typekro 0.33.9 → 0.34.0

package/dist/factories/traefik/index.js

@@ -0,0 +1,25 @@
+/**
+ * Traefik v3 factory.
+ *
+ * Stands Traefik up as a cluster edge — the Helm repository, the Helm release
+ * and a status contract — and exposes its `traefik.io/v1alpha1` CRDs as typed
+ * factories: `IngressRoute`, `IngressRouteTCP`, `Middleware` (the OSS
+ * middleware set as a discriminated union), `TLSOption`, `TLSStore`,
+ * `ServersTransport` and `TraefikService`.
+ *
+ * Traefik's Gateway API support comes from the shared
+ * `src/factories/gateway-api` module rather than a Traefik-specific copy of the
+ * upstream kinds.
+ *
+ * @security Secure by construction: the dashboard and the insecure API cannot
+ * be enabled through this factory, `forwardAuth` defaults to
+ * `trustForwardHeader: false` with an explicit `authResponseHeaders`
+ * allowlist, `TLSOption` defaults to TLS 1.2 with `sniStrict`, and the proxy
+ * runs non-root with a read-only root filesystem.
+ */
+export * from './compositions/index.js';
+export * from './constants.js';
+export * from './resources/index.js';
+export * from './types.js';
+export * from './utils/index.js';
+//# sourceMappingURL=index.js.map

package/dist/factories/traefik/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/factories/traefik/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}

package/dist/factories/traefik/resources/common.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Shared plumbing for the Traefik CRD resource factories.
+ *
+ * All of it exists to answer one question consistently: what does readiness
+ * mean for a resource that has no status?
+ */
+import type { Composable, ReadinessEvaluator } from '../../../core/types/index.js';
+import type { TraefikResourceMetadata } from '../types.js';
+/**
+ * Configuration accepted by every namespaced Traefik CRD factory.
+ *
+ * Nothing here is hand-written. The identity half is
+ * {@link TraefikResourceMetadata}, inferred from
+ * `TraefikResourceMetadataSchema`; `spec` stays a TYPE PARAMETER because it is
+ * a different schema per kind — `TraefikIngressRouteSpec`,
+ * `TraefikMiddlewareSpec`, `TraefikTLSOptionSpec` and the rest, each already
+ * inferred from its own ArkType schema — so the caller binds it rather than
+ * this file re-declaring any of them.
+ */
+export type TraefikResourceConfig<TSpec extends object> = TraefikResourceMetadata & {
+    readonly spec: TSpec;
+};
+/**
+ * Readiness evaluator for a Traefik CRD.
+ *
+ * **Why always-ready:** none of the `traefik.io/v1alpha1` kinds
+ * (`IngressRoute`, `IngressRouteTCP`, `Middleware`, `TLSOption`, `TLSStore`,
+ * `ServersTransport`, `TraefikService`) declares a `status` subresource — the
+ * proxy consumes them as dynamic configuration and reports problems in its own
+ * logs and metrics, never on the object. A condition-based evaluator would
+ * therefore poll to its deadline and then fail a deployment whose routing is
+ * in fact live, so applying the object successfully is the only readiness
+ * signal the API offers. This mirrors how `envoy-ai-gateway` treats Envoy
+ * Gateway's status-less `Backend` kind.
+ *
+ * A route that references a missing Service or Middleware is still surfaced —
+ * by the referenced resource's own readiness, and by Traefik returning 404/503
+ * for the route, which the integration suite asserts on.
+ *
+ * @param kind - Traefik kind name, used in the readiness message.
+ */
+export declare function traefikStatuslessReadinessEvaluator<T = unknown>(kind: string): ReadinessEvaluator<T>;
+/** The `app.kubernetes.io` label set TypeKro stamps on Traefik resources. */
+export declare function traefikManagedLabels(instance: string): Record<string, string>;
+/**
+ * Build the resource definition passed to `createResource`.
+ *
+ * Takes `Composable<...>` so a composition can pass proxy-sourced optional
+ * fields straight through (integration-skill.md: "All factory functions use
+ * `Composable<MyConfig>`").
+ */
+export declare function traefikResourceDefinition<TSpec extends object>(apiVersion: string, kind: string, config: Composable<TraefikResourceConfig<TSpec>>): {
+    id?: string;
+    apiVersion: string;
+    kind: string;
+    metadata: {
+        annotations?: {
+            [x: string]: string;
+        };
+        name: string;
+        namespace: string;
+        labels: {
+            [x: string]: string;
+        };
+    };
+    spec: TSpec;
+};
+//# sourceMappingURL=common.d.ts.map

