typekro 0.44.0 → 0.45.0

package/dist/factories/crowdsec/resources/helm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm.js","sourceRoot":"","sources":["../../../../src/factories/crowdsec/resources/helm.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,OAAO,EACL,sCAAsC,GAGvC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAMvF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,0BAA0B,EAC1B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,iBAAiB,CAAC;AA+BzB,MAAM,mBAAmB,GAAG,sCAAsC,CAAC,UAAU,CAAC,CAAC;AAE/E,oEAAoE;AACpE,MAAM,CAAC,MAAM,qCAAqC,GAChD,iCAAiC,CAAC,UAAU,CAAC,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAgD;IAEhD,OAAO,cAAc,CAA2C;QAC9D,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,UAAU,EAAE,6BAA6B;QACzC,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,sBAAsB,EAAE;QACtF,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,+BAA+B,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC7E,CAAC,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA6C;IAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC7D,OAAO,cAAc,CAAqC;QACxD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,UAAU,EAAE,2BAA2B;QACvC,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE;QAC1C,IAAI,EAAE;YACJ,QAAQ,EAAE,IAAI;YACd,uEAAuE;YACvE,OAAO,EAAE,KAAK;YACd,KAAK,EAAE;gBACL,IAAI,EAAE;oBACJ,KAAK,EAAE,2BAA2B;oBAClC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,8BAA8B;oBACzD,SAAS,EAAE;wBACT,IAAI,EAAE,gBAAyB;wBAC/B,IAAI,EAAE,MAAM,CAAC,cAAc,IAAI,gCAAgC;wBAC/D,SAAS,EAAE,MAAM,CAAC,mBAAmB,IAAI,SAAS;qBACnD;iBACF;aACF;YACD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,0BAA0B;YACrE,uEAAuE;YACvE,iEAAiE;YACjE,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,mEAAmE;YACnE,wEAAwE;YACxE,8DAA8D;YAC9D,GAAG,oBAAoB,CAAC,MAAM,EAAE;gBAC9B,OAAO,EAAE;oBACP,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,KAAK;oBAChD,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE;iBAC5B;gBACD,OAAO,EAAE;oBACP,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE;iBAC9E;aACF,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAiC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E;KACF,CAAC,CAAC,sBAAsB,CAAC,qCAAqC,CAAC,CAAC;AACnE,CAAC"}

package/dist/factories/crowdsec/resources/index.d.ts

@@ -0,0 +1,2 @@
+export * from './helm.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/factories/crowdsec/resources/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/factories/crowdsec/resources/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/dist/factories/crowdsec/resources/index.js

@@ -0,0 +1,2 @@
+export * from './helm.js';
+//# sourceMappingURL=index.js.map

package/dist/factories/crowdsec/resources/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/factories/crowdsec/resources/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/dist/factories/crowdsec/types.d.ts

