(`${id}Chart`, {
+		cluster: serviceAccount.connection,
+		chart: CONTAINER_REGISTRY_CHART,
+		version: CONTAINER_REGISTRY_CHART_VERSION,
+		releaseName,
+		namespace: namespaceName,
+		createNamespace: false,
+		timeoutSeconds: props.timeoutSeconds ?? 300,
+		values
+	});
+	const url = `https://${props.ingress.host}`;
+	return {
+		namespace: namespaceName,
+		releaseName,
+		serviceName: releaseName,
+		host: props.ingress.host,
+		url,
+		imagePrefix: props.ingress.host,
+		internalUrl: `http://${releaseName}.${namespaceName}.svc.cluster.local:5000`,
+		credentials: {
+			username,
+			password
+		},
+		pullSecretRefs,
+		ingress: {
+			host: props.ingress.host,
+			url,
+			tls: true
+		}
+	};
+});
+//#endregion
+//#region src/index.ts
+var Providers = class extends Provider.ProviderCollection()("KubernetesAddons") {};
+const SecretResource = Resource("KubernetesAddons.Secret");
+const toRedacted = (value) => Redacted.isRedacted(value) ? value : Redacted.make(value);
+const liftValue = (value) => Config.isConfig(value) ? Config.map(value, toRedacted) : Effect.isEffect(value) ? Effect.map(value, toRedacted) : Output.isOutput(value) ? Output.map(value, toRedacted) : toRedacted(value);
+const redactProps = Effect.fn(function* (props) {
+	const stringData = yield* Effect.all(Object.entries(props.stringData).map(([key, value]) => Effect.isEffect(value) && !Config.isConfig(value) ? Effect.map(Effect.orDie(Effect.mapError(value, () => /* @__PURE__ */ new Error("Failed to resolve Kubernetes Secret input"))), (resolved) => [key, toRedacted(resolved)]) : Effect.succeed([key, liftValue(value)])), { concurrency: "unbounded" });
+	return {
+		...props,
+		stringData: Object.fromEntries(stringData)
+	};
+});
+/** Write-only Kubernetes Secret with Redacted request-boundary handling. */
+const Secret = Object.assign((id, props) => Effect.isEffect(props) ? SecretResource(id, Effect.flatMap(props, redactProps)) : SecretResource(id, redactProps(props)), SecretResource);
+const safeSecretError = (operation, name, namespace, error) => /* @__PURE__ */ new Error(`Failed to ${operation} Kubernetes Secret ${namespace}/${name}${error instanceof KubernetesApiError ? `: Kubernetes API returned ${String(error.statusCode)}` : ""}`);
+const connectionIdentity = (connection) => {
+	const auth = Object.fromEntries(Object.entries(connection.auth).filter(([key]) => ![
+		"token",
+		"key",
+		"certificate",
+		"env"
+	].includes(key)));
+	return JSON.stringify({
+		endpoint: connection.endpoint,
+		auth
+	});
+};
+const secretRef = (value) => ({
+	apiVersion: "v1",
+	kind: "Secret",
+	name: value.name,
+	namespace: value.namespace
+});
+const SecretProvider = () => Provider.succeed(Secret, {
+	stables: [
+		"connection",
+		"name",
+		"namespace"
+	],
+	list: () => Effect.succeed([]),
+	diff: ({ olds = {}, news }) => Effect.sync(() => {
+		if (!isResolved(news)) return void 0;
+		if (olds.cluster !== void 0 && connectionIdentity(Kubernetes.toConnection(olds.cluster)) !== connectionIdentity(Kubernetes.toConnection(news.cluster)) || olds.name !== news.name || (olds.namespace ?? "default") !== (news.namespace ?? "default")) return { action: "replace" };
+	}),
+	read: ({ output }) => Effect.gen(function* () {
+		if (output === void 0) return void 0;
+		const connected = yield* connectCluster(output.connection).pipe(Effect.catchIf((error) => error instanceof Kubernetes.ClusterNotFoundError, () => Effect.succeed(void 0)), Effect.mapError((error) => safeSecretError("read", output.name, output.namespace, error)));
+		if (connected === void 0) return void 0;
+		const observed = yield* requestJson({
+			transport: connected.transport,
+			method: "GET",
+			path: objectPath(secretRef(output))
+		}).pipe(Effect.catchIf((error) => error instanceof KubernetesApiError && error.statusCode === 404, () => Effect.succeed(void 0)), Effect.mapError((error) => safeSecretError("read", output.name, output.namespace, error)));
+		if (observed === void 0) return void 0;
+		const secret = observed;
+		return {
+			...output,
+			type: secret.type ?? output.type,
+			uid: secret.metadata?.uid ?? output.uid,
+			resourceVersion: secret.metadata?.resourceVersion ?? output.resourceVersion
+		};
+	}),
+	reconcile: ({ news, session }) => Effect.gen(function* () {