package/dist/factories/traefik/resources/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/common.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,CAAC,KAAK,SAAS,MAAM,IAAI,uBAAuB,GAAG;IAClF,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;CACtB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mCAAmC,CAAC,CAAC,GAAG,OAAO,EAC7D,IAAI,EAAE,MAAM,GACX,kBAAkB,CAAC,CAAC,CAAC,CAKvB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7E;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,SAAS,MAAM,EAC5D,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;;;;;;;;;;;;;;UAWzB,KAAK;EAG7B"}

package/dist/factories/traefik/resources/common.js

@@ -0,0 +1,59 @@
+/**
+ * Shared plumbing for the Traefik CRD resource factories.
+ *
+ * All of it exists to answer one question consistently: what does readiness
+ * mean for a resource that has no status?
+ */
+import { createAlwaysReadyEvaluator } from '../../../core/readiness/evaluator-factories.js';
+/**
+ * Readiness evaluator for a Traefik CRD.
+ *
+ * **Why always-ready:** none of the `traefik.io/v1alpha1` kinds
+ * (`IngressRoute`, `IngressRouteTCP`, `Middleware`, `TLSOption`, `TLSStore`,
+ * `ServersTransport`, `TraefikService`) declares a `status` subresource — the
+ * proxy consumes them as dynamic configuration and reports problems in its own
+ * logs and metrics, never on the object. A condition-based evaluator would
+ * therefore poll to its deadline and then fail a deployment whose routing is
+ * in fact live, so applying the object successfully is the only readiness
+ * signal the API offers. This mirrors how `envoy-ai-gateway` treats Envoy
+ * Gateway's status-less `Backend` kind.
+ *
+ * A route that references a missing Service or Middleware is still surfaced —
+ * by the referenced resource's own readiness, and by Traefik returning 404/503
+ * for the route, which the integration suite asserts on.
+ *
+ * @param kind - Traefik kind name, used in the readiness message.
+ */
+export function traefikStatuslessReadinessEvaluator(kind) {
+    return createAlwaysReadyEvaluator(kind, `${kind} is ready (Traefik CRDs publish no status subresource)`);
+}
+/** The `app.kubernetes.io` label set TypeKro stamps on Traefik resources. */
+export function traefikManagedLabels(instance) {
+    return {
+        'app.kubernetes.io/name': 'traefik',
+        'app.kubernetes.io/instance': instance,
+        'app.kubernetes.io/managed-by': 'typekro',
+    };
+}
+/**
+ * Build the resource definition passed to `createResource`.
+ *
+ * Takes `Composable<...>` so a composition can pass proxy-sourced optional
+ * fields straight through (integration-skill.md: "All factory functions use
+ * `Composable<MyConfig>`").
+ */
+export function traefikResourceDefinition(apiVersion, kind, config) {
+    return {
+        apiVersion,
+        kind,
+        metadata: {
+            name: config.name,
+            namespace: config.namespace,
+            labels: { ...traefikManagedLabels(config.name), ...config.labels },
+            ...(config.annotations ? { annotations: { ...config.annotations } } : {}),
+        },
+        spec: config.spec,
+        ...(config.id ? { id: config.id } : {}),
+    };
+}
+//# sourceMappingURL=common.js.map

