typekro 0.33.7 → 0.33.9

package/dist/factories/clickstack/types.d.ts

@@ -5,7 +5,7 @@
  * inferred via `typeof Schema.infer` (mirrors the clickhouse/dagster families).
  *
  * Wraps the OFFICIAL ClickStack Helm chart (MIT):
- * - Chart: `clickstack` 3.0.x from https://clickhouse.github.io/ClickStack-helm-charts
+ * - Chart: `clickstack` 3.2.x from https://clickhouse.github.io/ClickStack-helm-charts
  *   (classic Helm repo, NOT OCI). The old hyperdxio/helm-charts repo is archived
  *   and its `hdx-oss-v2` chart is deprecated — do not use them.
  * - Components: the HyperDX app (UI + API + OpAMP server on 4320 that remotely
@@ -40,7 +40,8 @@
  * @see https://clickhouse.com/docs/use-cases/observability/clickstack
  */
 import type { ValuesMergeExpression } from '../../core/aspects/values-merge.js';
-import type { TypeKroChartValues } from '../../core/types/common.js';
+import type { TypeKroChartValues, TypeKroValue } from '../../core/types/common.js';
+import type { HelmReleaseValuesFromSource } from '../helm/types.js';
 /**
  * Loose ClickHouse version coupling facts for the external-ClickHouse mode,
  * exported for downstream platform layers that own the CHI sizing/versioning.
@@ -72,10 +73,18 @@ export declare const CLICKSTACK_CLICKHOUSE_GUIDANCE: {
 /**
  * Typed subset of the official `clickstack` chart values we map or pin
  * (verified 2026-07-06 against ClickHouse/ClickStack-helm-charts
- * charts/clickstack/values.yaml, chart 3.0.1). The index signature keeps the
+ * charts/clickstack/values.yaml, chart 3.2.0). The index signature keeps the
  * rest of the chart's surface reachable through the values passthrough.
  */
 export interface ClickStackHelmValues {
+    /** Cross-subchart settings, including the supported collector config overlay. */
+    global?: {
+        otelCollector?: {
+            customConfig?: string;
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
     /** HyperDX app (UI + API + OpAMP). */
     hyperdx?: {
         /** Shared non-sensitive env (rendered into the `clickstack-config` ConfigMap). */
@@ -206,19 +215,48 @@ interface ClickStackBuildOptionsBase {
     /** KRO kind override. */
     kind?: string;
 }
-/** Build-time options for the internal-Mongo bootstrap variant. */
-export interface ClickStackInternalMongoBuildOptions extends ClickStackBuildOptionsBase {
+/** Build-time options for inline credentials with internal Mongo. */
+export type ClickStackInlineInternalMongoBuildOptions = ClickStackBuildOptionsBase & {
     mongo?: {
         mode: 'internal';
         storage?: ClickStackMongoStorageOptions;
     };
-}
-/** Build-time options for the external-Mongo bootstrap variant. */
-export interface ClickStackExternalMongoBuildOptions extends ClickStackBuildOptionsBase {
+    credentials?: {
+        source: 'inline';
+    };
+};
+/** Build-time options for Secret-backed credentials with internal Mongo. */
+export type ClickStackSecretValuesInternalMongoBuildOptions = ClickStackBuildOptionsBase & {
+    mongo?: {
+        mode: 'internal';
+        storage?: ClickStackMongoStorageOptions;
+    };
+    credentials: {
+        source: 'secretValues';
+    };
+};
+/** Every supported internal-Mongo construction-time configuration. */
+export type ClickStackInternalMongoBuildOptions = ClickStackInlineInternalMongoBuildOptions | ClickStackSecretValuesInternalMongoBuildOptions;
+/** Build-time options for inline credentials with external Mongo. */
+export type ClickStackInlineExternalMongoBuildOptions = ClickStackBuildOptionsBase & {
     mongo: {
         mode: 'external';
     };
-}
+    credentials?: {
+        source: 'inline';
+    };
+};
+/** Build-time options for Secret-backed credentials with external Mongo. */
+export type ClickStackSecretValuesExternalMongoBuildOptions = ClickStackBuildOptionsBase & {
+    mongo: {
+        mode: 'external';
+    };
+    credentials: {
+        source: 'secretValues';
+    };
+};
+/** Every supported external-Mongo construction-time configuration. */
+export type ClickStackExternalMongoBuildOptions = ClickStackInlineExternalMongoBuildOptions | ClickStackSecretValuesExternalMongoBuildOptions;
 /** Union accepted by `makeClickstackBootstrap`. */
 export type ClickStackBuildOptions = ClickStackInternalMongoBuildOptions | ClickStackExternalMongoBuildOptions;
 /**
@@ -227,20 +265,20 @@ export type ClickStackBuildOptions = ClickStackInternalMongoBuildOptions | Click
  * are build-time (`makeClickstackBootstrap`).
  */
 export declare const ClickStackBootstrapConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    apiKey: string;
     name: string;
     clickhouse: {
         host: string;
+        password?: string;
+        appPassword?: string;
         nativePort?: number;
         httpPort?: number;
         database?: string;
         username?: string;
-        password?: string;
         appUsername?: string;
-        appPassword?: string;
     };
     namespace?: string;
     version?: string;
-    apiKey?: string;
     hyperdx?: {
         replicas?: number;
         resources?: {
@@ -263,25 +301,64 @@ export declare const ClickStackBootstrapConfigSchema: import("arktype/internal/v
 }, {}>;
 /** Runtime configuration for the internal-Mongo bootstrap variant. */
 export type ClickStackBootstrapConfig = typeof ClickStackBootstrapConfigSchema.infer;
+/** Runtime schema used by the Secret-backed internal-Mongo variant. */
+export declare const ClickStackSecretValuesBootstrapConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    credentialsSecret: {
+        name: string;
+        valuesKey?: string;
+    };
+    clickhouse: {
+        host: string;
+        nativePort?: number;
+        httpPort?: number;
+        database?: string;
+        username?: string;
+        appUsername?: string;
+    };
+    name: string;
+    namespace?: string;
+    version?: string;
+    hyperdx?: {
+        replicas?: number;
+        resources?: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        image?: {
+            repository?: string;
+            tag?: string;
+            pullPolicy?: "Always" | "IfNotPresent" | "Never";
+        };
+        frontendUrl?: string;
+    };
+}, {}>;
+/** Runtime configuration for the Secret-backed internal-Mongo variant. */
+export type ClickStackSecretValuesBootstrapConfig = typeof ClickStackSecretValuesBootstrapConfigSchema.infer;
 /**
  * Runtime spec for the external-Mongo variant: base + a required `mongoUri`.
