APIKey is a machine credential: an OAuth2 client (client_credentials grant) in the platform's Hydra (docs/auth.md). The caller exchanges id+secret for

APIKeyStore is Core's seam to the OAuth2 client registry — Hydra's admin API in production (NewHydraAPIKeys), a fake in tests. Core depends on this na

+kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.status.phase` +kubebuilder:

+kubebuilder:object:root=true AppList contains a list of App

AppPhase mirrors the lifecycle state machine (211.09 §Agent Lifecycle). +kubebuilder:validation:Enum=Pending;Building;Deploying;Running;Hibernated;Fai

AppReconciler reconciles an App: resolve an image (prebuilt or built from git) and run it as a revision on the selected runtime, recording status.

EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN! NOTE: json tags are required. Any new fields you add must have json tags for the fields to be se

AppStatus is the observed state of a App.

AppView is the neutral, bex-native projection of an App — spec intent + observed status. Core returns this; each adapter maps it to its own wire forma

Core is the shared domain layer. Every product action lives here exactly once; REST and GraphQL are presentation only.

CreatePostgresRequest is the POST /v1/postgres body (bex subset of Render's).

+kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.status.phase` +kubebuilder:

+kubebuilder:object:root=true DatabaseList contains a list of Database.

DatabasePhase mirrors the provisioning lifecycle. +kubebuilder:validation:Enum=Pending;Provisioning;Ready;Failed

DatabaseReconciler projects a Database into a CloudNativePG Cluster and surfaces the connection info. Optionally exposes an external SNI endpoint via

DatabaseSpec is the desired state of a managed PostgreSQL — the Render-style "add a Postgres" unit. The operator projects it to a CloudNativePG Cluste

DatabaseStatus is the observed state of a Database.

Identity is the authenticated caller: an OAuth2 client (API key) validated by Hydra introspection or a Kratos identity validated by its session. Subje

LogEntry is one log line in Render's log shape: a timestamp, the message, and a label set. Render tags every entry with labels (instance/type/...); be

LogQuery is the resolved filter set for QueryLogs / FollowLogs.

MetricPoint is one (timestamp, value) sample of a series.

MetricQuery is the resolved request for the Metrics verb, shared by every adapter. Metric selects which series to return; the rest are filters/options

MetricSeries is one labeled time-series — Render's metrics shape. Labels identify the series (e.g. instance, resource, status); Unit names the value's

OpenSandbox is a client for one OpenSandbox server.

PodLogSource fetches the raw (timestamped) log stream for one pod container. Core depends on this narrow function instead of a full client-go clientse

PodLogStream streams a pod container's logs live (Follow:true) until ctx is cancelled. It is PodLogSource's tail-follow sibling — kept separate so Cor

PodResourceUsage is one pod's current CPU/memory usage — a metrics-server snapshot. CPUCores is fractional vCPU, MemoryBytes is bytes; Timestamp is th

PostgresConnectionInfo mirrors Render's postgresConnectionInfo schema.

postgres.go extends Core with managed-Postgres methods over the Database CR, mirroring Render's /v1/postgres API. Same one-Core design: REST and Graph

RequestMetricsRequest is the backend-neutral request-metric ask handed to a RequestMetricsSource. The source (Prometheus over Traefik) owns the query

RequestMetricsSource returns request time-series for an App from the ingress metrics backend (Traefik scraped by Prometheus). nil => request metrics r

ResourceMetricsSource returns the current per-pod usage for an App's pods. Core depends on this narrow function instead of the metrics-server clientse

Server wires the adapters (REST + GraphQL + MCP) over one Core and one auth gate. All surfaces mount on the same mux, share the auth middleware, and c

Target is how the edge reaches a sandbox: host:port plus a path prefix (e.g. /proxy/3000 for OpenSandbox's per-sandbox endpoint).

dbPlan is one entry in the managed-Postgres plan catalog: a fixed allocation, exactly like the compute tier ladder. MVP plans are single-instance and

fakeKeyStore is the in-memory APIKeyStore for adapter tests.

getMetricsArgs mirrors Render's get_metrics: a required `resource` array of service ids and `metricTypes` (bex metric ids: cpu / memory / instance_cou

hydraAPIKeys implements APIKeyStore over Hydra's admin API.

hydraClient is the subset of Hydra's OAuth2 client object bex reads/writes.

listLogsArgs mirrors Render's list_logs: a required `resource` array of service ids and an optional `limit`. bex omits Render's structured-log filters

listServicesResult wraps the array — MCP tool outputs must be JSON objects.

oryAuth validates real credentials against the Ory substrate (docs/auth.md): a bearer token is introspected at Hydra's admin endpoint; otherwise an Or

podMetricsList is the subset of metrics.k8s.io/v1beta1 PodMetricsList bex reads: per-pod, per-container usage as Quantity strings ("12m" CPU, "34Mi" m

promRangeResponse is the subset of Prometheus's query_range result bex reads.

renderLabel is Render's logLabel ({name, value}); the REST logs API returns labels as an ordered array rather than Core's map.

renderLog is Render's public-API log object (id/message/timestamp/labels all required by the spec).

renderLogList is the logs envelope; Render marks all four fields required, so all four keys are always present. The cursors bound the returned batch:

--- Metrics (Render metrics-API shape) --- Render's metrics endpoints return an array of time-series, each with a `labels` array ({field, value}), a

renderMetricSeries is one element of a Render metrics response array.

renderService mirrors components.schemas.service (the fields bex has a real equivalent for) plus bex-native extras.

serviceArgs is the shared single-service argument. Render's tools key on `serviceId` (see get_service / list_deploys); for bex that id is the App name

serviceWithCursor is components.schemas.serviceWithCursor — the list-item envelope. Render's GET /v1/services returns an array of these.

tokenRequest is a simplified representation of the Kubernetes TokenRequest API response, containing only the token field that we need to extract.