@mcpg-dev/pulumi-policy 0.1.0-beta.11

package/BUILD.bazel

@@ -0,0 +1,24 @@
+load("@aspect_rules_js//js:defs.bzl", "js_library")
+load("@npm//:defs.bzl", "npm_link_all_packages")
+
+# This package's npm dependencies, linked the way node resolves them.
+npm_link_all_packages(name = "node_modules")
+
+# Every workspace package needs a `pkg` target: npm_link_all_packages resolves
+# a `workspace:*` dependency to one, and the root link covers the whole
+# workspace — so a package without it breaks the graph for everyone, not just
+# for itself.
+js_library(
+    name = "pkg",
+    srcs = glob(
+        ["**/*"],
+        allow_empty = True,
+        exclude = [
+            "node_modules/**",
+            "dist/**",
+            ".next/**",
+            "BUILD.bazel",
+        ],
+    ),
+    visibility = ["//visibility:public"],
+)

package/README.md

@@ -0,0 +1,117 @@
+# @mcpg/pulumi-policy
+
+A Pulumi **CrossGuard** policy pack that enforces the MCPG Kubernetes operator's
+admission rules at `pulumi preview`, before anything reaches a cluster. It
+inspects the `mcpg.dev` custom resources a program declares — gateways,
+plugins, plugin sets, revocation lists, clusters, routes, tenants and plugin
+mirrors — and reports the violations the operator's admission webhook would
+return, locally and with no API-server round trip.
+
+## Quick start
+
+The pack is referenced at preview/update time rather than imported into your
+program:
+
+```bash
+npm i --save-dev @mcpg/pulumi-policy
+pulumi preview --policy-pack node_modules/@mcpg/pulumi-policy
+```
+
+A violation is printed as `[<rule-id>] <message>` — for example
+`[gateway.workloadIdentity.oneOf] workloadIdentity must be exactly one of
+aws|gcp|azure|spiffe`. The rule id is stable, and is the same identifier the
+MCPG Terraform provider's plan-time validators emit.
+
+`main` points at `bin/index.js`, so a source checkout has to be compiled before
+Pulumi can load it:
+
+```bash
+npm install && npm run build   # tsc → bin/
+```
+
+## Rules
+
+| Kind | What it checks |
+|---|---|
+| `MCPGGateway` | `spec.image` present; `replicas` ≥ 1 when set; at most one of `workloadIdentity.{aws,gcp,azure,spiffe}`; a present `ingress` block carries a non-empty `ingressClassName`, at least one host, and non-empty `paths` per host. |
+| `MCPGPlugin` | `pluginId` non-empty and reverse-DNS; `version` non-empty; `pluginClass` is a known plugin class; `oci.image` carries a registry component and a tag or digest; the artifact is digest-pinned **or** carries a cosign identity; `trust.signingKeyRef.secretName` present (Ed25519 signing is the mandatory baseline); a cosign block has a non-empty, anchored `certificateIdentityRegexp` and an `oidcIssuer`; an SLSA block sets `configMapName`, `sourceUri` and `sourceTag`. |
+| `MCPGPluginSet` | `entries` non-empty; each entry has a reverse-DNS `id` and a `pluginRef.name`; ids unique; `capabilityGrants` keys name a declared entry and grant a non-empty capability list. |
+| `MCPGRevocationList` | `version == 1`; every `artifactSha256` is 64 hex characters; every revocation carries a `reason`; no duplicate hashes. |
+| `MCPGCluster` | the `single_node` backend takes no `config`; every other backend requires one; a plaintext coordinator address (`redis://`, `http://` Consul, non-`https://` etcd endpoints, NATS with `tls.require_tls: false`) is rejected unless `config.allow_insecure_transport: true`; `credentialRefs` entries carry `name` + `secretName` and unique names. |
+| `MCPGRoute` | `gatewayRef.name` non-empty; `match.tools` lists at least one tool; tool ids non-empty and unique; no empty entry in `identityChain` / `policyChain` / `auditChain`. |
+| `MCPGTenant` | `namespaces` non-empty, with entries non-empty and unique; each `allowedPlugins` entry sets `name` or `registryPrefix`; quota fields are non-negative; `identityAttribute.key` non-empty when that block is set. |
+| `MCPGPluginMirror` | `endpoint.service.{namespace,name,port}` set; `upstream.registry` present and shaped like a registry host; `upstream.namespace` present; `auth.secretRef.secretName` present when `auth` is set. |
+
+Two behaviours exist specifically so the preview verdict matches the cluster's:
+
+- A `certificateIdentityRegexp` using lookahead, lookbehind or a back-reference
+  is rejected even though JavaScript would compile it, because the operator
+  compiles the pattern with an RE2-style engine that will not.
+- SHA-256 hashes are accepted in either case, and duplicate detection is
+  case-insensitive, matching the operator's lowercase-then-deduplicate
+  behaviour.
+
+Cross-resource and client-backed admission checks are deliberately **not**
+mirrored: the per-tenant replica cap and plugin allowlist need cluster state,
+and `image.tag` is filled in by the mutating webhook, so enforcing it at preview
+would false-reject a program that relies on defaulting. Treat the pack as a
+high-coverage local gate, not a guarantee of admission acceptance.
+
+## Validator library
+
+The rules live in [`src/validators.ts`](src/validators.ts) as pure functions
+with no Pulumi runtime dependency, which is what lets the same logic back both
+the policy pack and a cross-tool contract test:
+
+- `validateByType(type, spec)` — dispatch by Pulumi type token.
+- `validateGatewaySpec`, `validatePluginSpec`, `validatePluginSetSpec`,
+  `validateRevocationListSpec`, `validateClusterSpec`, `validateRouteSpec`,
+  `validateTenantSpec`, `validatePluginMirrorSpec` — one per kind, each
+  returning `Finding[]` (`{ rule, message }`); an empty array means accept.
+- `isSha256Hex`, `isAnchoredRegexp`, `countWorkloadIdentities`,
+  `findDuplicates` — the shared predicates.
+
+The MCPG Terraform provider ships a Go port of these same functions, and a
+shared fixture corpus asserts both sides return identical verdicts, so a rule
+relaxed on one side fails the build.
+
+## Configuration
+
+The pack takes no configuration. It registers one policy,
+`mcpg-admission-mirror`, declared at `enforcementLevel: "mandatory"`, so a
+violation blocks the update instead of emitting an advisory.
+
+Resources are dispatched on the Pulumi type-token suffix (`…:MCPGGateway`,
+`…:MCPGPlugin`, …) and read from `props.spec`. Any resource whose token matches
+no rule set yields no findings, so the pack is safe to apply across a whole
+stack.
+
+## Build and test
+
+```bash
+npm run build                       # tsc → bin/
+node --test bin/validators.test.js  # unit tests over the pure validators
+```
+
+Inside the MCPG workspace, from the repo root:
+
+```bash
+pnpm --filter ./iac/pulumi/policy exec tsc -b --noEmit   # tsc --noEmit
+pnpm --filter ./iac/pulumi/policy test        # builds, then runs the validator tests
+```
+
+## Licence
+
+Apache-2.0.
+
+## See also
+
+- <https://mcpg.dev/docs/self-hosting/pulumi> — installing MCPG with Pulumi,
+  including the `@mcpg/pulumi` components and the `@mcpg/pulumi-crds` typed SDK
+  this pack guards.
+- <https://mcpg.dev/docs/reference/operator-crds> — the `mcpg.dev` CRDs and the
+  admission rules being mirrored.
+- <https://mcpg.dev/docs/security/plugin-security> — signing, trust roots and
+  revocation, which the plugin and revocation-list rules enforce.
+- <https://mcpg.dev/docs/self-hosting/terraform-provider> — the same rules
+  enforced as Terraform plan-time validation.

