typekro 0.33.9 → 0.34.0

package/dist/factories/traefik/compositions/traefik-bootstrap.js

@@ -0,0 +1,339 @@
+/**
+ * `traefikBootstrap` — the composition that stands Traefik up as a cluster edge.
+ *
+ * It owns the whole install: the (optional) namespace, the Flux `HelmRelease`,
+ * the entrypoint `Service`, and optionally the cluster-default
+ * `TLSOption`/`TLSStore`. The shared chart `HelmRepository` is delegated to a
+ * singleton composition so one instance's teardown cannot break another's
+ * chart source.
+ *
+ * **Why the entrypoint Service is owned rather than observed.** The status
+ * contract publishes the edge's load-balancer address, which means projecting
+ * the entrypoint Service's `status.loadBalancer`. A projection requires the
+ * resource to be in the graph. Observing the chart-created Service instead
+ * (`observedResource`) made every FRESH direct deployment fail: the direct
+ * engine resolves external references before it applies anything, so it read a
+ * `Service` that the release had not created yet and treated the `404` as
+ * fatal — and `dependsOn` cannot reorder that, because the read happens before
+ * the dependency graph is walked. So the chart's Service is disabled through
+ * values and this composition creates a typed one selecting the chart's pods.
+ * The graph therefore has no external reference to any Kubernetes API object.
+ *
+ * **Build-time vs runtime.** Options that decide WHICH resources exist — the
+ * namespace lifecycle, the default TLS resources, the `web` → `websecure`
+ * redirect, raw chart values — are arguments to {@link makeTraefikBootstrap}
+ * and are always concrete, so plain JavaScript branches on them are safe. The
+ * runtime spec carries only values, which may arrive as schema references in
+ * KRO mode and are therefore only ever placed into the values tree, never
+ * branched on. This is the ClickStack convention.
+ *
+ * @security The dashboard and the insecure API are not reachable through this
+ * contract: the spec's `dashboard` field is typed as the literal `false`, and
+ * `mapTraefikConfigToHelmValues` pins `api.dashboard`, `api.insecure`,
+ * `api.debug` and the dashboard `IngressRoute` off after every other values
+ * source has been merged.
+ */
+import { kubernetesComposition } from '../../../core/composition/imperative.js';
+import { DEFAULT_FLUX_NAMESPACE } from '../../../core/config/defaults.js';
+import { Cel } from '../../../core/references/cel.js';
+import { singleton } from '../../../core/singleton/singleton.js';
+import { helmReleaseConditionSummary } from '../../helm/status.js';
+import { namespace } from '../../kubernetes/core/namespace.js';
+import { service } from '../../kubernetes/networking/service.js';
+import { DEFAULT_TRAEFIK_CHART_VERSION, DEFAULT_TRAEFIK_CRDS_POLICY, DEFAULT_TRAEFIK_NAMESPACE, DEFAULT_TRAEFIK_REPOSITORY_NAME, DEFAULT_TRAEFIK_REPOSITORY_URL, DEFAULT_TRAEFIK_WEB_PORT, DEFAULT_TRAEFIK_WEBSECURE_PORT, TRAEFIK_DEFAULT_TLS_OPTION_NAME, TRAEFIK_DEFAULT_TLS_STORE_NAME, TRAEFIK_POD_NAME_LABEL_VALUE, TRAEFIK_WEB_ENTRYPOINT, TRAEFIK_WEBSECURE_ENTRYPOINT, } from '../constants.js';
+import { traefikHelmRelease } from '../resources/helm.js';
+import { traefikTLSOption, traefikTLSStore } from '../resources/tls.js';
+import { TraefikBootstrapConfigSchema, TraefikBootstrapStatusSchema, } from '../types.js';
+import { mapTraefikConfigToHelmValues, traefikEntrypointServiceType, } from '../utils/helm-values-mapper.js';
+import { traefikHelmRepositoryBootstrap } from './traefik-helm-repository.js';
+/**
+ * CEL reading one field of the first load-balancer address the entrypoint
+ * Service reports that carries it, falling back to `''`.
+ *
+ * Written as an explicit expression rather than a JavaScript optional chain
+ * because every hop is genuinely absent for a `ClusterIP`/`NodePort` Service
+ * and while a cloud controller is still provisioning: `status.loadBalancer` may
+ * be missing, `ingress` may be missing, it may be empty, and an entry carries
+ * either `ip` or `hostname` but rarely both.
+ *
+ * Two details of the shape are load-bearing, both of them about satisfying the
+ * two CEL engines this one string has to run on — KRO's cel-go and the `cel-js`
+ * evaluator direct mode uses:
+ *
+ * 1. **A ternary, not one `&&` chain.** `size()` on an absent `ingress` is an
+ *    evaluation error. cel-go absorbs an error in one operand of `&&` when the
+ *    other operand is false; cel-js evaluates both operands and propagates the
+ *    error. A ternary is lazy in both, so the guard is actually reached before
+ *    the access it protects. Without this, a plain `ClusterIP` Service took the
+ *    WHOLE status object down to unresolved — `ready` and `phase` included, not
+ *    just this field.
+ * 2. **`filter(...)` rather than a guard on `ingress[0]`.** The obvious
+ *    `has(ingress[0].hostname)` is rejected by cel-js ("has() does not support
+ *    atomic expressions" — its operand is an index expression), and the obvious
+ *    workaround `"hostname" in ingress[0]` is rejected by KRO, which types an
+ *    ingress entry as a message rather than a map ("no matching overload for
+ *    '@in'"). Selecting the entries that carry the field is accepted by both —
+ *    and says what is actually meant: an entry carries `ip` or `hostname`, and
+ *    a load balancer may report more than one.
