typekro 0.3.1 → 0.5.0

package/dist/factories/apisix/utils/admin-credentials.d.ts

@@ -0,0 +1,43 @@
+/**
+ * APISIX Admin API Credential Resolution
+ *
+ * Resolves APISIX admin API credentials from (in order of priority):
+ * 1. Explicit configuration via `gateway.adminCredentials`
+ * 2. Environment variables (`APISIX_ADMIN_KEY`, `APISIX_VIEWER_KEY`)
+ * 3. Test-environment-only defaults (throws in production if no credentials provided)
+ *
+ * @security This module handles sensitive admin API keys. Never log resolved
+ * credential values. In production, always provide credentials via the spec
+ * or environment variables.
+ *
+ * @module
+ */
+/**
+ * Resolved APISIX admin credentials.
+ *
+ * @security Treat both values as secrets — do not log or persist them.
+ */
+export interface ResolvedAdminCredentials {
+    admin: string;
+    viewer: string;
+}
+/**
+ * Resolves APISIX admin API credentials.
+ *
+ * Resolution order:
+ * 1. Values provided explicitly via the `specCredentials` parameter (from
+ *    `gateway.adminCredentials` in the bootstrap spec).
+ * 2. Environment variables `APISIX_ADMIN_KEY` / `APISIX_VIEWER_KEY`.
+ * 3. Development-only defaults identical to the upstream chart defaults.
+ *    A warning is emitted to stderr the first time these are used.
+ *
+ * @security Callers must never log the returned credential values.
+ *
+ * @param specCredentials - Optional explicit credentials from the user spec.
+ * @returns Resolved admin and viewer keys.
+ */
+export declare function resolveAdminCredentials(specCredentials?: {
+    admin?: string;
+    viewer?: string;
+} | undefined): ResolvedAdminCredentials;
+//# sourceMappingURL=admin-credentials.d.ts.map

package/dist/factories/apisix/utils/admin-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-credentials.d.ts","sourceRoot":"","sources":["../../../../src/factories/apisix/utils/admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuBH;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAChE,wBAAwB,CAK1B"}

package/dist/factories/apisix/utils/admin-credentials.js

@@ -0,0 +1,82 @@
+/**
+ * APISIX Admin API Credential Resolution
+ *
+ * Resolves APISIX admin API credentials from (in order of priority):
+ * 1. Explicit configuration via `gateway.adminCredentials`
+ * 2. Environment variables (`APISIX_ADMIN_KEY`, `APISIX_VIEWER_KEY`)
+ * 3. Test-environment-only defaults (throws in production if no credentials provided)
+ *
+ * @security This module handles sensitive admin API keys. Never log resolved
+ * credential values. In production, always provide credentials via the spec
+ * or environment variables.
+ *
+ * @module
+ */
+import { isTestEnvironment } from '../../../core/config/index.js';
+import { TypeKroError } from '../../../core/errors.js';
+import { getComponentLogger } from '../../../core/logging/index.js';
+const logger = getComponentLogger('apisix-admin-credentials');
+/**
+ * Well-known APISIX chart default keys — used ONLY as a development fallback.
+ * These are the public defaults shipped in the upstream Helm chart and provide
+ * zero additional security. They exist here solely so that local development
+ * workflows do not break when env vars are unset.
+ *
+ * @security Do NOT rely on these in any environment other than local development.
+ * @internal
+ */
+const DEV_DEFAULT_ADMIN_KEY = 'edd1c9f034335f136f87ad84b625c8f1';
+const DEV_DEFAULT_VIEWER_KEY = '4054f7cf07e344346cd3f287985e76a2';
+/** Whether we have already emitted the dev-default warning in this process. */
+let devDefaultWarningEmitted = false;
+/**
+ * Resolves APISIX admin API credentials.
+ *
+ * Resolution order:
+ * 1. Values provided explicitly via the `specCredentials` parameter (from
+ *    `gateway.adminCredentials` in the bootstrap spec).
+ * 2. Environment variables `APISIX_ADMIN_KEY` / `APISIX_VIEWER_KEY`.
+ * 3. Development-only defaults identical to the upstream chart defaults.
+ *    A warning is emitted to stderr the first time these are used.
+ *
+ * @security Callers must never log the returned credential values.
+ *
+ * @param specCredentials - Optional explicit credentials from the user spec.
+ * @returns Resolved admin and viewer keys.
+ */
+export function resolveAdminCredentials(specCredentials) {
+    const admin = resolveKey(specCredentials?.admin, 'APISIX_ADMIN_KEY', DEV_DEFAULT_ADMIN_KEY);
+    const viewer = resolveKey(specCredentials?.viewer, 'APISIX_VIEWER_KEY', DEV_DEFAULT_VIEWER_KEY);
+    return { admin, viewer };
+}
+/**
+ * Resolve a single credential value with the three-tier priority.
+ *
+ * @internal
+ */
+function resolveKey(specValue, envVarName, devDefault) {
+    // 1. Explicit spec value takes highest priority
+    if (specValue) {
+        return specValue;
+    }
+    // 2. Environment variable
+    const envValue = process.env[envVarName];
+    if (envValue) {
+        return envValue;
+    }
+    // 3. Default credentials — only allowed in test environments
+    if (!isTestEnvironment()) {
+        throw new TypeKroError(`APISIX admin credentials not configured. ` +
+            `Set the ${envVarName} environment variable or pass gateway.adminCredentials in the spec. ` +
+            `Default credentials are only permitted in test environments (NODE_ENV=test or VITEST=true).`, 'APISIX_CREDENTIALS_MISSING');
+    }
+    if (!devDefaultWarningEmitted) {
+        devDefaultWarningEmitted = true;
+        logger.warn('Using default APISIX admin API keys for test environment. These are the well-known chart defaults and are NOT secure.', {
+            envVar: envVarName,
+            hint: 'Set APISIX_ADMIN_KEY and APISIX_VIEWER_KEY environment variables, or pass gateway.adminCredentials in the spec for production deployments.',
+        });
+    }
+    return devDefault;
+}
+//# sourceMappingURL=admin-credentials.js.map