package/bin/index.d.ts

@@ -0,0 +1 @@
+export {};

package/bin/index.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const policy_1 = require("@pulumi/policy");
+const validators_1 = require("./validators");
+function report(findings, reportViolation) {
+    for (const f of findings) {
+        reportViolation(`[${f.rule}] ${f.message}`);
+    }
+}
+// CrossGuard pack mirroring the operator's admission webhook. Evaluated at
+// `pulumi preview` (local — no operator round-trip). The same accept/reject
+// verdicts the admission webhook would produce must hold here (the shared
+// contract corpus under iac/contract/).
+new policy_1.PolicyPack("mcpg-admission-mirror", {
+    policies: [
+        {
+            name: "mcpg-admission-mirror",
+            description: "Mirror the MCPG operator's CRD admission rules at preview time.",
+            enforcementLevel: "mandatory",
+            validateResource: (args, reportViolation) => {
+                const spec = args.props?.spec;
+                report((0, validators_1.validateByType)(args.type, spec), reportViolation);
+            },
+        },
+    ],
+});

package/bin/validators.d.ts

@@ -0,0 +1,25 @@
+export interface Finding {
+    rule: string;
+    message: string;
+}
+export declare function isSha256Hex(s: string): boolean;
+/** cosign certificateIdentityRegexp must be anchored with ^ and $, compile, AND
+ *  be RE2-compatible (the operator compiles it with the Rust regex crate). */
+export declare function isAnchoredRegexp(s: string): boolean;
+export declare function countWorkloadIdentities(wi: any): number;
+export declare function findDuplicates<T>(items: T[], key: (t: T) => string): string[];
+export declare function validateGatewaySpec(spec: any): Finding[];
+export declare function validatePluginSpec(spec: any): Finding[];
+export declare function validatePluginSetSpec(spec: any): Finding[];
+export declare function validateRevocationListSpec(spec: any): Finding[];
+/** Mirrors the MCPGCluster admission rules (validators/cluster.rs). */
+export declare function validateClusterSpec(spec: any): Finding[];
+/** Mirrors the MCPGRoute admission rules (validators/route.rs). Tenant-unset is
+ * an admit-with-warning in the webhook, so it is NOT a reject here. */
+export declare function validateRouteSpec(spec: any): Finding[];
+/** Mirrors the MCPGTenant admission rules (validators/tenant.rs). */
+export declare function validateTenantSpec(spec: any): Finding[];
+/** Mirrors the MCPGPluginMirror admission rules (validators/plugin_mirror.rs). */
+export declare function validatePluginMirrorSpec(spec: any): Finding[];
+/** Dispatch by Pulumi resource type token (…:MCPGGateway etc.). */
+export declare function validateByType(type: string, spec: any): Finding[];