  */
 export declare const ClickStackExternalMongoBootstrapConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    apiKey: string;
     mongoUri: string;
     name: string;
     clickhouse: {
         host: string;
+        password?: string;
+        appPassword?: string;
         nativePort?: number;
         httpPort?: number;
         database?: string;
         username?: string;
-        password?: string;
         appUsername?: string;
-        appPassword?: string;
     };
     namespace?: string;
     version?: string;
-    apiKey?: string;
     hyperdx?: {
         replicas?: number;
         resources?: {
@@ -304,8 +381,48 @@ export declare const ClickStackExternalMongoBootstrapConfigSchema: import("arkty
 }, {}>;
 /** Runtime configuration for the external-Mongo bootstrap variant. */
 export type ClickStackExternalMongoBootstrapConfig = typeof ClickStackExternalMongoBootstrapConfigSchema.infer;
+/** Runtime schema used by the Secret-backed external-Mongo variant. */
+export declare const ClickStackSecretValuesExternalMongoBootstrapConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    credentialsSecret: {
+        name: string;
+        valuesKey?: string;
+    };
+    mongoUri: string;
+    clickhouse: {
+        host: string;
+        nativePort?: number;
+        httpPort?: number;
+        database?: string;
+        username?: string;
+        appUsername?: string;
+    };
+    name: string;
+    namespace?: string;
+    version?: string;
+    hyperdx?: {
+        replicas?: number;
+        resources?: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        image?: {
+            repository?: string;
+            tag?: string;
+            pullPolicy?: "Always" | "IfNotPresent" | "Never";
+        };
+        frontendUrl?: string;
+    };
+}, {}>;
+/** Runtime configuration for the Secret-backed external-Mongo variant. */
+export type ClickStackSecretValuesExternalMongoBootstrapConfig = typeof ClickStackSecretValuesExternalMongoBootstrapConfigSchema.infer;
 /** Widest runtime config the values mapper accepts (either variant). */
-export type ClickStackBootstrapRuntimeConfig = ClickStackBootstrapConfig & {
+export type ClickStackBootstrapRuntimeConfig = (ClickStackBootstrapConfig | ClickStackSecretValuesBootstrapConfig | ClickStackExternalMongoBootstrapConfig | ClickStackSecretValuesExternalMongoBootstrapConfig) & {
     mongoUri?: string;
     /**
      * INTERNAL, DIRECT-MODE-ONLY escape hatch — not part of the runtime
@@ -452,6 +569,8 @@ export interface ClickStackHelmReleaseConfig {
     repositoryNamespace?: string;
     /** Official clickstack chart values (graph-aware trees / runtime merges allowed). */
     values?: ClickStackMappedHelmValues;
+    /** Secret/ConfigMap values overlays resolved by Flux before inline values. */
+    valuesFrom?: TypeKroValue<HelmReleaseValuesFromSource>[];
     id?: string;
 }
 /** Configuration for a stock opentelemetry-collector HelmRelease wrapper. */

package/dist/factories/clickstack/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/factories/clickstack/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAMrE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B;IACzC,kFAAkF;;IAElF,sEAAsE;;IAEtE,0EAA0E;;IAE1E,4DAA4D;;IAE5D;;;OAGG;;CAEK,CAAC;AAqBX;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,OAAO,CAAC,EAAE;QACR,kFAAkF;QAClF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,2EAA2E;QAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,4EAA4E;QAC5E,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACvD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,mFAAmF;IACnF,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC3D,kEAAkE;IAClE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACxD,gEAAgE;IAChE,gBAAgB,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACjE,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,4DAA4D;IAC5D,IAAI,CAAC,EAAE,WAAW,GAAG,YAAY,GAAG,aAAa,CAAC;IAClD,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACtE,OAAO,CAAC,EAAE;QACR,cAAc,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC/D,WAAW,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC5D,cAAc,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC/D,oBAAoB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QACrE,gBAAgB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QACjE,cAAc,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC/D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,CAAC,oBAAoB,CAAC,GACxC,qBAAqB,CAAC;AAE1B,6DAA6D;AAC7D,MAAM,MAAM,6BAA6B,GACrC,kBAAkB,CAAC,uBAAuB,CAAC,GAC3C,qBAAqB,CAAC;AAM1B,gFAAgF;AAChF,MAAM,WAAW,6BAA6B;IAC5C,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,2BAA2B,GACnC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,CAAC,EAAE,6BAA6B,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzB,6DAA6D;AAC7D,UAAU,0BAA0B;IAClC;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IAClD,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,mCAAoC,SAAQ,0BAA0B;IACrF,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,OAAO,CAAC,EAAE,6BAA6B,CAAA;KAAE,CAAC;CACvE;AAED,mEAAmE;AACnE,MAAM,WAAW,mCAAoC,SAAQ,0BAA0B;IACrF,KAAK,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;CAC7B;AAED,mDAAmD;AACnD,MAAM,MAAM,sBAAsB,GAC9B,mCAAmC,GACnC,mCAAmC,CAAC;AAmExC;;;;GAIG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAA2B,CAAC;AAExE,sEAAsE;AACtE,MAAM,MAAM,yBAAyB,GAAG,OAAO,+BAA+B,CAAC,KAAK,CAAC;AAErF;;GAEG;AACH,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAIvD,CAAC;AAEH,sEAAsE;AACtE,MAAM,MAAM,sCAAsC,GAChD,OAAO,4CAA4C,CAAC,KAAK,CAAC;AAE5D,wEAAwE;AACxE,MAAM,MAAM,gCAAgC,GAAG,yBAAyB,GAAG;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;MA4B1C,CAAC;AAEH,qDAAqD;AACrD,MAAM,MAAM,yBAAyB,GAAG,OAAO,+BAA+B,CAAC,KAAK,CAAC;AAMrF;;;GAGG;AACH,MAAM,WAAW,kCAAkC;IACjD,wFAAwF;IACxF,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;KAAE,CAAC;IACrE,yFAAyF;IACzF,UAAU,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;KAAE,CAAC;IACtE,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;MAyB7C,CAAC;AAEH,0EAA0E;AAC1E,MAAM,MAAM,4BAA4B,GAAG,OAAO,kCAAkC,CAAC,KAAK,CAAC;AAE3F,uDAAuD;AACvD,eAAO,MAAM,kCAAkC;;;;MAM7C,CAAC;AAMH,uEAAuE;AACvE,eAAO,MAAM,2CAA2C;;;;MAItD,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,6CAA6C;;MAExD,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