typekro 0.33.9 → 0.34.0

package/dist/factories/traefik/resources/middleware.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Traefik `Middleware` resources.
+ *
+ * One factory, {@link traefikMiddleware}, covers the whole OSS middleware set
+ * through a discriminated union whose variants are mutually exclusive at the
+ * type level. On top of it sit typed builders for the middlewares an edge
+ * almost always needs, each of which carries the secure defaults from #172.
+ */
+import type { Composable, Enhanced } from '../../../core/types/index.js';
+import type { TraefikBufferingMiddlewareConfig, TraefikChainMiddlewareConfig, TraefikForwardAuthMiddlewareConfig, TraefikHeadersMiddlewareConfig, TraefikInFlightReqMiddlewareConfig, TraefikMiddlewareSpec, TraefikRateLimitMiddlewareConfig, TraefikRedirectSchemeMiddlewareConfig } from '../types.js';
+import { type TraefikResourceConfig } from './common.js';
+import type { TraefikNoStatus } from './routing.js';
+/**
+ * The builders' configuration types.
+ *
+ * They are DECLARED in `../types.js`, next to the ArkType schemas they are
+ * inferred from — the guide keeps every schema in one file — and re-exported
+ * here so the public import path stays `resources/middleware.js`.
+ */
+export type { TraefikBufferingMiddlewareConfig, TraefikChainMiddlewareConfig, TraefikForwardAuthMiddlewareConfig, TraefikHeadersMiddlewareConfig, TraefikInFlightReqMiddlewareConfig, TraefikMiddlewareMetadata, TraefikRateLimitMiddlewareConfig, TraefikRedirectSchemeMiddlewareConfig, } from '../types.js';
+/**
+ * Create a Traefik `Middleware`.
+ *
+ * `spec` accepts exactly one middleware key. Setting two is a compile error,
+ * and is re-checked here because Traefik resolves such an object by applying
+ * one middleware and silently dropping the other.
+ *
+ * @throws {TypeKroError} `TRAEFIK_MIDDLEWARE_INVALID_SPEC` when the spec sets
+ *   zero, several, or unknown middleware keys.
+ *
+ * @example
+ * ```typescript
+ * traefikMiddleware({
+ *   name: 'strip-v1',
+ *   namespace: 'edge',
+ *   spec: { stripPrefix: { prefixes: ['/v1'] } },
+ *   id: 'stripV1',
+ * });
+ * ```
+ */
+export declare function traefikMiddleware(config: Composable<TraefikResourceConfig<TraefikMiddlewareSpec>>): Enhanced<TraefikMiddlewareSpec, TraefikNoStatus>;
+/**
+ * Create a `forwardAuth` `Middleware` with the secure edge defaults.
+ *
+ * `trustForwardHeader` is `false` unless explicitly overridden, and
+ * `authResponseHeaders` is an explicit allowlist.
+ *
+ * @example The Example orders-api authorizer, returning principal/tier/customer
+ * ```typescript
+ * traefikForwardAuthMiddleware({
+ *   name: 'orders-api-authz',
+ *   namespace: 'edge',
+ *   address: 'http://orders-authorizer.edge.svc.cluster.local:8080/authorize',
+ *   authResponseHeaders: ['X-Edge-Principal', 'X-Edge-Tier', 'X-Edge-Customer'],
+ *   authRequestHeaders: ['Authorization', 'X-Edge-Api-Key'],
+ *   id: 'ordersApiAuthz',
+ * });
+ * ```
+ */
+export declare function traefikForwardAuthMiddleware(config: Composable<TraefikForwardAuthMiddlewareConfig>): Enhanced<TraefikMiddlewareSpec, TraefikNoStatus>;
+/**
+ * Create a `rateLimit` `Middleware`.
