@r8s/harbor 0.2.1

package/dist/index.d.ts

@@ -0,0 +1,143 @@
+import { type DatabaseProps } from '@r8s/recipes';
+export interface HarborProps {
+    /** Release / chart name (defaults to 'harbor') */
+    name?: string;
+    /** Kubernetes namespace for the release + data (inherited from <Platform> unless set) */
+    namespace?: string;
+    /** Public registry hostname (required), e.g. 'registry.berget.ai' */
+    host: string;
+    /**
+     * Harbor chart version (defaults to the pinned '1.18.3'). Flux applies
+     * chart upgrades automatically on the repo interval — bump deliberately.
+     */
+    chartVersion?: string;
+    /** HelmRepository URL (defaults to https://helm.goharbor.io) */
+    repoUrl?: string;
+    /** Namespace the HelmRepository lives in (defaults to 'flux-system') */
+    repoNamespace?: string;
+    /**
+     * S3 (RustFS-compatible) registry blob storage — required. The Docker
+     * registry protocol cannot follow S3 307 redirects: `disableredirect`
+     * and path-style access (`VIRTUAL_HOSTED_STYLE=false`) are encoded
+     * unconditionally, and the credentials bundle carries both the
+     * `REGISTRY_STORAGE_S3_*` and `AWS_*` key aliases the chart/registry
+     * each read. Credentials are provisioned through the Platform secrets
+     * backend unless `credentialsSecret` references a pre-created Secret.
+     */
+    s3: {
+        bucket: string;
+        region: string;
+        endpoint: string;
+        /** Backend path (defaults to `<provider.path>/<name>`) */
+        path?: string;
+        /** Reference a pre-created credentials Secret instead of provisioning */
+        credentialsSecret?: string;
+    };
+    /**
+     * CNPG cluster name (defaults to 'harbor-db'). The bootstrap database
+     * is 'registry' owned by 'harbor' — chart `existingSecret` gets the
+     * CNPG-managed `<db>-app` secret (credentialsMode 'cnpg').
+     */
+    dbName?: string;
+    /** Number of CNPG instances (defaults to 2) */
+    dbInstances?: number;
+    /** CNPG data volume size (defaults to '40Gi' — registry metadata grows with blob count) */
+    dbStorage?: string;
+    /** CNPG storage class (defaults to cluster default) */
+    dbStorageClass?: string;
+    /**
+     * CNPG backup configuration. Credential provisioning differs from the
+     * Database recipe default: the store holds keys `accesskey`/`secretkey`
+     * which the bundled remap turns into the CNPG-required
+     * `access-key-id`/`secret-access-key` — path defaults to
+     * `<provider.path>/berget-internal-cnpg` (facit). Set
+     * `credentialsSecret` to reference an existing, correctly-keyed Secret
+     * instead.
+     */
+    backup?: Omit<DatabaseProps['backup'], 'credentialsSecret'> & {
+        credentialsSecret?: string;
+        /** Backend path for the remapped backup creds (defaults to `<provider.path>/berget-internal-cnpg`) */
+        credentialsPath?: string;
+    };
+    /** Reference a pre-created admin password Secret (key: HARBOR_ADMIN_PASSWORD) instead of provisioning */
+    adminPasswordSecretRef?: string;
+    /**
+     * Reference a pre-created HTTP secret-key bundle (key: secretKey,
+     * EXACTLY 16 chars) instead of provisioning. The chart rejects
+     * other lengths — keep the constraint when generating.
+     */
+    secretKeySecretRef?: string;
+    /**
+     * OIDC client credentials for Keycloak login. NOTE: Harbor has no
+     * declarative OIDC — provisioning this Secret is preparatory; apply the
+     * actual OIDC configuration via the Harbor UI/API after deploy.
+     */
+    oidc?: {
+        path?: string;
+    };
+    /** Reference a pre-created OIDC Secret (keys: oidc-client-id, oidc-client-secret) */
+    oidcSecretRef?: string;
+    /** Scanner (trivy) settings — enabled by default with facit resources */
+    trivy?: {
+        enabled?: boolean;
+        resources?: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+    };
+    /** Metrics: /metrics on port 8001 for core/registry/jobservice/exporter. `serviceMonitor` stays OFF — the cluster has no Prometheus CRDs. */
+    metrics?: {
+        enabled?: boolean;
+        serviceMonitor?: boolean;
+    };
+    /** TLS secret for the chart ingress (defaults to `harbor-tls` via letsencrypt-prod) */
+    tls?: {
+        secretName: string;
+        clusterIssuer: string;
+    };
+}
+/**
+ * Harbor — OCI artifact registry, facit-aligned via the official chart.