,qCAAqC;;;;MAIhD,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,uCAAuC;;MAElD,CAAC;AAMH,qEAAqE;AACrE,eAAO,MAAM,oCAAoC;;;;;;MAM/C,CAAC;AAEH,+DAA+D;AAC/D,MAAM,MAAM,8BAA8B,GAAG,OAAO,oCAAoC,CAAC,KAAK,CAAC;AAE/F,4DAA4D;AAC5D,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,MAAM,CAAC,EAAE,0BAA0B,CAAC;IACpC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,6EAA6E;AAC7E,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,MAAM,CAAC,EAAE,6BAA6B,CAAC;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAMD,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/factories/clickstack/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAMpE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B;IACzC,kFAAkF;;IAElF,sEAAsE;;IAEtE,0EAA0E;;IAE1E,4DAA4D;;IAE5D;;;OAGG;;CAEK,CAAC;AAqBX;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,MAAM,CAAC,EAAE;QACP,aAAa,CAAC,EAAE;YAAE,YAAY,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAClE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,sCAAsC;IACtC,OAAO,CAAC,EAAE;QACR,kFAAkF;QAClF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,2EAA2E;QAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,4EAA4E;QAC5E,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACvD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,mFAAmF;IACnF,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC3D,kEAAkE;IAClE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACxD,gEAAgE;IAChE,gBAAgB,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACjE,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,4DAA4D;IAC5D,IAAI,CAAC,EAAE,WAAW,GAAG,YAAY,GAAG,aAAa,CAAC;IAClD,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACtE,OAAO,CAAC,EAAE;QACR,cAAc,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC/D,WAAW,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC5D,cAAc,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC/D,oBAAoB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QACrE,gBAAgB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QACjE,cAAc,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC/D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,CAAC,oBAAoB,CAAC,GACxC,qBAAqB,CAAC;AAE1B,6DAA6D;AAC7D,MAAM,MAAM,6BAA6B,GACrC,kBAAkB,CAAC,uBAAuB,CAAC,GAC3C,qBAAqB,CAAC;AAM1B,gFAAgF;AAChF,MAAM,WAAW,6BAA6B;IAC5C,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,2BAA2B,GACnC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,CAAC,EAAE,6BAA6B,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzB,6DAA6D;AAC7D,UAAU,0BAA0B;IAClC;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IAClD,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qEAAqE;AACrE,MAAM,MAAM,yCAAyC,GAAG,0BAA0B,GAAG;IACnF,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,OAAO,CAAC,EAAE,6BAA6B,CAAA;KAAE,CAAC;IACtE,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAA;KAAE,CAAC;CACpC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,+CAA+C,GAAG,0BAA0B,GAAG;IACzF,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,OAAO,CAAC,EAAE,6BAA6B,CAAA;KAAE,CAAC;IACtE,WAAW,EAAE;QAAE,MAAM,EAAE,cAAc,CAAA;KAAE,CAAC;CACzC,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,mCAAmC,GAC3C,yCAAyC,GACzC,+CAA+C,CAAC;AAEpD,qEAAqE;AACrE,MAAM,MAAM,yCAAyC,GAAG,0BAA0B,GAAG;IACnF,KAAK,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;IAC5B,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,QAAQ,CAAA;KAAE,CAAC;CACpC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,+CAA+C,GAAG,0BAA0B,GAAG;IACzF,KAAK,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;IAC5B,WAAW,EAAE;QAAE,MAAM,EAAE,cAAc,CAAA;KAAE,CAAC;CACzC,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,mCAAmC,GAC3C,yCAAyC,GACzC,+CAA+C,CAAC;AAEpD,mDAAmD;AACnD,MAAM,MAAM,sBAAsB,GAC9B,mCAAmC,GACnC,mCAAmC,CAAC;AA0ExC;;;;GAIG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAI1C,CAAC;AAEH,sEAAsE;AACtE,MAAM,MAAM,yBAAyB,GAAG,OAAO,+BAA+B,CAAC,KAAK,CAAC;AAErF,uEAAuE;AACvE,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAMtD,CAAC;AAEH,0EAA0E;AAC1E,MAAM,MAAM,qCAAqC,GAC/C,OAAO,2CAA2C,CAAC,KAAK,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAMvD,CAAC;AAEH,sEAAsE;AACtE,MAAM,MAAM,sCAAsC,GAChD,OAAO,4CAA4C,CAAC,KAAK,CAAC;AAE5D,uEAAuE;AACvE,eAAO,MAAM,wDAAwD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAOnE,CAAC;AAEH,0EAA0E;AAC1E,MAAM,MAAM,kDAAkD,GAC5D,OAAO,wDAAwD,CAAC,KAAK,CAAC;AAExE,wEAAwE;AACxE,MAAM,MAAM,gCAAgC,GAAG,CAC3C,yBAAyB,GACzB,qCAAqC,GACrC,sCAAsC,GACtC,kDAAkD,CACrD,GAAG;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;MA4B1C,CAAC;AAEH,qDAAqD;AACrD,MAAM,MAAM,yBAAyB,GAAG,OAAO,+BAA+B,CAAC,KAAK,CAAC;AAMrF;;;GAGG;AACH,MAAM,WAAW,kCAAkC;IACjD,wFAAwF;IACxF,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;KAAE,CAAC;IACrE,yFAAyF;IACzF,UAAU,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;KAAE,CAAC;IACtE,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;MAyB7C,CAAC;AAEH,0EAA0E;AAC1E,MAAM,MAAM,4BAA4B,GAAG,OAAO,kCAAkC,CAAC,KAAK,CAAC;AAE3F,uDAAuD;AACvD,eAAO,MAAM,kCAAkC;;;;MAM7C,CAAC;AAMH,uEAAuE;AACvE,eAAO,MAAM,2CAA2C;;;;MAItD,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,6CAA6C;;MAExD,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,qCAAqC;;;;MAIhD,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,uCAAuC;;MAElD,CAAC;AAMH,qEAAqE;AACrE,eAAO,MAAM,oCAAoC;;;;;;MAM/C,CAAC;AAEH,+DAA+D;AAC/D,MAAM,MAAM,8BAA8B,GAAG,OAAO,oCAAoC,CAAC,KAAK,CAAC;AAE/F,4DAA4D;AAC5D,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,MAAM,CAAC,EAAE,0BAA0B,CAAC;IACpC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,YAAY,CAAC,2BAA2B,CAAC,EAAE,CAAC;IACzD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,6EAA6E;AAC7E,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,MAAM,CAAC,EAAE,6BAA6B,CAAC;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAMD,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/factories/clickstack/types.js

@@ -5,7 +5,7 @@
  * inferred via `typeof Schema.infer` (mirrors the clickhouse/dagster families).
  *
  * Wraps the OFFICIAL ClickStack Helm chart (MIT):
- * - Chart: `clickstack` 3.0.x from https://clickhouse.github.io/ClickStack-helm-charts
+ * - Chart: `clickstack` 3.2.x from https://clickhouse.github.io/ClickStack-helm-charts
  *   (classic Helm repo, NOT OCI). The old hyperdxio/helm-charts repo is archived
  *   and its `hdx-oss-v2` chart is deprecated — do not use them.
