typekro 0.22.1 → 0.24.0

package/dist/factories/clickhouse/utils/zone-layout.js

@@ -0,0 +1,103 @@
+/**
+ * Zone-pinned CHI layout compilation.
+ *
+ * WHY THIS EXISTS: the clickhouse-operator's own `podDistribution` supports
+ * ONLY the `kubernetes.io/hostname` topologyKey (Altinity/clickhouse-operator
+ * issue #772), so per-ZONE spreading cannot be expressed operator-natively.
+ * On EKS this matters operationally: EBS volumes are ZONAL, so a replica pod
+ * rescheduled into another AZ strands its PVC and the pod wedges Pending
+ * (we hit exactly this in production). The fix the operator DOES support is a
+ * per-replica `layout.replicas:` list where each replica's pod template pins
+ * one zone via nodeAffinity on `topology.kubernetes.io/zone` — this module
+ * compiles that layout deterministically.
+ *
+ * These helpers are pure (no resource construction) and unit-tested directly.
+ */
+/** Standard Kubernetes zone topology label. */
+export const ZONE_TOPOLOGY_KEY = 'topology.kubernetes.io/zone';
+/**
+ * Assign one zone per replica index, round-robin.
+ *
+ * When `replicaCount > zones.length`, zones repeat in order:
+ * replicas=5, zones=[a,b,c] → [a, b, c, a, b].
+ *
+ * @param replicaCount - Number of replicas per shard
+ * @param zones - Non-empty list of availability zones
+ * @returns Zone for each replica index (length === replicaCount)
+ */
+export function assignZonesRoundRobin(replicaCount, zones) {
+    if (zones.length === 0) {
+        throw new Error('assignZonesRoundRobin requires at least one zone');
+    }
+    if (!Number.isInteger(replicaCount) || replicaCount < 1) {
+        throw new Error(`assignZonesRoundRobin requires a positive integer replica count, got ${replicaCount}`);
+    }
+    return Array.from({ length: replicaCount }, (_, index) => {
+        const zone = zones[index % zones.length];
+        if (zone === undefined) {
+            throw new Error(`Zone assignment failed for replica ${index}`);
+        }
+        return zone;
+    });
+}
+/**
+ * Deterministic pod template name for a zone-pinned template.
+ *
+ * Zone names are DNS-safe label values, so embedding them keeps the template
+ * name valid and self-describing (e.g. `clickhouse-us-east-2a`).
+ */
+export function zonePodTemplateName(baseName, zone) {
+    return `${baseName}-${zone}`;
+}
+/**
+ * Explicit required nodeAffinity pinning a pod to one zone.
+ *
+ * Emitted as a plain PodSpec affinity (rather than the operator's
+ * `podTemplate.zone` sugar) so the pinning is visible verbatim in the
+ * rendered CHI and doesn't depend on operator-side template expansion.
+ */
+export function zoneNodeAffinity(zone) {
+    return {
+        nodeAffinity: {
+            requiredDuringSchedulingIgnoredDuringExecution: {
+                nodeSelectorTerms: [
+                    {
+                        matchExpressions: [
+                            {
+                                key: ZONE_TOPOLOGY_KEY,
+                                operator: 'In',
+                                values: [zone],
+                            },
+                        ],
+                    },
+                ],
+            },
+        },
+    };
+}
+/**
+ * Compile the per-replica zone-pinned layout for a CHI cluster.