+ */
+function loadBalancerAddressExpression(resourceId, field) {
+    const base = `${resourceId}.status.loadBalancer`;
+    const matching = `${base}.ingress.filter(entry, has(entry.${field}))`;
+    return (`has(${base}) && has(${base}.ingress) ` +
+        `? (size(${matching}) > 0 ? ${matching}[0].${field} : "") ` +
+        `: ""`);
+}
+/**
+ * CEL reading the chart version Flux actually installed off the owned
+ * `HelmRelease`.
+ *
+ * This is a RESOURCE PROJECTION, deliberately not a literal: KRO drops literal
+ * status fields (#188), and echoing `schema.spec.chartVersion` would report a
+ * version the release may never have managed to install. `status.history[]` is
+ * Flux's own record of its releases, newest first, so entry 0 is the live one.
+ *
+ * The shape mirrors {@link loadBalancerAddressExpression}, for the same two
+ * reasons — both about running on KRO's cel-go AND the `cel-js` evaluator
+ * direct mode uses. A lazy ternary rather than an `&&` chain, because `size()`
+ * over an absent `history` is an evaluation error that cel-js propagates; and
+ * `filter(...)` rather than `has(history[0].chartVersion)`, which cel-js
+ * rejects as `has()` over an index expression while KRO rejects the
+ * `"chartVersion" in history[0]` workaround. Reports `''` until Flux has
+ * recorded its first release.
+ */
+function chartVersionExpression(resourceId) {
+    const history = `${resourceId}.status.history`;
+    const matching = `${history}.filter(entry, has(entry.chartVersion))`;
+    return `has(${history}) ? (size(${matching}) > 0 ? ${matching}[0].chartVersion : "") : ""`;
+}
+/**
+ * Build a Traefik bootstrap composition.
+ *
+ * Use this when the defaults of {@link traefikBootstrap} are not enough — to
+ * adopt an externally managed namespace, to own the cluster-default TLS
+ * resources, to disable the HTTP→HTTPS redirect, or to pass chart values this
+ * factory does not model.
+ *
+ * @param options - Build-time options. Must be concrete values.
+ *
+ * @example An edge that owns its default TLS store, fed by cert-manager
+ * ```typescript
+ * const edge = makeTraefikBootstrap({
+ *   name: 'traefik-edge',
+ *   kind: 'TraefikEdge',
+ *   defaultTlsStore: { defaultCertificateSecretName: 'edge-wildcard-tls' },
+ *   defaultTlsOption: { minVersion: 'VersionTLS13' },
+ * });
+ *
+ * await edge.factory('direct', { kubeConfig, waitForReady: true }).deploy({
+ *   name: 'traefik',
+ *   namespace: 'traefik',
+ *   service: { type: 'LoadBalancer' },
+ * });
+ * ```
+ */
+export function makeTraefikBootstrap(options = {}) {
+    const ownsNamespace = (options.namespaceOwnership ?? 'owned') === 'owned';
+    const redirectWebToWebsecure = options.redirectWebToWebsecure ?? true;
+    const defaultTlsOption = options.defaultTlsOption;
+    const defaultTlsStore = options.defaultTlsStore;
+    const crdsPolicy = options.crds ?? DEFAULT_TRAEFIK_CRDS_POLICY;
+    return kubernetesComposition({
+        name: options.name ?? 'traefik-bootstrap',
+        kind: options.kind ?? 'TraefikBootstrap',
+        spec: TraefikBootstrapConfigSchema,
+        status: TraefikBootstrapStatusSchema,
+    }, (spec) => {
+        const installNamespace = Cel.default(spec.namespace, DEFAULT_TRAEFIK_NAMESPACE);
+        const chartVersion = Cel.default(spec.chartVersion, DEFAULT_TRAEFIK_CHART_VERSION);
+        if (ownsNamespace) {
+            namespace({
+                metadata: {
+                    name: installNamespace,
+                    labels: {
+                        'app.kubernetes.io/name': TRAEFIK_POD_NAME_LABEL_VALUE,
+                        'app.kubernetes.io/instance': spec.name,
+                        'app.kubernetes.io/managed-by': 'typekro',
+                    },
+                },
+                id: 'traefikNamespace',
+            });
+        }
+        // The official chart source is shared by every Traefik installation, so
+        // its ownership stays outside any consumer instance.
+        singleton(traefikHelmRepositoryBootstrap, {
+            id: 'traefikHelmRepository',
+            spec: {
+                name: DEFAULT_TRAEFIK_REPOSITORY_NAME,
+                namespace: DEFAULT_FLUX_NAMESPACE,
+                url: DEFAULT_TRAEFIK_REPOSITORY_URL,
+            },
+        });
+        const values = mapTraefikConfigToHelmValues(spec, {
+            redirectWebToWebsecure,
+            targetNamespace: installNamespace,
+            ...(options.values ? { baseValues: options.values } : {}),
+        });
+        // Chart 41.5.0 ships the traefik.io CRDs in its own crds/ directory, so
+        // this single release installs the CRDs and the proxy together.