package/dist/factories/apisix/utils/admin-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-credentials.js","sourceRoot":"","sources":["../../../../src/factories/apisix/utils/admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,MAAM,MAAM,GAAG,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AACjE,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAElE,+EAA+E;AAC/E,IAAI,wBAAwB,GAAG,KAAK,CAAC;AAYrC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CACrC,eAAiE;IAEjE,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,EAAE,KAAK,EAAE,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,eAAe,EAAE,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IAEhG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,SAA6B,EAAE,UAAkB,EAAE,UAAkB;IACvF,gDAAgD;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CACpB,2CAA2C;YACzC,WAAW,UAAU,sEAAsE;YAC3F,6FAA6F,EAC/F,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,wBAAwB,GAAG,IAAI,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,uHAAuH,EACvH;YACE,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,4IAA4I;SACnJ,CACF,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/factories/apisix/utils/helm-values-mapper.d.ts

@@ -0,0 +1,19 @@
+import type { APISixBootstrapConfig, APISixHelmValues } from '../types.js';
+/**
+ * Maps APISixBootstrapConfig to APISix Helm values
+ *
+ * This function transforms the TypeKro configuration interface into the format
+ * expected by the official APISix Helm chart.
+ *
+ * @param config - The APISix bootstrap configuration
+ * @returns Helm values object for the APISix chart
+ */
+export declare function mapAPISixConfigToHelmValues(config: APISixBootstrapConfig): APISixHelmValues;
+/**
+ * Validates APISix Helm values for common configuration issues
+ *
+ * @param values - The Helm values to validate
+ * @returns Array of validation warnings/errors
+ */
+export declare function validateAPISixHelmValues(values: APISixHelmValues): string[];
+//# sourceMappingURL=helm-values-mapper.d.ts.map

package/dist/factories/apisix/utils/helm-values-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm-values-mapper.d.ts","sourceRoot":"","sources":["../../../../src/factories/apisix/utils/helm-values-mapper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,qBAAqB,GAAG,gBAAgB,CA0E3F;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAwC3E"}

