@namzu/sandbox 14.0.0 → 16.0.0

package/dist/backends/kubernetes/egress-policy.js

@@ -76,11 +76,470 @@
  * the kernel, not by the workload's cooperation.
  */
 import { isDeepStrictEqual } from 'node:util';
+// The policy-enumeration and shape-reading primitives, shared with the
+// ingress direction. There is one enumeration of the policies selecting a pod
+// in this package and one reading of what a peer is; see that module's
+// "Shared with the egress direction".
+import { UnreadPolicyCollection, ciliumIdentityLabels, ciliumSelectorKey, corePeerIsWideOpen, formatLabels, isRecord, listPolicies, matchesLabelSelector, policyName, readList, selectorIsReadable, } from './ingress-policy.js';
 import { KubernetesAlreadyGoneError } from './k8s-client.js';
-import { CILIUM_NETWORK_POLICY_API_GROUP, CILIUM_NETWORK_POLICY_API_VERSION, CORE_NETWORK_POLICY_API_GROUP, CORE_NETWORK_POLICY_API_VERSION, ciliumNetworkPolicyPath, networkPolicyPath, sandboxTemplateLabel, } from './objects.js';
-/** `${sandboxTemplateName}-egress`, the name {@link KubernetesEgressConfig.networkPolicyName} defaults to. */
-export function defaultEgressPolicyName(sandboxTemplateName) {
-    return `${sandboxTemplateName}-egress`;
+import { CILIUM_NETWORK_POLICY_API_GROUP, CILIUM_NETWORK_POLICY_API_VERSION, CORE_NETWORK_POLICY_API_GROUP, CORE_NETWORK_POLICY_API_VERSION, SANDBOX_TEMPLATE_LABEL_KEY, ciliumNetworkPolicyCollectionPath, ciliumNetworkPolicyPath, networkPolicyCollectionPath, networkPolicyPath, sandboxTemplateLabel, } from './objects.js';
+/**
+ * Default {@link KubernetesEgressConfig.profileLabelKey} — this backend's
+ * own label domain, matching `SANDBOX_TEMPLATE_LABEL_KEY`'s prefix so
+ * every label a namzu host puts on a sandbox pod reads as one family.
+ *
+ * It is deliberately NOT upstream's `sandbox.users.io`: a key in someone
+ * else's domain is a key someone else may define differently. The cost is
+ * the ConfigMap edit named on {@link KubernetesEgressConfig.profile}, and
+ * the controller's refusal spells that edit out itself.
+ */
+export const DEFAULT_EGRESS_PROFILE_LABEL_KEY = 'sandbox.namzu.ai/egress-profile';
+/**
+ * Kubernetes' own label-value grammar, narrowed to DNS-1123: lowercase
+ * alphanumerics and `-`, starting and ending alphanumeric, at most 63
+ * characters.
+ *
+ * Narrower than what a label value may legally hold (`_` and `.` are legal
+ * there, and uppercase is too) because the profile is also a NAME: it goes
+ * into `${template}-${profile}-egress`, which has to be a legal object name,
+ * and a value that is legal as a label but not as a name would produce a
+ * policy an operator cannot apply.
+ */
+const DNS_1123_LABEL = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/;
+/**
+ * A label KEY: an optional DNS-subdomain prefix, a `/`, then a name segment
+ * of at most 63 characters. Exactly what the API server enforces, checked
+ * here so a typo is refused during host wiring rather than as a claim the
+ * controller rejects one round trip later.
+ */
+const LABEL_KEY_NAME = /^[A-Za-z0-9]([-A-Za-z0-9_.]{0,61}[A-Za-z0-9])?$/;
+const LABEL_KEY_PREFIX = /^[a-z0-9]([-a-z0-9.]{0,251}[a-z0-9])?$/;
+/**
+ * Named refusal for an egress PROFILE this backend can read but not use.
+ * Sibling of {@link KubernetesEgressPolicyConfigError} rather than a reuse of
+ * it: that one names a field under `config.egress.policy` and this one names
+ * a field beside it, and an operator reading either should not have to work
+ * out which level of the config the path belongs to.