+        const release = traefikHelmRelease({
+            name: spec.name,
+            namespace: DEFAULT_FLUX_NAMESPACE,
+            targetNamespace: installNamespace,
+            version: chartVersion,
+            repositoryName: DEFAULT_TRAEFIK_REPOSITORY_NAME,
+            repositoryNamespace: DEFAULT_FLUX_NAMESPACE,
+            // Flux creates the namespace only when this composition does not.
+            createNamespace: !ownsNamespace,
+            crds: crdsPolicy,
+            values,
+            id: 'traefikHelmRelease',
+        });
+        if (defaultTlsOption) {
+            const tlsOption = traefikTLSOption({
+                name: defaultTlsOption.name ?? TRAEFIK_DEFAULT_TLS_OPTION_NAME,
+                namespace: installNamespace,
+                spec: {
+                    ...(defaultTlsOption.minVersion ? { minVersion: defaultTlsOption.minVersion } : {}),
+                    ...(defaultTlsOption.sniStrict === undefined
+                        ? {}
+                        : { sniStrict: defaultTlsOption.sniStrict }),
+                    ...(defaultTlsOption.cipherSuites
+                        ? { cipherSuites: [...defaultTlsOption.cipherSuites] }
+                        : {}),
+                    ...(defaultTlsOption.curvePreferences
+                        ? { curvePreferences: [...defaultTlsOption.curvePreferences] }
+                        : {}),
+                    ...(defaultTlsOption.clientAuth ? { clientAuth: defaultTlsOption.clientAuth } : {}),
+                },
+                id: 'traefikDefaultTlsOption',
+            });
+            // The TLSOption CRD arrives with the release.
+            tlsOption.dependsOn(release);
+        }
+        if (defaultTlsStore) {
+            const tlsStore = traefikTLSStore({
+                name: defaultTlsStore.name ?? TRAEFIK_DEFAULT_TLS_STORE_NAME,
+                namespace: installNamespace,
+                spec: {
+                    defaultCertificate: { secretName: defaultTlsStore.defaultCertificateSecretName },
+                },
+                id: 'traefikDefaultTlsStore',
+            });
+            tlsStore.dependsOn(release);
+        }
+        // The entrypoint Service this composition OWNS. The chart's own Service
+        // is pinned off by the values mapper; this one carries the same name
+        // (`fullnameOverride` is pinned to `spec.name`) and the same selector, so
+        // nothing downstream — `providers.kubernetesIngress.publishedService`
+        // included — has to know which of the two created it.
+        //
+        // `targetPort` is the container port NAME, exactly as the chart's own
+        // Service template does it: the chart names every container port after
+        // its entrypoint, so the names survive a change of container port.
+        service({
+            metadata: {
+                name: spec.name,
+                namespace: installNamespace,
+                labels: {
+                    'app.kubernetes.io/name': TRAEFIK_POD_NAME_LABEL_VALUE,
+                    'app.kubernetes.io/instance': spec.name,
+                    'app.kubernetes.io/managed-by': 'typekro',
+                },
+                // `Cel.default`, never a JavaScript branch: a schema proxy is a truthy
+                // object, so `spec.service?.annotations ? ... : {}` would always take
+                // the first arm in KRO mode and disagree with direct mode.
+                annotations: Cel.default(spec.service?.annotations, {}),
+            },
+            spec: {
+                type: traefikEntrypointServiceType(spec),
+                // The chart stamps these two labels on the Traefik pods, and the
+                // values mapper pins both of their sources (`nameOverride`,
+                // `instanceLabelOverride`) so this selector is exact.
+                selector: {
+                    'app.kubernetes.io/name': TRAEFIK_POD_NAME_LABEL_VALUE,
+                    'app.kubernetes.io/instance': spec.name,
+                },
+                // @security The internal `traefik` entrypoint serves /ping, metrics
+                // and the (pinned off) dashboard. Owning the Service is what makes
+                // its absence here a structural guarantee rather than a chart value.
+                ports: [
+                    {
+                        name: TRAEFIK_WEB_ENTRYPOINT,
+                        port: Cel.default(spec.entrypoints?.web?.exposedPort, DEFAULT_TRAEFIK_WEB_PORT),
+                        targetPort: TRAEFIK_WEB_ENTRYPOINT,
+                        protocol: 'TCP',
+                    },
+                    {
+                        name: TRAEFIK_WEBSECURE_ENTRYPOINT,
+                        port: Cel.default(spec.entrypoints?.websecure?.exposedPort, DEFAULT_TRAEFIK_WEBSECURE_PORT),
+                        targetPort: TRAEFIK_WEBSECURE_ENTRYPOINT,
+                        protocol: 'TCP',
+                    },
+                ],
+            },
+            id: 'traefikService',
+        });
+        // Deliberately no `dependsOn`. Ordering against the owned namespace is
+        // already implicit — the dependency resolver adds an edge from any
+        // resource whose `metadata.namespace` matches a `Namespace` in the same
+        // graph — and the Service must NOT wait for the release: a Service with
+        // no endpoints is valid, and creating it first lets a cloud
+        // load-balancer controller provision while Helm is still installing.
+        // An explicit `dependsOn` would also force TypeKro to inject ordering
+        // annotations into `metadata.annotations`, which cannot be merged into an
+        // annotation map that arrives as one schema reference.