  * - Components: the HyperDX app (UI + API + OpAMP server on 4320 that remotely
@@ -86,45 +86,46 @@ const imageShape = {
 // ============================================================================
 // Bootstrap runtime spec (external ClickHouse)
 // ============================================================================
+const clickhouseConnectionBaseShape = {
+    /** DNS host of the external ClickHouse service (no scheme, no port). */
+    host: 'string',
+    /** Native TCP port (default: 9000) → `CLICKHOUSE_ENDPOINT`/`CLICKHOUSE_SERVER_ENDPOINT`. */
+    'nativePort?': 'number.integer',
+    /** HTTP port (default: 8123) → HyperDX UI `defaultConnections` host. */
+    'httpPort?': 'number.integer',
+    /** OTel export target database (default: 'default') → `HYPERDX_OTEL_EXPORTER_CLICKHOUSE_DATABASE`. */
+    'database?': 'string',
+    /** Ingest/collector user (default: 'default') → `hyperdx.config.CLICKHOUSE_USER`. Needs SELECT,INSERT,CREATE,SHOW on the database. */
+    'username?': 'string',
+    /** Read-mostly UI user for HyperDX connections (default: `username`). Needs SHOW + SELECT. */
+    'appUsername?': 'string',
+};
 const bootstrapBaseShape = {
     /** Release name for the Helm installation. */
     name: 'string',
     /** Namespace for the stack (default: 'clickstack'). */
     'namespace?': 'string',
-    /** Chart version (default: '3.0.1'). */
+    /** Chart version (default: '3.2.0'). */
     'version?': 'string',
-    // SECRETS CAVEAT: `password`/`appPassword` below (and `apiKey` further
-    // down) travel as PLAINTEXT runtime spec values all the way into the
+    // SECRETS CAVEAT: `password`/`appPassword` below (and the required inline
+    // `apiKey` on the inline-mode schemas) travel as PLAINTEXT runtime spec values all the way into the
     // generated HelmRelease's `spec.values.hyperdx.secrets.*` — a Kubernetes
     // object stored in etcd, readable by anyone with read access to the
     // HelmRelease/RGD instance (`kubectl get helmrelease -o yaml`), unlike
     // `k8s-telemetry.ts`'s `apiKeySecret` (a `secretKeyRef` env var — the
-    // value never appears in any CR spec). There is currently NO
-    // existing-Secret / secretKeyRef alternative for these three fields.
+    // value never appears in any CR spec). Use the secretValues constructor
+    // mode when these three fields need to stay out of the CR spec.
     // Treat them as no more protected than any other spec field; do not
     // consider this family production-ready for credentials that need
     // stronger-than-etcd-RBAC protection until that gap is closed.
     /** External ClickHouse connection (REQUIRED — external-only build-around). */
     clickhouse: {
-        /** DNS host of the external ClickHouse service (no scheme, no port). */
-        host: 'string',
-        /** Native TCP port (default: 9000) → `CLICKHOUSE_ENDPOINT`/`CLICKHOUSE_SERVER_ENDPOINT`. */
-        'nativePort?': 'number.integer',
-        /** HTTP port (default: 8123) → HyperDX UI `defaultConnections` host. */
-        'httpPort?': 'number.integer',
-        /** OTel export target database (default: 'default') → `HYPERDX_OTEL_EXPORTER_CLICKHOUSE_DATABASE`. */
-        'database?': 'string',
-        /** Ingest/collector user (default: 'default') → `hyperdx.config.CLICKHOUSE_USER`. Needs SELECT,INSERT,CREATE,SHOW on the database. */
-        'username?': 'string',
+        ...clickhouseConnectionBaseShape,
         /** Ingest/collector password → `hyperdx.secrets.CLICKHOUSE_PASSWORD` (default: ''). PLAINTEXT in the HelmRelease spec — see the secrets caveat above. */
         'password?': 'string',
-        /** Read-mostly UI user for HyperDX connections (default: `username`). Needs SHOW + SELECT. */
-        'appUsername?': 'string',
         /** UI user password → `hyperdx.secrets.CLICKHOUSE_APP_PASSWORD` (default: `password`). PLAINTEXT in the HelmRelease spec — see the secrets caveat above. */
         'appPassword?': 'string',
     },
-    /** HyperDX ingestion API key → `hyperdx.secrets.HYPERDX_API_KEY`. PLAINTEXT in the HelmRelease spec — see the secrets caveat above `clickhouse`. */
-    'apiKey?': 'string',
     /** HyperDX app (UI/API) conveniences. */
     'hyperdx?': {
         'replicas?': 'number.integer',
@@ -146,20 +147,47 @@ const bootstrapBaseShape = {
     // (`makeClickstackBootstrap({ values })`), where the merge happens on
     // concrete objects before serialization.
 };
+const secretValuesBootstrapBaseShape = {
+    ...bootstrapBaseShape,
+    clickhouse: clickhouseConnectionBaseShape,
+};
 /**
  * Runtime spec for the internal-Mongo variant (the default
  * `clickstackBootstrap`). Mongo needs no runtime config — mode and storage
  * are build-time (`makeClickstackBootstrap`).
  */
-export const ClickStackBootstrapConfigSchema = type(bootstrapBaseShape);
+export const ClickStackBootstrapConfigSchema = type({
+    ...bootstrapBaseShape,
+    /** HyperDX ingestion API key → `hyperdx.secrets.HYPERDX_API_KEY`. Required and non-empty in inline mode. */
+    apiKey: 'string > 0',
+});
+/** Runtime schema used by the Secret-backed internal-Mongo variant. */
+export const ClickStackSecretValuesBootstrapConfigSchema = type({
+    ...secretValuesBootstrapBaseShape,
+    credentialsSecret: {
+        name: 'string > 0',
+        'valuesKey?': 'string > 0',
+    },
+});
 /**
  * Runtime spec for the external-Mongo variant: base + a required `mongoUri`.