+		const namespace = news.namespace ?? "default";
+		const connected = yield* connectCluster(news.cluster).pipe(Effect.mapError((error) => safeSecretError("apply", news.name, namespace, error)));
+		const result = yield* requestJson({
+			transport: connected.transport,
+			method: "PATCH",
+			path: `${objectPath(secretRef({
+				name: news.name,
+				namespace
+			}))}?fieldManager=alchemy-kubernetes-addons&force=true`,
+			body: {
+				apiVersion: "v1",
+				kind: "Secret",
+				metadata: {
+					name: news.name,
+					namespace
+				},
+				type: news.type ?? "Opaque",
+				...news.immutable === void 0 ? {} : { immutable: news.immutable },
+				stringData: Object.fromEntries(Object.entries(news.stringData).map(([key, value]) => [key, Redacted.value(value)]))
+			}
+		}).pipe(Effect.mapError((error) => safeSecretError("apply", news.name, namespace, error)));
+		yield* session.note(`Applied Kubernetes Secret ${namespace}/${news.name}`);
+		return {
+			connection: connected.connection,
+			name: news.name,
+			namespace,
+			type: result.type ?? news.type ?? "Opaque",
+			uid: result.metadata?.uid,
+			resourceVersion: result.metadata?.resourceVersion
+		};
+	}),
+	delete: ({ output }) => Effect.gen(function* () {
+		const connected = yield* connectCluster(output.connection).pipe(Effect.catchIf((error) => error instanceof Kubernetes.ClusterNotFoundError, () => Effect.succeed(void 0)), Effect.mapError((error) => safeSecretError("delete", output.name, output.namespace, error)));
+		if (connected === void 0) return;
+		yield* requestJson({
+			transport: connected.transport,
+			method: "DELETE",
+			path: objectPath(secretRef(output))
+		}).pipe(Effect.catchIf((error) => error instanceof KubernetesApiError && error.statusCode === 404, () => Effect.void), Effect.mapError((error) => safeSecretError("delete", output.name, output.namespace, error)));
+	})
+});
+const Readiness = Resource("KubernetesAddons.Readiness");
+const ReadinessProvider = () => Provider.succeed(Readiness, {
+	list: () => Effect.succeed([]),
+	read: ({ output }) => Effect.succeed(output),
+	reconcile: ({ news }) => Effect.gen(function* () {
+		const connected = yield* connectCluster(news.cluster).pipe(Effect.mapError(() => /* @__PURE__ */ new Error("Failed to connect to Kubernetes for readiness")));
+		yield* waitForObjectsReady({
+			transport: connected.transport,
+			objects: news.objects,
+			timeoutSeconds: news.timeoutSeconds ?? 300
+		});
+		return {
+			connection: connected.connection,
+			objects: [...news.objects],
+			revision: news.revision
+		};
+	}),
+	delete: () => Effect.void
+});
+/** Apply an Alchemy Helm chart, then wait for its CRDs and workloads. */
+const ReadyHelmChart = (id, props) => Effect.gen(function* () {
+	const { timeoutSeconds, ...chartProps } = props;
+	const chart = yield* Kubernetes.HelmChart(id, chartProps);
+	yield* Readiness(`${id}Readiness`, {
+		cluster: chart.connection,
+		objects: chart.objects,
+		revision: chart.code.hash,
+		timeoutSeconds: timeoutSeconds ?? 300
+	});
+	return chart;
+});
+const providers = () => Layer.effect(Providers, Provider.collection([Secret, Readiness])).pipe(Layer.provide(Layer.mergeAll(SecretProvider(), ReadinessProvider())), Layer.provideMerge(RandomProvider()));
+//#endregion
+export { CERT_MANAGER_CHART, CERT_MANAGER_CHART_VERSION, CERT_MANAGER_IMAGE_VERSION, CONTAINER_REGISTRY_CHART, CONTAINER_REGISTRY_CHART_VERSION, CONTAINER_REGISTRY_IMAGE, CertManager, CloudflareAcmeIssuer, CloudflareExternalDns, ContainerRegistry, EXTERNAL_DNS_CHART_VERSION, EXTERNAL_DNS_IMAGE, KubernetesReadinessError, LETSENCRYPT_PRODUCTION_URL, LETSENCRYPT_STAGING_URL, OTEL_COLLECTOR_CHART_VERSION, OTEL_COLLECTOR_IMAGE, OtelCollector, PARSEABLE_CHART_VERSION, PARSEABLE_IMAGE, Parseable, Providers, Readiness, ReadinessProvider, ReadyHelmChart, Secret, SecretProvider, certManagerHelmValues, cloudflareAcmeIssuerManifest, cloudflareAcmeIssuerName, cloudflareAcmeIssuerTokenPolicies, containerRegistryDockerConfig, containerRegistryHelmValues, containerRegistryHtpasswd, kubernetesObjectReadiness, parseableHelmValues, planCloudflareExternalDns, planOtelCollector, providers, validateCertManagerProps, validateCloudflareAcmeIssuerProps, validateContainerRegistryProps };