+ *
+ * @param options.replicaCount - Replicas per shard
+ * @param options.zones - Availability zones to round-robin replicas across
+ * @param options.podTemplateBaseName - Base name for generated pod templates
+ * @param options.podSpec - Shared PodSpec (containers etc.); the zone
+ *   nodeAffinity is merged in per template
+ */
+export function compileZonePinnedLayout(options) {
+    const { replicaCount, zones, podTemplateBaseName, podSpec } = options;
+    const assignments = assignZonesRoundRobin(replicaCount, zones);
+    const distinctZones = [...new Set(assignments)];
+    const podTemplates = distinctZones.map((zone) => ({
+        name: zonePodTemplateName(podTemplateBaseName, zone),
+        spec: {
+            ...podSpec,
+            affinity: zoneNodeAffinity(zone),
+        },
+    }));
+    const replicas = assignments.map((zone) => ({
+        templates: { podTemplate: zonePodTemplateName(podTemplateBaseName, zone) },
+    }));
+    return { replicas, podTemplates };
+}
+//# sourceMappingURL=zone-layout.js.map

package/dist/factories/clickhouse/utils/zone-layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zone-layout.js","sourceRoot":"","sources":["../../../../src/factories/clickhouse/utils/zone-layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,KAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,wEAAwE,YAAY,EAAE,CACvF,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,IAAY;IAChE,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO;QACL,YAAY,EAAE;YACZ,8CAA8C,EAAE;gBAC9C,iBAAiB,EAAE;oBACjB;wBACE,gBAAgB,EAAE;4BAChB;gCACE,GAAG,EAAE,iBAAiB;gCACtB,QAAQ,EAAE,IAAI;gCACd,MAAM,EAAE,CAAC,IAAI,CAAC;6BACf;yBACF;qBACF;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAiBD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAKvC;IACC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACtE,MAAM,WAAW,GAAG,qBAAqB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAEhD,MAAM,YAAY,GAAqB,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,EAAE,mBAAmB,CAAC,mBAAmB,EAAE,IAAI,CAAC;QACpD,IAAI,EAAE;YACJ,GAAG,OAAO;YACV,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC;SACjC;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,QAAQ,GAA8B,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrE,SAAS,EAAE,EAAE,WAAW,EAAE,mBAAmB,CAAC,mBAAmB,EAAE,IAAI,CAAC,EAAE;KAC3E,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC"}

package/dist/factories/clickstack/compositions/clickstack-bootstrap.d.ts

@@ -0,0 +1,248 @@
+/**
+ * ClickStack (HyperDX) Bootstrap Composition — EXTERNAL ClickHouse only.
+ *
+ * Deploys the OFFICIAL `clickstack` chart (3.0.x, MIT) from
+ * https://clickhouse.github.io/ClickStack-helm-charts via HelmRepository and
+ * HelmRelease resources. Build-around: we wrap the official chart — never
+ * hand-rolled manifests. NOT the archived hyperdxio/helm-charts repo, NOT the
+ * deprecated `hdx-oss-v2` chart, and NOT the `clickstack-operators`
+ * prerequisite chart (its ClickHouse operator CRDs would collide with the
+ * Altinity clickhouse-operator that manages our ClickHouseInstallation, and
+ * it drags in a MongoDB operator we don't want).
+ *
+ * BUILD-TIME vs RUNTIME: `makeClickstackBootstrap(options)` constructs a
+ * composition VARIANT. Options that decide WHICH resources exist (the Mongo
+ * mode + its storage shape) and the static raw chart values are build-time —
+ * plain JS may branch on them because they are always concrete. The runtime
+ * spec carries only proxy-safe values (names, namespaces, endpoints,
+ * versions, credentials); a user composing with `schema.spec.*` refs never
+ * hits a JS branch on a proxy.
+ *
+ * What gets deployed:
+ * 1. The target Namespace.
+ * 2. The shared ClickStack HelmRepository singleton.
+ * 3. Internal-Mongo variant only: a minimal single-replica Mongo
+ *    StatefulSet + Service (`mongo:7`, no operator/CRDs/auth — APP METADATA
+ *    ONLY, dev-first; see resources/mongo.ts for the loud caveats).
+ * 4. The clickstack HelmRelease: HyperDX (UI/API/OpAMP) + the OTel gateway
+ *    collector subchart, wired to the EXTERNAL ClickHouse
+ *    (`clickhouse.enabled: false` and `mongodb.enabled: false` are hard-pinned
+ *    by the values mapper and beat the build-time values passthrough).
+ *
+ * STATUS CONTRACT: beyond ready/phase, the status exposes `ui.url`,
+ * `gateway.otlpHttpEndpoint` / `gateway.otlpGrpcEndpoint`, and
+ * `app.host/appPort/apiPort` so downstream compositions (e.g.
+ * `clickstackK8sTelemetry`) consume connection details without reconstructing
+ * chart naming rules. The mapper pins `fullnameOverride` to the release name
+ * to make that naming deterministic; endpoints are derived from the owned
+ * HelmRelease resource's metadata (never `schema.spec.*` — KRO status CEL
+ * cannot reference the instance spec).
+ *
+ * SCHEMA / REPLICATION CAVEAT: on first start the gateway collector's goose
+ * migrations create `otel_logs` / `otel_traces` / `otel_metrics_*` /
+ * `hyperdx_sessions` in the external ClickHouse as plain single-node
+ * MergeTree tables. That matches a 1-replica CHI (our dev-first sizing);
+ * multi-replica / `ON CLUSTER` schemas are NOT supported by ClickStack's
+ * tooling — revisit (and see `CLICKSTACK_CLICKHOUSE_GUIDANCE`) before scaling
+ * the CHI. Version coupling is loose: chart vendors CH 25.7, seed schemas
+ * carry a <26.2 compat variant, and the optional JSON-typed schema
+ * (`HYPERDX_OTEL_EXPORTER_CLICKHOUSE_JSON_ENABLE`) wants CH 25.3+.
