Retire the hand-maintained NebariApp field reference

README.md

@@ -175,7 +175,7 @@ software-pack-template/
     Makefile                     # Local dev with full Nebari stack on kind
     .cache/                      # (gitignored) Cloned nebari-operator scripts
   docs/
-    nebariapp-crd-reference.md   # Full NebariApp field reference
+    nebariapp-crd-reference.md   # Where the contract and field reference live
     auth-flow.md                 # Authentication flow details
   .gitignore
   .editorconfig
@@ -250,8 +250,8 @@ deploying standalone, simply skip that file or exclude it from your apply comman
 ### Beyond the basics
 
 The fields shown above cover the common cases. The operator also supports several
-more specialized features. Each is documented in
-[docs/nebariapp-crd-reference.md](docs/nebariapp-crd-reference.md):
+more specialized features. Each is documented in the
+[NebariApp API reference](https://github.com/nebari-dev/nebari-operator/blob/main/docs/api-reference.md), generated from the operator's Go types:
 
 - **`routing.publicRoutes`** - paths that bypass OIDC auth (e.g., `/healthz`,
   webhooks, public APIs).
@@ -277,7 +277,8 @@ more specialized features. Each is documented in
 - **`service.namespace`** - point the NebariApp at a Service in a different
   namespace.
 
-For the complete field reference, see [docs/nebariapp-crd-reference.md](docs/nebariapp-crd-reference.md).
+For the complete field reference, see the [NebariApp API reference](https://github.com/nebari-dev/nebari-operator/blob/main/docs/api-reference.md). For what a pack
+has to satisfy, see the [Nebari Pack Specification](https://github.com/nebari-dev/nebari-operator/blob/main/docs/pack-specification.md).
 
 ## Example 1: Vanilla YAML (Plain Manifests)
 

docs/auth-flow.md

@@ -356,16 +356,16 @@ for the complete configuration.
 
 ## NebariApp CRD vs Envoy Gateway SecurityPolicy
 
-The fields documented in [nebariapp-crd-reference.md](nebariapp-crd-reference.md) are the
+The fields documented in the [NebariApp API reference](https://github.com/nebari-dev/nebari-operator/blob/main/docs/api-reference.md) are the
 fields the **operator** understands - they go on `spec.auth` of the NebariApp resource.
 At runtime, the operator generates an Envoy Gateway `SecurityPolicy` from the NebariApp,
 and that SecurityPolicy has its own (much larger) set of OIDC tuning knobs.
 
 This section is specifically about the **Envoy Gateway SecurityPolicy OIDC
 filter** fields. Other Keycloak-side or client-provisioning features (`spaClient`,
 `deviceFlowClient`, `keycloakConfig`, `tokenExchange`) are first-class NebariApp
-fields and are documented in
-[nebariapp-crd-reference.md](nebariapp-crd-reference.md).
+fields and are documented in the
+[NebariApp API reference](https://github.com/nebari-dev/nebari-operator/blob/main/docs/api-reference.md).
 
 For the OIDC filter fields specifically, mentally place each one in one of these
 buckets:

docs/site/src/content/docs/auth-flow.md

@@ -350,7 +350,7 @@ Your app then configures its OAuth provider using these environment variables.
 
 ## NebariApp CRD vs Envoy Gateway SecurityPolicy
 
-The fields documented in the [NebariApp CRD Reference](/nebariapp-crd-reference/) are
+The fields documented in the [NebariApp API reference](https://github.com/nebari-dev/nebari-operator/blob/main/docs/api-reference.md) are
 the fields the **operator** understands - they go on `spec.auth` of the NebariApp
 resource. At runtime, the operator generates an Envoy Gateway `SecurityPolicy` from
 the NebariApp, and that SecurityPolicy has its own (much larger) set of OIDC tuning

docs/site/src/content/docs/build-your-own.md

@@ -48,6 +48,6 @@ Packs do not need to be public. Put yours in a private GitHub repo, an internal
 
 ## Going deeper
 
-- [NebariApp CRD reference](/nebariapp-crd-reference/) - every field explained
+- [Nebari Pack Specification](https://github.com/nebari-dev/nebari-operator/blob/main/docs/pack-specification.md) - what a pack must satisfy, and where every field is documented
 - [Authentication flow](/auth-flow/) - how OIDC works end-to-end, including reading the IdToken in your app
 - [Release readiness](/release-readiness/) - maturity levels and the promotion checklist for official packs

docs/site/src/content/docs/index.md

@@ -13,7 +13,7 @@ A software pack is a Kubernetes application bundled with a `NebariApp` custom re
 
 ## Reference pages
 
-- **[NebariApp CRD reference](/nebariapp-crd-reference/)** - complete field-by-field reference for the `NebariApp` custom resource
+- **[NebariApp CRD reference](/nebariapp-crd-reference/)** - where the `NebariApp` contract and its generated field reference live, both maintained with the operator
 - **[Authentication flow](/auth-flow/)** - how OIDC works end-to-end; reading the IdToken in your app
 - **[Release readiness](/release-readiness/)** - maturity levels and the promotion checklist for first-party packs