package/dist/factories/traefik/resources/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/common.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAmB5F;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mCAAmC,CACjD,IAAY;IAEZ,OAAO,0BAA0B,CAC/B,IAAI,EACJ,GAAG,IAAI,wDAAwD,CAChE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO;QACL,wBAAwB,EAAE,SAAS;QACnC,4BAA4B,EAAE,QAAQ;QACtC,8BAA8B,EAAE,SAAS;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAkB,EAClB,IAAY,EACZ,MAAgD;IAEhD,OAAO;QACL,UAAU;QACV,IAAI;QACJ,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;YAClE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E;QACD,IAAI,EAAE,MAAM,CAAC,IAAa;QAC1B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/dist/factories/traefik/resources/gateway.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Traefik's Gateway API surface.
+ *
+ * Traefik v3 implements upstream Gateway API, so there is no Traefik-specific
+ * copy of `Gateway`/`HTTPRoute`/`GRPCRoute` here: these are thin wrappers over
+ * the shared `src/factories/gateway-api` factories (#176) that pin Traefik's
+ * controller name and stamp the Traefik managed labels.
+ *
+ * Enable the provider with `providers: { gatewayApi: true }` on the bootstrap
+ * spec. Traefik middlewares attach to a Gateway API route through an
+ * `ExtensionRef` filter — see {@link traefikMiddlewareFilter}.
+ */
+import type { Composable, Enhanced } from '../../../core/types/index.js';
+import { type GatewayApiNamespacedResourceConfig } from '../../gateway-api/index.js';
+import type { AcceptedResourceStatus, GatewayClassSpec, GatewayObservedStatus, GatewaySpec, GRPCRouteSpec, HTTPRouteFilter, HTTPRouteSpec, RouteObservedStatus } from '../../gateway-api/types.js';
+import { TRAEFIK_GATEWAY_CONTROLLER_NAME } from '../constants.js';
+import type { TraefikGatewayClassConfig } from '../types.js';
+/** `GatewayClass.spec` pinned to Traefik's controller. */
+export type TraefikGatewayClassSpec = GatewayClassSpec<typeof TRAEFIK_GATEWAY_CONTROLLER_NAME>;
+/**
+ * `traefikGatewayClass`'s configuration type.
+ *
+ * DECLARED in `../types.js`, next to the ArkType schema it is inferred from,
+ * and re-exported here so the public import path stays `resources/gateway.js`.
+ */
+export type { TraefikGatewayClassConfig } from '../types.js';
+/**
+ * Create a `GatewayClass` claimed by Traefik.
+ *
+ * The Helm chart can create one itself (`gatewayClass.enabled`), which the
+ * bootstrap composition leaves alone. Use this factory when a consumer graph
+ * owns the class — for instance to run a second, differently named class
+ * alongside the chart's.
+ *
+ * @example
+ * ```typescript
+ * traefikGatewayClass({ name: 'traefik-edge', id: 'traefikGatewayClass' });
+ * ```
+ */
+export declare function traefikGatewayClass(config: Composable<TraefikGatewayClassConfig>): Enhanced<TraefikGatewayClassSpec, AcceptedResourceStatus>;
+/**
+ * Create a Gateway API `Gateway` served by Traefik.
+ *
+ * `spec.gatewayClassName` must name a class Traefik has claimed.
+ */
+export declare function traefikGateway(config: Composable<GatewayApiNamespacedResourceConfig<GatewaySpec>>): Enhanced<GatewaySpec, GatewayObservedStatus>;
+/**
+ * Create a Gateway API `HTTPRoute` served by Traefik.
+ *
+ * @example A route attaching a Traefik `Middleware` through an ExtensionRef
+ * ```typescript
+ * traefikHTTPRoute({
+ *   name: 'orders-api',
+ *   namespace: 'edge',
+ *   spec: {
+ *     parentRefs: [{ name: 'traefik-gateway', namespace: 'traefik' }],
+ *     hostnames: ['api.example.com'],
+ *     rules: [
+ *       {
+ *         matches: [{ path: { type: 'PathPrefix', value: '/v1' } }],
+ *         filters: [traefikMiddlewareFilter('orders-api-authz')],
+ *         backendRefs: [{ name: 'orders-api', port: 8080 }],
+ *         timeouts: { request: '120s' },
+ *       },
+ *     ],
+ *   },
+ *   id: 'ordersApiHttpRoute',
+ * });
+ * ```
+ */
+export declare function traefikHTTPRoute(config: Composable<GatewayApiNamespacedResourceConfig<HTTPRouteSpec>>): Enhanced<HTTPRouteSpec, RouteObservedStatus>;
+/** Create a Gateway API `GRPCRoute` served by Traefik. */
+export declare function traefikGRPCRoute(config: Composable<GatewayApiNamespacedResourceConfig<GRPCRouteSpec>>): Enhanced<GRPCRouteSpec, RouteObservedStatus>;
+/**
+ * Build the `ExtensionRef` filter that attaches a Traefik `Middleware` to a
+ * Gateway API route rule.
+ *
+ * Gateway API has no vendor-neutral filter for `forwardAuth` or `rateLimit`,
+ * so an implementation-specific extension is the supported way to reference
+ * one from an `HTTPRoute`.
+ *
+ * @param name - Name of a `Middleware` in the route's namespace.
+ */
+export declare function traefikMiddlewareFilter(name: string): HTTPRouteFilter;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/factories/traefik/resources/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAGL,KAAK,kCAAkC,EAGxC,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,WAAW,EACX,aAAa,EACb,eAAe,EACf,aAAa,EACb,mBAAmB,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAuB,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAG7D,0DAA0D;AAC1D,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE/F;;;;;GAKG;AACH,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,CAAC,yBAAyB,CAAC,GAC5C,QAAQ,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAW3D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,CAAC,kCAAkC,CAAC,WAAW,CAAC,CAAC,GAClE,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAK9C;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,CAAC,kCAAkC,CAAC,aAAa,CAAC,CAAC,GACpE,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAK9C;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,CAAC,kCAAkC,CAAC,aAAa,CAAC,CAAC,GACpE,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAK9C;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CASrE"}