+ *
+ * @example Internal Mongo (default)
+ * ```typescript
+ * const factory = clickstackBootstrap.factory('kro', { namespace: 'clickstack' });
+ *
+ * await factory.deploy({
+ *   name: 'clickstack',
+ *   clickhouse: {
+ *     host: 'clickhouse-observability.clickhouse.svc.cluster.local',
+ *     username: 'otelcollector',
+ *     password: '…',
+ *   },
+ * });
+ * ```
+ *
+ * @example External Mongo (build-time variant)
+ * ```typescript
+ * const bootstrap = makeClickstackBootstrap({ mongo: { mode: 'external' } });
+ *
+ * await bootstrap.factory('kro').deploy({
+ *   name: 'clickstack',
+ *   clickhouse: { host: '…' },
+ *   mongoUri: 'mongodb://user:pass@mongo.example.com:27017/hyperdx',
+ * });
+ * ```
+ */
+import { type ClickStackExternalMongoBuildOptions, type ClickStackInternalMongoBuildOptions } from '../types.js';
+declare function buildInternalComposition(options: ClickStackInternalMongoBuildOptions): import("../../../index.js").CallableComposition<{
+    name: string;
+    clickhouse: {
+        host: string;
+        nativePort?: number;
+        httpPort?: number;
+        database?: string;
+        username?: string;
+        password?: string;
+        appUsername?: string;
+        appPassword?: string;
+    };
+    namespace?: string;
+    version?: string;
+    apiKey?: string;
+    hyperdx?: {
+        replicas?: number;
+        resources?: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        image?: {
+            repository?: string;
+            tag?: string;
+            pullPolicy?: "Always" | "IfNotPresent" | "Never";
+        };
+        frontendUrl?: string;
+    };
+}, {
+    ready: boolean;
+    phase: "Ready" | "Failed" | "Installing";
+    ui: {
+        url: string;
+    };
+    gateway: {
+        otlpHttpEndpoint: string;
+        otlpGrpcEndpoint: string;
+    };
+    app: {
+        host: string;
+        appPort: number;
+        apiPort: number;
+    };
+    version?: string;
+}>;
+declare function buildExternalComposition(options: ClickStackExternalMongoBuildOptions): import("../../../index.js").CallableComposition<{
+    mongoUri: string;
+    name: string;
+    clickhouse: {
+        host: string;
+        nativePort?: number;
+        httpPort?: number;
+        database?: string;
+        username?: string;
+        password?: string;
+        appUsername?: string;
+        appPassword?: string;
+    };
+    namespace?: string;
+    version?: string;
+    apiKey?: string;
+    hyperdx?: {
+        replicas?: number;
+        resources?: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        image?: {
+            repository?: string;
+            tag?: string;
+            pullPolicy?: "Always" | "IfNotPresent" | "Never";
+        };
+        frontendUrl?: string;
+    };
+}, {
+    ready: boolean;
+    phase: "Ready" | "Failed" | "Installing";
+    ui: {
+        url: string;
+    };
+    gateway: {
+        otlpHttpEndpoint: string;
+        otlpGrpcEndpoint: string;
+    };
+    app: {
+        host: string;
+        appPort: number;
+        apiPort: number;
+    };
+    version?: string;
+}>;
+/** Composition type for the internal-Mongo variant. */
+export type ClickStackBootstrapComposition = ReturnType<typeof buildInternalComposition>;
+/** Composition type for the external-Mongo variant. */
+export type ClickStackExternalMongoBootstrapComposition = ReturnType<typeof buildExternalComposition>;
+/**
+ * Construct a ClickStack bootstrap composition variant. Build-time options
+ * select WHICH resources exist (Mongo mode/storage) and bake static raw chart
+ * values; everything per-instance stays in the runtime spec.
+ */
+export declare function makeClickstackBootstrap(options?: ClickStackInternalMongoBuildOptions): ClickStackBootstrapComposition;
+export declare function makeClickstackBootstrap(options: ClickStackExternalMongoBuildOptions): ClickStackExternalMongoBootstrapComposition;
+/**
+ * The default ClickStack bootstrap: internal single-replica Mongo (dev-first),
+ * default RGD name/kind. Use `makeClickstackBootstrap(...)` for the
+ * external-Mongo variant, custom Mongo storage, or static raw chart values.