+        const releaseStatus = helmReleaseConditionSummary(release);
+        return {
+            ready: releaseStatus.ready,
+            failed: releaseStatus.failed,
+            phase: releaseStatus.phase,
+            loadBalancer: {
+                hostname: Cel.expr(loadBalancerAddressExpression('traefikService', 'hostname')),
+                ip: Cel.expr(loadBalancerAddressExpression('traefikService', 'ip')),
+            },
+            // Read back from the owned Service rather than echoing the spec. The
+            // resource-scoped CEL form is deliberate: a `schema.spec` reference in
+            // a status field is not a resource projection and KRO drops it.
+            serviceName: Cel.expr('traefikService.metadata.name'),
+            // The chart version Flux INSTALLED, off the owned release's history —
+            // the same reasoning as `serviceName`, and the reason `version` is not
+            // a deploy-time literal here (#188).
+            version: Cel.expr(chartVersionExpression('traefikHelmRelease')),
+        };
+    });
+}
+/**
+ * The default Traefik bootstrap composition.
+ *
+ * Owns its install namespace, redirects `web` to `websecure`, and creates no
+ * default TLS resources. Use {@link makeTraefikBootstrap} for anything else.
+ *
+ * @example
+ * ```typescript
+ * const factory = traefikBootstrap.factory('direct', {
+ *   namespace: 'flux-system',
+ *   waitForReady: true,
+ *   timeout: 600_000,
+ *   kubeConfig,
+ * });
+ *
+ * const instance = await factory.deploy({
+ *   name: 'traefik',
+ *   namespace: 'traefik',
+ *   replicas: 2,
+ *   service: {
+ *     type: 'LoadBalancer',
+ *     annotations: {
+ *       'service.beta.kubernetes.io/aws-load-balancer-type': 'external',
+ *       'service.beta.kubernetes.io/aws-load-balancer-nlb-target-type': 'ip',
+ *       'service.beta.kubernetes.io/aws-load-balancer-scheme': 'internet-facing',
+ *     },
+ *   },
+ *   providers: { crd: true },
+ *   accessLogs: true,
+ * });
+ * ```
+ */
+export const traefikBootstrap = makeTraefikBootstrap();
+//# sourceMappingURL=traefik-bootstrap.js.map

package/dist/factories/traefik/compositions/traefik-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"traefik-bootstrap.js","sourceRoot":"","sources":["../../../../src/factories/traefik/compositions/traefik-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AACjE,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,yBAAyB,EACzB,+BAA+B,EAC/B,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAEL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,6BAA6B,CAAC,UAAkB,EAAE,KAAwB;IACjF,MAAM,IAAI,GAAG,GAAG,UAAU,sBAAsB,CAAC;IACjD,MAAM,QAAQ,GAAG,GAAG,IAAI,oCAAoC,KAAK,IAAI,CAAC;IACtE,OAAO,CACL,OAAO,IAAI,YAAY,IAAI,YAAY;QACvC,WAAW,QAAQ,WAAW,QAAQ,OAAO,KAAK,SAAS;QAC3D,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,sBAAsB,CAAC,UAAkB;IAChD,MAAM,OAAO,GAAG,GAAG,UAAU,iBAAiB,CAAC;IAC/C,MAAM,QAAQ,GAAG,GAAG,OAAO,yCAAyC,CAAC;IACrE,OAAO,OAAO,OAAO,aAAa,QAAQ,WAAW,QAAQ,6BAA6B,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAwC,EAAE;IAC7E,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC;IAC1E,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,IAAI,CAAC;IACtE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,2BAA2B,CAAC;IAE/D,OAAO,qBAAqB,CAC1B;QACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,mBAAmB;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,kBAAkB;QACxC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,4BAA4B;KACrC,EACD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,gBAAgB,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAChF,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;QAEnF,IAAI,aAAa,EAAE,CAAC;YAClB,SAAS,CAAC;gBACR,QAAQ,EAAE;oBACR,IAAI,EAAE,gBAAgB;oBACtB,MAAM,EAAE;wBACN,wBAAwB,EAAE,4BAA4B;wBACtD,4BAA4B,EAAE,IAAI,CAAC,IAAI;wBACvC,8BAA8B,EAAE,SAAS;qBAC1C;iBACF;gBACD,EAAE,EAAE,kBAAkB;aACvB,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,qDAAqD;QACrD,SAAS,CAAC,8BAA8B,EAAE;YACxC,EAAE,EAAE,uBAAuB;YAC3B,IAAI,EAAE;gBACJ,IAAI,EAAE,+BAA+B;gBACrC,SAAS,EAAE,sBAAsB;gBACjC,GAAG,EAAE,8BAA8B;aACpC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,EAAE;YAChD,sBAAsB;YACtB,eAAe,EAAE,gBAAgB;YACjC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;QAEH,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,sBAAsB;YACjC,eAAe,EAAE,gBAAgB;YACjC,OAAO,EAAE,YAAY;YACrB,cAAc,EAAE,+BAA+B;YAC/C,mBAAmB,EAAE,sBAAsB;YAC3C,kEAAkE;YAClE,eAAe,EAAE,CAAC,aAAa;YAC/B,IAAI,EAAE,UAAU;YAChB,MAAM;YACN,EAAE,EAAE,oBAAoB;SACzB,CAAC,CAAC;QAEH,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC;gBACjC,IAAI,EAAE,gBAAgB,CAAC,IAAI,IAAI,+BAA+B;gBAC9D,SAAS,EAAE,gBAAgB;gBAC3B,IAAI,EAAE;oBACJ,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnF,GAAG,CAAC,gBAAgB,CAAC,SAAS,KAAK,SAAS;wBAC1C,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,CAAC;oBAC9C,GAAG,CAAC