typekro 0.27.1 → 0.28.0

package/dist/factories/harbor/provider/kubernetes-secret-store.d.ts

@@ -0,0 +1,12 @@
+import type { V1ConfigMap, V1Secret } from '@kubernetes/client-node';
+import { type KubernetesClientConfig } from '../../../core/kubernetes/client-provider.js';
+/** Narrow Kubernetes boundary used by Harbor preparation and straightforward to fake in tests. */
+export interface HarborKubernetesStore {
+    readSecret(namespace: string, name: string): Promise<V1Secret | undefined>;
+    readConfigMap(namespace: string, name: string): Promise<V1ConfigMap | undefined>;
+    upsertSecret(secret: V1Secret): Promise<void>;
+    deleteSecret(namespace: string, name: string): Promise<void>;
+}
+/** Create a deployment-scoped Kubernetes store for one selected context. */
+export declare function createHarborKubernetesStore(config?: KubernetesClientConfig): HarborKubernetesStore;
+//# sourceMappingURL=kubernetes-secret-store.d.ts.map

package/dist/factories/harbor/provider/kubernetes-secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes-secret-store.d.ts","sourceRoot":"","sources":["../../../../src/factories/harbor/provider/kubernetes-secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,6CAA6C,CAAC;AAErD,kGAAkG;AAClG,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC3E,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACjF,YAAY,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,4EAA4E;AAC5E,wBAAgB,2BAA2B,CACzC,MAAM,GAAE,sBAA2B,GAClC,qBAAqB,CAsDvB"}

package/dist/factories/harbor/provider/kubernetes-secret-store.js

@@ -0,0 +1,81 @@
+import { createKubernetesClientProvider, } from '../../../core/kubernetes/client-provider.js';
+/** Create a deployment-scoped Kubernetes store for one selected context. */
+export function createHarborKubernetesStore(config = {}) {
+    const api = createKubernetesClientProvider(config).getCoreV1Api();
+    return {
+        async readSecret(namespace, name) {
+            try {
+                return await api.readNamespacedSecret({ namespace, name });
+            }
+            catch (error) {
+                if (isNotFound(error))
+                    return undefined;
+                throw error;
+            }
+        },
+        async readConfigMap(namespace, name) {
+            try {
+                return await api.readNamespacedConfigMap({ namespace, name });
+            }
+            catch (error) {
+                if (isNotFound(error))
+                    return undefined;
+                throw error;
+            }
+        },
+        async upsertSecret(secret) {
+            const namespace = requiredMetadata(secret.metadata?.namespace, 'Secret namespace');
+            const name = requiredMetadata(secret.metadata?.name, 'Secret name');
+            let existing;
+            try {
+                existing = await api.readNamespacedSecret({ namespace, name });
+            }
+            catch (error) {
+                if (!isNotFound(error))
+                    throw error;
+            }
+            if (!existing) {
+                await api.createNamespacedSecret({ namespace, body: secret });
+                return;
+            }
+            await api.replaceNamespacedSecret({
+                namespace,
+                name,
+                body: {
+                    ...secret,
+                    metadata: {
+                        ...secret.metadata,
+                        ...(existing.metadata?.resourceVersion
+                            ? { resourceVersion: existing.metadata.resourceVersion }
+                            : {}),
+                    },
+                },
+            });
+        },
+        async deleteSecret(namespace, name) {
+            try {
+                await api.deleteNamespacedSecret({ namespace, name });
+            }
+            catch (error) {
+                if (!isNotFound(error))
+                    throw error;
+            }
+        },
+    };
+}
+function requiredMetadata(value, label) {
+    if (!value)
+        throw new Error(`${label} is required.`);
+    return value;
+}
+function isNotFound(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const candidate = error;
+    return (candidate.code === 404 ||
+        candidate.statusCode === 404 ||
+        candidate.response?.statusCode === 404 ||
+        candidate.response?.status === 404 ||
+        candidate.body?.code === 404);
+}
+//# sourceMappingURL=kubernetes-secret-store.js.map