+ *
+ * @title Harbor
+ * @category Security & Identity
+ *
+ * The chart owns all app workloads (core/portal/registry/jobservice/redis/
+ * trivy/nginx ingress). This package owns the platform contract around it:
+ * - Flux `HelmRepository` + `HelmRelease` (pinned chart, facit values)
+ * - external CNPG cluster (`credentialsMode: 'cnpg'`; `<db>-app` secret is
+ *   the chart's `existingSecret`) + optional scheduled backups
+ * - S3 blob-storage credentials bundle with REGISTRY_STORAGE_S3_* + AWS_*
+ *   aliases, literal endpoint + path-style keys (RustFS trap: the registry
+ *   protocol cannot follow 307 redirects)
+ * - admin/secret-key/(optional) OIDC bundles via the Platform secrets
+ *   backend
+ *
+ * Encoded traps (learned from incidents — do not "fix" these):
+ * - `database.external.port` is the QUOTED STRING "5432" (chart bug)
+ * - ingress `proxy-body-size: "0"` — unlimited, large image layers
+ * - `updateStrategy.type: Recreate` — RWO jobLog PVC deadlocks rolling updates
+ * - `metrics.serviceMonitor.enabled: false` — no Prometheus CRDs on-cluster
+ * - OIDC is a manual post-deploy step; no declarative alternative exists
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Harbor } from '@r8s/harbor'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'secret', path: 'rustfs' }}>
+ *     <Harbor
+ *       host="registry.example.com"
+ *       s3={{ bucket: 'harbor-registry', region: 'berget-cloud', endpoint: 'https://s3.example.com' }}
+ *     />
+ *   </Platform>
+ * )
+ */
+export declare function Harbor(props: HarborProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAA;AAErB,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,EAAE,EAAE;QACF,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,0DAA0D;QAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,yEAAyE;QACzE,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;IACD;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2FAA2F;IAC3F,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,GAAG;QAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,sGAAsG;QACtG,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,yGAAyG;IACzG,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;OAIG;IACH,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,KAAK,CAAC,EAAE;QACN,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,SAAS,CAAC,EAAE;YACV,QAAQ,CAAC,EAAE;gBAAE,GAAG,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;YAC5C,MAAM,CAAC,EAAE;gBAAE,GAAG,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAC3C,CAAA;KACF,CAAA;IACD,6IAA6I;IAC7I,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACzD,uFAAuF;IACvF,GAAG,CAAC,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,kCA0TxC"}

package/dist/index.js

@@ -0,0 +1,295 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Harbor = Harbor;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const recipes_1 = require("@r8s/recipes");
+/**
+ * Harbor — OCI artifact registry, facit-aligned via the official chart.