package/dist/factories/apisix/utils/helm-values-mapper.js

@@ -0,0 +1,106 @@
+import { removeUndefinedValues } from '../../../utils/helpers.js';
+/**
+ * Maps APISixBootstrapConfig to APISix Helm values
+ *
+ * This function transforms the TypeKro configuration interface into the format
+ * expected by the official APISix Helm chart.
+ *
+ * @param config - The APISix bootstrap configuration
+ * @returns Helm values object for the APISix chart
+ */
+export function mapAPISixConfigToHelmValues(config) {
+    const helmValues = {
+        // Installation configuration
+        ...(config.installCRDs !== undefined && { installCRDs: config.installCRDs }),
+        // Global configuration
+        ...(config.global && { global: config.global }),
+        // Replica configuration
+        ...(config.replicaCount !== undefined && { replicaCount: config.replicaCount }),
+        // Gateway configuration
+        ...(config.gateway && { gateway: config.gateway }),
+        // Ingress Controller configuration
+        ...(config.ingressController && {
+            ingressController: {
+                // Only include fields that APISix Helm chart supports
+                ...(config.ingressController.enabled !== undefined && {
+                    enabled: config.ingressController.enabled,
+                }),
+                ...(config.ingressController.image && { image: config.ingressController.image }),
+                ...(config.ingressController.resources && {
+                    resources: config.ingressController.resources,
+                }),
+                ...(config.ingressController.nodeSelector && {
+                    nodeSelector: config.ingressController.nodeSelector,
+                }),
+                ...(config.ingressController.tolerations && {
+                    tolerations: config.ingressController.tolerations,
+                }),
+                ...(config.ingressController.affinity && { affinity: config.ingressController.affinity }),
+                ...(config.ingressController.securityContext && {
+                    securityContext: config.ingressController.securityContext,
+                }),
+                ...(config.ingressController.containerSecurityContext && {
+                    containerSecurityContext: config.ingressController.containerSecurityContext,
+                }),
+                ...(config.ingressController.extraArgs && {
+                    extraArgs: config.ingressController.extraArgs,
+                }),
+                ...(config.ingressController.env && { env: config.ingressController.env }),
+                ...(config.ingressController.config && { config: config.ingressController.config }),
+            },
+        }),
+        // APISix configuration
+        ...(config.apisix && { apisix: config.apisix }),
+        // Dashboard configuration
+        ...(config.dashboard && { dashboard: config.dashboard }),
+        // etcd configuration
+        ...(config.etcd && {
+            etcd: {
+                ...config.etcd,
+                ...(config.etcd.replicaCount !== undefined && {
+                    replicaCount: config.etcd.replicaCount,
+                }),
+            },
+        }),
+        // Service Account configuration
+        ...(config.serviceAccount && { serviceAccount: config.serviceAccount }),
+        // RBAC configuration
+        ...(config.rbac && { rbac: config.rbac }),
+        // Custom values override
+        ...(config.customValues || {}),
+    };
+    // Remove undefined values to keep the Helm values clean
+    return removeUndefinedValues(helmValues);
+}
+/**
+ * Validates APISix Helm values for common configuration issues
+ *
+ * @param values - The Helm values to validate
+ * @returns Array of validation warnings/errors
+ */
+export function validateAPISixHelmValues(values) {
+    const warnings = [];
+    // Check ingress controller configuration
+    if (values.ingressController?.enabled === false) {
+        warnings.push('Ingress controller is disabled. This will prevent ingress resources from being processed.');
+    }
+    // Check gateway configuration
+    if (!values.gateway?.http?.enabled && !values.gateway?.https?.enabled) {
+        warnings.push('Both HTTP and HTTPS are disabled on the gateway. Consider enabling at least one.');
+    }
+    // Check etcd configuration
+    if (values.etcd?.enabled === false) {
+        warnings.push('etcd is disabled. Ensure you have an external etcd cluster configured.');
+    }
+    // Check resource requirements
+    if (!values.apisix?.resources?.requests) {
+        warnings.push('No resource requests specified for APISix. Consider setting CPU and memory requests for better scheduling.');
+    }
+    // Check ingress class configuration
+    if (values.ingressController?.enabled &&
+        !values.ingressController?.config?.kubernetes?.ingressClass) {
+        warnings.push('No ingress class specified. Consider setting ingressClass for proper ingress handling.');
+    }
+    return warnings;
+}
+//# sourceMappingURL=helm-values-mapper.js.map