package/bin/validators.js

@@ -0,0 +1,378 @@
+"use strict";
+// Admission-mirror validation helpers — PURE functions so they can be shared
+// by the CrossGuard pack (preview-time) and the contract corpus, and unit
+// tested without a Pulumi runtime. Mirror k8s/operator/src/admission/validators/.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSha256Hex = isSha256Hex;
+exports.isAnchoredRegexp = isAnchoredRegexp;
+exports.countWorkloadIdentities = countWorkloadIdentities;
+exports.findDuplicates = findDuplicates;
+exports.validateGatewaySpec = validateGatewaySpec;
+exports.validatePluginSpec = validatePluginSpec;
+exports.validatePluginSetSpec = validatePluginSetSpec;
+exports.validateRevocationListSpec = validateRevocationListSpec;
+exports.validateClusterSpec = validateClusterSpec;
+exports.validateRouteSpec = validateRouteSpec;
+exports.validateTenantSpec = validateTenantSpec;
+exports.validatePluginMirrorSpec = validatePluginMirrorSpec;
+exports.validateByType = validateByType;
+const blank = (s) => typeof s !== "string" || s.trim() === "";
+// pluginClass values the operator accepts (mcpg_plugin_protocol::abi::ALL_KINDS,
+// the single source of truth in libs/plugin-protocol/src/abi.rs).
+const KNOWN_PLUGIN_CLASSES = [
+    "tool_gate", "transform", "identity_provider", "backend", "watch_strategy",
+    "http_route", "audit_sink", "log_sink", "telemetry_sink", "metrics_sink",
+    "store", "cache", "secret_provider", "config_provider", "policy_engine",
+    "cluster", "transport", "catalog_provider", "credential_issuer",
+    "approval_notifier", "content_store",
+];
+// Constructs RE2 (the Go provider + the Rust `regex` crate the operator uses)
+// cannot compile but JS RegExp can — lookahead/lookbehind + back-references.
+// Rejecting them keeps the Pulumi verdict identical to the operator.
+const RE2_INCOMPATIBLE = /\(\?<?[=!]|\\[1-9]|\\k</;
+function isSha256Hex(s) {
+    // The operator accepts any 64 ascii-hexdigit string (case-insensitive) and
+    // lowercases for dedup — uppercase hashes are valid.
+    return /^[0-9a-fA-F]{64}$/.test(s);
+}
+/** cosign certificateIdentityRegexp must be anchored with ^ and $, compile, AND
+ *  be RE2-compatible (the operator compiles it with the Rust regex crate). */
+function isAnchoredRegexp(s) {
+    if (typeof s !== "string" || !s.startsWith("^") || !s.endsWith("$"))
+        return false;
+    if (RE2_INCOMPATIBLE.test(s))
+        return false;
+    try {
+        new RegExp(s);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const WORKLOAD_IDENTITY_KEYS = ["aws", "gcp", "azure", "spiffe"];
+function countWorkloadIdentities(wi) {
+    if (!wi || typeof wi !== "object")
+        return 0;
+    return WORKLOAD_IDENTITY_KEYS.filter((k) => wi[k] != null).length;
+}
+function findDuplicates(items, key) {
+    const seen = new Set();
+    const dups = new Set();
+    for (const it of items) {
+        const k = key(it);
+        if (seen.has(k))
+            dups.add(k);
+        seen.add(k);
+    }
+    return [...dups];
+}
+function validateGatewaySpec(spec) {
+    const f = [];
+    if (!spec?.image)
+        f.push({ rule: "gateway.image.required", message: "spec.image is required" });
+    // replicas, when set, must be ≥ 1 (gateway.rs:65). Absent ⇒ defaulted ⇒ ok.
+    if (typeof spec?.replicas === "number" && spec.replicas < 1) {
+        f.push({ rule: "gateway.replicas.min", message: "spec.replicas must be ≥ 1" });
+    }
+    if (spec?.workloadIdentity && countWorkloadIdentities(spec.workloadIdentity) > 1) {
+        f.push({ rule: "gateway.workloadIdentity.oneOf", message: "workloadIdentity must be exactly one of aws|gcp|azure|spiffe" });
+    }
+    // Ingress sub-shape (gateway.rs:114-130) when an ingress block is present.
+    const ing = spec?.ingress;
+    if (ing) {
+        if (blank(ing.ingressClassName))
+            f.push({ rule: "gateway.ingress.ingressClassName", message: "spec.ingress.ingressClassName must not be empty" });
+        const hosts = ing.hosts ?? [];
+        if (hosts.length === 0)
+            f.push({ rule: "gateway.ingress.hosts", message: "spec.ingress.hosts must not be empty when ingress is set" });
+        hosts.forEach((h, i) => {
+            if (blank(h?.host))
+                f.push({ rule: "gateway.ingress.host", message: `spec.ingress.hosts[${i}].host is empty` });
+            if (!Array.isArray(h?.paths) || h.paths.length === 0)
+                f.push({ rule: "gateway.ingress.paths", message: `spec.ingress.hosts[${i}].paths must not be empty` });
+        });
+    }
+    // NB: image.tag-non-empty is enforced by the operator AFTER the mutating
+    // webhook defaults an empty/absent tag, so it is not a plan-time reject
+    // (would false-reject the rely-on-defaulting path). The per-gateway replica
+    // cap (tenant_guard) is a cross-resource, client-backed check — both are
+    // intentionally NOT mirrored at plan time.
+    return f;
+}
+function validatePluginSpec(spec) {
+    const f = [];
+    const oci = spec?.oci ?? {};
+    const trust = spec?.trust ?? {};
+    // Identity + class + version (plugin.rs:56-83).
+    if (blank(spec?.pluginId))
+        f.push({ rule: "plugin.pluginId.nonEmpty", message: "spec.pluginId must not be empty" });
+    else if (!spec.pluginId.includes("."))
+        f.push({ rule: "plugin.pluginId.reverseDns", message: "spec.pluginId is not reverse-DNS form (e.g. dev.mcpg.identity.workload)" });
+    if (blank(spec?.version))
+        f.push({ rule: "plugin.version.nonEmpty", message: "spec.version must not be empty" });
+    if (!KNOWN_PLUGIN_CLASSES.includes(spec?.pluginClass))
+        f.push({ rule: "plugin.pluginClass.known", message: `spec.pluginClass is not a known PluginClass` });
+    // OCI image reference shape (plugin.rs:84-99).
+    const img = typeof oci.image === "string" ? oci.image.trim() : "";
+    if (img === "")
+        f.push({ rule: "plugin.oci.image.nonEmpty", message: "spec.oci.image must not be empty" });
+    else {
+        if (!img.includes("/"))
+            f.push({ rule: "plugin.oci.image.registry", message: "spec.oci.image lacks a registry component (<registry>/<path>)" });
+        if (!img.includes(":") && !img.includes("@"))
+            f.push({ rule: "plugin.oci.image.tagOrDigest", message: "spec.oci.image lacks a tag or digest pin (:tag or @sha256:...)" });
+    }
+    // Trust anchor: digest pin OR cosign identity (plugin.rs:101-112).
+    const digestPinned = img.includes("@sha256:");
+    const hasCosign = trust.cosignIdentity != null;
+    if (!digestPinned && !hasCosign) {
+        f.push({ rule: "plugin.trust.anchor", message: "plugin must be digest-pinned OR carry a cosign identity" });
+    }
+    // signingKeyRef (Ed25519) is the MANDATORY baseline (plugin.rs:119-124).
+    const skr = trust.signingKeyRef;
+    if (blank(skr?.secretName)) {
+        f.push({ rule: "plugin.trust.signingKeyRef.required", message: "spec.trust.signingKeyRef.secretName is required (Ed25519 signing is the mandatory trust baseline)" });
+    }
+    // key defaults to release.pub; only an explicit empty key is invalid.
+    if (skr && skr.key !== undefined && blank(skr.key)) {
+        f.push({ rule: "plugin.trust.signingKeyRef.key", message: "spec.trust.signingKeyRef.key must not be empty when set" });
+    }
+    // Cosign sub-shape (plugin.rs:126-163).
+    if (hasCosign) {
+        if (blank(trust.cosignIdentity.certificateIdentityRegexp)) {
+            f.push({ rule: "plugin.cosign.regexpNonEmpty", message: "cosign certificateIdentityRegexp must not be empty" });
+        }
+        else if (!isAnchoredRegexp(trust.cosignIdentity.certificateIdentityRegexp)) {
+            f.push({ rule: "plugin.cosign.anchoredRegexp", message: "cosign certificateIdentityRegexp must be anchored with ^ and $ and compile (RE2)" });
+        }
+        if (blank(trust.cosignIdentity.oidcIssuer)) {
+            f.push({ rule: "plugin.cosign.oidcIssuer", message: "cosign oidcIssuer is required when cosign is set" });
+        }
+    }
+    // SLSA provenance sub-shape (plugin.rs:166-178).
+    const slsa = trust.slsaProvenance;
+    if (slsa) {
+        if (blank(slsa.configMapName))
+            f.push({ rule: "plugin.slsa.configMapName", message: "spec.trust.slsaProvenance.configMapName must not be empty" });
+        if (blank(slsa.sourceUri))
+            f.push({ rule: "plugin.slsa.sourceUri", message: "spec.trust.slsaProvenance.sourceUri must not be empty" });
+        if (blank(slsa.sourceTag))
+            f.push({ rule: "plugin.slsa.sourceTag", message: "spec.trust.slsaProvenance.sourceTag must not be empty" });
+    }
+    return f;
+}
+function validatePluginSetSpec(spec) {
+    const f = [];
+    const entries = spec?.entries ?? [];
+    if (entries.length === 0)
+        f.push({ rule: "pluginSet.entries.nonEmpty", message: "entries must be non-empty" });
+    const ids = new Set();
+    entries.forEach((e, i) => {
+        const id = e?.id;
+        if (blank(id))
+            f.push({ rule: "pluginSet.entries.id.nonEmpty", message: `spec.entries[${i}].id must not be empty` });
+        else if (!id.includes("."))
+            f.push({ rule: "pluginSet.entries.id.reverseDns", message: `spec.entries[${i}].id is not reverse-DNS form` });
+        if (blank(e?.pluginRef?.name))
+            f.push({ rule: "pluginSet.entries.pluginRef.name", message: `spec.entries[${i}].pluginRef.name must not be empty` });
+        if (typeof id === "string")
+            ids.add(id);
+    });
+    const dups = findDuplicates(entries, (e) => String(e?.id));
+    if (dups.length)
+        f.push({ rule: "pluginSet.entries.uniqueId", message: `duplicate entry ids: ${dups.join(",")}` });
+    // capabilityGrants is a MAP (id → [capabilities]); keys must name an entry