@@ -0,0 +1,266 @@
+/**
+ * CrowdSec types: the bootstrap's runtime spec and status (ArkType), its
+ * build-time options, and the Traefik bouncer configuration.
+ */
+import type { V1Affinity, V1EnvVar, V1Toleration, V1TopologySpreadConstraint } from '@kubernetes/client-node';
+import { type Type } from 'arktype';
+import type { HelmReleaseLifecycleOptions } from '../helm/types.js';
+/** Container requests (required, so no pod is BestEffort) and optional limits. */
+export interface CrowdsecResources {
+    requests: {
+        cpu: string;
+        memory: string;
+    };
+    limits?: {
+        cpu?: string;
+        memory?: string;
+    };
+}
+/** Runtime spec of the CrowdSec bootstrap. Every field may be a schema reference. */
+export interface CrowdsecBootstrapConfig {
+    /** Helm release name; also prefixes every chart resource. */
+    name: string;
+    /** @default 'crowdsec' */
+    namespace?: string;
+    /** @default DEFAULT_CROWDSEC_CHART_VERSION */
+    chartVersion?: string;
+    lapi?: {
+        resources?: CrowdsecResources;
+    };
+    agent?: {
+        resources?: CrowdsecResources;
+    };
+    /** Only used when the build options enable AppSec. */
+    appsec?: {
+        replicas?: number;
+        resources?: CrowdsecResources;
+    };
+}
+/** Status of the CrowdSec bootstrap. Every field is a projection of the owned release. */
+export interface CrowdsecBootstrapStatus {
+    ready: boolean;
+    failed: boolean;
+    phase: 'Ready' | 'Installing' | 'Failed';
+    /** `host:port` of the LAPI Service, for the bouncer middleware. */
+    lapiHost: string;
+    /** `host:port` of the AppSec Service, or `''` when AppSec is off. */
+    appsecHost: string;
+    /** Chart version Flux installed, `''` until the first release. */
+    version: string;
+}
+/** ArkType schema of {@link CrowdsecBootstrapConfig}. */
+export declare const CrowdsecBootstrapConfigSchema: Type<CrowdsecBootstrapConfig>;
+/** ArkType schema of {@link CrowdsecBootstrapStatus}. */
+export declare const CrowdsecBootstrapStatusSchema: Type<CrowdsecBootstrapStatus>;
+/** Spec of the shared `HelmRepository` singleton. */
+export interface CrowdsecHelmRepositorySpec {
+    name: string;
+    namespace: string;
+    url: string;
+}
+/** ArkType schema of {@link CrowdsecHelmRepositorySpec}. */
+export declare const CrowdsecHelmRepositorySpecSchema: Type<CrowdsecHelmRepositorySpec>;
+/** ArkType schema of the singleton's status. */
+export declare const CrowdsecHelmRepositoryStatusSchema: Type<{
+    ready: boolean;
+}>;
+/** A key of a Secret in the CrowdSec namespace. */
+export interface CrowdsecSecretKeyRef {
+    readonly name: string;
+    readonly key: string;
+}
+/** Scheduling for one CrowdSec component. */
+export interface CrowdsecPlacement {
+    readonly nodeSelector?: Readonly<Record<string, string>>;
+    readonly tolerations?: readonly V1Toleration[];
+    readonly affinity?: V1Affinity;
+    /** Defaults to a soft spread across nodes for LAPI and AppSec. */
+    readonly topologySpreadConstraints?: readonly V1TopologySpreadConstraint[];
+    readonly priorityClassName?: string;
+}
+/** LAPI storage: SQLite on a PVC (one replica) or an existing Postgres. */
+export type CrowdsecStorage = {
+    readonly type: 'sqlite';
+    readonly size?: string;
+    readonly storageClassName?: string;
+} | {
+    readonly type: 'postgres';
+    readonly host: string;
+    /** @default 5432 */
+    readonly port?: number;
+    readonly database: string;
+    readonly user: string;
+    readonly passwordSecretRef: CrowdsecSecretKeyRef;
+    /** @default 'require' */
+    readonly sslMode?: 'disable' | 'require' | 'verify-ca' | 'verify-full';
+};
+/**
+ * Pods whose logs the agents read: a namespace and a pod-name glob, matched
+ * against node-local container log files by every agent in the DaemonSet.
+ * @see docs/api/crowdsec/index.md for why label selectors are not offered.
+ */
+export interface CrowdsecAcquisition {
+    readonly namespace: string;
+    /** Glob over pod names, e.g. `traefik-*`. */
+    readonly podName: string;
+    /** Parser program. @default 'traefik' */
+    readonly program?: string;
+}
+/** An AppSec rule to switch off, everywhere or under one path prefix. */
+export interface CrowdsecAppsecExclusion {
+    readonly ruleId?: number;
+    readonly ruleName?: string;
+    readonly ruleTag?: string;
+    /** @default 'both' */
+    readonly phase?: 'inband' | 'outofband' | 'both';
+    /** Only exclude for request paths starting with this prefix. */
+    readonly pathPrefix?: string;
+}
+/** The AppSec (WAF) component. Present means enabled. */
+export interface CrowdsecAppsecOptions {
+    /** In-band virtual patching (`crowdsecurity/appsec-default`). @default true */
+    readonly virtualPatching?: boolean;
+    /** Out-of-band OWASP CRS (`crowdsecurity/crs`). @default true */
+    readonly crs?: boolean;
+    /** Largest body AppSec inspects, in bytes. @default 10485760 */
+    readonly maxBodySize?: number;
+    /** What happens to a larger body. @default 'partial' */
+    readonly bodySizeExceededAction?: 'drop' | 'partial' | 'allow';