,gBAAgB,CAAC,YAAY;wBAC/B,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,gBAAgB,CAAC,YAAY,CAAC,EAAE;wBACtD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,gBAAgB,CAAC,gBAAgB;wBACnC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,EAAE;wBAC9D,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF;gBACD,EAAE,EAAE,yBAAyB;aAC9B,CAAC,CAAC;YACH,8CAA8C;YAC9C,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,eAAe,CAAC;gBAC/B,IAAI,EAAE,eAAe,CAAC,IAAI,IAAI,8BAA8B;gBAC5D,SAAS,EAAE,gBAAgB;gBAC3B,IAAI,EAAE;oBACJ,kBAAkB,EAAE,EAAE,UAAU,EAAE,eAAe,CAAC,4BAA4B,EAAE;iBACjF;gBACD,EAAE,EAAE,wBAAwB;aAC7B,CAAC,CAAC;YACH,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAED,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,sEAAsE;QACtE,sDAAsD;QACtD,EAAE;QACF,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,OAAO,CAAC;YACN,QAAQ,EAAE;gBACR,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,gBAAgB;gBAC3B,MAAM,EAAE;oBACN,wBAAwB,EAAE,4BAA4B;oBACtD,4BAA4B,EAAE,IAAI,CAAC,IAAI;oBACvC,8BAA8B,EAAE,SAAS;iBAC1C;gBACD,uEAAuE;gBACvE,sEAAsE;gBACtE,2DAA2D;gBAC3D,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;aACxD;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,4BAA4B,CAAC,IAAI,CAAC;gBACxC,iEAAiE;gBACjE,4DAA4D;gBAC5D,sDAAsD;gBACtD,QAAQ,EAAE;oBACR,wBAAwB,EAAE,4BAA4B;oBACtD,4BAA4B,EAAE,IAAI,CAAC,IAAI;iBACxC;gBACD,oEAAoE;gBACpE,mEAAmE;gBACnE,qEAAqE;gBACrE,KAAK,EAAE;oBACL;wBACE,IAAI,EAAE,sBAAsB;wBAC5B,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,CAAC;wBAC/E,UAAU,EAAE,sBAAsB;wBAClC,QAAQ,EAAE,KAAK;qBAChB;oBACD;wBACE,IAAI,EAAE,4BAA4B;wBAClC,IAAI,EAAE,GAAG,CAAC,OAAO,CACf,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,EACxC,8BAA8B,CAC/B;wBACD,UAAU,EAAE,4BAA4B;wBACxC,QAAQ,EAAE,KAAK;qBAChB;iBACF;aACF;YACD,EAAE,EAAE,gBAAgB;SACrB,CAAC,CAAC;QACH,uEAAuE;QACvE,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,4DAA4D;QAC5D,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,uDAAuD;QAEvD,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAE3D,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAS,6BAA6B,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;gBACvF,EAAE,EAAE,GAAG,CAAC,IAAI,CAAS,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;aAC5E;YACD,qEAAqE;YACrE,uEAAuE;YACvE,gEAAgE;YAChE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAS,8BAA8B,CAAC;YAC7D,sEAAsE;YACtE,uEAAuE;YACvE,qCAAqC;YACrC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAS,sBAAsB,CAAC,oBAAoB,CAAC,CAAC;SACxE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,EAAE,CAAC"}

package/dist/factories/traefik/compositions/traefik-helm-repository.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared Traefik `HelmRepository` singleton.
+ *
+ * Every Traefik release consumes the same official chart source. Keeping that
+ * source outside consumer ownership prevents one installation's teardown from
+ * deleting or relabeling the repository another `HelmRelease` still resolves
+ * against.
+ */
+export declare const traefikHelmRepositoryBootstrap: import("../../../index.js").CallableComposition<{
+    name: string;
+    namespace: string;
+    url: string;
+}, {
+    ready: boolean;
+}>;
+//# sourceMappingURL=traefik-helm-repository.d.ts.map

package/dist/factories/traefik/compositions/traefik-helm-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traefik-helm-repository.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/compositions/traefik-helm-repository.ts"],"names":[],"mappings":"AAQA;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B;;;;;;EAwB1C,CAAC"}

package/dist/factories/traefik/compositions/traefik-helm-repository.js

@@ -0,0 +1,31 @@
+import { kubernetesComposition } from '../../../core/composition/imperative.js';
+import { Cel } from '../../../core/references/cel.js';
+import { traefikHelmRepository } from '../resources/helm.js';
+import { TraefikHelmRepositorySingletonSpecSchema, TraefikHelmRepositorySingletonStatusSchema, } from '../types.js';
+/**
+ * Shared Traefik `HelmRepository` singleton.
+ *
+ * Every Traefik release consumes the same official chart source. Keeping that
+ * source outside consumer ownership prevents one installation's teardown from
+ * deleting or relabeling the repository another `HelmRelease` still resolves
+ * against.
+ */
+export const traefikHelmRepositoryBootstrap = kubernetesComposition({
+    name: 'traefik-helm-repository',
+    kind: 'TraefikHelmRepository',
+    spec: TraefikHelmRepositorySingletonSpecSchema,
+    status: TraefikHelmRepositorySingletonStatusSchema,
+}, (spec) => {
+    const repository = traefikHelmRepository({
+        name: spec.name,
+        namespace: spec.namespace,
+        url: spec.url,
+        id: 'repository',
+    });
+    return {
+        // The official repository is a classic (non-OCI) Helm repository, so Flux
+        // publishes a real Ready condition for it.