package/dist/factories/traefik/resources/gateway.js

@@ -0,0 +1,109 @@
+/**
+ * Traefik's Gateway API surface.
+ *
+ * Traefik v3 implements upstream Gateway API, so there is no Traefik-specific
+ * copy of `Gateway`/`HTTPRoute`/`GRPCRoute` here: these are thin wrappers over
+ * the shared `src/factories/gateway-api` factories (#176) that pin Traefik's
+ * controller name and stamp the Traefik managed labels.
+ *
+ * Enable the provider with `providers: { gatewayApi: true }` on the bootstrap
+ * spec. Traefik middlewares attach to a Gateway API route through an
+ * `ExtensionRef` filter — see {@link traefikMiddlewareFilter}.
+ */
+import { gateway as gatewayApiGateway, gatewayClass as gatewayApiGatewayClass, grpcRoute as gatewayApiGrpcRoute, httpRoute as gatewayApiHttpRoute, } from '../../gateway-api/index.js';
+import { TRAEFIK_API_VERSION, TRAEFIK_GATEWAY_CONTROLLER_NAME } from '../constants.js';
+import { traefikManagedLabels } from './common.js';
+/**
+ * Create a `GatewayClass` claimed by Traefik.
+ *
+ * The Helm chart can create one itself (`gatewayClass.enabled`), which the
+ * bootstrap composition leaves alone. Use this factory when a consumer graph
+ * owns the class — for instance to run a second, differently named class
+ * alongside the chart's.
+ *
+ * @example
+ * ```typescript
+ * traefikGatewayClass({ name: 'traefik-edge', id: 'traefikGatewayClass' });
+ * ```
+ */
+export function traefikGatewayClass(config) {
+    return gatewayApiGatewayClass({
+        name: config.name,
+        labels: { ...traefikManagedLabels(config.name), ...config.labels },
+        ...(config.annotations ? { annotations: config.annotations } : {}),
+        ...(config.id ? { id: config.id } : {}),
+        spec: {
+            controllerName: TRAEFIK_GATEWAY_CONTROLLER_NAME,
+            ...(config.description === undefined ? {} : { description: config.description }),
+        },
+    });
+}
+/**
+ * Create a Gateway API `Gateway` served by Traefik.
+ *
+ * `spec.gatewayClassName` must name a class Traefik has claimed.
+ */
+export function traefikGateway(config) {
+    return gatewayApiGateway({
+        ...config,
+        labels: { ...traefikManagedLabels(config.name), ...config.labels },
+    });
+}
+/**
+ * Create a Gateway API `HTTPRoute` served by Traefik.
+ *
+ * @example A route attaching a Traefik `Middleware` through an ExtensionRef
+ * ```typescript
+ * traefikHTTPRoute({
+ *   name: 'orders-api',
+ *   namespace: 'edge',
+ *   spec: {
+ *     parentRefs: [{ name: 'traefik-gateway', namespace: 'traefik' }],
+ *     hostnames: ['api.example.com'],
+ *     rules: [
+ *       {
+ *         matches: [{ path: { type: 'PathPrefix', value: '/v1' } }],
+ *         filters: [traefikMiddlewareFilter('orders-api-authz')],
+ *         backendRefs: [{ name: 'orders-api', port: 8080 }],
+ *         timeouts: { request: '120s' },
+ *       },
+ *     ],
+ *   },
+ *   id: 'ordersApiHttpRoute',
+ * });
+ * ```
+ */
+export function traefikHTTPRoute(config) {
+    return gatewayApiHttpRoute({
+        ...config,
+        labels: { ...traefikManagedLabels(config.name), ...config.labels },
+    });
+}
+/** Create a Gateway API `GRPCRoute` served by Traefik. */
+export function traefikGRPCRoute(config) {
+    return gatewayApiGrpcRoute({
+        ...config,
+        labels: { ...traefikManagedLabels(config.name), ...config.labels },
+    });
+}
+/**
+ * Build the `ExtensionRef` filter that attaches a Traefik `Middleware` to a
+ * Gateway API route rule.
+ *
+ * Gateway API has no vendor-neutral filter for `forwardAuth` or `rateLimit`,
+ * so an implementation-specific extension is the supported way to reference
+ * one from an `HTTPRoute`.
+ *
+ * @param name - Name of a `Middleware` in the route's namespace.
+ */
+export function traefikMiddlewareFilter(name) {
+    return {
+        type: 'ExtensionRef',
+        extensionRef: {
+            group: TRAEFIK_API_VERSION.split('/')[0] ?? 'traefik.io',
+            kind: 'Middleware',
+            name,
+        },
+    };
+}
+//# sourceMappingURL=gateway.js.map

package/dist/factories/traefik/resources/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,OAAO,IAAI,iBAAiB,EAC5B,YAAY,IAAI,sBAAsB,EAEtC,SAAS,IAAI,mBAAmB,EAChC,SAAS,IAAI,mBAAmB,GACjC,MAAM,4BAA4B,CAAC;AAWpC,OAAO,EAAE,mBAAmB,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAEvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAanD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA6C;IAE7C,OAAO,sBAAsB,CAAyC;QACpE,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;QAClE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,EAAE;YACJ,cAAc,EAAE,+BAA+B;YAC/C,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;SACjF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAmE;IAEnE,OAAO,iBAAiB,CAAC;QACvB,GAAG,MAAM;QACT,MAAM,EAAE,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAqE;IAErE,OAAO,mBAAmB,CAAC;QACzB,GAAG,MAAM;QACT,MAAM,EAAE,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,gBAAgB,CAC9B,MAAqE;IAErE,OAAO,mBAAmB,CAAC;QACzB,GAAG,MAAM;QACT,MAAM,EAAE,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY;YACxD,IAAI,EAAE,YAAY;YAClB,IAAI;SACL;KACF,CAAC;AACJ,CAAC"}