+    /** In-band remediation. Defaults to `'allow'` under global simulation, else `'ban'`. */
+    readonly inBandRemediation?: 'ban' | 'allow';
+    readonly exclusions?: readonly CrowdsecAppsecExclusion[];
+    readonly pdb?: boolean;
+    readonly placement?: CrowdsecPlacement;
+}
+/**
+ * Simulation: everything simulated except `enforce`, or nothing simulated
+ * except `simulate`. Both render as CrowdSec's `exclusions`.
+ */
+export type CrowdsecSimulation = {
+    readonly global: true;
+    readonly enforce?: readonly string[];
+} | {
+    readonly global: false;
+    readonly simulate?: readonly string[];
+};
+/** Ingress allowed to LAPI (`:8080`) and AppSec (`:7422`). */
+export interface CrowdsecNetworkPolicyOptions {
+    /** Namespace of the Traefik pods running the bouncer. */
+    readonly traefikNamespace: string;
+    /** Namespace allowed to scrape `:6060`. @default any namespace */
+    readonly metricsNamespace?: string;
+}
+/**
+ * Build-time options of {@link makeCrowdsecBootstrap}.
+ *
+ * `install`, `upgrade` and `driftDetection` are the Flux lifecycle options
+ * every TypeKro HelmRelease factory takes. They override the release's
+ * defaults field by field.
+ */
+export interface CrowdsecBootstrapOptions extends HelmReleaseLifecycleOptions {
+    /** @default 'crowdsec-bootstrap' */
+    readonly name?: string;
+    /** @default 'CrowdsecBootstrap' */
+    readonly kind?: string;
+    /** @default 'owned' */
+    readonly namespaceOwnership?: 'owned' | 'external';
+    /** @default { type: 'sqlite', size: '1Gi' } */
+    readonly storage?: CrowdsecStorage;
+    readonly lapi?: {
+        /** More than one needs Postgres. @default 1 */
+        readonly replicas?: number;
+        /** @default true */
+        readonly pdb?: boolean;
+        readonly placement?: CrowdsecPlacement;
+        /** Pod CIDRs allowed to auto-register agents. @default the RFC 1918 ranges */
+        readonly autoRegistrationRanges?: readonly string[];
+        /** Extra LAPI env, appended after the env this factory sets. */
+        readonly env?: readonly V1EnvVar[];
+    };
+    readonly agent?: {
+        /** @default 'containerd' */
+        readonly containerRuntime?: 'containerd' | 'docker';
+        readonly placement?: CrowdsecPlacement;
+        /** Extra agent env, e.g. `DISABLE_PARSERS`, after `COLLECTIONS`. */
+        readonly env?: readonly V1EnvVar[];
+    };
+    /** @default [{ namespace: 'traefik', podName: 'traefik-*' }] */
+    readonly acquisitions?: readonly CrowdsecAcquisition[];
+    /** Hub collections installed on top of {@link DEFAULT_CROWDSEC_COLLECTIONS}. */
+    readonly collections?: readonly string[];
+    /** Central API. Absent means LAPI runs offline. */
+    readonly centralApi?: {
+        /** Register with CAPI and pull the community blocklist. */
+        readonly communityBlocklist: boolean;
+        readonly enrollment?: {
+            readonly keySecretRef: CrowdsecSecretKeyRef;
+            readonly instanceName?: string;
+            readonly tags?: readonly string[];
+        };
+    };
+    /** Bouncers registered as `BOUNCER_KEY_<name>`. */
+    readonly bouncers?: readonly {
+        readonly name: string;
+        readonly keySecretRef: CrowdsecSecretKeyRef;
+    }[];
+    /** IPs and CIDRs that never trigger a decision. */
+    readonly allowlist?: {
+        readonly ips?: readonly string[];
+        readonly cidrs?: readonly string[];
+        readonly reason?: string;
+    };
+    /** Simulated scenarios alert but do not remediate. */
+    readonly simulation?: CrowdsecSimulation;
+    /** NetworkPolicies for LAPI and AppSec ingress. Absent means none. */
+    readonly networkPolicy?: CrowdsecNetworkPolicyOptions;
+    readonly appsec?: CrowdsecAppsecOptions;
+    /** Prometheus Operator objects. Metrics are always served on port 6060. */
+    readonly metrics?: {
+        readonly serviceMonitor?: boolean;
+        readonly podMonitor?: boolean;
+    };
+    /** Raw chart values, merged first; everything this factory sets wins. */
+    readonly values?: Readonly<Record<string, unknown>>;
+}
+/** One entry of Traefik's `experimental.plugins`. */
+export interface CrowdsecTraefikPluginDeclaration {
+    moduleName: string;
+    version: string;
+    /** SHA-256 of the plugin archive, as Traefik verifies it. */
+    hash: string;
+}
+/** Options of {@link crowdsecBouncerMiddleware}. */
+export interface CrowdsecBouncerMiddlewareOptions {
+    /** LAPI `host:port`, e.g. the bootstrap's `status.lapiHost`. */
+    readonly lapiHost: string;
+    /** Secret in the Middleware's namespace holding this bouncer's key. */
+    readonly apiKeySecret?: CrowdsecSecretKeyRef;
+    /** Path of the key in the Traefik pods, instead of `apiKeySecret`. */
+    readonly apiKeyFile?: string;
+    /** AppSec `host:port`. Omit to skip the WAF. */
+    readonly appsecHost?: string;
+    /** Let traffic through when LAPI or AppSec is unreachable. @default true */
+    readonly failOpen?: boolean;
+    /** Failed pulls tolerated before fail-closed blocks traffic. @default 4 */