  */
 export const ClickStackExternalMongoBootstrapConfigSchema = type({
     ...bootstrapBaseShape,
+    /** HyperDX ingestion API key → `hyperdx.secrets.HYPERDX_API_KEY`. Required and non-empty in inline mode. */
+    apiKey: 'string > 0',
     /** Full MongoDB connection URI → `hyperdx.config.MONGO_URI` (verbatim). */
     mongoUri: 'string',
 });
+/** Runtime schema used by the Secret-backed external-Mongo variant. */
+export const ClickStackSecretValuesExternalMongoBootstrapConfigSchema = type({
+    ...secretValuesBootstrapBaseShape,
+    credentialsSecret: {
+        name: 'string > 0',
+        'valuesKey?': 'string > 0',
+    },
+    mongoUri: 'string',
+});
 // ============================================================================
 // Bootstrap status — a typed service contract, not just readiness
 // ============================================================================

package/dist/factories/clickstack/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/factories/clickstack/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAI/B,+EAA+E;AAC/E,uCAAuC;AACvC,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,kFAAkF;IAClF,8BAA8B,EAAE,MAAM;IACtC,sEAAsE;IACtE,+BAA+B,EAAE,MAAM;IACvC,0EAA0E;IAC1E,cAAc,EAAE,8CAA8C;IAC9D,4DAA4D;IAC5D,8BAA8B,EAAE,MAAM;IACtC;;;OAGG;IACH,oBAAoB,EAAE,IAAI;CAClB,CAAC;AAEX,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,MAAM,yBAAyB,GAAG;IAChC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE;IACtD,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE;CAC5C,CAAC;AAEX,MAAM,UAAU,GAAG;IACjB,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,QAAQ;IAChB,aAAa,EAAE,qCAAqC;CAC5C,CAAC;AAuIX,+EAA+E;AAC/E,+CAA+C;AAC/C,+EAA+E;AAE/E,MAAM,kBAAkB,GAAG;IACzB,8CAA8C;IAC9C,IAAI,EAAE,QAAQ;IACd,uDAAuD;IACvD,YAAY,EAAE,QAAQ;IACtB,wCAAwC;IACxC,UAAU,EAAE,QAAQ;IACpB,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,6DAA6D;IAC7D,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,+DAA+D;IAC/D,8EAA8E;IAC9E,UAAU,EAAE;QACV,wEAAwE;QACxE,IAAI,EAAE,QAAQ;QACd,4FAA4F;QAC5F,aAAa,EAAE,gBAAgB;QAC/B,wEAAwE;QACxE,WAAW,EAAE,gBAAgB;QAC7B,sGAAsG;QACtG,WAAW,EAAE,QAAQ;QACrB,sIAAsI;QACtI,WAAW,EAAE,QAAQ;QACrB,yJAAyJ;QACzJ,WAAW,EAAE,QAAQ;QACrB,8FAA8F;QAC9F,cAAc,EAAE,QAAQ;QACxB,4JAA4J;QAC5J,cAAc,EAAE,QAAQ;KACzB;IACD,oJAAoJ;IACpJ,SAAS,EAAE,QAAQ;IACnB,yCAAyC;IACzC,UAAU,EAAE;QACV,WAAW,EAAE,gBAAgB;QAC7B,YAAY,EAAE,yBAAyB;QACvC,QAAQ,EAAE,UAAU;QACpB,oEAAoE;QACpE,cAAc,EAAE,QAAQ;KACzB;IACD,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,iEAAiE;IACjE,uEAAuE;IACvE,mEAAmE;IACnE,yEAAyE;IACzE,iEAAiE;IACjE,sEAAsE;IACtE,yCAAyC;CACjC,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAKxE;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,IAAI,CAAC;IAC/D,GAAG,kBAAkB;IACrB,2EAA2E;IAC3E,QAAQ,EAAE,QAAQ;CACnB,CAAC,CAAC;AAoBH,+EAA+E;AAC/E,kEAAkE;AAClE,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,oEAAoE;IACpE,KAAK,EAAE,SAAS;IAChB,+DAA+D;IAC/D,KAAK,EAAE,mCAAmC;IAC1C,gCAAgC;IAChC,UAAU,EAAE,QAAQ;IACpB,kBAAkB;IAClB,EAAE,EAAE;QACF,wDAAwD;QACxD,GAAG,EAAE,QAAQ;KACd;IACD,uFAAuF;IACvF,OAAO,EAAE;QACP,oDAAoD;QACpD,gBAAgB,EAAE,QAAQ;QAC1B,oDAAoD;QACpD,gBAAgB,EAAE,QAAQ;KAC3B;IACD,uCAAuC;IACvC,GAAG,EAAE;QACH,sDAAsD;QACtD,IAAI,EAAE,QAAQ;QACd,eAAe;QACf,OAAO,EAAE,gBAAgB;QACzB,gBAAgB;QAChB,OAAO,EAAE,gBAAgB;KAC1B;CACF,CAAC,CAAC;AAwBH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;IACrD,6FAA6F;IAC7F,IAAI,EAAE,QAAQ;IACd,sEAAsE;IACtE,YAAY,EAAE,QAAQ;IACtB,wEAAwE;IACxE,UAAU,EAAE,QAAQ;IACpB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ;IACrB;;;;;OAKG;IACH,YAAY,EAAE;QACZ,IAAI,EAAE,QAAQ;QACd,0DAA0D;QAC1D,MAAM,EAAE,QAAQ;KACjB;CACF,CAAC,CAAC;AAKH,uDAAuD;AACvD,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;IACrD,gDAAgD;IAChD,KAAK,EAAE,SAAS;IAChB,wDAAwD;IACxD,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,mCAAmC;CAC3C,CAAC,CAAC;AAEH,+EAA+E;AAC/E,mCAAmC;AACnC,+EAA+E;AAE/E,uEAAuE;AACvE,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;IAC9D,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,QAAQ;IACnB,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,6CAA6C,GAAG,IAAI,CAAC;IAChE,KAAK,EAAE,SAAS;CACjB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,CAAC;IACxD,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,QAAQ;IACnB,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uCAAuC,GAAG,IAAI,CAAC;IAC1D,KAAK,EAAE,SAAS;CACjB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;IACvD,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,QAAQ;IACrB,KAAK,EAAE,QAAQ;CAChB,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/factories/clickstack/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAK/B,+EAA+E;AAC/E,uCAAuC;AACvC,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,kFAAkF;IAClF,8BAA8B,EAAE,MAAM;IACtC,sEAAsE;IACtE,+BAA+B,EAAE,MAAM;IACvC,0EAA0E;IAC1E,cAAc,EAAE,8CAA8C;IAC9D,4DAA4D;IAC5D,8BAA8B,EAAE,MAAM;IACtC;;;OAGG;IACH,oBAAoB,EAAE,IAAI;CAClB,CAAC;AAEX,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,MAAM,yBAAyB,GAAG;IAChC