package/dist/factories/apisix/utils/helm-values-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm-values-mapper.js","sourceRoot":"","sources":["../../../../src/factories/apisix/utils/helm-values-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGlE;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAA6B;IACvE,MAAM,UAAU,GAA8B;QAC5C,6BAA6B;QAC7B,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAE5E,uBAAuB;QACvB,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAE/C,wBAAwB;QACxB,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QAE/E,wBAAwB;QACxB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAElD,mCAAmC;QACnC,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE;gBACjB,sDAAsD;gBACtD,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,KAAK,SAAS,IAAI;oBACpD,OAAO,EAAE,MAAM,CAAC,iBAAiB,CAAC,OAAO;iBAC1C,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBAChF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,IAAI;oBACxC,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS;iBAC9C,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,IAAI;oBAC3C,YAAY,EAAE,MAAM,CAAC,iBAAiB,CAAC,YAAY;iBACpD,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,IAAI;oBAC1C,WAAW,EAAE,MAAM,CAAC,iBAAiB,CAAC,WAAW;iBAClD,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;gBACzF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,IAAI;oBAC9C,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC,eAAe;iBAC1D,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,IAAI;oBACvD,wBAAwB,EAAE,MAAM,CAAC,iBAAiB,CAAC,wBAAwB;iBAC5E,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,IAAI;oBACxC,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS;iBAC9C,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBAC1E,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;aACpF;SACF,CAAC;QAEF,uBAAuB;QACvB,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAE/C,0BAA0B;QAC1B,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAExD,qBAAqB;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;YACjB,IAAI,EAAE;gBACJ,GAAG,MAAM,CAAC,IAAI;gBACd,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI;oBAC5C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;iBACvC,CAAC;aACH;SACF,CAAC;QAEF,gCAAgC;QAChC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAEvE,qBAAqB;QACrB,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAEzC,yBAAyB;QACzB,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;KAC/B,CAAC;IAEF,wDAAwD;IACxD,OAAO,qBAAqB,CAAC,UAAU,CAAqB,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAwB;IAC/D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,yCAAyC;IACzC,IAAI,MAAM,CAAC,iBAAiB,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CACX,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACtE,QAAQ,CAAC,IAAI,CACX,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAM,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IAC1F,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CACX,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,IACE,MAAM,CAAC,iBAAiB,EAAE,OAAO;QACjC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAC3D,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,wFAAwF,CACzF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/factories/apisix/utils/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * APISix Utilities
+ */
+export { resolveAdminCredentials } from './admin-credentials.js';
+export { mapAPISixConfigToHelmValues, validateAPISixHelmValues } from './helm-values-mapper.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/factories/apisix/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/factories/apisix/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/factories/apisix/utils/index.js

@@ -0,0 +1,6 @@
+/**
+ * APISix Utilities
+ */
+export { resolveAdminCredentials } from './admin-credentials.js';
+export { mapAPISixConfigToHelmValues, validateAPISixHelmValues } from './helm-values-mapper.js';
+//# sourceMappingURL=index.js.map

package/dist/factories/apisix/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/factories/apisix/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/factories/cert-manager/compositions/cert-manager-bootstrap.d.ts

@@ -0,0 +1,45 @@
+import { type CertManagerBootstrapConfig } from '../types.js';
+/**
+ * Cert-Manager Bootstrap Composition
+ *
+ * Creates a complete cert-manager deployment using HelmRepository and HelmRelease resources.
+ * Provides comprehensive configuration options and status expressions derived from actual resource status.
+ *
+ * Features:
+ * - Complete cert-manager deployment (controller, webhook, cainjector)
+ * - Comprehensive configuration schema with ArkType validation
+ * - Status expressions using actual resource status fields
+ * - Integration endpoints derived from service status
+ * - Support for both kro and direct deployment strategies
+ *
+ * @example
+ * ```typescript
+ * const certManagerFactory = certManagerBootstrap.factory('direct', {
+ *   namespace: 'cert-manager-system',
+ *   waitForReady: true
+ * });
+ *
+ * const instance = await certManagerFactory.deploy({
+ *   name: 'cert-manager',
+ *   namespace: 'cert-manager',
+ *   version: '1.19.3',
+ *   installCRDs: true,
+ *   controller: {
+ *     resources: {
+ *       requests: { cpu: '100m', memory: '128Mi' },
+ *       limits: { cpu: '500m', memory: '512Mi' }
+ *     }
+ *   },
+ *   webhook: {
+ *     enabled: true,
+ *     replicaCount: 2
+ *   },
+ *   prometheus: {
+ *     enabled: true,
+ *     servicemonitor: { enabled: true }
+ *   }
+ * });
+ * ```
+ */
+export declare const certManagerBootstrap: import("../../../index.js").CallableComposition<CertManagerBootstrapConfig, import("../types.js").CertManagerBootstrapStatus>;
+//# sourceMappingURL=cert-manager-bootstrap.d.ts.map