+ *
+ * @title Harbor
+ * @category Security & Identity
+ *
+ * The chart owns all app workloads (core/portal/registry/jobservice/redis/
+ * trivy/nginx ingress). This package owns the platform contract around it:
+ * - Flux `HelmRepository` + `HelmRelease` (pinned chart, facit values)
+ * - external CNPG cluster (`credentialsMode: 'cnpg'`; `<db>-app` secret is
+ *   the chart's `existingSecret`) + optional scheduled backups
+ * - S3 blob-storage credentials bundle with REGISTRY_STORAGE_S3_* + AWS_*
+ *   aliases, literal endpoint + path-style keys (RustFS trap: the registry
+ *   protocol cannot follow 307 redirects)
+ * - admin/secret-key/(optional) OIDC bundles via the Platform secrets
+ *   backend
+ *
+ * Encoded traps (learned from incidents — do not "fix" these):
+ * - `database.external.port` is the QUOTED STRING "5432" (chart bug)
+ * - ingress `proxy-body-size: "0"` — unlimited, large image layers
+ * - `updateStrategy.type: Recreate` — RWO jobLog PVC deadlocks rolling updates
+ * - `metrics.serviceMonitor.enabled: false` — no Prometheus CRDs on-cluster
+ * - OIDC is a manual post-deploy step; no declarative alternative exists
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Harbor } from '@r8s/harbor'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'secret', path: 'rustfs' }}>
+ *     <Harbor
+ *       host="registry.example.com"
+ *       s3={{ bucket: 'harbor-registry', region: 'berget-cloud', endpoint: 'https://s3.example.com' }}
+ *     />
+ *   </Platform>
+ * )
+ */
+function Harbor(props) {
+    const { name = 'harbor', namespace: namespaceProp, host, chartVersion = '1.18.3', repoUrl = 'https://helm.goharbor.io', repoNamespace = 'flux-system', s3, dbName = 'harbor-db', dbInstances = 2, dbStorage = '40Gi', dbStorageClass, backup, adminPasswordSecretRef, secretKeySecretRef, oidc, oidcSecretRef, trivy, metrics, tls = { secretName: 'harbor-tls', clusterIssuer: 'letsencrypt-prod' }, } = props;
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const resources_ = [];
+    // --- S3 credentials bundle (chart + registry read DIFFERENT key sets) ------
+    const s3CredentialsName = s3.credentialsSecret ?? `${name}-s3-credentials`;
+    if (!s3.credentialsSecret) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Harbor', name, 'S3 credentials for registry blob storage (keys accesskey/secretkey in the store)', {
+                propName: 's3.credentialsSecret',
+                exampleValue: `${name}-s3-credentials`,
+                keys: ['REGISTRY_STORAGE_S3_ACCESSKEY', 'REGISTRY_STORAGE_S3_SECRETKEY'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-rustfs-s3-credentials`,
+            namespace,
+            path: s3.path ?? `${secretProvider.path ?? 'rustfs'}/${name}`,
+            secretName: s3CredentialsName,
+            // Chart needs REGISTRY_STORAGE_S3_*; registry tooling needs AWS_* —
+            // both map from the same store keys; endpoint + path-style are
+            // LITERAL templates (RustFS: no 307 redirects, no vhost buckets)
+            keys: {
+                REGISTRY_STORAGE_S3_ACCESSKEY: 'accesskey',
+                REGISTRY_STORAGE_S3_SECRETKEY: 'secretkey',
+                AWS_ACCESS_KEY_ID: 'accesskey',
+                AWS_SECRET_ACCESS_KEY: 'secretkey',
+            },
+            templates: {
+                AWS_ENDPOINTS: s3.endpoint,
+                VIRTUAL_HOSTED_STYLE: 'false',
+            },
+            refreshAfter: '3600s',
+        }));
+    }
+    // --- Admin + http secret key -------------------------------------------------
+    const adminSecretName = adminPasswordSecretRef ?? `${name}-admin-secret`;
+    if (!adminPasswordSecretRef) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Harbor', name, 'an admin password (key HARBOR_ADMIN_PASSWORD)', {
+                propName: 'adminPasswordSecretRef',
+                exampleValue: `${name}-admin-secret`,
+                keys: ['HARBOR_ADMIN_PASSWORD'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-admin-secret`,
+            namespace,
+            path: `${secretProvider.path ?? name}/${name}/admin`,
+            secretName: adminSecretName,
+            keys: ['HARBOR_ADMIN_PASSWORD'],
+        }));
+    }