+    readonly failClosedAfter?: number;
+    /**
+     * Key of the plugin in `experimental.plugins`: a letter, then letters, digits, `_` or `-`.
+     * @default 'crowdsec'
+     */
+    readonly pluginName?: string;
+    /** Seconds between decision pulls. @default 15 */
+    readonly updateIntervalSeconds?: number;
+    /** Proxies in front of Traefik whose `X-Forwarded-For` is trusted. */
+    readonly forwardedHeadersTrustedIps?: readonly string[];
+    /** Clients that bypass the bouncer and AppSec. */
+    readonly clientTrustedIps?: readonly string[];
+    /** Bytes of body sent to AppSec; match `appsec.maxBodySize`. @default 10485760 */
+    readonly appsecBodyLimit?: number;
+    /** @default 'INFO' */
+    readonly logLevel?: 'DEBUG' | 'INFO' | 'WARN' | 'ERROR';
+}
+/** A Traefik `Middleware.spec` that runs the bouncer plugin. */
+export interface CrowdsecBouncerMiddlewareSpec {
+    plugin: Record<string, Record<string, unknown>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/factories/crowdsec/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/factories/crowdsec/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,0BAA0B,EAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,EAAQ,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAIpE,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAC;IACzC,KAAK,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAC1C,sDAAsD;IACtD,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAC;CAC/D;AAED,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,QAAQ,CAAC;IACzC,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAYD,yDAAyD;AACzD,eAAO,MAAM,6BAA6B,EAAE,IAAI,CAAC,uBAAuB,CAOtE,CAAC;AAEH,yDAAyD;AACzD,eAAO,MAAM,6BAA6B,EAAE,IAAI,CAAC,uBAAuB,CAOtE,CAAC;AAEH,qDAAqD;AACrD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4DAA4D;AAC5D,eAAO,MAAM,gCAAgC,EAAE,IAAI,CAAC,0BAA0B,CAI5E,CAAC;AAEH,gDAAgD;AAChD,eAAO,MAAM,kCAAkC,EAAE,IAAI,CAAC;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,CAEtE,CAAC;AAIH,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAC3E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GACvF;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oBAAoB;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD,yBAAyB;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;CACxE,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yCAAyC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,yEAAyE;AACzE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,MAAM,CAAC;IACjD,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,yDAAyD;AACzD,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,gEAAgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IAC/D,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEtE,8DAA8D;AAC9D,MAAM,WAAW,4BAA4B;IAC3C,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,2BAA2B;IAC3E,oCAAoC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB;IACvB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IACnD,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,+CAA+C;QAC/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,oBAAoB;QACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;QACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;QACvC,8EAA8E;QAC9E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACpD,gEAAgE;QAChE,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;KACpC,CAAC;IACF,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,4BAA4B;QAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;QACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;QACvC,oEAAoE;QACpE,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;KACpC,CAAC;IACF,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACvD,gFAAgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,mDAAmD;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,2DAA2D;QAC3D,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;QACrC,QAAQ,CAAC,UAAU,CAAC,EAAE;YACpB,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;YAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;SACnC,CAAC;KACH,CAAC;IACF,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS;QAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;KAC7C,EAAE,CAAC;IACJ,mDAAmD;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,sDAAsD;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;IACzC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,4BAA4B,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACxF,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD;AAID,qDAAqD;AACrD,MAAM,WAAW,gCAAgC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,oDAAoD;AACpD,MAAM,WAAW,gCAAgC;IAC/C,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAC;IAC7C,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gDAAgD;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,sEAAsE;IACtE,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxD,kDAAkD;IAClD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,kFAAkF;IAClF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,sBAAsB;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CACzD;AAED,gEAAgE;AAChE,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjD"}