package/dist/factories/cert-manager/compositions/cert-manager-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-manager-bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/factories/cert-manager/compositions/cert-manager-bootstrap.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,aAAa,CAAC;AAGrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,oBAAoB,+HAwShC,CAAC"}

package/dist/factories/cert-manager/compositions/cert-manager-bootstrap.js

@@ -0,0 +1,309 @@
+import { kubernetesComposition } from '../../../core/composition/imperative.js';
+import { DEFAULT_FLUX_NAMESPACE } from '../../../core/config/defaults.js';
+import { Cel } from '../../../core/references/cel.js';
+import { ensureVersionPrefix } from '../../../utils/string.js';
+import { namespace } from '../../kubernetes/core/namespace.js';
+import { certManagerHelmRelease, certManagerHelmRepository } from '../resources/helm.js';
+import { CertManagerBootstrapConfigSchema, CertManagerBootstrapStatusSchema, } from '../types.js';
+import { mapCertManagerConfigToHelmValues } from '../utils/helm-values-mapper.js';
+/**
+ * Cert-Manager Bootstrap Composition
+ *
+ * Creates a complete cert-manager deployment using HelmRepository and HelmRelease resources.
+ * Provides comprehensive configuration options and status expressions derived from actual resource status.
+ *
+ * Features:
+ * - Complete cert-manager deployment (controller, webhook, cainjector)
+ * - Comprehensive configuration schema with ArkType validation
+ * - Status expressions using actual resource status fields
+ * - Integration endpoints derived from service status
+ * - Support for both kro and direct deployment strategies
+ *
+ * @example
+ * ```typescript
+ * const certManagerFactory = certManagerBootstrap.factory('direct', {
+ *   namespace: 'cert-manager-system',
+ *   waitForReady: true
+ * });
+ *
+ * const instance = await certManagerFactory.deploy({
+ *   name: 'cert-manager',
+ *   namespace: 'cert-manager',
+ *   version: '1.19.3',
+ *   installCRDs: true,
+ *   controller: {
+ *     resources: {
+ *       requests: { cpu: '100m', memory: '128Mi' },
+ *       limits: { cpu: '500m', memory: '512Mi' }
+ *     }
+ *   },
+ *   webhook: {
+ *     enabled: true,
+ *     replicaCount: 2
+ *   },
+ *   prometheus: {
+ *     enabled: true,
+ *     servicemonitor: { enabled: true }
+ *   }
+ * });
+ * ```
+ */
+export const certManagerBootstrap = kubernetesComposition({
+    name: 'cert-manager-bootstrap',
+    // apiVersion defaults to 'v1alpha1' and Kro adds kro.run group automatically
+    kind: 'CertManagerBootstrap',
+    spec: CertManagerBootstrapConfigSchema,
+    status: CertManagerBootstrapStatusSchema,
+}, (spec) => {
+    // TODO: Future Enhancement - Create a full cert-manager composition that includes:
+    // 1. Direct Kubernetes resources (Deployments, Services, etc.) for status references
+    // 2. CRD queries for real-time certificate/issuer counts
+    // 3. Service status references for dynamic endpoint URLs
+    //
+    // For now, this bootstrap composition focuses on Helm-based deployment
+    // Apply default configuration values
+    const fullConfig = {
+        // Basic defaults
+        namespace: spec.namespace || 'cert-manager',
+        version: spec.version || '1.19.3',
+        installCRDs: spec.installCRDs !== undefined ? spec.installCRDs : true, // TypeKro installs CRDs by default
+        replicaCount: spec.replicaCount || 1,
+        // Global defaults
+        global: {
+            leaderElection: {
+                namespace: spec.global?.leaderElection?.namespace || spec.namespace || 'cert-manager',
+            },
+            logLevel: spec.global?.logLevel || 2,
+            podSecurityPolicy: {
+                enabled: spec.global?.podSecurityPolicy?.enabled || false,
+                useAppArmor: spec.global?.podSecurityPolicy?.useAppArmor || true,
+            },
+        },
+        // Strategy defaults
+        strategy: {
+            type: spec.strategy?.type || 'RollingUpdate',
+            rollingUpdate: {
+                maxSurge: spec.strategy?.rollingUpdate?.maxSurge || '25%',