+    const secretKeySecretName = secretKeySecretRef ?? `${name}-secret`;
+    if (!secretKeySecretRef) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Harbor', name, 'an HTTP secret key (key secretKey — EXACTLY 16 chars, the chart rejects other lengths)', {
+                propName: 'secretKeySecretRef',
+                exampleValue: `${name}-secret`,
+                keys: ['secretKey'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-secret`,
+            namespace,
+            path: `${secretProvider.path ?? name}/${name}/secret`,
+            secretName: secretKeySecretName,
+            keys: ['secretKey'],
+        }));
+    }
+    // --- OIDC bundle (manual post-deploy config on the Harbor side) -------------
+    if (oidc && !oidcSecretRef) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Harbor', name, 'OIDC client credentials because oidc is requested (keys oidc-client-id/oidc-client-secret)', {
+                propName: 'oidcSecretRef',
+                exampleValue: `${name}-keycloak-oidc`,
+                keys: ['oidc-client-id', 'oidc-client-secret'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-keycloak-oidc`,
+            namespace,
+            path: oidc.path ?? `${secretProvider.path ?? name}/${name}/keycloak-oidc`,
+            secretName: `${name}-keycloak-oidc`,
+            keys: ['oidc-client-id', 'oidc-client-secret'],
+        }));
+    }
+    // --- CNPG cluster (CNPG-managed credentials: the chart's existingSecret) -----
+    resources_.push((0, core_1.jsx)(recipes_1.Database, {
+        name: dbName,
+        namespace,
+        database: 'registry',
+        owner: 'harbor',
+        instances: dbInstances,
+        storage: dbStorage,
+        ...(dbStorageClass ? { storageClass: dbStorageClass } : {}),
+        parameters: {
+            shared_buffers: '256MB',
+            max_connections: '200',
+            work_mem: '8MB',
+            maintenance_work_mem: '128MB',
+            effective_cache_size: '768MB',
+        },
+        credentialsMode: 'cnpg',
+        ...(backup
+            ? {
+                backup: {
+                    ...backup,
+                    // Explicit reference wins; otherwise the package provisions
+                    // the remapped bundle below
+                    credentialsSecret: backup.credentialsSecret ?? `${name}-cnpg-backup`,
+                },
+            }
+            : {}),
+    }));
+    if (backup && !backup.credentialsSecret) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Harbor', name, 'backup credentials (store keys accesskey/secretkey → CNPG access-key-id/secret-access-key)', {
+                propName: 'backup.credentialsSecret',
+                exampleValue: `${name}-cnpg-backup`,
+                keys: ['access-key-id', 'secret-access-key'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-cnpg-backup`,
+            namespace,
+            path: backup.credentialsPath ?? `${secretProvider.path}/berget-internal-cnpg`,
+            secretName: `${name}-cnpg-backup`,
+            // The store uses camelCase keys; CNPG requires kebab-case
+            keys: { 'access-key-id': 'accesskey', 'secret-access-key': 'secretkey' },
+            refreshAfter: '3600s',
+            // No restart targets — barman reads credentials per backup run
+        }));
+    }
+    // --- Flux: HelmRepository + HelmRelease (facit values, traps encoded) --------
+    resources_.push((0, core_1.jsx)('HelmRepository', {
+        apiVersion: 'source.toolkit.fluxcd.io/v1',
+        kind: 'HelmRepository',
+        metadata: { name, namespace: repoNamespace },
+        spec: { interval: '24h', url: repoUrl },
+    }), (0, core_1.jsx)('HelmRelease', {
+        apiVersion: 'helm.toolkit.fluxcd.io/v2',
+        kind: 'HelmRelease',
+        metadata: { name, namespace },
+        spec: {
+            interval: '30m',
+            chart: {
+                spec: {
+                    chart: 'harbor',
+                    version: chartVersion,
+                    sourceRef: { kind: 'HelmRepository', name, namespace: repoNamespace },
+                    interval: '12h',
+                },
+            },
+            values: {
+                externalURL: `https://${host}`,
+                expose: {