+ */
+export declare const clickstackBootstrap: import("../../../index.js").CallableComposition<{
+    name: string;
+    clickhouse: {
+        host: string;
+        nativePort?: number;
+        httpPort?: number;
+        database?: string;
+        username?: string;
+        password?: string;
+        appUsername?: string;
+        appPassword?: string;
+    };
+    namespace?: string;
+    version?: string;
+    apiKey?: string;
+    hyperdx?: {
+        replicas?: number;
+        resources?: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        image?: {
+            repository?: string;
+            tag?: string;
+            pullPolicy?: "Always" | "IfNotPresent" | "Never";
+        };
+        frontendUrl?: string;
+    };
+}, {
+    ready: boolean;
+    phase: "Ready" | "Failed" | "Installing";
+    ui: {
+        url: string;
+    };
+    gateway: {
+        otlpHttpEndpoint: string;
+        otlpGrpcEndpoint: string;
+    };
+    app: {
+        host: string;
+        appPort: number;
+        apiPort: number;
+    };
+    version?: string;
+}>;
+export {};
+//# sourceMappingURL=clickstack-bootstrap.d.ts.map

package/dist/factories/clickstack/compositions/clickstack-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clickstack-bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/factories/clickstack/compositions/clickstack-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAoBH,OAAO,EAQL,KAAK,mCAAmC,EACxC,KAAK,mCAAmC,EAEzC,MAAM,aAAa,CAAC;AAwJrB,iBAAS,wBAAwB,CAAC,OAAO,EAAE,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAe7E;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAc7E;AAED,uDAAuD;AACvD,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzF,uDAAuD;AACvD,MAAM,MAAM,2CAA2C,GAAG,UAAU,CAClE,OAAO,wBAAwB,CAChC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,CAAC,EAAE,mCAAmC,GAC5C,8BAA8B,CAAC;AAClC,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,mCAAmC,GAC3C,2CAA2C,CAAC;AAmB/C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA4B,CAAC"}

package/dist/factories/clickstack/compositions/clickstack-bootstrap.js

@@ -0,0 +1,251 @@
+/**
+ * ClickStack (HyperDX) Bootstrap Composition — EXTERNAL ClickHouse only.
+ *
+ * Deploys the OFFICIAL `clickstack` chart (3.0.x, MIT) from
+ * https://clickhouse.github.io/ClickStack-helm-charts via HelmRepository and
+ * HelmRelease resources. Build-around: we wrap the official chart — never
+ * hand-rolled manifests. NOT the archived hyperdxio/helm-charts repo, NOT the
+ * deprecated `hdx-oss-v2` chart, and NOT the `clickstack-operators`
+ * prerequisite chart (its ClickHouse operator CRDs would collide with the
+ * Altinity clickhouse-operator that manages our ClickHouseInstallation, and
+ * it drags in a MongoDB operator we don't want).
+ *
+ * BUILD-TIME vs RUNTIME: `makeClickstackBootstrap(options)` constructs a
+ * composition VARIANT. Options that decide WHICH resources exist (the Mongo
+ * mode + its storage shape) and the static raw chart values are build-time —
+ * plain JS may branch on them because they are always concrete. The runtime
+ * spec carries only proxy-safe values (names, namespaces, endpoints,
+ * versions, credentials); a user composing with `schema.spec.*` refs never
+ * hits a JS branch on a proxy.
+ *
+ * What gets deployed:
+ * 1. The target Namespace.
+ * 2. The shared ClickStack HelmRepository singleton.
+ * 3. Internal-Mongo variant only: a minimal single-replica Mongo
+ *    StatefulSet + Service (`mongo:7`, no operator/CRDs/auth — APP METADATA
+ *    ONLY, dev-first; see resources/mongo.ts for the loud caveats).
+ * 4. The clickstack HelmRelease: HyperDX (UI/API/OpAMP) + the OTel gateway
+ *    collector subchart, wired to the EXTERNAL ClickHouse
+ *    (`clickhouse.enabled: false` and `mongodb.enabled: false` are hard-pinned
+ *    by the values mapper and beat the build-time values passthrough).
+ *
+ * STATUS CONTRACT: beyond ready/phase, the status exposes `ui.url`,
+ * `gateway.otlpHttpEndpoint` / `gateway.otlpGrpcEndpoint`, and
+ * `app.host/appPort/apiPort` so downstream compositions (e.g.
+ * `clickstackK8sTelemetry`) consume connection details without reconstructing
+ * chart naming rules. The mapper pins `fullnameOverride` to the release name
+ * to make that naming deterministic; endpoints are derived from the owned
+ * HelmRelease resource's metadata (never `schema.spec.*` — KRO status CEL
+ * cannot reference the instance spec).