+                maxUnavailable: spec.strategy?.rollingUpdate?.maxUnavailable || '25%',
+            },
+        },
+        // Controller defaults
+        // NOTE: Each field is explicitly handled with a fallback default.
+        // Do NOT spread ...spec.controller at the end — it would overwrite
+        // the carefully-built nested objects (image, resources, serviceAccount).
+        controller: {
+            image: {
+                repository: spec.controller?.image?.repository || 'quay.io/jetstack/cert-manager-controller',
+                tag: spec.controller?.image?.tag || ensureVersionPrefix(spec.version || '1.19.3'),
+                pullPolicy: spec.controller?.image?.pullPolicy || 'IfNotPresent',
+            },
+            resources: {
+                requests: {
+                    cpu: spec.controller?.resources?.requests?.cpu || '10m',
+                    memory: spec.controller?.resources?.requests?.memory || '32Mi',
+                },
+                limits: {
+                    cpu: spec.controller?.resources?.limits?.cpu || '100m',
+                    memory: spec.controller?.resources?.limits?.memory || '128Mi',
+                },
+            },
+            serviceAccount: {
+                create: spec.controller?.serviceAccount?.create !== undefined
+                    ? spec.controller.serviceAccount.create
+                    : true,
+                name: spec.controller?.serviceAccount?.name || '',
+                annotations: spec.controller?.serviceAccount?.annotations || {},
+            },
+            nodeSelector: spec.controller?.nodeSelector || {},
+        },
+        // Webhook defaults
+        // NOTE: cert-manager 1.19+ removed 'enabled', 'mutatingAdmissionWebhooks',
+        // and 'validatingAdmissionWebhooks' from the webhook section.
+        // Webhook is always enabled; admission webhooks are configured via
+        // 'mutatingWebhookConfiguration' and 'validatingWebhookConfiguration'.
+        webhook: {
+            replicaCount: spec.webhook?.replicaCount || 1,
+            image: {
+                repository: spec.webhook?.image?.repository || 'quay.io/jetstack/cert-manager-webhook',
+                tag: spec.webhook?.image?.tag || ensureVersionPrefix(spec.version || '1.19.3'),
+                pullPolicy: spec.webhook?.image?.pullPolicy || 'IfNotPresent',
+            },
+            resources: {
+                requests: {
+                    cpu: spec.webhook?.resources?.requests?.cpu || '10m',
+                    memory: spec.webhook?.resources?.requests?.memory || '32Mi',
+                },
+                limits: {
+                    cpu: spec.webhook?.resources?.limits?.cpu || '100m',
+                    memory: spec.webhook?.resources?.limits?.memory || '128Mi',
+                },
+            },
+            serviceAccount: {
+                create: spec.webhook?.serviceAccount?.create !== undefined
+                    ? spec.webhook.serviceAccount.create
+                    : true,
+                name: spec.webhook?.serviceAccount?.name || '',
+                annotations: spec.webhook?.serviceAccount?.annotations || {},
+            },
+            nodeSelector: spec.webhook?.nodeSelector || {},
+        },
+        // CA Injector defaults
+        cainjector: {
+            enabled: spec.cainjector?.enabled !== undefined ? spec.cainjector.enabled : true,
+            replicaCount: spec.cainjector?.replicaCount || 1,
+            image: {
+                repository: spec.cainjector?.image?.repository || 'quay.io/jetstack/cert-manager-cainjector',
+                tag: spec.cainjector?.image?.tag || ensureVersionPrefix(spec.version || '1.19.3'),
+                pullPolicy: spec.cainjector?.image?.pullPolicy || 'IfNotPresent',
+            },
+            resources: {
+                requests: {
+                    cpu: spec.cainjector?.resources?.requests?.cpu || '10m',
+                    memory: spec.cainjector?.resources?.requests?.memory || '32Mi',
+                },
+                limits: {
+                    cpu: spec.cainjector?.resources?.limits?.cpu || '100m',
+                    memory: spec.cainjector?.resources?.limits?.memory || '128Mi',