+ *
+ * @example Per-principal budget shared across replicas through Valkey
+ * ```typescript
+ * traefikRateLimitMiddleware({
+ *   name: 'orders-api-rate-limit',
+ *   namespace: 'edge',
+ *   average: 50,
+ *   burst: 100,
+ *   period: '1s',
+ *   requestHeaderName: 'X-Edge-Principal',
+ *   redis: {
+ *     endpoints: ['valkey-primary.edge.svc.cluster.local:6379'],
+ *     secret: 'valkey-auth',
+ *     db: 3,
+ *   },
+ *   id: 'ordersApiRateLimit',
+ * });
+ * ```
+ */
+export declare function traefikRateLimitMiddleware(config: Composable<TraefikRateLimitMiddlewareConfig>): Enhanced<TraefikMiddlewareSpec, TraefikNoStatus>;
+/**
+ * Create an `inFlightReq` `Middleware` — a concurrency cap that protects an
+ * upstream from a slow-request pile-up that a rate limit alone would allow.
+ *
+ * @example
+ * ```typescript
+ * traefikInFlightReqMiddleware({
+ *   name: 'orders-api-concurrency',
+ *   namespace: 'edge',
+ *   amount: 20,
+ *   requestHeaderName: 'X-Edge-Customer',
+ *   id: 'ordersApiConcurrency',
+ * });
+ * ```
+ */
+export declare function traefikInFlightReqMiddleware(config: Composable<TraefikInFlightReqMiddlewareConfig>): Enhanced<TraefikMiddlewareSpec, TraefikNoStatus>;
+/**
+ * Create a `headers` `Middleware` for CORS and browser security headers.
+ *
+ * @example
+ * ```typescript
+ * traefikHeadersMiddleware({
+ *   name: 'orders-api-headers',
+ *   namespace: 'edge',
+ *   headers: {
+ *     accessControlAllowOriginList: ['https://console.example.com'],
+ *     accessControlAllowMethods: ['GET', 'POST', 'OPTIONS'],
+ *     accessControlAllowHeaders: ['authorization', 'content-type'],
+ *     accessControlAllowCredentials: true,
+ *     accessControlMaxAge: 600,
+ *     addVaryHeader: true,
+ *     frameDeny: true,
+ *     contentTypeNosniff: true,
+ *     referrerPolicy: 'strict-origin-when-cross-origin',
+ *     stsSeconds: 31_536_000,
+ *     stsIncludeSubdomains: true,
+ *   },
+ *   id: 'ordersApiHeaders',
+ * });
+ * ```
+ */
+export declare function traefikHeadersMiddleware(config: Composable<TraefikHeadersMiddlewareConfig>): Enhanced<TraefikMiddlewareSpec, TraefikNoStatus>;
+/**
+ * Create a `redirectScheme` `Middleware`, the route-level counterpart to the
+ * entrypoint-level `web` → `websecure` redirect.
+ *
+ * Prefer the entrypoint redirect (`entrypoints.web.redirectToWebsecure` on the
+ * bootstrap spec) for a blanket policy; use this middleware when only some
+ * routes should redirect.
+ */
+export declare function traefikRedirectSchemeMiddleware(config: Composable<TraefikRedirectSchemeMiddlewareConfig>): Enhanced<TraefikMiddlewareSpec, TraefikNoStatus>;
+/**
+ * Create a `buffering` `Middleware` enforcing request/response body limits.
+ *
+ * @example A 1 MiB request-body cap
+ * ```typescript
+ * traefikBufferingMiddleware({
+ *   name: 'orders-api-body-limit',
+ *   namespace: 'edge',
+ *   buffering: { maxRequestBodyBytes: 1_048_576, memRequestBodyBytes: 262_144 },
+ *   id: 'ordersApiBodyLimit',
+ * });
+ * ```
+ */
+export declare function traefikBufferingMiddleware(config: Composable<TraefikBufferingMiddlewareConfig>): Enhanced<TraefikMiddlewareSpec, TraefikNoStatus>;
+/**
+ * Create a `chain` `Middleware` bundling an ordered middleware list into one
+ * reference, so several routes can share the same edge policy.