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE;IACtD,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE;CAC5C,CAAC;AAEX,MAAM,UAAU,GAAG;IACjB,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,QAAQ;IAChB,aAAa,EAAE,qCAAqC;CAC5C,CAAC;AAoKX,+EAA+E;AAC/E,+CAA+C;AAC/C,+EAA+E;AAE/E,MAAM,6BAA6B,GAAG;IACpC,wEAAwE;IACxE,IAAI,EAAE,QAAQ;IACd,4FAA4F;IAC5F,aAAa,EAAE,gBAAgB;IAC/B,wEAAwE;IACxE,WAAW,EAAE,gBAAgB;IAC7B,sGAAsG;IACtG,WAAW,EAAE,QAAQ;IACrB,sIAAsI;IACtI,WAAW,EAAE,QAAQ;IACrB,8FAA8F;IAC9F,cAAc,EAAE,QAAQ;CAChB,CAAC;AAEX,MAAM,kBAAkB,GAAG;IACzB,8CAA8C;IAC9C,IAAI,EAAE,QAAQ;IACd,uDAAuD;IACvD,YAAY,EAAE,QAAQ;IACtB,wCAAwC;IACxC,UAAU,EAAE,QAAQ;IACpB,0EAA0E;IAC1E,oGAAoG;IACpG,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,gEAAgE;IAChE,oEAAoE;IACpE,kEAAkE;IAClE,+DAA+D;IAC/D,8EAA8E;IAC9E,UAAU,EAAE;QACV,GAAG,6BAA6B;QAChC,yJAAyJ;QACzJ,WAAW,EAAE,QAAQ;QACrB,4JAA4J;QAC5J,cAAc,EAAE,QAAQ;KACzB;IACD,yCAAyC;IACzC,UAAU,EAAE;QACV,WAAW,EAAE,gBAAgB;QAC7B,YAAY,EAAE,yBAAyB;QACvC,QAAQ,EAAE,UAAU;QACpB,oEAAoE;QACpE,cAAc,EAAE,QAAQ;KACzB;IACD,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,iEAAiE;IACjE,uEAAuE;IACvE,mEAAmE;IACnE,yEAAyE;IACzE,iEAAiE;IACjE,sEAAsE;IACtE,yCAAyC;CACjC,CAAC;AAEX,MAAM,8BAA8B,GAAG;IACrC,GAAG,kBAAkB;IACrB,UAAU,EAAE,6BAA6B;CACjC,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,GAAG,kBAAkB;IACrB,4GAA4G;IAC5G,MAAM,EAAE,YAAY;CACrB,CAAC,CAAC;AAKH,uEAAuE;AACvE,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;IAC9D,GAAG,8BAA8B;IACjC,iBAAiB,EAAE;QACjB,IAAI,EAAE,YAAY;QAClB,YAAY,EAAE,YAAY;KAC3B;CACF,CAAC,CAAC;AAMH;;GAEG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,IAAI,CAAC;IAC/D,GAAG,kBAAkB;IACrB,4GAA4G;IAC5G,MAAM,EAAE,YAAY;IACpB,2EAA2E;IAC3E,QAAQ,EAAE,QAAQ;CACnB,CAAC,CAAC;AAMH,uEAAuE;AACvE,MAAM,CAAC,MAAM,wDAAwD,GAAG,IAAI,CAAC;IAC3E,GAAG,8BAA8B;IACjC,iBAAiB,EAAE;QACjB,IAAI,EAAE,YAAY;QAClB,YAAY,EAAE,YAAY;KAC3B;IACD,QAAQ,EAAE,QAAQ;CACnB,CAAC,CAAC;AAyBH,+EAA+E;AAC/E,kEAAkE;AAClE,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,oEAAoE;IACpE,KAAK,EAAE,SAAS;IAChB,+DAA+D;IAC/D,KAAK,EAAE,mCAAmC;IAC1C,gCAAgC;IAChC,UAAU,EAAE,QAAQ;IACpB,kBAAkB;IAClB,EAAE,EAAE;QACF,wDAAwD;QACxD,GAAG,EAAE,QAAQ;KACd;IACD,uFAAuF;IACvF,OAAO,EAAE;QACP,oDAAoD;QACpD,gBAAgB,EAAE,QAAQ;QAC1B,oDAAoD;QACpD,gBAAgB,EAAE,QAAQ;KAC3B;IACD,uCAAuC;IACvC,GAAG,EAAE;QACH,sDAAsD;QACtD,IAAI,EAAE,QAAQ;QACd,eAAe;QACf,OAAO,EAAE,gBAAgB;QACzB,gBAAgB;QAChB,OAAO,EAAE,gBAAgB;KAC1B;CACF,CAAC,CAAC;AAwBH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;IACrD,6FAA6F;IAC7F,IAAI,EAAE,QAAQ;IACd,sEAAsE;IACtE,YAAY,EAAE,QAAQ;IACtB,wEAAwE;IACxE,UAAU,EAAE,QAAQ;IACpB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ;IACrB;;;;;OAKG;IACH,YAAY,EAAE;QACZ,IAAI,EAAE,QAAQ;QACd,0DAA0D;QAC1D,MAAM,EAAE,QAAQ;KACjB;CACF,CAAC,CAAC;AAKH,uDAAuD;AACvD,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;IACrD,gDAAgD;IAChD,KAAK,EAAE,SAAS;IAChB,wDAAwD;IACxD,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,mCAAmC;CAC3C,CAAC,CAAC;AAEH,+EAA+E;AAC/E,mCAAmC;AACnC,+EAA+E;AAE/E,uEAAuE;AACvE,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;IAC9D,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,QAAQ;IACnB,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,6CAA6C,GAAG,IAAI,CAAC;IAChE,KAAK,EAAE,SAAS;CACjB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,CAAC;IACxD,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,QAAQ;IACnB,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uCAAuC,GAAG,IAAI,CAAC;IAC1D,KAAK,EAAE,SAAS;CACjB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;IACvD,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,QAAQ;IACrB,KAAK,EAAE,QAAQ;CAChB,CAAC,CAAC"}

package/dist/factories/clickstack/utils/helm-values-mapper.d.ts

@@ -13,7 +13,7 @@
  *
  * Values keys verified 2026-07-06 against
  * https://github.com/ClickHouse/ClickStack-helm-charts
- * charts/clickstack/values.yaml (chart 3.0.1, appVersion 2.29.0):
+ * charts/clickstack/values.yaml (chart 3.2.0, appVersion 2.35.0):
  * - `hyperdx.config.*` env map: `CLICKHOUSE_ENDPOINT` (native, tcp://…),
  *   `CLICKHOUSE_SERVER_ENDPOINT` (host:port), `CLICKHOUSE_USER`,
  *   `HYPERDX_OTEL_EXPORTER_CLICKHOUSE_DATABASE`, `MONGO_URI`, `FRONTEND_URL`.
@@ -71,12 +71,23 @@ export declare const DEFAULT_CLICKSTACK_GATEWAY_ENDPOINT = "http://clickstack-ot
 export declare const DEFAULT_K8S_TELEMETRY_COLLECTOR_IMAGE = "otel/opentelemetry-collector-contrib";
 /** Name of the HyperDX connection emitted into `defaultConnections`/`defaultSources`. */
 export declare const CLICKSTACK_CONNECTION_NAME = "External ClickHouse";
+/**
+ * The ClickStack image runs under the OpAMP supervisor. Its built-in remote
+ * configuration declares the OTLP receiver but, without an overlay, does not
+ * attach it to any pipeline. The Service and health endpoint can therefore be
+ * Ready while 4317/4318 refuse connections. Chart 3.1+ provides the supported
+ * `global.otelCollector.customConfig` merge seam; keep every built-in receiver
+ * while attaching OTLP to all three signal pipelines.