+                },
+            },
+            serviceAccount: {
+                create: spec.cainjector?.serviceAccount?.create !== undefined
+                    ? spec.cainjector.serviceAccount.create
+                    : true,
+                name: spec.cainjector?.serviceAccount?.name || '',
+                annotations: spec.cainjector?.serviceAccount?.annotations || {},
+            },
+            nodeSelector: spec.cainjector?.nodeSelector || {},
+        },
+        // ACME solver defaults
+        // NOTE: cert-manager 1.19+ only supports 'image' in acmesolver section.
+        // 'resources' and 'nodeSelector' were removed from the chart schema.
+        acmesolver: {
+            image: {
+                repository: spec.acmesolver?.image?.repository || 'quay.io/jetstack/cert-manager-acmesolver',
+                tag: spec.acmesolver?.image?.tag || ensureVersionPrefix(spec.version || '1.19.3'),
+                pullPolicy: spec.acmesolver?.image?.pullPolicy || 'IfNotPresent',
+            },
+            ...spec.acmesolver,
+        },
+        // Startup API check defaults
+        // IMPORTANT: startupapicheck validates the webhook is working before marking cert-manager as ready
+        // This is ENABLED by default to ensure accurate readiness reporting and prevent
+        // "webhook not found" errors when deploying cert-manager CRDs (Certificate, ClusterIssuer, etc.)
+        // It runs as a post-install Helm hook that verifies the cert-manager API is responding
+        // Set enabled: false to disable if you have custom readiness requirements
+        // Timeout increased to 5m to handle slower environments (configurable via startupapicheck.timeout)
+        startupapicheck: {
+            enabled: spec.startupapicheck?.enabled !== false, // Enabled by default, disable only if explicitly set to false
+            ...(spec.startupapicheck?.enabled !== false && {
+                image: {
+                    repository: spec.startupapicheck?.image?.repository || 'quay.io/jetstack/cert-manager-ctl',
+                    tag: spec.startupapicheck?.image?.tag || ensureVersionPrefix(spec.version || '1.19.3'),
+                    pullPolicy: spec.startupapicheck?.image?.pullPolicy || 'IfNotPresent',
+                },
+                resources: {
+                    requests: {
+                        cpu: spec.startupapicheck?.resources?.requests?.cpu || '10m',
+                        memory: spec.startupapicheck?.resources?.requests?.memory || '32Mi',
+                    },
+                    limits: {
+                        cpu: spec.startupapicheck?.resources?.limits?.cpu || '100m',
+                        memory: spec.startupapicheck?.resources?.limits?.memory || '128Mi',
+                    },
+                },
+                nodeSelector: spec.startupapicheck?.nodeSelector || {},
+                timeout: spec.startupapicheck?.timeout || '5m', // Increased from 1m to handle slower environments
+                backoffLimit: spec.startupapicheck?.backoffLimit || 4,
+            }),
+        },
+        // Prometheus defaults
+        prometheus: {
+            enabled: spec.prometheus?.enabled || false,
+            servicemonitor: {
+                enabled: spec.prometheus?.servicemonitor?.enabled || false,
+                prometheusInstance: spec.prometheus?.servicemonitor?.prometheusInstance || 'default',
+                targetPort: spec.prometheus?.servicemonitor?.targetPort || 9402,
+                path: spec.prometheus?.servicemonitor?.path || '/metrics',
+                interval: spec.prometheus?.servicemonitor?.interval || '60s',
+                scrapeTimeout: spec.prometheus?.servicemonitor?.scrapeTimeout || '30s',
+                honorLabels: spec.prometheus?.servicemonitor?.honorLabels || false,
+            },
+            ...spec.prometheus,
+        },
+        // Note: We do NOT spread ...spec here. Each field above already handles
+        // spec values with proper fallbacks. A final ...spec would overwrite all
+        // carefully-constructed defaults (e.g., spec.controller = { extraArgs: ['--flag'] }