+ *
+ * @example
+ * ```typescript
+ * traefikChainMiddleware({
+ *   name: 'orders-api-edge',
+ *   namespace: 'edge',
+ *   middlewares: [
+ *     { name: 'orders-api-headers' },
+ *     { name: 'orders-api-authz' },
+ *     { name: 'orders-api-rate-limit' },
+ *     { name: 'orders-api-concurrency' },
+ *     { name: 'orders-api-body-limit' },
+ *   ],
+ *   id: 'ordersApiEdgeChain',
+ * });
+ * ```
+ */
+export declare function traefikChainMiddleware(config: Composable<TraefikChainMiddlewareConfig>): Enhanced<TraefikMiddlewareSpec, TraefikNoStatus>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/factories/traefik/resources/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAGzE,OAAO,KAAK,EACV,gCAAgC,EAEhC,4BAA4B,EAE5B,kCAAkC,EAClC,8BAA8B,EAE9B,kCAAkC,EAElC,qBAAqB,EAErB,gCAAgC,EAEhC,qCAAqC,EACtC,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,KAAK,qBAAqB,EAG3B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;;GAMG;AACH,YAAY,EACV,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,8BAA8B,EAC9B,kCAAkC,EAClC,yBAAyB,EACzB,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,aAAa,CAAC;AASrB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,UAAU,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC,GAC/D,QAAQ,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAMlD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,UAAU,CAAC,kCAAkC,CAAC,GACrD,QAAQ,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAYlD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,UAAU,CAAC,gCAAgC,CAAC,GACnD,QAAQ,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAclD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,UAAU,CAAC,kCAAkC,CAAC,GACrD,QAAQ,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAWlD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,UAAU,CAAC,8BAA8B,CAAC,GACjD,QAAQ,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,UAAU,CAAC,qCAAqC,CAAC,GACxD,QAAQ,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAOlD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,UAAU,CAAC,gCAAgC,CAAC,GACnD,QAAQ,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAElD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,CAAC,4BAA4B,CAAC,GAC/C,QAAQ,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAGlD"}

package/dist/factories/traefik/resources/middleware.js

@@ -0,0 +1,225 @@
+/**
+ * Traefik `Middleware` resources.
+ *
+ * One factory, {@link traefikMiddleware}, covers the whole OSS middleware set
+ * through a discriminated union whose variants are mutually exclusive at the
+ * type level. On top of it sit typed builders for the middlewares an edge
+ * almost always needs, each of which carries the secure defaults from #172.
+ */
+import { createResource } from '../../shared.js';
+import { TRAEFIK_API_VERSION } from '../constants.js';
+import { assertTraefikMiddlewareSpec } from '../utils/middleware-validation.js';
+import { traefikResourceDefinition, traefikStatuslessReadinessEvaluator, } from './common.js';
+function middlewareResource(metadata, spec) {
+    return traefikMiddleware({ ...metadata, spec });
+}
+/**
+ * Create a Traefik `Middleware`.
+ *
+ * `spec` accepts exactly one middleware key. Setting two is a compile error,
+ * and is re-checked here because Traefik resolves such an object by applying
+ * one middleware and silently dropping the other.
+ *
+ * @throws {TypeKroError} `TRAEFIK_MIDDLEWARE_INVALID_SPEC` when the spec sets
+ *   zero, several, or unknown middleware keys.
+ *
+ * @example
+ * ```typescript
+ * traefikMiddleware({
+ *   name: 'strip-v1',
+ *   namespace: 'edge',
+ *   spec: { stripPrefix: { prefixes: ['/v1'] } },
+ *   id: 'stripV1',
+ * });
+ * ```
+ */
+export function traefikMiddleware(config) {
+    assertTraefikMiddlewareSpec(config.spec, config.name);
+    return createResource(traefikResourceDefinition(TRAEFIK_API_VERSION, 'Middleware', config), { scope: 'namespaced' }).withReadinessEvaluator(traefikStatuslessReadinessEvaluator('Middleware'));
+}
+/**
+ * Create a `forwardAuth` `Middleware` with the secure edge defaults.
+ *
+ * `trustForwardHeader` is `false` unless explicitly overridden, and
+ * `authResponseHeaders` is an explicit allowlist.