+ */
+export declare const CLICKSTACK_INGEST_PIPELINES_CONFIG: string;
 /** Concrete build-time options consumed by the bootstrap values mapper. */
 export interface ClickStackValuesMapperOptions {
     /** Which Mongo wiring to emit (build-time; default 'internal'). */
     mongoMode?: 'internal' | 'external';
     /** Static raw chart values merged after the typed mapping (pins re-applied after). */
     values?: TypeKroChartValues<ClickStackHelmValues>;
+    /** Runtime credential transport selected by the composition constructor. */
+    credentialSource?: 'inline' | 'secretValues';
 }
 /** Values pair for the two stock collector instances. */
 export interface ClickStackK8sTelemetryValues {

package/dist/factories/clickstack/utils/helm-values-mapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helm-values-mapper.d.ts","sourceRoot":"","sources":["../../../../src/factories/clickstack/utils/helm-values-mapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAOH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAGxE,OAAO,KAAK,EACV,gCAAgC,EAChC,oBAAoB,EACpB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,aAAa,CAAC;AAErB,kDAAkD;AAClD,eAAO,MAAM,4BAA4B,eAAe,CAAC;AAEzD,0DAA0D;AAC1D,eAAO,MAAM,sCAAsC,yBAAyB,CAAC;AAE7E;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,uEACsB,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,yCAAyC,CAAC;AAE5F,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,WAAW,6BAA6B;IAC5C,mEAAmE;IACnE,SAAS,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACpC,sFAAsF;IACtF,MAAM,CAAC,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,6BAA6B,CAAC;IACzC,UAAU,EAAE,6BAA6B,CAAC;CAC3C;AA4ND;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,gCAAgC,EACxC,OAAO,GAAE,6BAAkC,GAC1C,0BAA0B,CAqI5B;AAMD,2EAA2E;AAC3E,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;KAAE,CAAC;IACrE,UAAU,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;KAAE,CAAC;CACvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,4BAA4B,EACpC,OAAO,GAAE,mCAAwC,GAChD,4BAA4B,CAgH9B"}
+{"version":3,"file":"helm-values-mapper.d.ts","sourceRoot":"","sources":["../../../../src/factories/clickstack/utils/helm-values-mapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAOH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAGxE,OAAO,KAAK,EAEV,gCAAgC,EAEhC,oBAAoB,EACpB,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,aAAa,CAAC;AAErB,kDAAkD;AAClD,eAAO,MAAM,4BAA4B,eAAe,CAAC;AAEzD,0DAA0D;AAC1D,eAAO,MAAM,sCAAsC,yBAAyB,CAAC;AAE7E;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,uEACsB,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,yCAAyC,CAAC;AAE5F,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAEhE;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC,QAUnC,CAAC;AAEb,2EAA2E;AAC3E,MAAM,WAAW,6BAA6B;IAC5C,mEAAmE;IACnE,SAAS,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACpC,sFAAsF;IACtF,MAAM,CAAC,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IAClD,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAC;CAC9C;AAED,yDAAyD;AACzD,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,6BAA6B,CAAC;IACzC,UAAU,EAAE,6BAA6B,CAAC;CAC3C;AA2ND;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,gCAAgC,EACxC,OAAO,GAAE,6BAAkC,GAC1C,0BAA0B,CAqJ5B;AAMD,2EAA2E;AAC3E,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;KAAE,CAAC;IACrE,UAAU,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;KAAE,CAAC;CACvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,4BAA4B,EACpC,OAAO,GAAE,mCAAwC,GAChD,4BAA4B,CAgH9B"}

package/dist/factories/clickstack/utils/helm-values-mapper.js

@@ -13,7 +13,7 @@
  *
  * Values keys verified 2026-07-06 against
  * https://github.com/ClickHouse/ClickStack-helm-charts
- * charts/clickstack/values.yaml (chart 3.0.1, appVersion 2.29.0):
+ * charts/clickstack/values.yaml (chart 3.2.0, appVersion 2.35.0):
  * - `hyperdx.config.*` env map: `CLICKHOUSE_ENDPOINT` (native, tcp://…),
  *   `CLICKHOUSE_SERVER_ENDPOINT` (host:port), `CLICKHOUSE_USER`,
  *   `HYPERDX_OTEL_EXPORTER_CLICKHOUSE_DATABASE`, `MONGO_URI`, `FRONTEND_URL`.
@@ -73,6 +73,25 @@ export const DEFAULT_CLICKSTACK_GATEWAY_ENDPOINT = 'http://clickstack-otel-colle
 export const DEFAULT_K8S_TELEMETRY_COLLECTOR_IMAGE = 'otel/opentelemetry-collector-contrib';
 /** Name of the HyperDX connection emitted into `defaultConnections`/`defaultSources`. */
 export const CLICKSTACK_CONNECTION_NAME = 'External ClickHouse';
+/**
+ * The ClickStack image runs under the OpAMP supervisor. Its built-in remote
+ * configuration declares the OTLP receiver but, without an overlay, does not
+ * attach it to any pipeline. The Service and health endpoint can therefore be
+ * Ready while 4317/4318 refuse connections. Chart 3.1+ provides the supported
+ * `global.otelCollector.customConfig` merge seam; keep every built-in receiver
+ * while attaching OTLP to all three signal pipelines.
+ */
+export const CLICKSTACK_INGEST_PIPELINES_CONFIG = [
+    'service:',
+    '  pipelines:',
+    '    logs/in:',
+    '      receivers: [fluentforward, otlp/hyperdx]',
+    '    metrics:',
+    '      receivers: [prometheus, otlp/hyperdx]',
+    '    traces:',
+    '      receivers: [nop, otlp/hyperdx]',
+    '',
+].join('\n');
 // ============================================================================
 // Shared helpers
 // ============================================================================
@@ -174,7 +193,7 @@ function mergeOverridesWithPinsLast(base, overrides, pins) {
  * `defaultConnections`/`defaultSources` pointing at the (nonexistent) bundled
  * ClickHouse Service, so both must be overridden for external mode. The
  * sources below mirror the chart defaults (values.yaml `defaultSources`,
- * chart 3.0.1) with the connection renamed and the database parameterized
+ * chart 3.2.0) with the connection renamed and the database parameterized
  * (`%s` slots filled per mode).
  */
 const DEFAULT_SOURCES_FORMAT = JSON.stringify([
@@ -280,6 +299,7 @@ const DEFAULT_CONNECTIONS_FORMAT = `[{"name":"${CLICKSTACK_CONNECTION_NAME}","ho
 export function mapClickStackConfigToHelmValues(config, options = {}) {
     const isGraph = isKubernetesRef(config.name) || isKubernetesRef(config.clickhouse);
     const mongoMode = options.mongoMode ?? 'internal';
+    const credentialSource = options.credentialSource ?? 'inline';
     const ch = config.clickhouse;
     const hyperdxConfig = {};
     const hyperdxSecrets = {};
@@ -289,10 +309,6 @@ export function mapClickStackConfigToHelmValues(config, options = {}) {
         // templates (KRO mixed templates want string-typed segments).