package/dist/factories/harbor/provider/kubernetes-secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes-secret-store.js","sourceRoot":"","sources":["../../../../src/factories/harbor/provider/kubernetes-secret-store.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,8BAA8B,GAE/B,MAAM,6CAA6C,CAAC;AAUrD,4EAA4E;AAC5E,MAAM,UAAU,2BAA2B,CACzC,SAAiC,EAAE;IAEnC,MAAM,GAAG,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,CAAC;IAClE,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI;YAC9B,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,UAAU,CAAC,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI;YACjC,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,UAAU,CAAC,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YACpE,IAAI,QAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YACtC,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,GAAG,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC,uBAAuB,CAAC;gBAChC,SAAS;gBACT,IAAI;gBACJ,IAAI,EAAE;oBACJ,GAAG,MAAM;oBACT,QAAQ,EAAE;wBACR,GAAG,MAAM,CAAC,QAAQ;wBAClB,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe;4BACpC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE;4BACxD,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YACtC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,KAAa;IAChE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAKjB,CAAC;IACF,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,GAAG;QACtB,SAAS,CAAC,UAAU,KAAK,GAAG;QAC5B,SAAS,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG;QACtC,SAAS,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG;QAClC,SAAS,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG,CAC7B,CAAC;AACJ,CAAC"}

package/dist/factories/harbor/provider/rook-s3-binding.d.ts

@@ -0,0 +1,30 @@
+import type { KubernetesClientConfig } from '../../../core/kubernetes/client-provider.js';
+import { type HarborKubernetesStore } from './kubernetes-secret-store.js';
+export interface PrepareHarborRookS3BindingOptions {
+    sourceNamespace: string;
+    claimName: string;
+    targetNamespace: string;
+    targetSecretName: string;
+    secure?: boolean;
+    endpointOverride?: string;
+    regionOverride?: string;
+    rootDirectory?: string;
+    kubeConfig?: KubernetesClientConfig;
+    store?: HarborKubernetesStore;
+}
+export interface PreparedHarborRookS3Binding {
+    bucket: string;
+    region: string;
+    regionEndpoint: string;
+    existingSecret: string;
+    secure: boolean;
+    rootDirectory?: string;
+}
+/**
+ * Adapt a bound Rook OBC Secret to Harbor's official S3 Secret contract.
+ *
+ * Encoded credential bytes are copied directly between Kubernetes Secrets. They are never decoded,
+ * returned, logged, or inserted into a TypeKro graph.
+ */
+export declare function prepareHarborRookS3Binding(options: PrepareHarborRookS3BindingOptions): Promise<PreparedHarborRookS3Binding>;
+//# sourceMappingURL=rook-s3-binding.d.ts.map

package/dist/factories/harbor/provider/rook-s3-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rook-s3-binding.d.ts","sourceRoot":"","sources":["../../../../src/factories/harbor/provider/rook-s3-binding.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,2BAA2B,CAAC,CA4DtC"}