package/dist/factories/crowdsec/types.js

@@ -0,0 +1,43 @@
+/**
+ * CrowdSec types: the bootstrap's runtime spec and status (ArkType), its
+ * build-time options, and the Traefik bouncer configuration.
+ */
+import { type } from 'arktype';
+// The longest name the 0.24.2 chart renders from the release name is the LAPI
+// volume `<name>-lapi-cscli-credentials-volume` (+30). Volume names are DNS-1123
+// labels of at most 63 characters, so the release name is capped at 33.
+const releaseName = type(/^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/).and('string <= 33');
+const dnsLabel = type(/^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/).and('string <= 63');
+const resources = type({
+    requests: { cpu: 'string > 0', memory: 'string > 0' },
+    'limits?': { 'cpu?': 'string > 0', 'memory?': 'string > 0' },
+});
+/** ArkType schema of {@link CrowdsecBootstrapConfig}. */
+export const CrowdsecBootstrapConfigSchema = type({
+    name: releaseName,
+    'namespace?': dnsLabel,
+    'chartVersion?': 'string > 0',
+    'lapi?': { 'resources?': resources },
+    'agent?': { 'resources?': resources },
+    'appsec?': { 'replicas?': 'number.integer >= 1', 'resources?': resources },
+});
+/** ArkType schema of {@link CrowdsecBootstrapStatus}. */
+export const CrowdsecBootstrapStatusSchema = type({
+    ready: 'boolean',
+    failed: 'boolean',
+    phase: '"Ready" | "Installing" | "Failed"',
+    lapiHost: 'string',
+    appsecHost: 'string',
+    version: 'string',
+});
+/** ArkType schema of {@link CrowdsecHelmRepositorySpec}. */
+export const CrowdsecHelmRepositorySpecSchema = type({
+    name: dnsLabel,
+    namespace: dnsLabel,
+    url: 'string > 0',
+});
+/** ArkType schema of the singleton's status. */
+export const CrowdsecHelmRepositoryStatusSchema = type({
+    ready: 'boolean',
+});
+//# sourceMappingURL=types.js.map

package/dist/factories/crowdsec/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/factories/crowdsec/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAAa,IAAI,EAAE,MAAM,SAAS,CAAC;AAsC1C,8EAA8E;AAC9E,iFAAiF;AACjF,wEAAwE;AACxE,MAAM,WAAW,GAAG,IAAI,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC/E,MAAM,SAAS,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE;IACrD,SAAS,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE;CAC7D,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,6BAA6B,GAAkC,IAAI,CAAC;IAC/E,IAAI,EAAE,WAAW;IACjB,YAAY,EAAE,QAAQ;IACtB,eAAe,EAAE,YAAY;IAC7B,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE;IACpC,QAAQ,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE;IACrC,SAAS,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,YAAY,EAAE,SAAS,EAAE;CAC3E,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,6BAA6B,GAAkC,IAAI,CAAC;IAC/E,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,mCAAmC;IAC1C,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;CAClB,CAAC,CAAC;AASH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gCAAgC,GAAqC,IAAI,CAAC;IACrF,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,QAAQ;IACnB,GAAG,EAAE,YAAY;CAClB,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAA6B,IAAI,CAAC;IAC/E,KAAK,EAAE,SAAS;CACjB,CAAC,CAAC"}