+    // id and each grant list must be non-empty (plugin_set.rs:85-100).
+    const grants = spec?.capabilityGrants;
+    if (grants && typeof grants === "object" && !Array.isArray(grants)) {
+        for (const id of Object.keys(grants)) {
+            if (!ids.has(id))
+                f.push({ rule: "pluginSet.capabilityGrants.unknownId", message: `capabilityGrants['${id}'] names an id not in entries` });
+            else if (!Array.isArray(grants[id]) || grants[id].length === 0)
+                f.push({ rule: "pluginSet.capabilityGrants.empty", message: `capabilityGrants['${id}'] must not be empty` });
+        }
+    }
+    return f;
+}
+function validateRevocationListSpec(spec) {
+    const f = [];
+    if (spec?.version !== 1)
+        f.push({ rule: "revocationList.version", message: "version must be 1" });
+    const revs = spec?.revocations ?? [];
+    for (const r of revs) {
+        if (!isSha256Hex(String(r?.artifactSha256 ?? ""))) {
+            f.push({ rule: "revocationList.sha256", message: "artifactSha256 must be 64 hex chars" });
+        }
+        // empty reason defeats the audit trail (revocation_list.rs:86).
+        if (blank(r?.reason)) {
+            f.push({ rule: "revocationList.reason", message: "revocation reason must not be empty" });
+        }
+    }
+    // dedup is case-insensitive in the operator (hashes lowercased), so ABCD…
+    // and abcd… collide.
+    const dups = findDuplicates(revs, (r) => String(r?.artifactSha256 ?? "").toLowerCase());
+    if (dups.length)
+        f.push({ rule: "revocationList.noDuplicates", message: `duplicate hashes: ${dups.join(",")}` });
+    return f;
+}
+/** Mirrors the MCPGCluster admission rules (validators/cluster.rs). */
+function validateClusterSpec(spec) {
+    const f = [];
+    const backend = spec?.backend ?? "single_node";
+    const singleNode = backend === "" || backend === "single_node";
+    const configEmpty = !spec?.config || Object.keys(spec.config).length === 0;
+    if (singleNode && !configEmpty) {
+        f.push({ rule: "cluster.singleNode.noConfig", message: "spec.config must be empty for the single_node backend (it takes no parameters)" });
+    }
+    if (!singleNode && configEmpty) {
+        f.push({ rule: "cluster.backend.configRequired", message: "spec.config must not be empty for an external backend — it needs at least a connection address" });
+    }
+    // Transport security: reject a plaintext coordinator unless opted out
+    // with `spec.config.allow_insecure_transport: true`. Mirrors the gateway
+    // boot guard + the operator admission webhook (validators/cluster.rs).
+    if (!singleNode && !configEmpty && spec?.config?.allow_insecure_transport !== true) {
+        const c = spec.config;
+        const lead = (s) => (typeof s === "string" ? s.replace(/^\s+/, "") : "");
+        let insecure = null;
+        if (backend === "redis" && lead(c?.url).startsWith("redis://")) {
+            insecure = "the redis `url` uses the plaintext `redis://` scheme (use `rediss://`)";
+        }
+        else if (backend === "consul" && lead(c?.address).startsWith("http://")) {
+            insecure = "the consul `address` uses the plaintext `http://` scheme (use `https://`)";
+        }
+        else if (backend === "etcd" && Array.isArray(c?.endpoints) &&
+            c.endpoints.some((e) => !lead(e).startsWith("https://"))) {
+            insecure = "an etcd `endpoint` is not an `https://` URL (use `https://`)";
+        }
+        else if (backend === "nats" && c?.tls?.require_tls === false) {
+            insecure = "nats `tls.require_tls` is set to `false` (plaintext)";
+        }
+        if (insecure) {
+            f.push({ rule: "cluster.transport.insecure", message: `spec.config: ${insecure}. Set spec.config.allow_insecure_transport: true to accept plaintext (local/dev only).` });
+        }
+    }
+    const seen = new Set();
+    const refs = spec?.credentialRefs ?? [];
+    refs.forEach((c, i) => {
+        if (blank(c?.name)) {
+            f.push({ rule: "cluster.credentialRefs.name", message: `spec.credentialRefs[${i}].name must not be empty` });
+            return;
+        }
+        if (blank(c?.secretName)) {
+            f.push({ rule: "cluster.credentialRefs.secretName", message: `spec.credentialRefs[${i}].secretName must not be empty` });
+        }
+        if (seen.has(c.name)) {
+            f.push({ rule: "cluster.credentialRefs.uniqueName", message: `spec.credentialRefs name '${c.name}' is duplicated` });
+        }
+        seen.add(c.name);
+    });
+    return f;
+}
+/** Mirrors the MCPGRoute admission rules (validators/route.rs). Tenant-unset is
+ * an admit-with-warning in the webhook, so it is NOT a reject here. */
+function validateRouteSpec(spec) {
+    const f = [];
+    if (blank(spec?.gatewayRef?.name))
+        f.push({ rule: "route.gatewayRef.name", message: "spec.gatewayRef.name must not be empty" });
+    const tools = spec?.match?.tools ?? [];
+    if (tools.length === 0)
+        f.push({ rule: "route.match.tools.nonEmpty", message: "spec.match.tools must list at least one tool" });
+    const seen = new Set();
+    tools.forEach((t, i) => {
+        const id = typeof t?.id === "string" ? t.id.trim() : "";
+        if (id === "") {
+            f.push({ rule: "route.match.tools.id", message: `spec.match.tools[${i}].id must not be empty` });
+            return;
+        }
+        if (seen.has(id))
+            f.push({ rule: "route.match.tools.uniqueId", message: `spec.match.tools contains duplicate tool id '${id}'` });
+        seen.add(id);
+    });
+    for (const chain of ["identityChain", "policyChain", "auditChain"]) {
+        const ids = spec?.[chain] ?? [];
+        ids.forEach((id, i) => {
+            if (blank(id))
+                f.push({ rule: "route.chain.nonEmptyId", message: `spec.${chain}[${i}] must not be empty` });
+        });
+    }
+    return f;
+}
+/** Mirrors the MCPGTenant admission rules (validators/tenant.rs). */
+function validateTenantSpec(spec) {
+    const f = [];
+    const namespaces = spec?.namespaces ?? [];
+    if (namespaces.length === 0)
+        f.push({ rule: "tenant.namespaces.nonEmpty", message: "spec.namespaces must not be empty" });
+    const seen = new Set();
+    for (const ns of namespaces) {
+        if (blank(ns)) {
+            f.push({ rule: "tenant.namespaces.nonEmptyEntry", message: "spec.namespaces[] entries must not be empty" });
+            continue;
+        }
+        if (seen.has(ns))
+            f.push({ rule: "tenant.namespaces.unique", message: `spec.namespaces lists '${ns}' more than once` });
+        seen.add(ns);
+    }
+    (spec?.allowedPlugins ?? []).forEach((a, i) => {
+        const nameSet = !blank(a?.name);
+        const prefixSet = !blank(a?.registryPrefix);
+        if (!nameSet && !prefixSet)
+            f.push({ rule: "tenant.allowedPlugins.matcher", message: `spec.allowedPlugins[${i}] must set name or registryPrefix` });
+    });
+    if (spec?.quotas) {
+        for (const field of ["maxGateways", "maxPluginSets", "maxRoutes", "maxReplicasPerGateway"]) {
+            const v = spec.quotas[field];
+            if (typeof v === "number" && v < 0)
+                f.push({ rule: "tenant.quotas.nonNegative", message: `spec.quotas.${field} must be ≥ 0` });
+        }
+    }
+    if (spec?.identityAttribute && blank(spec.identityAttribute.key)) {
+        f.push({ rule: "tenant.identityAttribute.key", message: "spec.identityAttribute.key must not be empty when set" });
+    }
+    return f;
+}
+/** Mirrors the MCPGPluginMirror admission rules (validators/plugin_mirror.rs). */
+function validatePluginMirrorSpec(spec) {
+    const f = [];
+    const svc = spec?.endpoint?.service ?? {};
+    if (blank(svc.namespace))
+        f.push({ rule: "pluginMirror.endpoint.service.namespace", message: "spec.endpoint.service.namespace must not be empty" });
+    if (blank(svc.name))
+        f.push({ rule: "pluginMirror.endpoint.service.name", message: "spec.endpoint.service.name must not be empty" });
+    if (!svc.port)
+        f.push({ rule: "pluginMirror.endpoint.service.port", message: "spec.endpoint.service.port must be in 1..=65535" });
+    const up = spec?.upstream ?? {};
+    if (blank(up.registry)) {
+        f.push({ rule: "pluginMirror.upstream.registry", message: "spec.upstream.registry must not be empty" });
+    }
+    else if (!up.registry.includes(".") && !up.registry.includes(":")) {
+        f.push({ rule: "pluginMirror.upstream.registryHost", message: `spec.upstream.registry '${up.registry}' does not look like a registry host` });
+    }
+    if (blank(up.namespace))
+        f.push({ rule: "pluginMirror.upstream.namespace", message: "spec.upstream.namespace must not be empty" });
+    if (spec?.auth && blank(spec.auth.secretRef?.secretName)) {
+        f.push({ rule: "pluginMirror.auth.secretName", message: "spec.auth.secretRef.secretName must not be empty when auth is set" });
+    }
+    return f;
+}
+/** Dispatch by Pulumi resource type token (…:MCPGGateway etc.). */
+function validateByType(type, spec) {
+    if (type.endsWith(":MCPGGateway"))
+        return validateGatewaySpec(spec);
+    if (type.endsWith(":MCPGPlugin"))
+        return validatePluginSpec(spec);
+    if (type.endsWith(":MCPGPluginSet"))
+        return validatePluginSetSpec(spec);
+    if (type.endsWith(":MCPGRevocationList"))
+        return validateRevocationListSpec(spec);
+    if (type.endsWith(":MCPGCluster"))
+        return validateClusterSpec(spec);
+    if (type.endsWith(":MCPGRoute"))
+        return validateRouteSpec(spec);
+    if (type.endsWith(":MCPGTenant"))
+        return validateTenantSpec(spec);
+    if (type.endsWith(":MCPGPluginMirror"))
+        return validatePluginMirrorSpec(spec);
+    return [];
+}