+ *
+ * Thrown SYNCHRONOUSLY from `buildKubernetesBackend` and
+ * `createKubernetesWorkspace`, so a misconfigured profile surfaces during
+ * host wiring rather than on the first `create()`.
+ */
+export class KubernetesEgressProfileConfigError extends Error {
+    field;
+    value;
+    name = 'KubernetesEgressProfileConfigError';
+    constructor(field, value, reason) {
+        super(`kubernetes: config.egress.${field} is unusable: ${JSON.stringify(value)} ${reason}. The profile travels onto a SandboxClaim's additionalPodMetadata.labels, onto a directly created Sandbox's pod template and into the translated policy's own selector, so a value the API server would reject leaves either a claim nothing binds or a policy nobody can apply. Refusing here rather than emitting it.`);
+        this.field = field;
+        this.value = value;
+    }
+}
+/**
+ * The profile label this config asks for, or nothing at all — the ONE place
+ * the key/value pair is derived, so the claim body, the Sandbox pod
+ * template, the policy selector and the policy name cannot disagree about
+ * what the profile is.
+ *
+ * Validates as it resolves: the value has to be a DNS-1123 label and the key
+ * a legal label key, both refused with {@link KubernetesEgressProfileConfigError}.
+ */
+export function egressProfileLabel(egress) {
+    // The KEY is validated whenever it is present, profile or no profile. A
+    // key set without a value is a half-finished configuration — the value is
+    // usually the next line someone writes — and reporting the typo only once
+    // the profile arrives is reporting it at the second edit rather than the
+    // first.
+    const configured = egress?.profileLabelKey;
+    if (configured !== undefined)
+        assertUsableProfileLabelKey(configured);
+    const value = egress?.profile;
+    if (value === undefined)
+        return undefined;
+    if (!DNS_1123_LABEL.test(value)) {
+        throw new KubernetesEgressProfileConfigError('profile', value, 'is not a DNS-1123 label (lowercase letters, digits and dashes, starting and ending alphanumeric, at most 63 characters)');
+    }
+    const key = configured ?? DEFAULT_EGRESS_PROFILE_LABEL_KEY;
+    return { key, value };
+}
+/**
+ * Why a label KEY is unusable, or `undefined` when it is fine — the grammar
+ * half of the two checks below, shared because the API server's rule is the
+ * same whichever of this backend's label keys is being configured and two
+ * spellings of it would be two rules.
+ */
+function labelKeyProblem(key) {
+    const slash = key.indexOf('/');
+    const name = slash === -1 ? key : key.slice(slash + 1);
+    const prefix = slash === -1 ? undefined : key.slice(0, slash);
+    if (!LABEL_KEY_NAME.test(name) ||
+        (prefix !== undefined && !LABEL_KEY_PREFIX.test(prefix)) ||
+        key.indexOf('/', slash + 1) !== -1) {
+        return 'is not a Kubernetes label key (an optional DNS-subdomain prefix, a single slash, then a name of at most 63 characters)';
+    }
+    return undefined;
+}
+/**
+ * Refuse a `profileLabelKey` the API server would not take, or that this
+ * backend already uses for something else.
+ */
+function assertUsableProfileLabelKey(key) {
+    const problem = labelKeyProblem(key);
+    if (problem !== undefined) {
+        throw new KubernetesEgressProfileConfigError('profileLabelKey', key, problem);
+    }
+    // The one legal key that must not be used: it is the key this backend
+    // stamps the SandboxTemplate name under, and the profile label is applied
+    // LAST (see `sandboxPodLabels`), so this key would overwrite the template
+    // label on every pod this backend creates — and the translated policy's
+    // selector, built from the same resolution, would agree with it. Both
+    // halves would be wrong together, which is exactly the shape nothing else
+    // would catch.
+    if (key === SANDBOX_TEMPLATE_LABEL_KEY) {
+        throw new KubernetesEgressProfileConfigError('profileLabelKey', key, 'is the key this backend writes the SandboxTemplate name under, and a profile label is applied last — a pod would carry the profile value where its template label belongs, and the policy selector built from the same resolution would match it anyway');
+    }
+}
+/**
+ * Validate the profile without needing its value — the wiring-time hook, so
+ * `buildKubernetesBackend` and `createKubernetesWorkspace` refuse a bad
+ * profile the same moment they refuse an unenforceable policy.