+        ready: Cel.expr(repository.status.conditions, '.exists(c, c.type == "Ready" && c.status == "True")'),
+    };
+});
+//# sourceMappingURL=traefik-helm-repository.js.map

package/dist/factories/traefik/compositions/traefik-helm-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"traefik-helm-repository.js","sourceRoot":"","sources":["../../../../src/factories/traefik/compositions/traefik-helm-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,wCAAwC,EACxC,0CAA0C,GAC3C,MAAM,aAAa,CAAC;AAErB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,qBAAqB,CACjE;IACE,IAAI,EAAE,yBAAyB;IAC/B,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,wCAAwC;IAC9C,MAAM,EAAE,0CAA0C;CACnD,EACD,CAAC,IAAI,EAAE,EAAE;IACP,MAAM,UAAU,GAAG,qBAAqB,CAAC;QACvC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,EAAE,EAAE,YAAY;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,0EAA0E;QAC1E,2CAA2C;QAC3C,KAAK,EAAE,GAAG,CAAC,IAAI,CACb,UAAU,CAAC,MAAM,CAAC,UAAU,EAC5B,qDAAqD,CACtD;KACF,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/factories/traefik/constants.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Traefik factory constants.
+ *
+ * Compatibility tuple verified against the official Traefik Helm chart
+ * `traefik` 41.5.0 (appVersion `v3.7.13`, `kubeVersion >=1.25.0-0`) published on
+ * https://traefik.github.io/charts. That chart ships the `traefik.io/v1alpha1`
+ * CRDs in its own `crds/` directory, so one HelmRelease installs both the CRDs
+ * and the proxy.
+ */
+/** API group/version of every Traefik CRD this factory creates. */
+export declare const TRAEFIK_API_VERSION = "traefik.io/v1alpha1";
+/** Pinned official chart version. */
+export declare const DEFAULT_TRAEFIK_CHART_VERSION = "41.5.0";
+/** Traefik Proxy version bundled with {@link DEFAULT_TRAEFIK_CHART_VERSION}. */
+export declare const DEFAULT_TRAEFIK_APP_VERSION = "v3.7.13";
+/** Chart name inside the official repository. */
+export declare const DEFAULT_TRAEFIK_CHART_NAME = "traefik";
+/** Official classic (non-OCI) Helm repository. */
+export declare const DEFAULT_TRAEFIK_REPOSITORY_URL = "https://traefik.github.io/charts";
+/** `HelmRepository` name the bootstrap composition owns as a singleton. */
+export declare const DEFAULT_TRAEFIK_REPOSITORY_NAME = "traefik-repo";
+/** Namespace Traefik is installed into by default. */
+export declare const DEFAULT_TRAEFIK_NAMESPACE = "traefik";
+/** `IngressClass` / `providers.kubernetesCRD.ingressClass` value. */
+export declare const DEFAULT_TRAEFIK_INGRESS_CLASS = "traefik";
+/**
+ * Controller name Traefik v3 claims for Gateway API `GatewayClass` resources.
+ *
+ * Passed to the shared `src/factories/gateway-api` factories so a Traefik edge
+ * and an Envoy AI Gateway can coexist in one cluster.
+ */
+export declare const TRAEFIK_GATEWAY_CONTROLLER_NAME = "traefik.io/gateway-controller";
+/** Plain-HTTP entrypoint name. */
+export declare const TRAEFIK_WEB_ENTRYPOINT = "web";
+/** TLS entrypoint name. */
+export declare const TRAEFIK_WEBSECURE_ENTRYPOINT = "websecure";
+/** Internal entrypoint serving `/ping`, metrics and (when enabled) the dashboard. */
+export declare const TRAEFIK_INTERNAL_ENTRYPOINT = "traefik";
+/**
+ * `app.kubernetes.io/name` the chart stamps on the Traefik pods.
+ *
+ * The chart derives this label from `nameOverride`, defaulting to the chart
+ * name. The values mapper pins `nameOverride` to this constant so the
+ * entrypoint Service this factory OWNS can select the chart's pods by an
+ * exactly known label rather than by whatever the chart's template computed.
+ */
+export declare const TRAEFIK_POD_NAME_LABEL_VALUE = "traefik";
+/**
+ * Flux CRD policy this factory applies to install AND upgrade.
+ *
+ * Chart 41.5.0 ships the `traefik.io/v1alpha1` CRDs in its own `crds/`
+ * directory, and the helm-controller SKIPS `crds/` on upgrade by default — so a
+ * chart bump would otherwise keep serving the CRD schemas the release was
+ * first installed with.
+ *
+ * @see https://fluxcd.io/flux/components/helm/api/v2/
+ */
+export declare const DEFAULT_TRAEFIK_CRDS_POLICY = "CreateReplace";
+/** Externally published port of the `web` entrypoint. */
+export declare const DEFAULT_TRAEFIK_WEB_PORT = 80;
+/** Externally published port of the `websecure` entrypoint. */
+export declare const DEFAULT_TRAEFIK_WEBSECURE_PORT = 443;
+/** Container port backing the `web` entrypoint. */
+export declare const DEFAULT_TRAEFIK_WEB_CONTAINER_PORT = 8000;
+/** Container port backing the `websecure` entrypoint. */
+export declare const DEFAULT_TRAEFIK_WEBSECURE_CONTAINER_PORT = 8443;
+/** Name of the cluster-wide default `TLSOption`, per Traefik's convention. */
+export declare const TRAEFIK_DEFAULT_TLS_OPTION_NAME = "default";
+/** Name of the cluster-wide default `TLSStore`, per Traefik's convention. */
+export declare const TRAEFIK_DEFAULT_TLS_STORE_NAME = "default";
+/**
+ * Every OSS Traefik middleware key, in CRD order.