         const nativePortStr = Cel.expr(`string(${hasSchemaPath('schema.spec.clickhouse.nativePort')} ? schema.spec.clickhouse.nativePort : 9000)`);
         const httpPortStr = Cel.expr(`string(${hasSchemaPath('schema.spec.clickhouse.httpPort')} ? schema.spec.clickhouse.httpPort : 8123)`);
-        const appUsername = Cel.expr(`${hasSchemaPath('schema.spec.clickhouse.appUsername')} ? schema.spec.clickhouse.appUsername : ` +
-            `(${hasSchemaPath('schema.spec.clickhouse.username')} ? schema.spec.clickhouse.username : "default")`);
-        const appPassword = Cel.expr(`${hasSchemaPath('schema.spec.clickhouse.appPassword')} ? schema.spec.clickhouse.appPassword : ` +
-            `(${hasSchemaPath('schema.spec.clickhouse.password')} ? schema.spec.clickhouse.password : "")`);
         hyperdxConfig.CLICKHOUSE_ENDPOINT = Cel.template('tcp://%s:%s?dial_timeout=10s', ch.host, nativePortStr);
         hyperdxConfig.CLICKHOUSE_SERVER_ENDPOINT = Cel.template('%s:%s', ch.host, nativePortStr);
         hyperdxConfig.CLICKHOUSE_USER = resolve(ch.username, 'default');
@@ -302,13 +318,21 @@ export function mapClickStackConfigToHelmValues(config, options = {}) {
                 ? config.mongoUri
                 : Cel.template(`mongodb://%s${CLICKSTACK_MONGO_NAME_SUFFIX}.%s.svc.cluster.local:${CLICKSTACK_MONGO_PORT}/hyperdx`, config.name, resolve(config.namespace, DEFAULT_CLICKSTACK_NAMESPACE));
         hyperdxConfig.FRONTEND_URL = graphOptional('schema.spec.hyperdx.frontendUrl');
-        hyperdxSecrets.CLICKHOUSE_PASSWORD = resolve(ch.password, '');
-        hyperdxSecrets.CLICKHOUSE_APP_PASSWORD = appPassword;
-        hyperdxSecrets.HYPERDX_API_KEY = graphOptional('schema.spec.apiKey');
+        if (credentialSource === 'inline') {
+            const inlineConfig = config;
+            const inlineClickhouse = inlineConfig.clickhouse;
+            const appUsername = Cel.expr(`${hasSchemaPath('schema.spec.clickhouse.appUsername')} ? schema.spec.clickhouse.appUsername : ` +
+                `(${hasSchemaPath('schema.spec.clickhouse.username')} ? schema.spec.clickhouse.username : "default")`);
+            const appPassword = Cel.expr(`${hasSchemaPath('schema.spec.clickhouse.appPassword')} ? schema.spec.clickhouse.appPassword : ` +
+                `(${hasSchemaPath('schema.spec.clickhouse.password')} ? schema.spec.clickhouse.password : "")`);
+            hyperdxSecrets.CLICKHOUSE_PASSWORD = resolve(inlineClickhouse.password, '');
+            hyperdxSecrets.CLICKHOUSE_APP_PASSWORD = appPassword;
+            hyperdxSecrets.HYPERDX_API_KEY = inlineConfig.apiKey;
+            hyperdxDeployment.defaultConnections = Cel.template(DEFAULT_CONNECTIONS_FORMAT, ch.host, httpPortStr, httpPortStr, appUsername, appPassword);
+        }
         hyperdxDeployment.replicas = graphOptional('schema.spec.hyperdx.replicas');
         hyperdxDeployment.resources = graphOptional('schema.spec.hyperdx.resources');
         hyperdxDeployment.image = graphOptional('schema.spec.hyperdx.image');
-        hyperdxDeployment.defaultConnections = Cel.template(DEFAULT_CONNECTIONS_FORMAT, ch.host, httpPortStr, httpPortStr, appUsername, appPassword);
         const database = resolve(ch.database, 'default');
         hyperdxDeployment.defaultSources = Cel.template(DEFAULT_SOURCES_FORMAT, database, database, database, database);
     }
@@ -317,9 +341,6 @@ export function mapClickStackConfigToHelmValues(config, options = {}) {
         const httpPort = ch.httpPort ?? 8123;
         const database = ch.database ?? 'default';
         const username = ch.username ?? 'default';
-        const password = ch.password ?? '';
-        const appUsername = ch.appUsername ?? username;
-        const appPassword = ch.appPassword ?? password;
         hyperdxConfig.CLICKHOUSE_ENDPOINT = `tcp://${ch.host}:${nativePort}?dial_timeout=10s`;
         hyperdxConfig.CLICKHOUSE_SERVER_ENDPOINT = `${ch.host}:${nativePort}`;
         hyperdxConfig.CLICKHOUSE_USER = username;
@@ -329,27 +350,34 @@ export function mapClickStackConfigToHelmValues(config, options = {}) {
                 ? config.mongoUri
                 : `mongodb://${config.name}${CLICKSTACK_MONGO_NAME_SUFFIX}.${config.namespace ?? DEFAULT_CLICKSTACK_NAMESPACE}.svc.cluster.local:${CLICKSTACK_MONGO_PORT}/hyperdx`;
         setIfDefined(hyperdxConfig, 'FRONTEND_URL', config.hyperdx?.frontendUrl);
-        hyperdxSecrets.CLICKHOUSE_PASSWORD = password;
-        hyperdxSecrets.CLICKHOUSE_APP_PASSWORD = appPassword;
-        setIfDefined(hyperdxSecrets, 'HYPERDX_API_KEY', config.apiKey);
+        if (credentialSource === 'inline') {
+            const inlineConfig = config;
+            const inlineClickhouse = inlineConfig.clickhouse;
+            const password = inlineClickhouse.password ?? '';
+            const appUsername = inlineClickhouse.appUsername ?? username;
+            const appPassword = inlineClickhouse.appPassword ?? password;
+            hyperdxSecrets.CLICKHOUSE_PASSWORD = password;
+            hyperdxSecrets.CLICKHOUSE_APP_PASSWORD = appPassword;
+            hyperdxSecrets.HYPERDX_API_KEY = inlineConfig.apiKey;
+            hyperdxDeployment.defaultConnections = JSON.stringify([
+                {
+                    name: CLICKSTACK_CONNECTION_NAME,
+                    host: `http://${ch.host}:${httpPort}`,
+                    port: httpPort,
+                    username: appUsername,
+                    password: appPassword,
+                },
+            ]);
+        }
         setIfDefined(hyperdxDeployment, 'replicas', config.hyperdx?.replicas);
         setIfDefined(hyperdxDeployment, 'resources', config.hyperdx?.resources);
         setIfDefined(hyperdxDeployment, 'image', config.hyperdx?.image);
-        hyperdxDeployment.defaultConnections = JSON.stringify([
-            {
-                name: CLICKSTACK_CONNECTION_NAME,
-                host: `http://${ch.host}:${httpPort}`,
-                port: httpPort,
-                username: appUsername,
-                password: appPassword,
-            },
-        ]);
         hyperdxDeployment.defaultSources = DEFAULT_SOURCES_FORMAT.replace(/%s/g, () => database);
     }
     const values = {
         hyperdx: {
             config: hyperdxConfig,
-            secrets: hyperdxSecrets,
+            ...(credentialSource === 'inline' ? { secrets: hyperdxSecrets } : {}),
             deployment: hyperdxDeployment,
         },
     };
@@ -357,6 +385,11 @@ export function mapClickStackConfigToHelmValues(config, options = {}) {
     // contract's naming anchor. Merged AFTER every passthrough so they always
     // win — including over a graph-aware per-instance `customValues` override.
     const pins = {
+        global: {
+            otelCollector: {
+                customConfig: CLICKSTACK_INGEST_PIPELINES_CONFIG,
+            },
+        },
         clickhouse: { enabled: false },
         mongodb: { enabled: false },
         fullnameOverride: config.name,