package/bin/validators.test.d.ts

@@ -0,0 +1 @@
+export {};

package/bin/validators.test.js

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Unit tests for the admission-mirror validators (pure; node:test, no deps).
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const validators_1 = require("./validators");
+(0, node_test_1.test)("gateway: two workload identities rejected", () => {
+    const f = (0, validators_1.validateGatewaySpec)({ image: {}, workloadIdentity: { aws: {}, gcp: {} } });
+    strict_1.default.ok(f.some((x) => x.rule === "gateway.workloadIdentity.oneOf"));
+});
+(0, node_test_1.test)("gateway: minimal accepted", () => {
+    strict_1.default.deepEqual((0, validators_1.validateGatewaySpec)({ image: { repository: "x", tag: "y" } }), []);
+});
+(0, node_test_1.test)("plugin: tag-only with no cosign rejected", () => {
+    const f = (0, validators_1.validatePluginSpec)({ oci: { image: "ghcr.io/x:1.0" }, trust: {} });
+    strict_1.default.ok(f.some((x) => x.rule === "plugin.trust.anchor"));
+});
+(0, node_test_1.test)("plugin: cosign regexp must be anchored", () => {
+    const f = (0, validators_1.validatePluginSpec)({
+        oci: { image: "ghcr.io/x:1.0" },
+        trust: { cosignIdentity: { certificateIdentityRegexp: "https://github.com/.+", oidcIssuer: "x" } },
+    });
+    strict_1.default.ok(f.some((x) => x.rule === "plugin.cosign.anchoredRegexp"));
+});
+(0, node_test_1.test)("plugin: fully-formed digest-pinned accepted", () => {
+    strict_1.default.deepEqual((0, validators_1.validatePluginSpec)({
+        pluginId: "dev.mcpg.backend.sql",
+        pluginClass: "backend",
+        version: "1.4.2",
+        oci: { image: "ghcr.io/x@sha256:" + "a".repeat(64) },
+        trust: { signingKeyRef: { secretName: "k" } },
+    }), []);
+});
+(0, node_test_1.test)("plugin: bad class + non-reverse-DNS id rejected (adm-3)", () => {
+    const f = (0, validators_1.validatePluginSpec)({
+        pluginId: "noDotId",
+        pluginClass: "frobnicator",
+        version: "1.0",
+        oci: { image: "ghcr.io/x@sha256:" + "a".repeat(64) },
+        trust: { signingKeyRef: { secretName: "k" } },
+    });
+    strict_1.default.ok(f.some((x) => x.rule === "plugin.pluginId.reverseDns"));
+    strict_1.default.ok(f.some((x) => x.rule === "plugin.pluginClass.known"));
+});
+(0, node_test_1.test)("plugin: missing signingKeyRef rejected (trust-9)", () => {
+    const f = (0, validators_1.validatePluginSpec)({ oci: { image: "ghcr.io/x@sha256:" + "a".repeat(64) }, trust: {} });
+    strict_1.default.ok(f.some((x) => x.rule === "plugin.trust.signingKeyRef.required"));
+});
+(0, node_test_1.test)("revocationList: bad sha + duplicates rejected", () => {
+    const f = (0, validators_1.validateRevocationListSpec)({
+        version: 1,
+        revocations: [{ artifactSha256: "xyz" }, { artifactSha256: "a".repeat(64) }, { artifactSha256: "a".repeat(64) }],
+    });
+    strict_1.default.ok(f.some((x) => x.rule === "revocationList.sha256"));
+    strict_1.default.ok(f.some((x) => x.rule === "revocationList.noDuplicates"));
+});
+(0, node_test_1.test)("helpers", () => {
+    // case-insensitive 64-hex (the operator accepts uppercase — adm-2/trust-5/parity-5).
+    strict_1.default.equal((0, validators_1.isSha256Hex)("a".repeat(64)), true);
+    strict_1.default.equal((0, validators_1.isSha256Hex)("A".repeat(64)), true);
+    strict_1.default.equal((0, validators_1.isSha256Hex)("a".repeat(63)), false);
+    strict_1.default.equal((0, validators_1.isSha256Hex)("g".repeat(64)), false);
+    strict_1.default.equal((0, validators_1.isAnchoredRegexp)("^x$"), true);
+    strict_1.default.equal((0, validators_1.isAnchoredRegexp)("x"), false);
+    // RE2-incompatible lookahead rejected to match Go/operator (parity-1).
+    strict_1.default.equal((0, validators_1.isAnchoredRegexp)("^(?=.*x).*$"), false);
+});
+(0, node_test_1.test)("dispatch: ours validated, non-MCPG ignored", () => {
+    strict_1.default.ok((0, validators_1.validateByType)("kubernetes:mcpg.dev/v1alpha1:MCPGGateway", {}).length > 0);
+    strict_1.default.deepEqual((0, validators_1.validateByType)("kubernetes:core/v1:ConfigMap", {}), []);
+});