package/dist/factories/crowdsec/utils/helm-values-mapper.d.ts

@@ -0,0 +1,40 @@
+/**
+ * CrowdSec Helm values mapping for the official `crowdsec` chart 0.24.2.
+ *
+ * The detection policy (acquisitions, collections, allowlist, simulation,
+ * AppSec) is rendered into CrowdSec config FILES, so it comes from the
+ * build-time options and is always concrete. The runtime spec only supplies
+ * values that land in the tree as-is (names, resources, replicas), which may be
+ * schema references in KRO mode and are never branched on here.
+ */
+import type { CrowdsecAcquisition, CrowdsecBootstrapConfig, CrowdsecBootstrapOptions } from '../types.js';
+/** Default acquisition: the pods `traefikBootstrap` creates with its defaults. */
+export declare const DEFAULT_CROWDSEC_ACQUISITIONS: readonly CrowdsecAcquisition[];
+/** File names this factory writes into the chart's config maps. */
+export declare const CROWDSEC_GENERATED_FILES: {
+    readonly allowlist: "typekro-allowlist.yaml";
+    readonly appsecPolicy: "typekro-appsec-policy.yaml";
+};
+/** Name of the AppSec config holding the body limit and the exclusions. */
+export declare const CROWDSEC_APPSEC_POLICY_NAME = "typekro/appsec-policy";
+/**
+ * Throw on option combinations the chart would accept but CrowdSec would run
+ * wrongly, or not at all.
+ *
+ * @throws {TypeKroError} `CROWDSEC_INVALID_OPTIONS`
+ */
+export declare function assertCrowdsecBootstrapOptions(options: CrowdsecBootstrapOptions): void;
+/** The parser (and postoverflow) whitelist this factory renders, or `undefined`. */
+export declare function renderCrowdsecAllowlist(allowlist: CrowdsecBootstrapOptions['allowlist']): string | undefined;
+/** `simulation.yaml`, or `''` when simulation is not configured. */
+export declare function renderCrowdsecSimulation(simulation: CrowdsecBootstrapOptions['simulation']): string;
+/** The AppSec config carrying the body limit and the rule exclusions. */
+export declare function renderCrowdsecAppsecPolicy(options: CrowdsecBootstrapOptions): string;
+/**
+ * Map the runtime spec and the build options to chart values.
+ *
+ * `options.values` is merged first; the mapped values win, and the network
+ * pins (no LAPI Ingress, ClusterIP Services only) are applied last.
+ */
+export declare function mapCrowdsecConfigToHelmValues(spec: CrowdsecBootstrapConfig, options?: CrowdsecBootstrapOptions): Record<string, unknown>;
+//# sourceMappingURL=helm-values-mapper.d.ts.map

package/dist/factories/crowdsec/utils/helm-values-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm-values-mapper.d.ts","sourceRoot":"","sources":["../../../../src/factories/crowdsec/utils/helm-values-mapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAYH,OAAO,KAAK,EACV,mBAAmB,EAEnB,uBAAuB,EACvB,wBAAwB,EAGzB,MAAM,aAAa,CAAC;AA2BrB,kFAAkF;AAClF,eAAO,MAAM,6BAA6B,EAAE,SAAS,mBAAmB,EAEvE,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,wBAAwB;;;CAG3B,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAsCnE;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CA0FtF;AAuDD,oFAAoF;AACpF,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,wBAAwB,CAAC,WAAW,CAAC,GAC/C,MAAM,GAAG,SAAS,CAapB;AAED,oEAAoE;AACpE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,wBAAwB,CAAC,YAAY,CAAC,GACjD,MAAM,CAMR;AAQD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAyBpF;AAuDD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,uBAAuB,EAC7B,OAAO,GAAE,wBAA6B,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgGzB"}