package/dist/factories/harbor/provider/rook-s3-binding.js

@@ -0,0 +1,74 @@
+import { createHarborKubernetesStore, } from './kubernetes-secret-store.js';
+/**
+ * Adapt a bound Rook OBC Secret to Harbor's official S3 Secret contract.
+ *
+ * Encoded credential bytes are copied directly between Kubernetes Secrets. They are never decoded,
+ * returned, logged, or inserted into a TypeKro graph.
+ */
+export async function prepareHarborRookS3Binding(options) {
+    const store = options.store ?? createHarborKubernetesStore(options.kubeConfig);
+    const [credentials, connection] = await Promise.all([
+        store.readSecret(options.sourceNamespace, options.claimName),
+        store.readConfigMap(options.sourceNamespace, options.claimName),
+    ]);
+    if (!credentials) {
+        throw new Error(`Rook OBC credential Secret ${options.sourceNamespace}/${options.claimName} is not available.`);
+    }
+    if (!connection) {
+        throw new Error(`Rook OBC connection ConfigMap ${options.sourceNamespace}/${options.claimName} is not available.`);
+    }
+    const accessKey = requiredSecretKey(credentials, 'AWS_ACCESS_KEY_ID');
+    const secretKey = requiredSecretKey(credentials, 'AWS_SECRET_ACCESS_KEY');
+    const bucket = requiredConfig(connection.data, 'BUCKET_NAME');
+    const secure = options.secure ?? false;
+    const host = requiredConfig(connection.data, 'BUCKET_HOST');
+    const port = connection.data?.BUCKET_PORT;
+    const regionEndpoint = options.endpointOverride ?? `${secure ? 'https' : 'http'}://${host}${port ? `:${port}` : ''}`;
+    const configuredRegion = options.regionOverride ?? connection.data?.BUCKET_REGION;
+    // Rook emits BUCKET_REGION as an empty string for RGW installations without
+    // an explicit zonegroup region. Harbor's distribution registry rejects an
+    // empty region, so normalize both missing and blank provider values to the
+    // conventional S3 default.
+    const region = configuredRegion?.trim() || 'us-east-1';
+    const adapted = {
+        apiVersion: 'v1',
+        kind: 'Secret',
+        metadata: {
+            name: options.targetSecretName,
+            namespace: options.targetNamespace,
+            labels: {
+                'app.kubernetes.io/name': 'harbor',
+                'app.kubernetes.io/component': 'registry-storage',
+                'app.kubernetes.io/managed-by': 'typekro',
+                'typekro.dev/source-obc': options.claimName,
+            },
+        },
+        type: 'Opaque',
+        data: {
+            REGISTRY_STORAGE_S3_ACCESSKEY: accessKey,
+            REGISTRY_STORAGE_S3_SECRETKEY: secretKey,
+        },
+    };
+    await store.upsertSecret(adapted);
+    return {
+        bucket,
+        region,
+        regionEndpoint,
+        existingSecret: options.targetSecretName,
+        secure,
+        ...(options.rootDirectory ? { rootDirectory: options.rootDirectory } : {}),
+    };
+}
+function requiredSecretKey(secret, key) {
+    const value = secret.data?.[key];
+    if (!value)
+        throw new Error(`Rook OBC credential Secret is missing required key ${key}.`);
+    return value;
+}
+function requiredConfig(data, key) {
+    const value = data?.[key];
+    if (!value)
+        throw new Error(`Rook OBC connection ConfigMap is missing required key ${key}.`);
+    return value;
+}
+//# sourceMappingURL=rook-s3-binding.js.map

package/dist/factories/harbor/provider/rook-s3-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rook-s3-binding.js","sourceRoot":"","sources":["../../../../src/factories/harbor/provider/rook-s3-binding.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,2BAA2B,GAE5B,MAAM,8BAA8B,CAAC;AAwBtC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAA0C;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,2BAA2B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC;QAC5D,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC;KAChE,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,SAAS,oBAAoB,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,SAAS,oBAAoB,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;IAC1C,MAAM,cAAc,GAClB,OAAO,CAAC,gBAAgB,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAChG,MAAM,gBAAgB,GAAG,OAAO,CAAC,cAAc,IAAI,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC;IAClF,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,MAAM,GAAG,gBAAgB,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC;IAEvD,MAAM,OAAO,GAAa;QACxB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE;YACR,IAAI,EAAE,OAAO,CAAC,gBAAgB;YAC9B,SAAS,EAAE,OAAO,CAAC,eAAe;YAClC,MAAM,EAAE;gBACN,wBAAwB,EAAE,QAAQ;gBAClC,6BAA6B,EAAE,kBAAkB;gBACjD,8BAA8B,EAAE,SAAS;gBACzC,wBAAwB,EAAE,OAAO,CAAC,SAAS;aAC5C;SACF;QACD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE;YACJ,6BAA6B,EAAE,SAAS;YACxC,6BAA6B,EAAE,SAAS;SACzC;KACF,CAAC;IACF,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAElC,OAAO;QACL,MAAM;QACN,MAAM;QACN,cAAc;QACd,cAAc,EAAE,OAAO,CAAC,gBAAgB;QACxC,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAgB,EAAE,GAAW;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,GAAG,GAAG,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,IAAwC,EAAE,GAAW;IAC3E,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,GAAG,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/factories/harbor/resources/helm.d.ts