package/copy.bara.sky

@@ -0,0 +1,98 @@
+# GENERATED by tools/open-source/gen-copybara.mjs — DO NOT EDIT.
+# One-way mirror of the @mcpg-dev/pulumi-policy npm package from the mcpg monorepo to
+# its own public repository. Contains NO version literals — regenerate
+# (`--write-npm`) only when the package's identity or layout changes.
+#
+# Licence: Apache-2.0. Repo: github.com/mcpg-dev/pulumi-mcpg-policy.
+# History is SQUASHED and re-authored to the bot, so no internal commit
+# history, subjects, or contributor identities are exposed.
+
+# Reads "version" from the package's own package.json at MIRROR time: sets
+# the public release message and the PKG_VERSION label the destination
+# resolves in tag_name — so no version is baked into this file. Matched at
+# two-space indentation so a nested "version" (the CRD SDK's generated
+# provider block carries one) can never be mistaken for the package's.
+def _release_meta(ctx):
+    content = ctx.read_path(ctx.new_path("package.json"))
+    version = ""
+    for line in content.split("\n"):
+        if not line.startswith('  "version"'):
+            continue
+        rest = line.split(":", 1)
+        if len(rest) < 2:
+            continue
+        version = rest[1].strip().strip(",").strip('"')
+        break
+    if version == "":
+        fail("mirror: could not read top-level \"version\" from package.json")
+    ctx.set_message("Release v" + version + "\n")
+    ctx.add_label("PKG_VERSION", version, hidden = True)
+
+core.workflow(
+    name = "default",
+    mode = "SQUASH",
+
+    origin = git.origin(
+        url = "https://github.com/mcpg-dev/source-code.git",
+        ref = "main",
+    ),
+    # push the code to main AND create the v{version} tag the public repo's
+    # release.yml fires on to self-publish to npm.
+    destination = git.github_destination(
+        url  = "https://github.com/mcpg-dev/pulumi-mcpg-policy.git",
+        push = "main",
+        tag_name = "v${PKG_VERSION}",
+        tag_msg  = "Release v${PKG_VERSION}",
+    ),
+
+    # The package subtree, minus internal artifacts: nx project.json,
+    # CHANGELOG.md (internal commits/PRs), AI-agent working rules, build
+    # output, and installed dependencies. Sources and tests DO travel — the
+    # tests use only node:test and node:assert, so they build and run in the
+    # public repo with nothing extra.
+    origin_files = glob(["iac/pulumi/policy/**"], exclude = [
+        "iac/pulumi/policy/copy.bara.sky", "iac/pulumi/policy/project.json",
+        "iac/pulumi/policy/BUILD.bazel", "iac/pulumi/policy/**/BUILD.bazel",
+        "iac/pulumi/policy/CHANGELOG.md", "iac/pulumi/policy/**/AGENTS.md",
+        "iac/pulumi/policy/bin/**", "iac/pulumi/policy/node_modules/**",
+        "iac/pulumi/policy/**/*.tsbuildinfo",
+        # Destination-managed names never travel from the origin (the
+        # destination excludes them, and Copybara refuses uncovered writes).
+        "iac/pulumi/policy/.gitignore", "iac/pulumi/policy/CONTRIBUTING.md",
+        "iac/pulumi/policy/package-lock.json", "iac/pulumi/policy/.github/**",
+        "iac/pulumi/policy/**/DEFERRED.md", "iac/pulumi/policy/**/TODO.md",
+        "iac/pulumi/policy/**/NOTES.md", "iac/pulumi/policy/**/ROADMAP.md",
+        "iac/pulumi/policy/**/INTERNAL*.md",
+    ]),
+
+    # Repo-only scaffold (CI, release shim, CONTRIBUTING, .gitignore) is
+    # seeded at bootstrap and excluded here so the mirror never deletes or
+    # clobbers it. LICENSE is NOT excluded — the mirror manages it.
+    destination_files = glob(["**"], exclude = [
+        ".github/**", ".gitignore", "CONTRIBUTING.md", "package-lock.json",
+    ]),
+
+    # Re-author every commit to the bot — no real contributor identity leaks.
+    authoring = authoring.overwrite("mcpg-bot <oss-bot@mcpg.dev>"),
+
+    transformations = [
+        # 1) subdir -> repo root.
+        core.move("iac/pulumi/policy", ""),
+
+        # 2) point "repository" at this package's own public repo. Left
+        #    naming the monorepo, a published package sends every reader
+        #    to a repository they cannot open.
+        core.transform([
+            core.replace(
+                before = "\"repository\": \"https://github.com/mcpg-dev/source-code\"",
+                after  = "\"repository\": \"https://github.com/mcpg-dev/pulumi-mcpg-policy\"",
+                paths  = glob(["package.json"]),
+            ),
+        ], reversal = []),
+
+        # 3) release message + PKG_VERSION label from the mirrored
+        #    manifest — replaces the squashed history's message entirely: NO
+        #    commit list, NO authors, NO subjects.
+        _release_meta,
+    ],
+)