+ *
+ * SCHEMA / REPLICATION CAVEAT: on first start the gateway collector's goose
+ * migrations create `otel_logs` / `otel_traces` / `otel_metrics_*` /
+ * `hyperdx_sessions` in the external ClickHouse as plain single-node
+ * MergeTree tables. That matches a 1-replica CHI (our dev-first sizing);
+ * multi-replica / `ON CLUSTER` schemas are NOT supported by ClickStack's
+ * tooling — revisit (and see `CLICKSTACK_CLICKHOUSE_GUIDANCE`) before scaling
+ * the CHI. Version coupling is loose: chart vendors CH 25.7, seed schemas
+ * carry a <26.2 compat variant, and the optional JSON-typed schema
+ * (`HYPERDX_OTEL_EXPORTER_CLICKHOUSE_JSON_ENABLE`) wants CH 25.3+.
+ *
+ * @example Internal Mongo (default)
+ * ```typescript
+ * const factory = clickstackBootstrap.factory('kro', { namespace: 'clickstack' });
+ *
+ * await factory.deploy({
+ *   name: 'clickstack',
+ *   clickhouse: {
+ *     host: 'clickhouse-observability.clickhouse.svc.cluster.local',
+ *     username: 'otelcollector',
+ *     password: '…',
+ *   },
+ * });
+ * ```
+ *
+ * @example External Mongo (build-time variant)
+ * ```typescript
+ * const bootstrap = makeClickstackBootstrap({ mongo: { mode: 'external' } });
+ *
+ * await bootstrap.factory('kro').deploy({
+ *   name: 'clickstack',
+ *   clickhouse: { host: '…' },
+ *   mongoUri: 'mongodb://user:pass@mongo.example.com:27017/hyperdx',
+ * });
+ * ```
+ */
+import { kubernetesComposition } from '../../../core/composition/imperative.js';
+import { DEFAULT_FLUX_NAMESPACE } from '../../../core/config/defaults.js';
+import { Cel } from '../../../core/references/cel.js';
+import { singleton } from '../../../core/singleton/singleton.js';
+import { containsKubernetesRefs, isKubernetesRef } from '../../../utils/type-guards.js';
+import { namespace } from '../../kubernetes/core/namespace.js';
+import { CLICKSTACK_API_PORT, CLICKSTACK_APP_PORT, CLICKSTACK_GATEWAY_NAME_SUFFIX, CLICKSTACK_OTLP_GRPC_PORT, CLICKSTACK_OTLP_HTTP_PORT, clickstackHelmRelease, DEFAULT_CLICKSTACK_REPO_NAME, DEFAULT_CLICKSTACK_REPO_URL, DEFAULT_CLICKSTACK_VERSION, } from '../resources/helm.js';
+import { clickstackMongoService, clickstackMongoStatefulSet } from '../resources/mongo.js';
+import { ClickStackBootstrapConfigSchema, ClickStackBootstrapStatusSchema, ClickStackExternalMongoBootstrapConfigSchema, } from '../types.js';
+import { DEFAULT_CLICKSTACK_NAMESPACE, mapClickStackConfigToHelmValues, } from '../utils/helm-values-mapper.js';
+import { clickstackHelmRepositoryBootstrap } from './clickstack-helm-repository.js';
+/**
+ * Shared composition body. `build` is CONCRETE (construction-time), so every
+ * plain-JS branch below is on build config — never on the (possibly
+ * schema-proxy) runtime spec.
+ *
+ * NOTE: the variant builders pass INLINE delegating arrows
+ * (`(spec) => bootstrapBody(spec, build)`) to `kubernetesComposition` — a
+ * composition function that is itself a returned closure defeats the
+ * composition analyzer and mis-serializes mixed CEL templates (verified
+ * empirically: `Cel.template` values came out double-wrapped as
+ * `${tcp://${…}}`).
+ */
+function bootstrapBody(spec, build) {
+    {
+        const resolvedNamespace = isKubernetesRef(spec.namespace)
+            ? Cel.default(spec.namespace, DEFAULT_CLICKSTACK_NAMESPACE)
+            : (spec.namespace ?? DEFAULT_CLICKSTACK_NAMESPACE);
+        const resolvedVersion = isKubernetesRef(spec.version)
+            ? Cel.default(spec.version, DEFAULT_CLICKSTACK_VERSION)
+            : (spec.version ?? DEFAULT_CLICKSTACK_VERSION);
+        const helmValues = mapClickStackConfigToHelmValues(spec, {
+            mongoMode: build.mongoMode,
+            ...(build.values !== undefined && { values: build.values }),
+        });
+        const _clickstackNamespace = namespace({
+            metadata: {
+                name: resolvedNamespace,
+                labels: {
+                    'app.kubernetes.io/name': 'clickstack',
+                    'app.kubernetes.io/instance': spec.name,
+                    'app.kubernetes.io/managed-by': 'typekro',
+                },
+            },
+            id: 'clickstackNamespace',
+        });
+        // One cluster-level Flux source shared by every ClickStack instance —
+        // singleton(...) keeps it out of any single instance's KRO ApplySet
+        // (see clickstack-helm-repository.ts for the ownership rationale).