+        // would wipe out all default image/resources/serviceAccount config).
+        // Any additional spec fields not explicitly handled above are passed through
+        // via the nested ...spec.X spreads within each section.
+        name: spec.name || 'cert-manager',
+    };
+    // Map configuration to Helm values
+    const helmValues = mapCertManagerConfigToHelmValues(fullConfig);
+    // Create namespace for cert-manager (required before HelmRelease)
+    const _certManagerNamespace = namespace({
+        metadata: {
+            name: spec.namespace || 'cert-manager',
+            labels: {
+                'app.kubernetes.io/name': 'cert-manager',
+                'app.kubernetes.io/instance': spec.name,
+                'app.kubernetes.io/version': spec.version || '1.19.3',
+                'app.kubernetes.io/managed-by': 'typekro',
+            },
+        },
+        id: 'certManagerNamespace',
+    });
+    // Create HelmRepository for cert-manager charts
+    const _helmRepository = certManagerHelmRepository({
+        name: 'cert-manager-repo', // Use static name to avoid schema proxy issues
+        namespace: DEFAULT_FLUX_NAMESPACE, // HelmRepositories should always be in flux-system
+        id: 'certManagerHelmRepository',
+    });
+    // Create HelmRelease for cert-manager deployment
+    const _helmRelease = certManagerHelmRelease({
+        name: spec.name,
+        namespace: spec.namespace || 'cert-manager',
+        version: spec.version || '1.19.3',
+        values: helmValues,
+        repositoryName: 'cert-manager-repo', // Match the repository name
+        id: 'certManagerHelmRelease',
+    });
+    // Return status matching the simplified schema structure
+    //
+    // DESIGN NOTE: This is a "bootstrap composition" that deploys cert-manager via Helm.
+    // Status references actual HelmRelease status fields (conditions array).
+    // Flux HelmRelease v2 uses conditions with type='Ready' for readiness, not a phase field.
+    //
+    // Using CEL expressions with .exists() to check conditions array:
+    // - _helmRelease.status.conditions is a KubernetesRef to the conditions array
+    // - CEL's .exists() function evaluates at runtime with actual cluster data
+    // - The reference resolver fetches the real HelmRelease from the cluster
+    // - This is the proper pattern for checking arrays in status builders
+    //
+    // CEL Expression Pattern:
+    // Cel.expr<boolean>(
+    //   resourceRef.status.arrayField,
+    //   '.exists(item, item.property == "value")'
+    // )
+    return {
+        // Reference actual HelmRelease status for proper dependency management
+        // Use CEL .exists() to check if Ready condition exists with status=True
+        ready: Cel.expr(_helmRelease.status.conditions, '.exists(c, c.type == "Ready" && c.status == "True")'),
+        phase: Cel.expr(_helmRelease.status.conditions, '.exists(c, c.type == "Ready" && c.status == "True") ? "Ready" : "Installing"'),
+        version: spec.version || '1.19.3',
+        controllerReady: Cel.expr(_helmRelease.status.conditions, '.exists(c, c.type == "Ready" && c.status == "True")'),
+        webhookReady: Cel.expr(_helmRelease.status.conditions, '.exists(c, c.type == "Ready" && c.status == "True")'),
+        cainjectorReady: Cel.expr(_helmRelease.status.conditions, '.exists(c, c.type == "Ready" && c.status == "True")'),
+        crds: {
+            // KNOWN ISSUE: Nested CEL expression resolution is broken in direct mode (tracked in TODO).
+            // In direct mode, nested CEL expressions referencing resource statuses are not resolved by
+            // ReferenceResolver, so we hardcode static values here as a workaround. This means the
+            // cert-manager composition reports `crds.installed: true` regardless of actual CRD state
+            // when deployed in direct mode. Fix: implement nested CEL resolution in ReferenceResolver
+            // before exposing cert-manager direct-mode deployments in production workflows.
+            installed: true,
+            version: spec.version || '1.19.3',
+        },
+    };
+});
+//# sourceMappingURL=cert-manager-bootstrap.js.map