@@ -0,0 +1,12 @@
+import type { Composable, Enhanced } from '../../../core/types/index.js';
+import { type HelmRepositorySpec, type HelmRepositoryStatus } from '../../helm/helm-repository.js';
+import type { HelmReleaseSpec, HelmReleaseStatus } from '../../helm/types.js';
+import type { HarborHelmReleaseConfig, HarborHelmRepositoryConfig } from '../types.js';
+export declare const DEFAULT_HARBOR_REPOSITORY_URL = "https://helm.goharbor.io";
+export declare const DEFAULT_HARBOR_REPOSITORY_NAME = "harbor";
+export declare const HARBOR_CHART_NAME = "harbor";
+export declare const DEFAULT_HARBOR_CHART_VERSION = "1.19.1";
+export declare const DEFAULT_HARBOR_VERSION = "v2.15.1";
+export declare function harborHelmRepository(config: Composable<HarborHelmRepositoryConfig>): Enhanced<HelmRepositorySpec, HelmRepositoryStatus>;
+export declare function harborHelmRelease(config: Composable<HarborHelmReleaseConfig>): Enhanced<HelmReleaseSpec, HelmReleaseStatus>;
+//# sourceMappingURL=helm.d.ts.map

package/dist/factories/harbor/resources/helm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm.d.ts","sourceRoot":"","sources":["../../../../src/factories/harbor/resources/helm.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAEzE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAE1B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAEvF,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AACxE,eAAO,MAAM,8BAA8B,WAAW,CAAC;AACvD,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,eAAO,MAAM,4BAA4B,WAAW,CAAC;AACrD,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAEhD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,CAAC,0BAA0B,CAAC,GAC7C,QAAQ,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAWpD;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,UAAU,CAAC,uBAAuB,CAAC,GAC1C,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC,CA6B9C"}

package/dist/factories/harbor/resources/helm.js

@@ -0,0 +1,46 @@
+import { DEFAULT_FLUX_NAMESPACE } from '../../../core/config/defaults.js';
+import { helmRelease } from '../../helm/helm-release.js';
+import { createHelmRepositoryReadinessEvaluator, helmRepository, } from '../../helm/helm-repository.js';
+import { createLabeledHelmReleaseEvaluator } from '../../helm/readiness-evaluators.js';
+export const DEFAULT_HARBOR_REPOSITORY_URL = 'https://helm.goharbor.io';
+export const DEFAULT_HARBOR_REPOSITORY_NAME = 'harbor';
+export const HARBOR_CHART_NAME = 'harbor';
+export const DEFAULT_HARBOR_CHART_VERSION = '1.19.1';
+export const DEFAULT_HARBOR_VERSION = 'v2.15.1';
+export function harborHelmRepository(config) {
+    return helmRepository({
+        name: config.name ?? DEFAULT_HARBOR_REPOSITORY_NAME,
+        namespace: config.namespace ?? DEFAULT_FLUX_NAMESPACE,
+        url: config.url ?? DEFAULT_HARBOR_REPOSITORY_URL,
+        interval: config.interval ?? '5m',
+        ...(config.id && { id: config.id }),
+    }).withReadinessEvaluator(createHelmRepositoryReadinessEvaluator('Harbor'));
+}
+export function harborHelmRelease(config) {
+    return helmRelease({
+        name: config.name,
+        namespace: config.namespace ?? 'harbor-system',
+        chart: {
+            repository: config.repositoryUrl ?? DEFAULT_HARBOR_REPOSITORY_URL,
+            name: HARBOR_CHART_NAME,
+            version: config.version ?? DEFAULT_HARBOR_CHART_VERSION,
+        },
+        sourceRef: {
+            name: config.repositoryName ?? DEFAULT_HARBOR_REPOSITORY_NAME,
+            namespace: config.repositoryNamespace ?? DEFAULT_FLUX_NAMESPACE,
+            kind: 'HelmRepository',
+        },
+        driftDetection: { mode: 'enabled' },
+        install: { timeout: '20m', remediation: { retries: 3 } },
+        // Harbor may migrate its external database during an upgrade. Retrying the
+        // same revision is bounded, but an automatic rollback to an older chart is
+        // not universally safe once that migration has committed.
+        upgrade: {
+            timeout: '20m',
+            remediation: { retries: 0, remediateLastFailure: false },
+        },
+        values: config.values ?? {},
+        ...(config.id && { id: config.id }),
+    }).withReadinessEvaluator(createLabeledHelmReleaseEvaluator('Harbor'));
+}
+//# sourceMappingURL=helm.js.map