+ *
+ * @example The Example orders-api authorizer, returning principal/tier/customer
+ * ```typescript
+ * traefikForwardAuthMiddleware({
+ *   name: 'orders-api-authz',
+ *   namespace: 'edge',
+ *   address: 'http://orders-authorizer.edge.svc.cluster.local:8080/authorize',
+ *   authResponseHeaders: ['X-Edge-Principal', 'X-Edge-Tier', 'X-Edge-Customer'],
+ *   authRequestHeaders: ['Authorization', 'X-Edge-Api-Key'],
+ *   id: 'ordersApiAuthz',
+ * });
+ * ```
+ */
+export function traefikForwardAuthMiddleware(config) {
+    const forwardAuth = {
+        address: config.address,
+        // @security Never inherit the client's own X-Forwarded-* by default.
+        trustForwardHeader: config.trustForwardHeader ?? false,
+        authResponseHeaders: [...config.authResponseHeaders],
+        ...(config.authRequestHeaders ? { authRequestHeaders: [...config.authRequestHeaders] } : {}),
+        ...(config.forwardBody === undefined ? {} : { forwardBody: config.forwardBody }),
+        ...(config.maxBodySize === undefined ? {} : { maxBodySize: config.maxBodySize }),
+        ...(config.tls ? { tls: config.tls } : {}),
+    };
+    return middlewareResource(metadataOf(config), { forwardAuth });
+}
+/**
+ * Create a `rateLimit` `Middleware`.
+ *
+ * @example Per-principal budget shared across replicas through Valkey
+ * ```typescript
+ * traefikRateLimitMiddleware({
+ *   name: 'orders-api-rate-limit',
+ *   namespace: 'edge',
+ *   average: 50,
+ *   burst: 100,
+ *   period: '1s',
+ *   requestHeaderName: 'X-Edge-Principal',
+ *   redis: {
+ *     endpoints: ['valkey-primary.edge.svc.cluster.local:6379'],
+ *     secret: 'valkey-auth',
+ *     db: 3,
+ *   },
+ *   id: 'ordersApiRateLimit',
+ * });
+ * ```
+ */
+export function traefikRateLimitMiddleware(config) {
+    const sourceCriterion = config.sourceCriterion ??
+        (config.requestHeaderName === undefined
+            ? undefined
+            : { requestHeaderName: config.requestHeaderName });
+    const rateLimit = {
+        average: config.average,
+        burst: config.burst,
+        period: config.period ?? '1s',
+        ...(sourceCriterion ? { sourceCriterion } : {}),
+        ...(config.redis ? { redis: config.redis } : {}),
+    };
+    return middlewareResource(metadataOf(config), { rateLimit });
+}
+/**
+ * Create an `inFlightReq` `Middleware` — a concurrency cap that protects an
+ * upstream from a slow-request pile-up that a rate limit alone would allow.
+ *
+ * @example
+ * ```typescript
+ * traefikInFlightReqMiddleware({
+ *   name: 'orders-api-concurrency',
+ *   namespace: 'edge',
+ *   amount: 20,
+ *   requestHeaderName: 'X-Edge-Customer',
+ *   id: 'ordersApiConcurrency',
+ * });
+ * ```
+ */
+export function traefikInFlightReqMiddleware(config) {
+    const sourceCriterion = config.sourceCriterion ??
+        (config.requestHeaderName === undefined
+            ? undefined
+            : { requestHeaderName: config.requestHeaderName });
+    const inFlightReq = {
+        amount: config.amount,
+        ...(sourceCriterion ? { sourceCriterion } : {}),
+    };
+    return middlewareResource(metadataOf(config), { inFlightReq });
+}
+/**
+ * Create a `headers` `Middleware` for CORS and browser security headers.