+ */
+export function assertEgressProfileIsUsable(egress) {
+    egressProfileLabel(egress);
+}
+/**
+ * Default {@link KubernetesPerSandboxEgressConfig.labelKey} — the key the
+ * per-sandbox policy's `endpointSelector` matches on.
+ *
+ * In this backend's own label domain, for the same reason the profile key is
+ * (see {@link DEFAULT_EGRESS_PROFILE_LABEL_KEY}), and carrying the same
+ * operator prerequisite: the controller's `allowed-label-domains` allowlist
+ * has to admit `sandbox.namzu.ai`, or every claim carrying it is refused with
+ * {@link KubernetesPodLabelsRejectedError} as the cause. A deployment that
+ * would rather not edit that ConfigMap sets this to a key under
+ * `sandbox.users.io`, which is upstream's own default domain.
+ */
+export const DEFAULT_PER_SANDBOX_EGRESS_LABEL_KEY = 'sandbox.namzu.ai/per-sandbox-egress';
+/**
+ * Named refusal for a `config.egress.perSandbox` this backend can read but
+ * not honour. Thrown SYNCHRONOUSLY from `buildKubernetesBackend`, beside the
+ * policy and profile refusals, so a host that has mis-declared the capability
+ * learns it during wiring rather than from the first `setNetworkPolicy` call
+ * — which may be an hour into a run, after work that cannot be redone.
+ *
+ * Its own class rather than a reuse of {@link KubernetesEgressProfileConfigError}
+ * for the reason that one is not a reuse of
+ * {@link KubernetesEgressPolicyConfigError}: an operator reading a refusal
+ * should not have to work out which level of `config.egress` the named field
+ * belongs to.
+ */
+export class KubernetesPerSandboxEgressConfigError extends Error {
+    field;
+    value;
+    name = 'KubernetesPerSandboxEgressConfigError';
+    constructor(field, value, reason) {
+        super(`kubernetes: config.egress.perSandbox.${field} is unusable: ${JSON.stringify(value)} ${reason}. Per-sandbox egress writes one CiliumNetworkPolicy per live sandbox, selected by a per-sandbox pod label and fenced by an operator-applied ValidatingAdmissionPolicy, so a value this backend cannot honour would leave either a policy that selects nothing or a write the fence refuses. Refusing during host wiring rather than at the first setNetworkPolicy call.`);
+        this.field = field;
+        this.value = value;
+    }
+}
+/**
+ * The per-sandbox selector label KEY this config asks for, or nothing at all
+ * when `perSandbox` is unset — the one place the default is applied, so the
+ * pod label, the policy selector and the admission policy's own expectation
+ * cannot disagree.
+ *
+ * Validates as it resolves, exactly as {@link egressProfileLabel} does.
+ */
+export function perSandboxEgressLabelKey(egress) {
+    const perSandbox = egress?.perSandbox;
+    if (perSandbox === undefined)
+        return undefined;
+    const key = perSandbox.labelKey ?? DEFAULT_PER_SANDBOX_EGRESS_LABEL_KEY;
+    const problem = labelKeyProblem(key);
+    if (problem !== undefined) {
+        throw new KubernetesPerSandboxEgressConfigError('labelKey', key, problem);
+    }
+    if (key === SANDBOX_TEMPLATE_LABEL_KEY) {
+        throw new KubernetesPerSandboxEgressConfigError('labelKey', key, 'is the key this backend writes the SandboxTemplate name under, so a pod would carry a sandbox name where its template label belongs and every policy selecting the template would stop selecting it');
+    }
+    // The profile's key is refused from the other direction too — see
+    // `composeAdditionalPodLabels` — but naming it HERE names the field a
+    // reader has to change, which the generic collision message cannot.
+    const profile = egressProfileLabel(egress);
+    if (profile !== undefined && key === profile.key) {
+        throw new KubernetesPerSandboxEgressConfigError('labelKey', key, 'is also config.egress.profileLabelKey, and both are written into the SAME pod-label map — one value would silently replace the other, and whichever lost would be a label a policy selector still expects');
+    }
+    return key;
+}
+/**
+ * Validate `config.egress.perSandbox` in full — the wiring-time hook, so a
+ * mis-declared capability is refused the same moment an unenforceable policy
+ * or an unusable profile is.