package/dist/factories/harbor/resources/helm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm.js","sourceRoot":"","sources":["../../../../src/factories/harbor/resources/helm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EACL,sCAAsC,EAGtC,cAAc,GACf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAIvF,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAAG,QAAQ,CAAC;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAC1C,MAAM,CAAC,MAAM,4BAA4B,GAAG,QAAQ,CAAC;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD,MAAM,UAAU,oBAAoB,CAClC,MAA8C;IAE9C,OAAO,cAAc,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,8BAA8B;QACnD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,sBAAsB;QACrD,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,6BAA6B;QAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;QACjC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;KACpC,CAAC,CAAC,sBAAsB,CAAC,sCAAsC,CAAC,QAAQ,CAAC,CAGzE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAA2C;IAE3C,OAAO,WAAW,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,eAAe;QAC9C,KAAK,EAAE;YACL,UAAU,EAAE,MAAM,CAAC,aAAa,IAAI,6BAA6B;YACjE,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,4BAA4B;SACxD;QACD,SAAS,EAAE;YACT,IAAI,EAAE,MAAM,CAAC,cAAc,IAAI,8BAA8B;YAC7D,SAAS,EAAE,MAAM,CAAC,mBAAmB,IAAI,sBAAsB;YAC/D,IAAI,EAAE,gBAAgB;SACvB;QACD,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACnC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;QACxD,2EAA2E;QAC3E,2EAA2E;QAC3E,0DAA0D;QAC1D,OAAO,EAAE;YACP,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE;SACzD;QACD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;KACpC,CAAC,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,QAAQ,CAAC,CAGpE,CAAC;AACJ,CAAC"}

package/dist/factories/harbor/resources/index.d.ts

@@ -0,0 +1,2 @@
+export * from './helm.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/factories/harbor/resources/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/factories/harbor/resources/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/dist/factories/harbor/resources/index.js

@@ -0,0 +1,2 @@
+export * from './helm.js';
+//# sourceMappingURL=index.js.map

package/dist/factories/harbor/resources/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/factories/harbor/resources/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/dist/factories/harbor/types.d.ts