+ *
+ * @example
+ * ```typescript
+ * traefikHeadersMiddleware({
+ *   name: 'orders-api-headers',
+ *   namespace: 'edge',
+ *   headers: {
+ *     accessControlAllowOriginList: ['https://console.example.com'],
+ *     accessControlAllowMethods: ['GET', 'POST', 'OPTIONS'],
+ *     accessControlAllowHeaders: ['authorization', 'content-type'],
+ *     accessControlAllowCredentials: true,
+ *     accessControlMaxAge: 600,
+ *     addVaryHeader: true,
+ *     frameDeny: true,
+ *     contentTypeNosniff: true,
+ *     referrerPolicy: 'strict-origin-when-cross-origin',
+ *     stsSeconds: 31_536_000,
+ *     stsIncludeSubdomains: true,
+ *   },
+ *   id: 'ordersApiHeaders',
+ * });
+ * ```
+ */
+export function traefikHeadersMiddleware(config) {
+    return middlewareResource(metadataOf(config), { headers: config.headers });
+}
+/**
+ * Create a `redirectScheme` `Middleware`, the route-level counterpart to the
+ * entrypoint-level `web` → `websecure` redirect.
+ *
+ * Prefer the entrypoint redirect (`entrypoints.web.redirectToWebsecure` on the
+ * bootstrap spec) for a blanket policy; use this middleware when only some
+ * routes should redirect.
+ */
+export function traefikRedirectSchemeMiddleware(config) {
+    const redirectScheme = {
+        scheme: config.scheme ?? 'https',
+        permanent: config.permanent ?? true,
+        ...(config.port === undefined ? {} : { port: config.port }),
+    };
+    return middlewareResource(metadataOf(config), { redirectScheme });
+}
+/**
+ * Create a `buffering` `Middleware` enforcing request/response body limits.
+ *
+ * @example A 1 MiB request-body cap
+ * ```typescript
+ * traefikBufferingMiddleware({
+ *   name: 'orders-api-body-limit',
+ *   namespace: 'edge',
+ *   buffering: { maxRequestBodyBytes: 1_048_576, memRequestBodyBytes: 262_144 },
+ *   id: 'ordersApiBodyLimit',
+ * });
+ * ```
+ */
+export function traefikBufferingMiddleware(config) {
+    return middlewareResource(metadataOf(config), { buffering: config.buffering });
+}
+/**
+ * Create a `chain` `Middleware` bundling an ordered middleware list into one
+ * reference, so several routes can share the same edge policy.
+ *
+ * @example
+ * ```typescript
+ * traefikChainMiddleware({
+ *   name: 'orders-api-edge',
+ *   namespace: 'edge',
+ *   middlewares: [
+ *     { name: 'orders-api-headers' },
+ *     { name: 'orders-api-authz' },
+ *     { name: 'orders-api-rate-limit' },
+ *     { name: 'orders-api-concurrency' },
+ *     { name: 'orders-api-body-limit' },
+ *   ],
+ *   id: 'ordersApiEdgeChain',
+ * });
+ * ```
+ */
+export function traefikChainMiddleware(config) {
+    const chain = { middlewares: [...config.middlewares] };
+    return middlewareResource(metadataOf(config), { chain });
+}
+function metadataOf(config) {
+    return {
+        name: config.name,
+        namespace: config.namespace,
+        ...(config.labels ? { labels: config.labels } : {}),
+        ...(config.annotations ? { annotations: config.annotations } : {}),
+        ...(config.id ? { id: config.id } : {}),
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/factories/traefik/resources/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAiBtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAEL,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,aAAa,CAAC;AAqBrB,SAAS,kBAAkB,CACzB,QAA+C,EAC/C,IAAuC;IAEvC,OAAO,iBAAiB,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAgE;IAEhE,2BAA2B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,cAAc,CACnB,yBAAyB,CAAC,mBAAmB,EAAE,YAAY,EAAE,MAAM,CAAC,EACpE,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAsD;IAEtD,MAAM,WAAW,GAA6C;QAC5D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,qEAAqE;QACrE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,KAAK;QACtD,mBAAmB,EAAE,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,GAAG,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;IACF,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAoD;IAEpD,MAAM,eAAe,GACnB,MAAM,CAAC,eAAe;QACtB,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACrC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAA2C;QACxD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QAC7B,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAsD;IAEtD,MAAM,eAAe,GACnB,MAAM,CAAC,eAAe;QACtB,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACrC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,MAAM,WAAW,GAA6C;QAC5D,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAkD;IAElD,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAyD;IAEzD,MAAM,cAAc,GAAgD;QAClE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO;QAChC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;KAC5D,CAAC;IACF,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAoD;IAEpD,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAgD;IAEhD,MAAM,KAAK,GAAuC,EAAE,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3F,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CACjB,MAA6C;IAE7C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/dist/factories/traefik/resources/routing.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Traefik routing resources: `IngressRoute`, `IngressRouteTCP`,
+ * `TraefikService` and `ServersTransport`.