package/dist/factories/traefik/resources/helm.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Traefik Helm resources.
+ *
+ * The factory owns both halves of the install — the chart source and the
+ * release — so a consumer never hand-writes Flux objects. The bootstrap
+ * composition owns the release and delegates the shared repository to a
+ * singleton composition.
+ */
+import type { Composable, Enhanced } from '../../../core/types/index.js';
+import { type HelmRepositorySpec, type HelmRepositoryStatus } from '../../helm/helm-repository.js';
+import type { HelmReleaseSpec, HelmReleaseStatus } from '../../helm/types.js';
+import type { TraefikHelmReleaseConfig, TraefikHelmRepositoryConfig, TraefikHelmValues } from '../types.js';
+/**
+ * Traefik `HelmRelease` readiness (delegates to the shared Flux evaluator).
+ *
+ * Exported so a consumer graph that adopts an externally created release can
+ * reuse the same readiness contract.
+ */
+export declare const traefikHelmReleaseReadinessEvaluator: import("../../index.js").ReadinessEvaluator<unknown>;
+/**
+ * Create the Flux `HelmRepository` for the official Traefik chart repository.
+ *
+ * This is a classic (non-OCI) Helm repository, so Flux publishes a normal
+ * `Ready` condition for it.
+ *
+ * @example
+ * ```typescript
+ * traefikHelmRepository({ name: 'traefik-repo', id: 'repository' });
+ * ```
+ */
+export declare function traefikHelmRepository(config: Composable<TraefikHelmRepositoryConfig>): Enhanced<HelmRepositorySpec, HelmRepositoryStatus>;
+/**
+ * Create the Flux `HelmRelease` installing Traefik.
+ *
+ * Chart 41.5.0 ships the `traefik.io/v1alpha1` CRDs in its own `crds/`
+ * directory, so this single release installs both the CRDs and the proxy — no
+ * separate `traefik-crds` release is needed. Because Flux SKIPS `crds/` on
+ * upgrade by default, `install.crds` and `upgrade.crds` are both set from
+ * `config.crds` (default `CreateReplace`) so a chart bump moves the CRDs too.
+ *
+ * Values are passed through unchanged. Build them with
+ * `mapTraefikConfigToHelmValues`, which applies the security pins from #172.
+ *
+ * @example
+ * ```typescript
+ * traefikHelmRelease({
+ *   name: 'traefik',
+ *   targetNamespace: 'traefik',
+ *   repositoryName: 'traefik-repo',
+ *   values: mapTraefikConfigToHelmValues({ name: 'traefik' }),
+ *   id: 'traefikHelmRelease',
+ * });
+ * ```
+ */
+export declare function traefikHelmRelease(config: Composable<TraefikHelmReleaseConfig>): Enhanced<HelmReleaseSpec<TraefikHelmValues>, HelmReleaseStatus>;
+//# sourceMappingURL=helm.d.ts.map

package/dist/factories/traefik/resources/helm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/helm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAU9E,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EAElB,MAAM,aAAa,CAAC;AAKrB;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,sDAA+C,CAAC;AAEjG;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,CAAC,2BAA2B,CAAC,GAC9C,QAAQ,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAcpD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,CAAC,wBAAwB,CAAC,GAC3C,QAAQ,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,CA0DjE"}