+                    type: 'ingress',
+                    tls: { enabled: true, certSource: 'secret', secret: { secretName: tls.secretName } },
+                    ingress: {
+                        hosts: { core: host },
+                        className: 'nginx',
+                        annotations: {
+                            'cert-manager.io/cluster-issuer': tls.clusterIssuer,
+                            'external-dns.alpha.kubernetes.io/hostname': host,
+                            'nginx.ingress.kubernetes.io/ssl-redirect': 'true',
+                            // TRAP: "0" = unlimited — large image layers; any size
+                            // limit breaks `docker push` with 413
+                            'nginx.ingress.kubernetes.io/proxy-body-size': '0',
+                        },
+                    },
+                },
+                existingSecretAdminPassword: adminSecretName,
+                existingSecretAdminPasswordKey: 'HARBOR_ADMIN_PASSWORD',
+                existingSecretSecretKey: secretKeySecretName,
+                persistence: {
+                    enabled: true,
+                    resourcePolicy: 'keep',
+                    imageChartStorage: {
+                        type: 's3',
+                        // TRAP: the registry protocol cannot follow S3 307 redirects —
+                        // stream blobs server-side (RustFS requirement)
+                        disableredirect: true,
+                        s3: {
+                            region: s3.region,
+                            bucket: s3.bucket,
+                            regionendpoint: s3.endpoint,
+                            secure: true,
+                            v4auth: true,
+                            existingSecret: s3CredentialsName,
+                        },
+                    },
+                    // PVCs only for jobLog/redis/trivy — registry blobs live in S3,
+                    // database lives in CNPG (by design)
+                    persistentVolumeClaim: {
+                        jobservice: {
+                            jobLog: {
+                                size: '5Gi',
+                                ...(dbStorageClass ? { storageClass: dbStorageClass } : {}),
+                            },
+                        },
+                        redis: { size: '2Gi', ...(dbStorageClass ? { storageClass: dbStorageClass } : {}) },
+                        trivy: { size: '10Gi', ...(dbStorageClass ? { storageClass: dbStorageClass } : {}) },
+                    },
+                },
+                database: {
+                    type: 'external',
+                    external: {
+                        host: `${dbName}-rw`,
+                        // TRAP: must be a QUOTED string — numeric breaks the chart
+                        // template (renders unquoted)
+                        port: String(5432),
+                        username: 'harbor',
+                        password: '',
+                        coreDatabase: 'registry',
+                        existingSecret: `${dbName}-app`,
+                        sslmode: 'disable',
+                    },
+                },
+                redis: { type: 'internal' },
+                core: { replicas: 1 },
+                portal: { replicas: 1 },
+                registry: { replicas: 1 },
+                jobservice: { replicas: 1 },
+                // TRAP: RWO jobLog PVC deadlocks rolling updates on multi-node
+                updateStrategy: { type: 'Recreate' },
+                trivy: {
+                    enabled: trivy?.enabled !== false,
+                    replicas: 1,
+                    resources: trivy?.resources ?? {
+                        requests: { cpu: '200m', memory: '512Mi' },
+                        limits: { cpu: '1', memory: '1Gi' },
+                    },
+                },
+                metrics: {
+                    enabled: metrics?.enabled !== false,
+                    core: { path: '/metrics', port: 8001 },
+                    registry: { path: '/metrics', port: 8001 },
+                    jobservice: { path: '/metrics', port: 8001 },
+                    exporter: { path: '/metrics', port: 8001 },