+ *
+ * Every one of these kinds is status-less; see
+ * {@link traefikStatuslessReadinessEvaluator} for why they are registered as
+ * always-ready rather than condition-based.
+ */
+import type { Composable, Enhanced } from '../../../core/types/index.js';
+import type { TraefikIngressRouteSpec, TraefikIngressRouteTCPSpec, TraefikServersTransportSpec, TraefikServiceSpec } from '../types.js';
+import { type TraefikResourceConfig } from './common.js';
+/** Traefik CRDs have no status subresource, so their status type is empty. */
+export type TraefikNoStatus = Record<string, never>;
+/**
+ * Create a Traefik `IngressRoute`.
+ *
+ * The HTTP router: it binds rule expressions on one or more entrypoints to
+ * backend services, with an ordered middleware chain and optional TLS.
+ *
+ * Set `ingressClassName` whenever the installation sets
+ * `providers.kubernetesCRD.ingressClass` — `traefikBootstrap` does, from
+ * `spec.ingressClass`. Traefik then processes only the CRDs whose class
+ * matches, which is what keeps two installations from stealing each other's
+ * routes; a route without it is silently ignored and the edge answers `404`.
+ *
+ * @example An authenticated, rate-limited API route terminating TLS
+ * ```typescript
+ * traefikIngressRoute({
+ *   name: 'orders-api',
+ *   namespace: 'edge',
+ *   spec: {
+ *     entryPoints: ['websecure'],
+ *     ingressClassName: 'traefik',
+ *     routes: [
+ *       {
+ *         match: 'Host(`api.example.com`) && PathPrefix(`/v1`)',
+ *         kind: 'Rule',
+ *         middlewares: [{ name: 'orders-api-authz' }, { name: 'orders-api-rate-limit' }],
+ *         services: [{ name: 'orders-api', port: 8080 }],
+ *       },
+ *     ],
+ *     tls: { secretName: 'orders-api-tls' },
+ *   },
+ *   id: 'ordersApiRoute',
+ * });
+ * ```
+ */
+export declare function traefikIngressRoute(config: Composable<TraefikResourceConfig<TraefikIngressRouteSpec>>): Enhanced<TraefikIngressRouteSpec, TraefikNoStatus>;
+/**
+ * Create a Traefik `IngressRouteTCP`.
+ *
+ * The TCP router, matched on SNI. Use `tls.passthrough` to hand the TLS
+ * handshake to the backend instead of terminating it at the edge.
+ *
+ * @example
+ * ```typescript
+ * traefikIngressRouteTCP({
+ *   name: 'postgres',
+ *   namespace: 'edge',
+ *   spec: {
+ *     entryPoints: ['postgres'],
+ *     routes: [{ match: 'HostSNI(`db.example.com`)', services: [{ name: 'pg-rw', port: 5432 }] }],
+ *     tls: { passthrough: true },
+ *   },
+ *   id: 'postgresRoute',
+ * });
+ * ```
+ */
+export declare function traefikIngressRouteTCP(config: Composable<TraefikResourceConfig<TraefikIngressRouteTCPSpec>>): Enhanced<TraefikIngressRouteTCPSpec, TraefikNoStatus>;
+/**
+ * Create a Traefik `TraefikService`.
+ *
+ * A composed backend — weighted round-robin, mirroring, failover, or highest
+ * random weight — referenced from a route with `kind: 'TraefikService'`.
+ *
+ * @example Canary split between two Deployments
+ * ```typescript
+ * traefikService({
+ *   name: 'orders-api-canary',
+ *   namespace: 'edge',
+ *   spec: {
+ *     weighted: {
+ *       services: [
+ *         { name: 'orders-api', port: 8080, weight: 9 },
+ *         { name: 'orders-api-next', port: 8080, weight: 1 },
+ *       ],
+ *     },
+ *   },
+ *   id: 'ordersApiCanary',
+ * });
+ * ```
+ */
+export declare function traefikService(config: Composable<TraefikResourceConfig<TraefikServiceSpec>>): Enhanced<TraefikServiceSpec, TraefikNoStatus>;
+/**
+ * Create a Traefik `ServersTransport`.