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@mcpg-dev/pulumi-policy",
+  "version": "0.1.0-beta.11",
+  "repository": "https://github.com/mcpg-dev/source-code",
+  "description": "Pulumi CrossGuard policy pack mirroring MCPG operator admission rules.",
+  "license": "Apache-2.0",
+  "main": "bin/index.js",
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "node --test bin/validators.test.js"
+  },
+  "dependencies": {
+    "@pulumi/policy": "^1.13.0",
+    "@pulumi/pulumi": "^3.142.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20",
+    "typescript": "^5.4.0"
+  }
+}

package/src/index.ts

@@ -0,0 +1,26 @@
+import { PolicyPack } from "@pulumi/policy";
+import { validateByType, Finding } from "./validators";
+
+function report(findings: Finding[], reportViolation: (message: string) => void): void {
+    for (const f of findings) {
+        reportViolation(`[${f.rule}] ${f.message}`);
+    }
+}
+
+// CrossGuard pack mirroring the operator's admission webhook. Evaluated at
+// `pulumi preview` (local — no operator round-trip). The same accept/reject
+// verdicts the admission webhook would produce must hold here (the shared
+// contract corpus under iac/contract/).
+new PolicyPack("mcpg-admission-mirror", {
+    policies: [
+        {
+            name: "mcpg-admission-mirror",
+            description: "Mirror the MCPG operator's CRD admission rules at preview time.",
+            enforcementLevel: "mandatory",
+            validateResource: (args, reportViolation) => {
+                const spec = (args.props as any)?.spec;
+                report(validateByType(args.type, spec), reportViolation);
+            },
+        },
+    ],
+});

package/src/validators.test.ts

@@ -0,0 +1,89 @@
+// Unit tests for the admission-mirror validators (pure; node:test, no deps).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+    validateByType,
+    validateGatewaySpec,
+    validatePluginSpec,
+    validateRevocationListSpec,
+    isAnchoredRegexp,
+    isSha256Hex,
+} from "./validators";
+
+test("gateway: two workload identities rejected", () => {
+    const f = validateGatewaySpec({ image: {}, workloadIdentity: { aws: {}, gcp: {} } });
+    assert.ok(f.some((x) => x.rule === "gateway.workloadIdentity.oneOf"));
+});
+
+test("gateway: minimal accepted", () => {
+    assert.deepEqual(validateGatewaySpec({ image: { repository: "x", tag: "y" } }), []);
+});
+
+test("plugin: tag-only with no cosign rejected", () => {
+    const f = validatePluginSpec({ oci: { image: "ghcr.io/x:1.0" }, trust: {} });
+    assert.ok(f.some((x) => x.rule === "plugin.trust.anchor"));
+});
+
+test("plugin: cosign regexp must be anchored", () => {
+    const f = validatePluginSpec({
+        oci: { image: "ghcr.io/x:1.0" },
+        trust: { cosignIdentity: { certificateIdentityRegexp: "https://github.com/.+", oidcIssuer: "x" } },
+    });
+    assert.ok(f.some((x) => x.rule === "plugin.cosign.anchoredRegexp"));
+});
+
+test("plugin: fully-formed digest-pinned accepted", () => {
+    assert.deepEqual(
+        validatePluginSpec({
+            pluginId: "dev.mcpg.backend.sql",
+            pluginClass: "backend",
+            version: "1.4.2",
+            oci: { image: "ghcr.io/x@sha256:" + "a".repeat(64) },
+            trust: { signingKeyRef: { secretName: "k" } },
+        }),
+        [],
+    );
+});
+
+test("plugin: bad class + non-reverse-DNS id rejected (adm-3)", () => {
+    const f = validatePluginSpec({
+        pluginId: "noDotId",
+        pluginClass: "frobnicator",
+        version: "1.0",
+        oci: { image: "ghcr.io/x@sha256:" + "a".repeat(64) },
+        trust: { signingKeyRef: { secretName: "k" } },
+    });
+    assert.ok(f.some((x) => x.rule === "plugin.pluginId.reverseDns"));
+    assert.ok(f.some((x) => x.rule === "plugin.pluginClass.known"));
+});
+
+test("plugin: missing signingKeyRef rejected (trust-9)", () => {
+    const f = validatePluginSpec({ oci: { image: "ghcr.io/x@sha256:" + "a".repeat(64) }, trust: {} });
+    assert.ok(f.some((x) => x.rule === "plugin.trust.signingKeyRef.required"));
+});
+
+test("revocationList: bad sha + duplicates rejected", () => {
+    const f = validateRevocationListSpec({
+        version: 1,
+        revocations: [{ artifactSha256: "xyz" }, { artifactSha256: "a".repeat(64) }, { artifactSha256: "a".repeat(64) }],
+    });
+    assert.ok(f.some((x) => x.rule === "revocationList.sha256"));
+    assert.ok(f.some((x) => x.rule === "revocationList.noDuplicates"));
+});
+
+test("helpers", () => {
+    // case-insensitive 64-hex (the operator accepts uppercase — adm-2/trust-5/parity-5).
+    assert.equal(isSha256Hex("a".repeat(64)), true);
+    assert.equal(isSha256Hex("A".repeat(64)), true);
+    assert.equal(isSha256Hex("a".repeat(63)), false);
+    assert.equal(isSha256Hex("g".repeat(64)), false);
+    assert.equal(isAnchoredRegexp("^x$"), true);
+    assert.equal(isAnchoredRegexp("x"), false);
+    // RE2-incompatible lookahead rejected to match Go/operator (parity-1).
+    assert.equal(isAnchoredRegexp("^(?=.*x).*$"), false);
+});
+
+test("dispatch: ours validated, non-MCPG ignored", () => {
+    assert.ok(validateByType("kubernetes:mcpg.dev/v1alpha1:MCPGGateway", {}).length > 0);
+    assert.deepEqual(validateByType("kubernetes:core/v1:ConfigMap", {}), []);
+});