package/dist/factories/traefik/resources/helm.js

@@ -0,0 +1,131 @@
+/**
+ * Traefik Helm resources.
+ *
+ * The factory owns both halves of the install — the chart source and the
+ * release — so a consumer never hand-writes Flux objects. The bootstrap
+ * composition owns the release and delegates the shared repository to a
+ * singleton composition.
+ */
+import { DEFAULT_FLUX_NAMESPACE } from '../../../core/config/defaults.js';
+import { createHelmRepositoryReadinessEvaluator, } from '../../helm/helm-repository.js';
+import { createLabeledHelmReleaseEvaluator } from '../../helm/readiness-evaluators.js';
+import { createResource } from '../../shared.js';
+import { DEFAULT_TRAEFIK_CHART_NAME, DEFAULT_TRAEFIK_CHART_VERSION, DEFAULT_TRAEFIK_CRDS_POLICY, DEFAULT_TRAEFIK_NAMESPACE, DEFAULT_TRAEFIK_REPOSITORY_NAME, DEFAULT_TRAEFIK_REPOSITORY_URL, } from '../constants.js';
+/** Traefik `HelmRepository` readiness (delegates to the shared Flux evaluator). */
+const traefikHelmRepositoryReadinessEvaluator = createHelmRepositoryReadinessEvaluator('Traefik');
+/**
+ * Traefik `HelmRelease` readiness (delegates to the shared Flux evaluator).
+ *
+ * Exported so a consumer graph that adopts an externally created release can
+ * reuse the same readiness contract.
+ */
+export const traefikHelmReleaseReadinessEvaluator = createLabeledHelmReleaseEvaluator('Traefik');
+/**
+ * Create the Flux `HelmRepository` for the official Traefik chart repository.
+ *
+ * This is a classic (non-OCI) Helm repository, so Flux publishes a normal
+ * `Ready` condition for it.
+ *
+ * @example
+ * ```typescript
+ * traefikHelmRepository({ name: 'traefik-repo', id: 'repository' });
+ * ```
+ */
+export function traefikHelmRepository(config) {
+    return createResource({
+        ...(config.id ? { id: config.id } : {}),
+        apiVersion: 'source.toolkit.fluxcd.io/v1',
+        kind: 'HelmRepository',
+        metadata: {
+            name: config.name,
+            namespace: config.namespace ?? DEFAULT_FLUX_NAMESPACE,
+        },
+        spec: {
+            url: config.url ?? DEFAULT_TRAEFIK_REPOSITORY_URL,
+            interval: config.interval ?? '1h',
+        },
+    }).withReadinessEvaluator(traefikHelmRepositoryReadinessEvaluator);
+}
+/**
+ * Create the Flux `HelmRelease` installing Traefik.
+ *
+ * Chart 41.5.0 ships the `traefik.io/v1alpha1` CRDs in its own `crds/`
+ * directory, so this single release installs both the CRDs and the proxy — no
+ * separate `traefik-crds` release is needed. Because Flux SKIPS `crds/` on
+ * upgrade by default, `install.crds` and `upgrade.crds` are both set from
+ * `config.crds` (default `CreateReplace`) so a chart bump moves the CRDs too.
+ *
+ * Values are passed through unchanged. Build them with
+ * `mapTraefikConfigToHelmValues`, which applies the security pins from #172.
+ *
+ * @example
+ * ```typescript
+ * traefikHelmRelease({
+ *   name: 'traefik',
+ *   targetNamespace: 'traefik',
+ *   repositoryName: 'traefik-repo',
+ *   values: mapTraefikConfigToHelmValues({ name: 'traefik' }),
+ *   id: 'traefikHelmRelease',
+ * });
+ * ```
+ */