+ *
+ * A `Middleware` must set exactly one of these, which the middleware factory
+ * enforces at the type level and re-checks before serialization.
+ */
+export declare const TRAEFIK_MIDDLEWARE_KINDS: readonly ["addPrefix", "basicAuth", "buffering", "chain", "circuitBreaker", "compress", "contentType", "digestAuth", "encodedCharacters", "errors", "forwardAuth", "grpcWeb", "headers", "inFlightReq", "ipAllowList", "passTLSClientCert", "plugin", "rateLimit", "redirectRegex", "redirectScheme", "replacePath", "replacePathRegex", "retry", "stripPrefix", "stripPrefixRegex"];
+//# sourceMappingURL=constants.d.ts.map

package/dist/factories/traefik/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/factories/traefik/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,qCAAqC;AACrC,eAAO,MAAM,6BAA6B,WAAW,CAAC;AACtD,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,YAAY,CAAC;AACrD,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,YAAY,CAAC;AACpD,kDAAkD;AAClD,eAAO,MAAM,8BAA8B,qCAAqC,CAAC;AACjF,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,iBAAiB,CAAC;AAE9D,sDAAsD;AACtD,eAAO,MAAM,yBAAyB,YAAY,CAAC;AACnD,qEAAqE;AACrE,eAAO,MAAM,6BAA6B,YAAY,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAE/E,kCAAkC;AAClC,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAC5C,2BAA2B;AAC3B,eAAO,MAAM,4BAA4B,cAAc,CAAC;AACxD,qFAAqF;AACrF,eAAO,MAAM,2BAA2B,YAAY,CAAC;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,YAAY,CAAC;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAE3D,yDAAyD;AACzD,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,+DAA+D;AAC/D,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,mDAAmD;AACnD,eAAO,MAAM,kCAAkC,OAAO,CAAC;AACvD,yDAAyD;AACzD,eAAO,MAAM,wCAAwC,OAAO,CAAC;AAE7D,8EAA8E;AAC9E,eAAO,MAAM,+BAA+B,YAAY,CAAC;AACzD,6EAA6E;AAC7E,eAAO,MAAM,8BAA8B,YAAY,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,sXA0B3B,CAAC"}

package/dist/factories/traefik/constants.js

@@ -0,0 +1,104 @@
+/**
+ * Traefik factory constants.
+ *
+ * Compatibility tuple verified against the official Traefik Helm chart
+ * `traefik` 41.5.0 (appVersion `v3.7.13`, `kubeVersion >=1.25.0-0`) published on
+ * https://traefik.github.io/charts. That chart ships the `traefik.io/v1alpha1`
+ * CRDs in its own `crds/` directory, so one HelmRelease installs both the CRDs
+ * and the proxy.
+ */
+/** API group/version of every Traefik CRD this factory creates. */
+export const TRAEFIK_API_VERSION = 'traefik.io/v1alpha1';
+/** Pinned official chart version. */
+export const DEFAULT_TRAEFIK_CHART_VERSION = '41.5.0';
+/** Traefik Proxy version bundled with {@link DEFAULT_TRAEFIK_CHART_VERSION}. */
+export const DEFAULT_TRAEFIK_APP_VERSION = 'v3.7.13';
+/** Chart name inside the official repository. */
+export const DEFAULT_TRAEFIK_CHART_NAME = 'traefik';
+/** Official classic (non-OCI) Helm repository. */
+export const DEFAULT_TRAEFIK_REPOSITORY_URL = 'https://traefik.github.io/charts';
+/** `HelmRepository` name the bootstrap composition owns as a singleton. */
+export const DEFAULT_TRAEFIK_REPOSITORY_NAME = 'traefik-repo';
+/** Namespace Traefik is installed into by default. */
+export const DEFAULT_TRAEFIK_NAMESPACE = 'traefik';
+/** `IngressClass` / `providers.kubernetesCRD.ingressClass` value. */
+export const DEFAULT_TRAEFIK_INGRESS_CLASS = 'traefik';
+/**
+ * Controller name Traefik v3 claims for Gateway API `GatewayClass` resources.
+ *
+ * Passed to the shared `src/factories/gateway-api` factories so a Traefik edge
+ * and an Envoy AI Gateway can coexist in one cluster.
+ */
+export const TRAEFIK_GATEWAY_CONTROLLER_NAME = 'traefik.io/gateway-controller';
+/** Plain-HTTP entrypoint name. */
+export const TRAEFIK_WEB_ENTRYPOINT = 'web';
+/** TLS entrypoint name. */
+export const TRAEFIK_WEBSECURE_ENTRYPOINT = 'websecure';
+/** Internal entrypoint serving `/ping`, metrics and (when enabled) the dashboard. */
+export const TRAEFIK_INTERNAL_ENTRYPOINT = 'traefik';
+/**
+ * `app.kubernetes.io/name` the chart stamps on the Traefik pods.