+ *
+ * Controls how Traefik dials the upstream: TLS trust, connection pooling and
+ * the forwarding timeouts. An edge fronting requests longer than Traefik's 60s
+ * default must raise `forwardingTimeouts.responseHeaderTimeout` here as well
+ * as the entrypoint's `respondingTimeouts`.
+ *
+ * @example
+ * ```typescript
+ * traefikServersTransport({
+ *   name: 'orders-api-slow',
+ *   namespace: 'edge',
+ *   spec: { forwardingTimeouts: { responseHeaderTimeout: '120s', idleConnTimeout: '150s' } },
+ *   id: 'ordersApiTransport',
+ * });
+ * ```
+ */
+export declare function traefikServersTransport(config: Composable<TraefikResourceConfig<TraefikServersTransportSpec>>): Enhanced<TraefikServersTransportSpec, TraefikNoStatus>;
+//# sourceMappingURL=routing.d.ts.map

package/dist/factories/traefik/resources/routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAGzE,OAAO,KAAK,EACV,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,qBAAqB,EAG3B,MAAM,aAAa,CAAC;AAErB,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,CAAC,qBAAqB,CAAC,uBAAuB,CAAC,CAAC,GACjE,QAAQ,CAAC,uBAAuB,EAAE,eAAe,CAAC,CAKpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,CAAC,qBAAqB,CAAC,0BAA0B,CAAC,CAAC,GACpE,QAAQ,CAAC,0BAA0B,EAAE,eAAe,CAAC,CAKvD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,GAC5D,QAAQ,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAK/C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,UAAU,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,CAAC,GACrE,QAAQ,CAAC,2BAA2B,EAAE,eAAe,CAAC,CAKxD"}

package/dist/factories/traefik/resources/routing.js

@@ -0,0 +1,119 @@
+/**
+ * Traefik routing resources: `IngressRoute`, `IngressRouteTCP`,
+ * `TraefikService` and `ServersTransport`.
+ *
+ * Every one of these kinds is status-less; see
+ * {@link traefikStatuslessReadinessEvaluator} for why they are registered as
+ * always-ready rather than condition-based.
+ */
+import { createResource } from '../../shared.js';
+import { TRAEFIK_API_VERSION } from '../constants.js';
+import { traefikResourceDefinition, traefikStatuslessReadinessEvaluator, } from './common.js';
+/**
+ * Create a Traefik `IngressRoute`.
+ *
+ * The HTTP router: it binds rule expressions on one or more entrypoints to
+ * backend services, with an ordered middleware chain and optional TLS.
+ *
+ * Set `ingressClassName` whenever the installation sets
+ * `providers.kubernetesCRD.ingressClass` — `traefikBootstrap` does, from
+ * `spec.ingressClass`. Traefik then processes only the CRDs whose class
+ * matches, which is what keeps two installations from stealing each other's
+ * routes; a route without it is silently ignored and the edge answers `404`.
+ *
+ * @example An authenticated, rate-limited API route terminating TLS
+ * ```typescript
+ * traefikIngressRoute({
+ *   name: 'orders-api',
+ *   namespace: 'edge',
+ *   spec: {
+ *     entryPoints: ['websecure'],
+ *     ingressClassName: 'traefik',
+ *     routes: [
+ *       {
+ *         match: 'Host(`api.example.com`) && PathPrefix(`/v1`)',
+ *         kind: 'Rule',
+ *         middlewares: [{ name: 'orders-api-authz' }, { name: 'orders-api-rate-limit' }],
+ *         services: [{ name: 'orders-api', port: 8080 }],
+ *       },
+ *     ],
+ *     tls: { secretName: 'orders-api-tls' },
+ *   },
+ *   id: 'ordersApiRoute',
+ * });
+ * ```
+ */
+export function traefikIngressRoute(config) {
+    return createResource(traefikResourceDefinition(TRAEFIK_API_VERSION, 'IngressRoute', config), { scope: 'namespaced' }).withReadinessEvaluator(traefikStatuslessReadinessEvaluator('IngressRoute'));
+}
+/**
+ * Create a Traefik `IngressRouteTCP`.