+export function traefikHelmRelease(config) {
+    const namespace = config.namespace ?? DEFAULT_FLUX_NAMESPACE;
+    // Flux's own defaults are `install.crds: Create` and `upgrade.crds: Skip`.
+    // `Skip` on upgrade is the dangerous half: the chart carries its CRDs in
+    // `crds/`, so a version bump would install a newer proxy against the CRD
+    // schemas the release was FIRST created with. Both actions are set from one
+    // policy so they cannot drift apart.
+    const crds = config.crds ?? DEFAULT_TRAEFIK_CRDS_POLICY;
+    return createResource({
+        ...(config.id ? { id: config.id } : {}),
+        apiVersion: 'helm.toolkit.fluxcd.io/v2',
+        kind: 'HelmRelease',
+        metadata: {
+            name: config.name,
+            namespace,
+        },
+        spec: {
+            interval: config.interval ?? '5m',
+            timeout: config.timeout ?? '10m',
+            chart: {
+                spec: {
+                    chart: DEFAULT_TRAEFIK_CHART_NAME,
+                    version: config.version ?? DEFAULT_TRAEFIK_CHART_VERSION,
+                    sourceRef: {
+                        kind: 'HelmRepository',
+                        name: config.repositoryName ?? DEFAULT_TRAEFIK_REPOSITORY_NAME,
+                        namespace: config.repositoryNamespace ?? namespace,
+                    },
+                },
+            },
+            targetNamespace: config.targetNamespace ?? DEFAULT_TRAEFIK_NAMESPACE,
+            // Pinned to the same `name` the values mapper pins as the chart's
+            // `fullnameOverride`. Left unset, Flux's `GetReleaseName()` composes
+            // `<targetNamespace>-<name>` — this factory always sets
+            // `targetNamespace`, so the install namespace would spend part of Helm's
+            // 53-character release-name budget and a `name` at exactly the schema's
+            // limit would fail the install. Pinning it makes the release name `name`
+            // itself, so that limit binds on `name` alone. It also stops the release
+            // name from moving when a caller changes the install namespace, which
+            // Helm treats as a different release entirely.
+            releaseName: config.name,
+            install: {
+                createNamespace: config.createNamespace ?? false,
+                crds,
+                remediation: { retries: 3 },
+            },
+            upgrade: {
+                crds,
+                remediation: { retries: 3, remediateLastFailure: true, strategy: 'rollback' },
+            },
+            // The mapper's output is a graph-aware value tree — refs and CEL
+            // expressions live inside it — so it is handed to Flux as-is. The cast
+            // re-states that: `Composable<>` widens every optional branch of the
+            // values tree, which `TypeKroChartValues` models as its own recursive
+            // union rather than as optional properties.
+            ...(config.values ? { values: config.values } : {}),
+        },
+    }).withReadinessEvaluator(traefikHelmReleaseReadinessEvaluator);
+}
+//# sourceMappingURL=helm.js.map