@@ -0,0 +1,319 @@
+import type { TypeKroChartValue } from '../../core/types/common.js';
+/** Local Harbor profile. Internal DB/cache are explicit development conveniences. */
+export declare const HarborLocalInstallationConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    profile: "local-development";
+    name: string;
+    exposure: {
+        type: "ingress" | "loadBalancer" | "clusterIP" | "nodePort";
+        externalUrl: string;
+        tls: {
+            enabled: boolean;
+            source: "auto" | "secret" | "none" | "cert-manager";
+            secretName?: string;
+        };
+        ingress?: {
+            host: string;
+            className?: string;
+            annotations?: Record<string, string>;
+        };
+        nodePort?: {
+            http?: number;
+            https?: number;
+        };
+    };
+    storage: {
+        bucket: string;
+        region: string;
+        regionEndpoint: string;
+        existingSecret: string;
+        rootDirectory?: string;
+        secure?: boolean;
+        skipVerify?: boolean;
+        disableRedirect?: boolean;
+        caBundleSecretName?: string;
+    };
+    adminPasswordSecret: {
+        name: string;
+        key?: string;
+    };
+    componentSecrets: {
+        encryptionKey: string;
+        core: string;
+        jobservice: string;
+        registry: string;
+        registryCredentials: string;
+        xsrf?: string;
+    };
+    database?: {
+        host: string;
+        username: string;
+        database: string;
+        existingSecret: string;
+        port?: number;
+        sslMode?: "require" | "disable" | "verify-ca" | "verify-full";
+    };
+    cache?: {
+        address: string;
+        existingSecret: string;
+        username?: string;
+        tls?: {
+            enabled: boolean;
+            caBundleSecretName?: string;
+        };
+    };
+    networkPolicy?: {
+        enabled: boolean;
+        ingressNamespaceLabels?: Record<string, string>;
+        egressNamespaceLabels?: Record<string, string>[];
+        egressCidrs?: string[];
+    };
+    namespace?: string;
+    chartVersion?: string;
+    harborVersion?: string;
+    repositoryName?: string;
+    repositoryNamespace?: string;
+    repositoryNamespaceOwnership?: "external" | "owned";
+    repositoryUrl?: string;
+    namespaceOwnership?: "external" | "owned";
+    certificate?: {
+        secretName: string;
+        issuerRef: {
+            name: string;
+            kind?: "Issuer" | "ClusterIssuer";
+            group?: string;
+        };
+        duration?: string;
+        renewBefore?: string;
+    };
+    internalTls?: {
+        enabled: boolean;
+        certSource?: "auto" | "secret";
+        caBundleSecretName?: string;
+        coreSecretName?: string;
+        jobserviceSecretName?: string;
+        registrySecretName?: string;
+        portalSecretName?: string;
+        trivySecretName?: string;
+    };
+    caBundleSecretName?: string;
+    pvcStorageClassName?: string;
+    trivyEnabled?: boolean;
+    metricsEnabled?: boolean;
+    values?: Record<string, unknown>;
+}, {}>;
+export type HarborLocalInstallationConfig = typeof HarborLocalInstallationConfigSchema.infer;
+/** Production Harbor profile requiring external durable database and cache providers. */
+export declare const HarborProductionInstallationConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    profile: "production";
+    exposure: {
+        tls: {
+            enabled: true;
+            source: "auto" | "secret" | "cert-manager";
+            secretName?: string;
+        };
+        type: "ingress" | "loadBalancer" | "clusterIP" | "nodePort";
+        externalUrl: string;
+        ingress?: {
+            host: string;
+            className?: string;
+            annotations?: Record<string, string>;
+        };
+        nodePort?: {
+            http?: number;
+            https?: number;
+        };
+    };
+    certificate: {
+        secretName: string;
+        issuerRef: {
+            name: string;
+            kind?: "Issuer" | "ClusterIssuer";
+            group?: string;
+        };
+        duration?: string;
+        renewBefore?: string;
+    };
+    storage: {
+        secure: true;
+        skipVerify: false;
+        bucket: string;
+        region: string;
+        regionEndpoint: string;
+        existingSecret: string;
+        rootDirectory?: string;
+        disableRedirect?: boolean;
+        caBundleSecretName?: string;
+    };
+    database: {
+        host: string;
+        username: string;
+        database: string;
+        existingSecret: string;
+        port?: number;
+        sslMode?: "require" | "disable" | "verify-ca" | "verify-full";
+    };
+    cache: {
+        address: string;