+ *
+ * The chart derives this label from `nameOverride`, defaulting to the chart
+ * name. The values mapper pins `nameOverride` to this constant so the
+ * entrypoint Service this factory OWNS can select the chart's pods by an
+ * exactly known label rather than by whatever the chart's template computed.
+ */
+export const TRAEFIK_POD_NAME_LABEL_VALUE = 'traefik';
+/**
+ * Flux CRD policy this factory applies to install AND upgrade.
+ *
+ * Chart 41.5.0 ships the `traefik.io/v1alpha1` CRDs in its own `crds/`
+ * directory, and the helm-controller SKIPS `crds/` on upgrade by default — so a
+ * chart bump would otherwise keep serving the CRD schemas the release was
+ * first installed with.
+ *
+ * @see https://fluxcd.io/flux/components/helm/api/v2/
+ */
+export const DEFAULT_TRAEFIK_CRDS_POLICY = 'CreateReplace';
+/** Externally published port of the `web` entrypoint. */
+export const DEFAULT_TRAEFIK_WEB_PORT = 80;
+/** Externally published port of the `websecure` entrypoint. */
+export const DEFAULT_TRAEFIK_WEBSECURE_PORT = 443;
+/** Container port backing the `web` entrypoint. */
+export const DEFAULT_TRAEFIK_WEB_CONTAINER_PORT = 8000;
+/** Container port backing the `websecure` entrypoint. */
+export const DEFAULT_TRAEFIK_WEBSECURE_CONTAINER_PORT = 8443;
+/** Name of the cluster-wide default `TLSOption`, per Traefik's convention. */
+export const TRAEFIK_DEFAULT_TLS_OPTION_NAME = 'default';
+/** Name of the cluster-wide default `TLSStore`, per Traefik's convention. */
+export const TRAEFIK_DEFAULT_TLS_STORE_NAME = 'default';
+/**
+ * Every OSS Traefik middleware key, in CRD order.
+ *
+ * A `Middleware` must set exactly one of these, which the middleware factory
+ * enforces at the type level and re-checks before serialization.
+ */
+export const TRAEFIK_MIDDLEWARE_KINDS = [
+    'addPrefix',
+    'basicAuth',
+    'buffering',
+    'chain',
+    'circuitBreaker',
+    'compress',
+    'contentType',
+    'digestAuth',
+    'encodedCharacters',
+    'errors',
+    'forwardAuth',
+    'grpcWeb',
+    'headers',
+    'inFlightReq',
+    'ipAllowList',
+    'passTLSClientCert',
+    'plugin',
+    'rateLimit',
+    'redirectRegex',
+    'redirectScheme',
+    'replacePath',
+    'replacePathRegex',
+    'retry',
+    'stripPrefix',
+    'stripPrefixRegex',
+];
+//# sourceMappingURL=constants.js.map

package/dist/factories/traefik/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/factories/traefik/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,qCAAqC;AACrC,MAAM,CAAC,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AACtD,gFAAgF;AAChF,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC;AACrD,iDAAiD;AACjD,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AACpD,kDAAkD;AAClD,MAAM,CAAC,MAAM,8BAA8B,GAAG,kCAAkC,CAAC;AACjF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,+BAA+B,GAAG,cAAc,CAAC;AAE9D,sDAAsD;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC;AACnD,qEAAqE;AACrE,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,+BAA+B,CAAC;AAE/E,kCAAkC;AAClC,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAC5C,2BAA2B;AAC3B,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AACxD,qFAAqF;AACrF,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAE3D,yDAAyD;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,mDAAmD;AACnD,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AACvD,yDAAyD;AACzD,MAAM,CAAC,MAAM,wCAAwC,GAAG,IAAI,CAAC;AAE7D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC;AACzD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CAAC;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,WAAW;IACX,WAAW;IACX,WAAW;IACX,OAAO;IACP,gBAAgB;IAChB,UAAU;IACV,aAAa;IACb,YAAY;IACZ,mBAAmB;IACnB,QAAQ;IACR,aAAa;IACb,SAAS;IACT,SAAS;IACT,aAAa;IACb,aAAa;IACb,mBAAmB;IACnB,QAAQ;IACR,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,kBAAkB;IAClB,OAAO;IACP,aAAa;IACb,kBAAkB;CACV,CAAC"}

package/dist/factories/traefik/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Traefik v3 factory.
+ *
+ * Stands Traefik up as a cluster edge — the Helm repository, the Helm release
+ * and a status contract — and exposes its `traefik.io/v1alpha1` CRDs as typed
+ * factories: `IngressRoute`, `IngressRouteTCP`, `Middleware` (the OSS
+ * middleware set as a discriminated union), `TLSOption`, `TLSStore`,
+ * `ServersTransport` and `TraefikService`.
+ *
+ * Traefik's Gateway API support comes from the shared
+ * `src/factories/gateway-api` module rather than a Traefik-specific copy of the
+ * upstream kinds.
+ *
+ * @security Secure by construction: the dashboard and the insecure API cannot
+ * be enabled through this factory, `forwardAuth` defaults to
+ * `trustForwardHeader: false` with an explicit `authResponseHeaders`
+ * allowlist, `TLSOption` defaults to TLS 1.2 with `sniStrict`, and the proxy
+ * runs non-root with a read-only root filesystem.
+ */
+export * from './compositions/index.js';
+export * from './constants.js';
+export * from './resources/index.js';
+export * from './types.js';
+export * from './utils/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/factories/traefik/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/factories/traefik/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}