package/dist/factories/traefik/resources/helm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm.js","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/helm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,OAAO,EACL,sCAAsC,GAGvC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,yBAAyB,EACzB,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AAQzB,mFAAmF;AACnF,MAAM,uCAAuC,GAAG,sCAAsC,CAAC,SAAS,CAAC,CAAC;AAElG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;AAEjG;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA+C;IAE/C,OAAO,cAAc,CAA2C;QAC9D,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,UAAU,EAAE,6BAA6B;QACzC,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,sBAAsB;SACtD;QACD,IAAI,EAAE;YACJ,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,8BAA8B;YACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;SAClC;KACF,CAAC,CAAC,sBAAsB,CAAC,uCAAuC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA4C;IAE5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC7D,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,qCAAqC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,2BAA2B,CAAC;IACxD,OAAO,cAAc,CAAwD;QAC3E,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,UAAU,EAAE,2BAA2B;QACvC,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS;SACV;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;YAChC,KAAK,EAAE;gBACL,IAAI,EAAE;oBACJ,KAAK,EAAE,0BAA0B;oBACjC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,6BAA6B;oBACxD,SAAS,EAAE;wBACT,IAAI,EAAE,gBAAyB;wBAC/B,IAAI,EAAE,MAAM,CAAC,cAAc,IAAI,+BAA+B;wBAC9D,SAAS,EAAE,MAAM,CAAC,mBAAmB,IAAI,SAAS;qBACnD;iBACF;aACF;YACD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,yBAAyB;YACpE,kEAAkE;YAClE,qEAAqE;YACrE,wDAAwD;YACxD,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,sEAAsE;YACtE,+CAA+C;YAC/C,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,OAAO,EAAE;gBACP,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,KAAK;gBAChD,IAAI;gBACJ,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE;aAC5B;YACD,OAAO,EAAE;gBACP,IAAI;gBACJ,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE;aAC9E;YACD,iEAAiE;YACjE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,4CAA4C;YAC5C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAiC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E;KACF,CAAC,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,CAAC;AAClE,CAAC"}

package/dist/factories/traefik/resources/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Traefik resource factories.
+ */
+export * from './common.js';
+export * from './gateway.js';
+export * from './helm.js';
+export * from './middleware.js';
+export * from './routing.js';
+export * from './tls.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/factories/traefik/resources/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC"}

package/dist/factories/traefik/resources/index.js

@@ -0,0 +1,10 @@
+/**
+ * Traefik resource factories.
+ */
+export * from './common.js';
+export * from './gateway.js';
+export * from './helm.js';
+export * from './middleware.js';
+export * from './routing.js';
+export * from './tls.js';
+//# sourceMappingURL=index.js.map

package/dist/factories/traefik/resources/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC"}