+        const _clickstackHelmRepository = singleton(clickstackHelmRepositoryBootstrap, {
+            id: 'clickstack-helm-repository',
+            spec: {
+                name: DEFAULT_CLICKSTACK_REPO_NAME,
+                namespace: DEFAULT_FLUX_NAMESPACE,
+                url: DEFAULT_CLICKSTACK_REPO_URL,
+            },
+        });
+        // ── Internal Mongo (build-time variant) ─────────────────────────────
+        if (build.mongoMode === 'internal') {
+            const _mongoStatefulSet = clickstackMongoStatefulSet({
+                name: spec.name,
+                namespace: resolvedNamespace,
+                ...(build.storage?.size !== undefined && { storageSize: build.storage.size }),
+                ...(build.storage?.storageClassName !== undefined && {
+                    storageClassName: build.storage.storageClassName,
+                }),
+                statefulSetId: 'clickstackMongoStatefulSet',
+            });
+            const _mongoService = clickstackMongoService({
+                name: spec.name,
+                namespace: resolvedNamespace,
+                serviceId: 'clickstackMongoService',
+            });
+        }
+        // ── ClickStack HelmRelease ───────────────────────────────────────────
+        //
+        // The HelmRelease does not set `disableWait`, so helm-controller waits
+        // for the chart's workloads (HyperDX app + gateway collector) before
+        // reporting Ready — readiness is workload-aware, mirroring the
+        // dagster/clickhouse bootstraps. The HyperDX pod's own waitForMongodb
+        // init container gates on Mongo reachability, so no explicit dependency
+        // on the internal Mongo is needed.
+        const _clickstackHelmRelease = clickstackHelmRelease({
+            name: spec.name,
+            namespace: resolvedNamespace,
+            version: resolvedVersion,
+            values: helmValues,
+            id: 'clickstackHelmRelease',
+        });
+        const helmReleaseReady = Cel.expr(_clickstackHelmRelease.status.conditions, '.exists(c, c.type == "Ready" && c.status == "True")');
+        // Status endpoints derive from the owned HelmRelease resource so they
+        // serialize as KRO status CEL and land on the live KRO CR's status
+        // (same reachability class as the PR #93 review finding). Naming is
+        // deterministic because the mapper pins `fullnameOverride` to the release
+        // name: HyperDX Service = `<name>`, gateway Service =
+        // `<name>-otel-collector`. Ports are chart defaults (see resources/helm.ts)
+        // and ride INSIDE the resource-derived URL strings.
+        //
+        // RAW Cel.expr over the resource id is required: the status-builder proxy
+        // passes `metadata` values through VERBATIM, and the HelmRelease's
+        // metadata.name in the template is itself a schema ref — a Cel.template
+        // over `_clickstackHelmRelease.metadata.name` therefore resolves back to
+        // `schema.spec.name`, gets classified static (client-hydrated), and is
+        // DROPPED from the KRO status. A raw resource-path expression survives
+        // serialization as genuine KRO CEL.
+        const releaseMeta = 'clickstackHelmRelease.metadata';
+        const appHostCel = `${releaseMeta}.name + "." + ${releaseMeta}.namespace + ".svc.cluster.local"`;
+        const gatewayHostCel = `${releaseMeta}.name + "${CLICKSTACK_GATEWAY_NAME_SUFFIX}." + ${releaseMeta}.namespace + ".svc.cluster.local"`;
+        return {
+            ready: helmReleaseReady,
+            phase: Cel.expr('clickstackHelmRelease.status.conditions.exists(c, c.type == "Ready" && c.status == "False") ' +
+                '? "Failed" : clickstackHelmRelease.status.conditions.exists(c, c.type == "Ready" && ' +
+                'c.status == "True") ? "Ready" : "Installing"'),
+            version: resolvedVersion,
+            ui: {
+                url: Cel.expr(`"http://" + ${appHostCel} + ":${CLICKSTACK_APP_PORT}"`),
+            },
+            gateway: {
+                otlpHttpEndpoint: Cel.expr(`"http://" + ${gatewayHostCel} + ":${CLICKSTACK_OTLP_HTTP_PORT}"`),
+                otlpGrpcEndpoint: Cel.expr(`"http://" + ${gatewayHostCel} + ":${CLICKSTACK_OTLP_GRPC_PORT}"`),
+            },
+            app: {
+                host: Cel.expr(appHostCel),
+                // Bare numeric constants — no resource anchor, so client-hydrated
+                // only; both ports are KRO-visible inside the URL fields above.