package/src/validators.ts

@@ -0,0 +1,335 @@
+// Admission-mirror validation helpers — PURE functions so they can be shared
+// by the CrossGuard pack (preview-time) and the contract corpus, and unit
+// tested without a Pulumi runtime. Mirror k8s/operator/src/admission/validators/.
+
+export interface Finding {
+    rule: string;
+    message: string;
+}
+
+const blank = (s: any): boolean => typeof s !== "string" || s.trim() === "";
+
+// pluginClass values the operator accepts (mcpg_plugin_protocol::abi::ALL_KINDS,
+// the single source of truth in libs/plugin-protocol/src/abi.rs).
+const KNOWN_PLUGIN_CLASSES = [
+    "tool_gate", "transform", "identity_provider", "backend", "watch_strategy",
+    "http_route", "audit_sink", "log_sink", "telemetry_sink", "metrics_sink",
+    "store", "cache", "secret_provider", "config_provider", "policy_engine",
+    "cluster", "transport", "catalog_provider", "credential_issuer",
+    "approval_notifier", "content_store",
+];
+
+// Constructs RE2 (the Go provider + the Rust `regex` crate the operator uses)
+// cannot compile but JS RegExp can — lookahead/lookbehind + back-references.
+// Rejecting them keeps the Pulumi verdict identical to the operator.
+const RE2_INCOMPATIBLE = /\(\?<?[=!]|\\[1-9]|\\k</;
+
+export function isSha256Hex(s: string): boolean {
+    // The operator accepts any 64 ascii-hexdigit string (case-insensitive) and
+    // lowercases for dedup — uppercase hashes are valid.
+    return /^[0-9a-fA-F]{64}$/.test(s);
+}
+
+/** cosign certificateIdentityRegexp must be anchored with ^ and $, compile, AND
+ *  be RE2-compatible (the operator compiles it with the Rust regex crate). */
+export function isAnchoredRegexp(s: string): boolean {
+    if (typeof s !== "string" || !s.startsWith("^") || !s.endsWith("$")) return false;
+    if (RE2_INCOMPATIBLE.test(s)) return false;
+    try {
+        new RegExp(s);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+const WORKLOAD_IDENTITY_KEYS = ["aws", "gcp", "azure", "spiffe"];
+export function countWorkloadIdentities(wi: any): number {
+    if (!wi || typeof wi !== "object") return 0;
+    return WORKLOAD_IDENTITY_KEYS.filter((k) => wi[k] != null).length;
+}
+
+export function findDuplicates<T>(items: T[], key: (t: T) => string): string[] {
+    const seen = new Set<string>();
+    const dups = new Set<string>();
+    for (const it of items) {
+        const k = key(it);
+        if (seen.has(k)) dups.add(k);
+        seen.add(k);
+    }
+    return [...dups];
+}
+
+export function validateGatewaySpec(spec: any): Finding[] {
+    const f: Finding[] = [];
+    if (!spec?.image) f.push({ rule: "gateway.image.required", message: "spec.image is required" });
+    // replicas, when set, must be ≥ 1 (gateway.rs:65). Absent ⇒ defaulted ⇒ ok.
+    if (typeof spec?.replicas === "number" && spec.replicas < 1) {
+        f.push({ rule: "gateway.replicas.min", message: "spec.replicas must be ≥ 1" });
+    }
+    if (spec?.workloadIdentity && countWorkloadIdentities(spec.workloadIdentity) > 1) {
+        f.push({ rule: "gateway.workloadIdentity.oneOf", message: "workloadIdentity must be exactly one of aws|gcp|azure|spiffe" });
+    }
+    // Ingress sub-shape (gateway.rs:114-130) when an ingress block is present.
+    const ing = spec?.ingress;
+    if (ing) {
+        if (blank(ing.ingressClassName)) f.push({ rule: "gateway.ingress.ingressClassName", message: "spec.ingress.ingressClassName must not be empty" });
+        const hosts: any[] = ing.hosts ?? [];
+        if (hosts.length === 0) f.push({ rule: "gateway.ingress.hosts", message: "spec.ingress.hosts must not be empty when ingress is set" });
+        hosts.forEach((h, i) => {
+            if (blank(h?.host)) f.push({ rule: "gateway.ingress.host", message: `spec.ingress.hosts[${i}].host is empty` });
+            if (!Array.isArray(h?.paths) || h.paths.length === 0) f.push({ rule: "gateway.ingress.paths", message: `spec.ingress.hosts[${i}].paths must not be empty` });
+        });
+    }
+    // NB: image.tag-non-empty is enforced by the operator AFTER the mutating
+    // webhook defaults an empty/absent tag, so it is not a plan-time reject
+    // (would false-reject the rely-on-defaulting path). The per-gateway replica
+    // cap (tenant_guard) is a cross-resource, client-backed check — both are
+    // intentionally NOT mirrored at plan time.
+    return f;
+}
+
+export function validatePluginSpec(spec: any): Finding[] {
+    const f: Finding[] = [];
+    const oci = spec?.oci ?? {};
+    const trust = spec?.trust ?? {};
+
+    // Identity + class + version (plugin.rs:56-83).
+    if (blank(spec?.pluginId)) f.push({ rule: "plugin.pluginId.nonEmpty", message: "spec.pluginId must not be empty" });
+    else if (!spec.pluginId.includes(".")) f.push({ rule: "plugin.pluginId.reverseDns", message: "spec.pluginId is not reverse-DNS form (e.g. dev.mcpg.identity.workload)" });
+    if (blank(spec?.version)) f.push({ rule: "plugin.version.nonEmpty", message: "spec.version must not be empty" });
+    if (!KNOWN_PLUGIN_CLASSES.includes(spec?.pluginClass)) f.push({ rule: "plugin.pluginClass.known", message: `spec.pluginClass is not a known PluginClass` });
+
+    // OCI image reference shape (plugin.rs:84-99).
+    const img = typeof oci.image === "string" ? oci.image.trim() : "";
+    if (img === "") f.push({ rule: "plugin.oci.image.nonEmpty", message: "spec.oci.image must not be empty" });
+    else {
+        if (!img.includes("/")) f.push({ rule: "plugin.oci.image.registry", message: "spec.oci.image lacks a registry component (<registry>/<path>)" });
+        if (!img.includes(":") && !img.includes("@")) f.push({ rule: "plugin.oci.image.tagOrDigest", message: "spec.oci.image lacks a tag or digest pin (:tag or @sha256:...)" });
+    }
+
+    // Trust anchor: digest pin OR cosign identity (plugin.rs:101-112).
+    const digestPinned = img.includes("@sha256:");
+    const hasCosign = trust.cosignIdentity != null;
+    if (!digestPinned && !hasCosign) {
+        f.push({ rule: "plugin.trust.anchor", message: "plugin must be digest-pinned OR carry a cosign identity" });
+    }
+
+    // signingKeyRef (Ed25519) is the MANDATORY baseline (plugin.rs:119-124).
+    const skr = trust.signingKeyRef;
+    if (blank(skr?.secretName)) {
+        f.push({ rule: "plugin.trust.signingKeyRef.required", message: "spec.trust.signingKeyRef.secretName is required (Ed25519 signing is the mandatory trust baseline)" });
+    }
+    // key defaults to release.pub; only an explicit empty key is invalid.
+    if (skr && skr.key !== undefined && blank(skr.key)) {
+        f.push({ rule: "plugin.trust.signingKeyRef.key", message: "spec.trust.signingKeyRef.key must not be empty when set" });
+    }
+
+    // Cosign sub-shape (plugin.rs:126-163).
+    if (hasCosign) {
+        if (blank(trust.cosignIdentity.certificateIdentityRegexp)) {
+            f.push({ rule: "plugin.cosign.regexpNonEmpty", message: "cosign certificateIdentityRegexp must not be empty" });
+        } else if (!isAnchoredRegexp(trust.cosignIdentity.certificateIdentityRegexp)) {
+            f.push({ rule: "plugin.cosign.anchoredRegexp", message: "cosign certificateIdentityRegexp must be anchored with ^ and $ and compile (RE2)" });
+        }
+        if (blank(trust.cosignIdentity.oidcIssuer)) {
+            f.push({ rule: "plugin.cosign.oidcIssuer", message: "cosign oidcIssuer is required when cosign is set" });
+        }
+    }
+
+    // SLSA provenance sub-shape (plugin.rs:166-178).
+    const slsa = trust.slsaProvenance;
+    if (slsa) {
+        if (blank(slsa.configMapName)) f.push({ rule: "plugin.slsa.configMapName", message: "spec.trust.slsaProvenance.configMapName must not be empty" });
+        if (blank(slsa.sourceUri)) f.push({ rule: "plugin.slsa.sourceUri", message: "spec.trust.slsaProvenance.sourceUri must not be empty" });
+        if (blank(slsa.sourceTag)) f.push({ rule: "plugin.slsa.sourceTag", message: "spec.trust.slsaProvenance.sourceTag must not be empty" });
+    }
+    return f;
+}
+
+export function validatePluginSetSpec(spec: any): Finding[] {
+    const f: Finding[] = [];
+    const entries: any[] = spec?.entries ?? [];
+    if (entries.length === 0) f.push({ rule: "pluginSet.entries.nonEmpty", message: "entries must be non-empty" });
+    const ids = new Set<string>();
+    entries.forEach((e, i) => {
+        const id = e?.id;
+        if (blank(id)) f.push({ rule: "pluginSet.entries.id.nonEmpty", message: `spec.entries[${i}].id must not be empty` });
+        else if (!id.includes(".")) f.push({ rule: "pluginSet.entries.id.reverseDns", message: `spec.entries[${i}].id is not reverse-DNS form` });
+        if (blank(e?.pluginRef?.name)) f.push({ rule: "pluginSet.entries.pluginRef.name", message: `spec.entries[${i}].pluginRef.name must not be empty` });
+        if (typeof id === "string") ids.add(id);
+    });
+    const dups = findDuplicates(entries, (e) => String(e?.id));
+    if (dups.length) f.push({ rule: "pluginSet.entries.uniqueId", message: `duplicate entry ids: ${dups.join(",")}` });
+    // capabilityGrants is a MAP (id → [capabilities]); keys must name an entry
+    // id and each grant list must be non-empty (plugin_set.rs:85-100).
+    const grants = spec?.capabilityGrants;
+    if (grants && typeof grants === "object" && !Array.isArray(grants)) {
+        for (const id of Object.keys(grants)) {
+            if (!ids.has(id)) f.push({ rule: "pluginSet.capabilityGrants.unknownId", message: `capabilityGrants['${id}'] names an id not in entries` });
+            else if (!Array.isArray(grants[id]) || grants[id].length === 0) f.push({ rule: "pluginSet.capabilityGrants.empty", message: `capabilityGrants['${id}'] must not be empty` });
+        }
+    }
+    return f;
+}
+
+export function validateRevocationListSpec(spec: any): Finding[] {
+    const f: Finding[] = [];
+    if (spec?.version !== 1) f.push({ rule: "revocationList.version", message: "version must be 1" });
+    const revs: any[] = spec?.revocations ?? [];
+    for (const r of revs) {
+        if (!isSha256Hex(String(r?.artifactSha256 ?? ""))) {
+            f.push({ rule: "revocationList.sha256", message: "artifactSha256 must be 64 hex chars" });
+        }
+        // empty reason defeats the audit trail (revocation_list.rs:86).
+        if (blank(r?.reason)) {
+            f.push({ rule: "revocationList.reason", message: "revocation reason must not be empty" });
+        }
+    }
+    // dedup is case-insensitive in the operator (hashes lowercased), so ABCD…
+    // and abcd… collide.
+    const dups = findDuplicates(revs, (r) => String(r?.artifactSha256 ?? "").toLowerCase());
+    if (dups.length) f.push({ rule: "revocationList.noDuplicates", message: `duplicate hashes: ${dups.join(",")}` });
+    return f;
+}
+
+/** Mirrors the MCPGCluster admission rules (validators/cluster.rs). */
+export function validateClusterSpec(spec: any): Finding[] {
+    const f: Finding[] = [];
+    const backend: string = spec?.backend ?? "single_node";
+    const singleNode = backend === "" || backend === "single_node";
+    const configEmpty = !spec?.config || Object.keys(spec.config).length === 0;
+    if (singleNode && !configEmpty) {
+        f.push({ rule: "cluster.singleNode.noConfig", message: "spec.config must be empty for the single_node backend (it takes no parameters)" });
+    }
+    if (!singleNode && configEmpty) {
+        f.push({ rule: "cluster.backend.configRequired", message: "spec.config must not be empty for an external backend — it needs at least a connection address" });
+    }
+    // Transport security: reject a plaintext coordinator unless opted out
+    // with `spec.config.allow_insecure_transport: true`. Mirrors the gateway
+    // boot guard + the operator admission webhook (validators/cluster.rs).
+    if (!singleNode && !configEmpty && spec?.config?.allow_insecure_transport !== true) {
+        const c = spec.config;
+        const lead = (s: any) => (typeof s === "string" ? s.replace(/^\s+/, "") : "");
+        let insecure: string | null = null;
+        if (backend === "redis" && lead(c?.url).startsWith("redis://")) {
+            insecure = "the redis `url` uses the plaintext `redis://` scheme (use `rediss://`)";
+        } else if (backend === "consul" && lead(c?.address).startsWith("http://")) {
+            insecure = "the consul `address` uses the plaintext `http://` scheme (use `https://`)";
+        } else if (backend === "etcd" && Array.isArray(c?.endpoints) &&
+                   c.endpoints.some((e: any) => !lead(e).startsWith("https://"))) {
+            insecure = "an etcd `endpoint` is not an `https://` URL (use `https://`)";
+        } else if (backend === "nats" && c?.tls?.require_tls === false) {
+            insecure = "nats `tls.require_tls` is set to `false` (plaintext)";
+        }
+        if (insecure) {
+            f.push({ rule: "cluster.transport.insecure", message: `spec.config: ${insecure}. Set spec.config.allow_insecure_transport: true to accept plaintext (local/dev only).` });
+        }
+    }
+    const seen = new Set<string>();
+    const refs: any[] = spec?.credentialRefs ?? [];
+    refs.forEach((c, i) => {
+        if (blank(c?.name)) {
+            f.push({ rule: "cluster.credentialRefs.name", message: `spec.credentialRefs[${i}].name must not be empty` });
+            return;
+        }
+        if (blank(c?.secretName)) {
+            f.push({ rule: "cluster.credentialRefs.secretName", message: `spec.credentialRefs[${i}].secretName must not be empty` });
+        }
+        if (seen.has(c.name)) {
+            f.push({ rule: "cluster.credentialRefs.uniqueName", message: `spec.credentialRefs name '${c.name}' is duplicated` });
+        }
+        seen.add(c.name);
+    });
+    return f;
+}
+
+/** Mirrors the MCPGRoute admission rules (validators/route.rs). Tenant-unset is
+ * an admit-with-warning in the webhook, so it is NOT a reject here. */
+export function validateRouteSpec(spec: any): Finding[] {
+    const f: Finding[] = [];
+    if (blank(spec?.gatewayRef?.name)) f.push({ rule: "route.gatewayRef.name", message: "spec.gatewayRef.name must not be empty" });
+    const tools: any[] = spec?.match?.tools ?? [];
+    if (tools.length === 0) f.push({ rule: "route.match.tools.nonEmpty", message: "spec.match.tools must list at least one tool" });
+    const seen = new Set<string>();
+    tools.forEach((t, i) => {
+        const id = typeof t?.id === "string" ? t.id.trim() : "";
+        if (id === "") {
+            f.push({ rule: "route.match.tools.id", message: `spec.match.tools[${i}].id must not be empty` });
+            return;
+        }
+        if (seen.has(id)) f.push({ rule: "route.match.tools.uniqueId", message: `spec.match.tools contains duplicate tool id '${id}'` });
+        seen.add(id);
+    });
+    for (const chain of ["identityChain", "policyChain", "auditChain"]) {
+        const ids: any[] = spec?.[chain] ?? [];
+        ids.forEach((id, i) => {
+            if (blank(id)) f.push({ rule: "route.chain.nonEmptyId", message: `spec.${chain}[${i}] must not be empty` });
+        });
+    }
+    return f;
+}
+
+/** Mirrors the MCPGTenant admission rules (validators/tenant.rs). */
+export function validateTenantSpec(spec: any): Finding[] {
+    const f: Finding[] = [];
+    const namespaces: any[] = spec?.namespaces ?? [];
+    if (namespaces.length === 0) f.push({ rule: "tenant.namespaces.nonEmpty", message: "spec.namespaces must not be empty" });
+    const seen = new Set<string>();
+    for (const ns of namespaces) {
+        if (blank(ns)) {
+            f.push({ rule: "tenant.namespaces.nonEmptyEntry", message: "spec.namespaces[] entries must not be empty" });
+            continue;
+        }
+        if (seen.has(ns)) f.push({ rule: "tenant.namespaces.unique", message: `spec.namespaces lists '${ns}' more than once` });
+        seen.add(ns);
+    }
+    (spec?.allowedPlugins ?? []).forEach((a: any, i: number) => {
+        const nameSet = !blank(a?.name);
+        const prefixSet = !blank(a?.registryPrefix);
+        if (!nameSet && !prefixSet) f.push({ rule: "tenant.allowedPlugins.matcher", message: `spec.allowedPlugins[${i}] must set name or registryPrefix` });
+    });
+    if (spec?.quotas) {
+        for (const field of ["maxGateways", "maxPluginSets", "maxRoutes", "maxReplicasPerGateway"]) {
+            const v = spec.quotas[field];
+            if (typeof v === "number" && v < 0) f.push({ rule: "tenant.quotas.nonNegative", message: `spec.quotas.${field} must be ≥ 0` });
+        }
+    }
+    if (spec?.identityAttribute && blank(spec.identityAttribute.key)) {
+        f.push({ rule: "tenant.identityAttribute.key", message: "spec.identityAttribute.key must not be empty when set" });
+    }
+    return f;
+}
+
+/** Mirrors the MCPGPluginMirror admission rules (validators/plugin_mirror.rs). */
+export function validatePluginMirrorSpec(spec: any): Finding[] {
+    const f: Finding[] = [];
+    const svc = spec?.endpoint?.service ?? {};
+    if (blank(svc.namespace)) f.push({ rule: "pluginMirror.endpoint.service.namespace", message: "spec.endpoint.service.namespace must not be empty" });
+    if (blank(svc.name)) f.push({ rule: "pluginMirror.endpoint.service.name", message: "spec.endpoint.service.name must not be empty" });
+    if (!svc.port) f.push({ rule: "pluginMirror.endpoint.service.port", message: "spec.endpoint.service.port must be in 1..=65535" });
+    const up = spec?.upstream ?? {};
+    if (blank(up.registry)) {
+        f.push({ rule: "pluginMirror.upstream.registry", message: "spec.upstream.registry must not be empty" });
+    } else if (!up.registry.includes(".") && !up.registry.includes(":")) {
+        f.push({ rule: "pluginMirror.upstream.registryHost", message: `spec.upstream.registry '${up.registry}' does not look like a registry host` });
+    }
+    if (blank(up.namespace)) f.push({ rule: "pluginMirror.upstream.namespace", message: "spec.upstream.namespace must not be empty" });
+    if (spec?.auth && blank(spec.auth.secretRef?.secretName)) {
+        f.push({ rule: "pluginMirror.auth.secretName", message: "spec.auth.secretRef.secretName must not be empty when auth is set" });
+    }
+    return f;
+}
+
+/** Dispatch by Pulumi resource type token (…:MCPGGateway etc.). */
+export function validateByType(type: string, spec: any): Finding[] {
+    if (type.endsWith(":MCPGGateway")) return validateGatewaySpec(spec);
+    if (type.endsWith(":MCPGPlugin")) return validatePluginSpec(spec);
+    if (type.endsWith(":MCPGPluginSet")) return validatePluginSetSpec(spec);
+    if (type.endsWith(":MCPGRevocationList")) return validateRevocationListSpec(spec);
+    if (type.endsWith(":MCPGCluster")) return validateClusterSpec(spec);
+    if (type.endsWith(":MCPGRoute")) return validateRouteSpec(spec);
+    if (type.endsWith(":MCPGTenant")) return validateTenantSpec(spec);
+    if (type.endsWith(":MCPGPluginMirror")) return validatePluginMirrorSpec(spec);
+    return [];
+}

package/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "es2020",
+    "module": "commonjs",
+    "moduleResolution": "node",
+    "declaration": true,
+    "outDir": "bin",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src/**/*.ts"]
+}