+        existingSecret: string;
+        username?: string;
+        tls?: {
+            enabled: boolean;
+            caBundleSecretName?: string;
+        };
+    };
+    networkPolicy: {
+        enabled: true;
+        ingressNamespaceLabels: Record<string, string>;
+        egressNamespaceLabels: Record<string, string>[];
+        egressCidrs?: string[];
+    };
+    replicas: {
+        core: number;
+        portal: number;
+        registry: number;
+        jobservice: number;
+        exporter: number;
+    };
+    resources: {
+        core: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        portal: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        registry: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        jobservice: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        exporter: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+    };
+    name: string;
+    adminPasswordSecret: {
+        name: string;
+        key?: string;
+    };
+    componentSecrets: {
+        encryptionKey: string;
+        core: string;
+        jobservice: string;
+        registry: string;
+        registryCredentials: string;
+        xsrf?: string;
+    };
+    namespace?: string;
+    chartVersion?: string;
+    harborVersion?: string;
+    repositoryName?: string;
+    repositoryNamespace?: string;
+    repositoryNamespaceOwnership?: "external" | "owned";
+    repositoryUrl?: string;
+    namespaceOwnership?: "external" | "owned";
+    internalTls?: {
+        enabled: boolean;
+        certSource?: "auto" | "secret";
+        caBundleSecretName?: string;
+        coreSecretName?: string;
+        jobserviceSecretName?: string;
+        registrySecretName?: string;
+        portalSecretName?: string;
+        trivySecretName?: string;
+    };
+    caBundleSecretName?: string;
+    pvcStorageClassName?: string;
+    trivyEnabled?: boolean;
+    metricsEnabled?: boolean;
+    values?: Record<string, unknown>;
+}, {}>;
+export type HarborProductionInstallationConfig = typeof HarborProductionInstallationConfigSchema.infer;
+export declare const HarborInstallationStatusSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    ready: boolean;
+    failed: boolean;
+    phase: "Ready" | "Failed" | "Installing";
+    endpoint: string;
+    chartVersion: string;
+    harborVersion: string;
+    profile: "production" | "local-development";
+    observedGeneration: number;
+    tlsEnabled: boolean;
+    storageReady: boolean;
+    databaseReady: boolean;
+    cacheReady: boolean;
+    networkPolicyReady: boolean;
+    conditions: {
+        type: string;
+        status: string;
+        reason?: string;
+        message?: string;
+        observedGeneration?: number;
+    }[];
+}, {}>;
+export type HarborInstallationStatus = typeof HarborInstallationStatusSchema.infer;
+export declare const HarborHelmRepositoryConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name?: string;
+    namespace?: string;
+    url?: string;
+    interval?: string;
+    id?: string;
+}, {}>;
+export type HarborHelmRepositoryConfig = typeof HarborHelmRepositoryConfigSchema.infer;
+export declare const HarborHelmReleaseConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace?: string;
+    version?: string;
+    repositoryName?: string;
+    repositoryNamespace?: string;
+    repositoryUrl?: string;
+    values?: Record<string, unknown>;
+    id?: string;
+}, {}>;
+export type HarborHelmReleaseConfig = Omit<typeof HarborHelmReleaseConfigSchema.infer, 'values'> & {
+    values?: TypeKroChartValue<Record<string, unknown>>;
+};
+export interface HarborS3StorageBinding {
+    bucket: string;
+    region: string;
+    regionEndpoint: string;
+    existingSecret: string;
+    secure: boolean;
+    skipVerify: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/factories/harbor/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/factories/harbor/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAuJpE,qFAAqF;AACrF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAW9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,OAAO,mCAAmC,CAAC,KAAK,CAAC;AAS7F,yFAAyF;AACzF,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA4BnD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAC5C,OAAO,wCAAwC,CAAC,KAAK,CAAC;AAExD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;MAsBzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,8BAA8B,CAAC,KAAK,CAAC;AAEnF,eAAO,MAAM,gCAAgC;;;;;;MAM3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,OAAO,gCAAgC,CAAC,KAAK,CAAC;AAEvF,eAAO,MAAM,6BAA6B;;;;;;;;;MASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,OAAO,6BAA6B,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG;IACjG,MAAM,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;CACrB"}