+                appPort: CLICKSTACK_APP_PORT,
+                apiPort: CLICKSTACK_API_PORT,
+            },
+        };
+    }
+}
+function buildInternalComposition(options) {
+    const build = {
+        mongoMode: 'internal',
+        ...(options.mongo?.storage !== undefined && { storage: options.mongo.storage }),
+        ...(options.values !== undefined && { values: options.values }),
+    };
+    return kubernetesComposition({
+        name: options.name ?? 'clickstack-bootstrap',
+        kind: options.kind ?? 'ClickStackBootstrap',
+        spec: ClickStackBootstrapConfigSchema,
+        status: ClickStackBootstrapStatusSchema,
+    }, (spec) => bootstrapBody(spec, build));
+}
+function buildExternalComposition(options) {
+    const build = {
+        mongoMode: 'external',
+        ...(options.values !== undefined && { values: options.values }),
+    };
+    return kubernetesComposition({
+        name: options.name ?? 'clickstack-bootstrap-external-mongo',
+        kind: options.kind ?? 'ClickStackExternalMongoBootstrap',
+        spec: ClickStackExternalMongoBootstrapConfigSchema,
+        status: ClickStackBootstrapStatusSchema,
+    }, (spec) => bootstrapBody(spec, build));
+}
+export function makeClickstackBootstrap(options = {}) {
+    // Build-time options must be CONCRETE: they select which resources exist and bake static chart
+    // values at construction — a schema ref here can never serialize (loud > silent mis-serialization).
+    if (containsKubernetesRefs(options)) {
+        throw new Error('makeClickstackBootstrap: build-time options contain a schema/resource reference. ' +
+            'Build-time options (mongo mode/storage, static chart values, name/kind) are fixed at ' +
+            'construction — move per-instance values into the runtime spec instead.');
+    }
+    if (options.mongo?.mode === 'external') {
+        return buildExternalComposition(options);
+    }
+    return buildInternalComposition(options);
+}
+/**
+ * The default ClickStack bootstrap: internal single-replica Mongo (dev-first),
+ * default RGD name/kind. Use `makeClickstackBootstrap(...)` for the
+ * external-Mongo variant, custom Mongo storage, or static raw chart values.
+ */
+export const clickstackBootstrap = makeClickstackBootstrap();
+//# sourceMappingURL=clickstack-bootstrap.js.map

package/dist/factories/clickstack/compositions/clickstack-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clickstack-bootstrap.js","sourceRoot":"","sources":["../../../../src/factories/clickstack/compositions/clickstack-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAEL,+BAA+B,EAE/B,+BAA+B,EAG/B,4CAA4C,GAI7C,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AASpF;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,IAAsC,EAAE,KAA0B;IACvF,CAAC;QACC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC;YAC3D,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,4BAA4B,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;YACnD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC;YACvD,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC;QAEjD,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,EAAE;YACvD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,MAAM,oBAAoB,GAAG,SAAS,CAAC;YACrC,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE;oBACN,wBAAwB,EAAE,YAAY;oBACtC,4BAA4B,EAAE,IAAI,CAAC,IAAI;oBACvC,8BAA8B,EAAE,SAAS;iBAC1C;aACF;YACD,EAAE,EAAE,qBAAqB;SAC1B,CAAC,CAAC;QAEH,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,yBAAyB,GAAG,SAAS,CAAC,iCAAiC,EAAE;YAC7E,EAAE,EAAE,4BAA4B;YAChC,IAAI,EAAE;gBACJ,IAAI,EAAE,4BAA4B;gBAClC,SAAS,EAAE,sBAAsB;gBACjC,GAAG,EAAE,2BAA2B;aACjC;SACF,CAAC,CAAC;QAEH,uEAAuE;QACvE,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;gBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,iBAA2B;gBACtC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC7E,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,KAAK,SAAS,IAAI;oBACnD,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB;iBACjD,CAAC;gBACF,aAAa,EAAE,4BAA4B;aAC5C,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