+                    // TRAP: Prometheus CRDs (ServiceMonitor) are absent on-cluster
+                    serviceMonitor: { enabled: metrics?.serviceMonitor === true },
+                },
+                ipFamily: 'ipv4',
+                logLevel: 'info',
+            },
+        },
+    }));
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources_ });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;AA4IA,wBA0TC;AAtcD,oCAAqD;AACrD,iDAAgE;AAChE,0CAMqB;AA+FrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,SAAgB,MAAM,CAAC,KAAkB;IACvC,MAAM,EACJ,IAAI,GAAG,QAAQ,EACf,SAAS,EAAE,aAAa,EACxB,IAAI,EACJ,YAAY,GAAG,QAAQ,EACvB,OAAO,GAAG,0BAA0B,EACpC,aAAa,GAAG,aAAa,EAC7B,EAAE,EACF,MAAM,GAAG,WAAW,EACpB,WAAW,GAAG,CAAC,EACf,SAAS,GAAG,MAAM,EAClB,cAAc,EACd,MAAM,EACN,sBAAsB,EACtB,kBAAkB,EAClB,IAAI,EACJ,aAAa,EACb,KAAK,EACL,OAAO,EACP,GAAG,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,GACtE,GAAG,KAAK,CAAA;IAET,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,UAAU,GAA6B,EAAE,CAAA;IAE/C,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,EAAE,CAAC,iBAAiB,IAAI,GAAG,IAAI,iBAAiB,CAAA;IAC1E,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,QAAQ,EACR,IAAI,EACJ,kFAAkF,EAClF;gBACE,QAAQ,EAAE,sBAAsB;gBAChC,YAAY,EAAE,GAAG,IAAI,iBAAiB;gBACtC,IAAI,EAAE,CAAC,+BAA+B,EAAE,+BAA+B,CAAC;aACzE,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,wBAAwB;YACrC,SAAS;YACT,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,cAAc,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE;YAC7D,UAAU,EAAE,iBAAiB;YAC7B,oEAAoE;YACpE,+DAA+D;YAC/D,iEAAiE;YACjE,IAAI,EAAE;gBACJ,6BAA6B,EAAE,WAAW;gBAC1C,6BAA6B,EAAE,WAAW;gBAC1C,iBAAiB,EAAE,WAAW;gBAC9B,qBAAqB,EAAE,WAAW;aACnC;YACD,SAAS,EAAE;gBACT,aAAa,EAAE,EAAE,CAAC,QAAQ;gBAC1B,oBAAoB,EAAE,OAAO;aAC9B;YACD,YAAY,EAAE,OAAO;SACtB,CAAC,CACH,CAAA;IACH,CAAC;IAED,gFAAgF;IAChF,MAAM,eAAe,GAAG,sBAAsB,IAAI,GAAG,IAAI,eAAe,CAAA;IACxE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EAAC,QAAQ,EAAE,IAAI,EAAE,+CAA+C,EAAE;gBAC1F,QAAQ,EAAE,wBAAwB;gBAClC,YAAY,EAAE,GAAG,IAAI,eAAe;gBACpC,IAAI,EAAE,CAAC,uBAAuB,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,eAAe;YAC5B,SAAS;YACT,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,QAAQ;YACpD,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,CAAC,uBAAuB,CAAC;SAChC,CAAC,CACH,CAAA;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,kBAAkB,IAAI,GAAG,IAAI,SAAS,CAAA;IAClE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,QAAQ,EACR,IAAI,EACJ,wFAAwF,EACxF;gBACE,QAAQ,EAAE,oBAAoB;gBAC9B,YAAY,EAAE,GAAG,IAAI,SAAS;gBAC9B,IAAI,EAAE,CAAC,WAAW,CAAC;aACpB,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,SAAS;YACtB,SAAS;YACT,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,SAAS;YACrD,UAAU,EAAE,mBAAmB;YAC/B,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CACH,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,QAAQ,EACR,IAAI,EACJ,4FAA4F,EAC5F;gBACE,QAAQ,EAAE,eAAe;gBACzB,YAAY,EAAE,GAAG,IAAI,gBAAgB;gBACrC,IAAI,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;aAC/C,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,gBAAgB;YAC7B,SAAS;YACT,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,gBAAgB;YACzE,UAAU,EAAE,GAAG,IAAI,gBAAgB;YACnC,IAAI,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;SAC/C,CAAC,CACH,CAAA;IACH,CAAC;IAED,gFAAgF;IAChF,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,IAAI,EAAE,MAAM;QACZ,SAAS;QACT,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,WAAW;QACtB,OAAO,EAAE,SAAS;QAClB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,UAAU,EAAE;YACV,cAAc,EAAE,OAAO;YACvB,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,KAAK;YACf,oBAAoB,EAAE,OAAO;YAC7B,oBAAoB,EAAE,OAAO;SAC9B;QACD,eAAe,EAAE,MAAM;QACvB,GAAG,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,GAAG,MAAM;oBACT,4DAA4D;oBAC5D,4BAA4B;oBAC5B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,GAAG,IAAI,cAAc;iBACrE;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CACH,CAAA;IAED,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACxC,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,QAAQ,EACR,IAAI,EACJ,4FAA4F,EAC5F;gBACE,QAAQ,EAAE,0BAA0B;gBACpC,YAAY,EAAE,GAAG,IAAI,cAAc;gBACnC,IAAI,EAAE,CAAC,eAAe,EAAE,mBAAmB,CAAC;aAC7C,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,cAAc;YAC3B,SAAS;YACT,IAAI,EAAE,MAAM,CAAC,eAAe,IAAI,GAAG,cAAc,CAAC,IAAI,uBAAuB;YAC7E,UAAU,EAAE,GAAG,IAAI,cAAc;YACjC,0DAA0D;YAC1D,IAAI,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE;YACxE,YAAY,EAAE,OAAO;YACrB,+DAA+D;SAChE,CAAC,CACH,CAAA;IACH,CAAC;IAED,gFAAgF;IAChF,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,gBAAgB,EAAE;QACpB,UAAU,EAAE,6BAA6B;QACzC,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE;QAC5C,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;KACxC,CAAC,EACF,IAAA,UAAG,EAAC,aAAa,EAAE;QACjB,UAAU,EAAE,2BAA2B;QACvC,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE;gBACL,IAAI,EAAE;oBACJ,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,YAAY;oBACrB,SAAS,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE;oBACrE,QAAQ,EAAE,KAAK;iBAChB;aACF;YACD,MAAM,EAAE;gBACN,WAAW,EAAE,WAAW,IAAI,EAAE;gBAC9B,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE;oBACpF,OAAO,EAAE;wBACP,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;wBACrB,SAAS,EAAE,OAAO;wBAClB,WAAW,EAAE;4BACX,gCAAgC,EAAE,GAAG,CAAC,aAAa;4BACnD,2CAA2C,EAAE,IAAI;4BACjD,0CAA0C,EAAE,MAAM;4BAClD,uDAAuD;4BACvD,sCAAsC;4BACtC,6CAA6C,EAAE,GAAG;yBACnD;qBACF;iBACF;gBACD,2BAA2B,EAAE,eAAe;gBAC5C,8BAA8B,EAAE,uBAAuB;gBACvD,uBAAuB,EAAE,mBAAmB;gBAC5C,WAAW,EAAE;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,MAAM;oBACtB,iBAAiB,EAAE;wBACjB,IAAI,EAAE,IAAI;wBACV,+DAA+D;wBAC/D,gDAAgD;wBAChD,eAAe,EAAE,IAAI;wBACrB,EAAE,EAAE;4BACF,MAAM,EAAE,EAAE,CAAC,MAAM;4BACjB,MAAM,EAAE,EAAE,CAAC,MAAM;4BACjB,cAAc,EAAE,EAAE,CAAC,QAAQ;4BAC3B,MAAM,EAAE,IAAI;4BACZ,MAAM,EAAE,IAAI;4BACZ,cAAc,EAAE,iBAAiB;yBAClC;qBACF;oBACD,gEAAgE;oBAChE,qCAAqC;oBACrC,qBAAqB,EAAE;wBACrB,UAAU,EAAE;4BACV,MAAM,EAAE;gCACN,IAAI,EAAE,KAAK;gCACX,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC5D;yBACF;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;wBACnF,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;qBACrF;iBACF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE;wBACR,IAAI,EAAE,GAAG,MAAM,KAAK;wBACpB,2DAA2D;wBAC3D,8BAA8B;wBAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;wBAClB,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,EAAE;wBACZ,YAAY,EAAE,UAAU;wBACxB,cAAc,EAAE,GAAG,MAAM,MAAM;wBAC/B,OAAO,EAAE,SAAS;qBACnB;iBACF;gBACD,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;gBAC3B,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;gBACvB,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;gBACzB,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;gBAC3B,+DAA+D;gBAC/D,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;gBACpC,KAAK,EAAE;oBACL,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,KAAK;oBACjC,QAAQ,EAAE,CAAC;oBACX,SAAS,EAAE,KAAK,EAAE,SAAS,IAAI;wBAC7B,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;wBAC1C,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;qBACpC;iBACF;gBACD,OAAO,EAAE;oBACP,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK;oBACnC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;oBACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;oBAC1C,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;oBAC5C,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;oBAC1C,+DAA+D;oBAC/D,cAAc,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,EAAE;iBAC9D;gBACD,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,MAAM;aACjB;SACF;KACF,CAAC,CACH,CAAA;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@r8s/harbor",
+  "version": "0.2.1",
+  "description": "Harbor container registry — chart release via Flux, CNPG persistence, S3 blob storage for r8s",
+  "license": "MIT",
+  "author": "Berget AI AB",
+  "homepage": "https://r8s.berget.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/berget-ai/r8s.git",
+    "directory": "packages/harbor"
+  },
+  "bugs": "https://github.com/berget-ai/r8s/issues",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "harbor"
+  ],
+  "r8s": {
+    "category": "Security & Identity"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsc --build",
+    "test": "vitest run",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
+  },
+  "dependencies": {
+    "@r8s/core": "^0.2.0",
+    "@r8s/crds": "^0.2.0",
+    "@r8s/k8s-types": "^0.2.0",
+    "@r8s/recipes": "^0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0",
+    "vitest": "^1.0.0"
+  }
+}