+ *
+ * The TCP router, matched on SNI. Use `tls.passthrough` to hand the TLS
+ * handshake to the backend instead of terminating it at the edge.
+ *
+ * @example
+ * ```typescript
+ * traefikIngressRouteTCP({
+ *   name: 'postgres',
+ *   namespace: 'edge',
+ *   spec: {
+ *     entryPoints: ['postgres'],
+ *     routes: [{ match: 'HostSNI(`db.example.com`)', services: [{ name: 'pg-rw', port: 5432 }] }],
+ *     tls: { passthrough: true },
+ *   },
+ *   id: 'postgresRoute',
+ * });
+ * ```
+ */
+export function traefikIngressRouteTCP(config) {
+    return createResource(traefikResourceDefinition(TRAEFIK_API_VERSION, 'IngressRouteTCP', config), { scope: 'namespaced' }).withReadinessEvaluator(traefikStatuslessReadinessEvaluator('IngressRouteTCP'));
+}
+/**
+ * Create a Traefik `TraefikService`.
+ *
+ * A composed backend — weighted round-robin, mirroring, failover, or highest
+ * random weight — referenced from a route with `kind: 'TraefikService'`.
+ *
+ * @example Canary split between two Deployments
+ * ```typescript
+ * traefikService({
+ *   name: 'orders-api-canary',
+ *   namespace: 'edge',
+ *   spec: {
+ *     weighted: {
+ *       services: [
+ *         { name: 'orders-api', port: 8080, weight: 9 },
+ *         { name: 'orders-api-next', port: 8080, weight: 1 },
+ *       ],
+ *     },
+ *   },
+ *   id: 'ordersApiCanary',
+ * });
+ * ```
+ */
+export function traefikService(config) {
+    return createResource(traefikResourceDefinition(TRAEFIK_API_VERSION, 'TraefikService', config), { scope: 'namespaced' }).withReadinessEvaluator(traefikStatuslessReadinessEvaluator('TraefikService'));
+}
+/**
+ * Create a Traefik `ServersTransport`.
+ *
+ * Controls how Traefik dials the upstream: TLS trust, connection pooling and
+ * the forwarding timeouts. An edge fronting requests longer than Traefik's 60s
+ * default must raise `forwardingTimeouts.responseHeaderTimeout` here as well
+ * as the entrypoint's `respondingTimeouts`.
+ *
+ * @example
+ * ```typescript
+ * traefikServersTransport({
+ *   name: 'orders-api-slow',
+ *   namespace: 'edge',
+ *   spec: { forwardingTimeouts: { responseHeaderTimeout: '120s', idleConnTimeout: '150s' } },
+ *   id: 'ordersApiTransport',
+ * });
+ * ```
+ */
+export function traefikServersTransport(config) {
+    return createResource(traefikResourceDefinition(TRAEFIK_API_VERSION, 'ServersTransport', config), { scope: 'namespaced' }).withReadinessEvaluator(traefikStatuslessReadinessEvaluator('ServersTransport'));
+}
+//# sourceMappingURL=routing.js.map

package/dist/factories/traefik/resources/routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.js","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAOtD,OAAO,EAEL,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,aAAa,CAAC;AAKrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAkE;IAElE,OAAO,cAAc,CACnB,yBAAyB,CAAC,mBAAmB,EAAE,cAAc,EAAE,MAAM,CAAC,EACtE,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,cAAc,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAqE;IAErE,OAAO,cAAc,CACnB,yBAAyB,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,CAAC,EACzE,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6D;IAE7D,OAAO,cAAc,CACnB,yBAAyB,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,CAAC,EACxE,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAsE;IAEtE,OAAO,cAAc,CACnB,yBAAyB,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAC1E,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACpF,CAAC"}