,sBAAsB,CAAC;gBAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,iBAA2B;gBACtC,SAAS,EAAE,wBAAwB;aACpC,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,EAAE;QACF,uEAAuE;QACvE,qEAAqE;QACrE,+DAA+D;QAC/D,sEAAsE;QACtE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;YACnD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,UAAU;YAClB,EAAE,EAAE,uBAAuB;SAC5B,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,GAAG,CAAC,IAAI,CAC/B,sBAAsB,CAAC,MAAM,CAAC,UAAU,EACxC,qDAAqD,CACtD,CAAC;QAEF,sEAAsE;QACtE,mEAAmE;QACnE,oEAAoE;QACpE,0EAA0E;QAC1E,sDAAsD;QACtD,4EAA4E;QAC5E,oDAAoD;QACpD,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACrD,MAAM,UAAU,GAAG,GAAG,WAAW,iBAAiB,WAAW,mCAAmC,CAAC;QACjG,MAAM,cAAc,GAAG,GAAG,WAAW,YAAY,8BAA8B,QAAQ,WAAW,mCAAmC,CAAC;QAEtI,OAAO;YACL,KAAK,EAAE,gBAAgB;YACvB,KAAK,EAAE,GAAG,CAAC,IAAI,CACb,8FAA8F;gBAC5F,sFAAsF;gBACtF,8CAA8C,CACjD;YACD,OAAO,EAAE,eAAe;YACxB,EAAE,EAAE;gBACF,GAAG,EAAE,GAAG,CAAC,IAAI,CAAS,eAAe,UAAU,QAAQ,mBAAmB,GAAG,CAAC;aAC/E;YACD,OAAO,EAAE;gBACP,gBAAgB,EAAE,GAAG,CAAC,IAAI,CACxB,eAAe,cAAc,QAAQ,yBAAyB,GAAG,CAClE;gBACD,gBAAgB,EAAE,GAAG,CAAC,IAAI,CACxB,eAAe,cAAc,QAAQ,yBAAyB,GAAG,CAClE;aACF;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,GAAG,CAAC,IAAI,CAAS,UAAU,CAAC;gBAClC,kEAAkE;gBAClE,gEAAgE;gBAChE,OAAO,EAAE,mBAAmB;gBAC5B,OAAO,EAAE,mBAAmB;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,OAA4C;IAC5E,MAAM,KAAK,GAAwB;QACjC,SAAS,EAAE,UAAU;QACrB,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC;IACF,OAAO,qBAAqB,CAC1B;QACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,sBAAsB;QAC5C,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,qBAAqB;QAC3C,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,+BAA+B;KACxC,EACD,CAAC,IAA+B,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAA4C;IAC5E,MAAM,KAAK,GAAwB;QACjC,SAAS,EAAE,UAAU;QACrB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC;IACF,OAAO,qBAAqB,CAC1B;QACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,qCAAqC;QAC3D,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,kCAAkC;QACxD,IAAI,EAAE,4CAA4C;QAClD,MAAM,EAAE,+BAA+B;KACxC,EACD,CAAC,IAA4C,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAC7E,CAAC;AACJ,CAAC;AAqBD,MAAM,UAAU,uBAAuB,CACrC,UAAkC,EAAE;IAEpC,+FAA+F;IAC/F,oGAAoG;IACpG,IAAI,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,uFAAuF;YACvF,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,wBAAwB,CAAC,OAA8C,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,wBAAwB,CAAC,OAA8C,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC"}

package/dist/factories/clickstack/compositions/clickstack-helm-repository.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared ClickStack HelmRepository singleton.
+ *
+ * The official ClickStack chart repository
+ * (https://clickhouse.github.io/ClickStack-helm-charts) is a single
+ * cluster-level Flux source — the same URL serves every consumer. Deploying it
+ * inline in the `clickstackBootstrap` RGD would make each instance's KRO
+ * ApplySet try to *own* the HelmRepository exclusively, so a second instance
+ * of the RGD fails to reconcile ("resource belongs to a different ApplySet
+ * ... cannot reassign"). Modelling the repository as its own composition lets
+ * the bootstrap consume it via `singleton(...)`, so one shared HelmRepository
+ * is owned outside any single instance's ApplySet and every instance's
+ * HelmRelease references it by the same `sourceRef`. (Same pattern as the
+ * dagster/clickhouse bootstraps' shared repositories.)
+ */
+export declare const clickstackHelmRepositoryBootstrap: import("../../../index.js").CallableComposition<{
+    name: string;
+    namespace: string;
+    url: string;
+}, {
+    ready: boolean;
+}>;
+//# sourceMappingURL=clickstack-helm-repository.d.ts.map

package/dist/factories/clickstack/compositions/clickstack-helm-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clickstack-helm-repository.d.ts","sourceRoot":"","sources":["../../../../src/factories/clickstack/compositions/clickstack-helm-repository.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iCAAiC;;;;;;EAsB7C,CAAC"}