+ *
+ * `engine: 'core'` is the refusal the SDK's contract cares about: core
+ * `NetworkPolicy` cannot express a hostname at all, so a host that configured
+ * it would be told "policy applied" about an object that could never carry
+ * the allowlist. It is refused here rather than from the method, which means
+ * a `'core'` deployment never gets a handle carrying the method in the first
+ * place.
+ */
+export function assertPerSandboxEgressIsUsable(egress) {
+    const perSandbox = egress?.perSandbox;
+    if (perSandbox === undefined)
+        return;
+    if (perSandbox.engine !== 'cilium') {
+        throw new KubernetesPerSandboxEgressConfigError('engine', perSandbox.engine, "is not 'cilium'; a per-sandbox allowlist is a list of HOSTNAMES, and core NetworkPolicy has only ipBlock, podSelector and namespaceSelector — it has no hostname concept to translate one into");
+    }
+    // `admissionPolicyName` is REQUIRED by the type; the cast is for the
+    // caller reaching here from JavaScript, or through a cast of its own.
+    // There is no default and there must not be one: the fence is what makes
+    // the policy-write RBAC safe to grant, and a host that could skip naming
+    // it would hold create/patch/delete on every CiliumNetworkPolicy in the
+    // namespace with nothing bounding what it writes.
+    const names = [
+        ['admissionPolicyName', perSandbox.admissionPolicyName, true],
+        ['admissionPolicyBindingName', perSandbox.admissionPolicyBindingName, false],
+    ];
+    for (const [field, value, required] of names) {
+        if (value === undefined) {
+            if (!required)
+                continue;
+            throw new KubernetesPerSandboxEgressConfigError(field, '', 'is required, and has no default: an unnamed fence is an unchecked one');
+        }
+        if (value === '' || value.trim() !== value) {
+            throw new KubernetesPerSandboxEgressConfigError(field, value, 'is not an object name (an empty or space-padded name matches nothing, so the fence check would refuse every write)');
+        }
+    }
+    if (perSandbox.narrowing !== undefined) {
+        assertCiliumNarrowingIsUsable(perSandbox.narrowing, 'perSandbox.narrowing');
+    }
+    perSandboxEgressLabelKey(egress);
+}
+/**
+ * Named refusal for `config.egress.perSandbox` reaching an entry point that
+ * can never carry the capability it configures: `createKubernetesWorkspace`.
+ *
+ * `perSandbox` exists to make `Sandbox.setNetworkPolicy` PRESENT on a TASK
+ * handle, where the acquire creates the object each policy is named after and
+ * owned by and stamps the per-sandbox pod label its selector matches, and
+ * where the RBAC and the admission fence are the ones that bound the write.
+ * A workspace's create path does none of that — it composes no per-sandbox
+ * pod label and tracks no owner uid for one — so on that path the option
+ * would be accepted and mean nothing at all: exactly the "declared and
+ * silently unused" configuration this module refuses everywhere else. The
+ * alternative, omitting the method and saying nothing, is how a host comes to
+ * believe it narrowed a workspace's egress.
+ *
+ * NOT a variant of {@link KubernetesPerSandboxEgressConfigError}, which is
+ * about a `perSandbox` value this backend cannot honour ANYWHERE (an engine
+ * with no hostname concept, an unnamed fence). This one is about a `perSandbox`
+ * value it honours perfectly well on the other entry point, so a caller
+ * catching the sibling for a typo'd value does not also catch a correct
+ * configuration aimed at the wrong path.
+ */
+export class KubernetesWorkspacePerSandboxEgressConfigError extends Error {
+    name = 'KubernetesWorkspacePerSandboxEgressConfigError';
+    constructor() {
+        super(`kubernetes: config.egress.perSandbox is set, but a KubernetesWorkspace cannot carry the capability it configures: Sandbox.setNetworkPolicy is implemented on a TASK handle, whose acquire creates the object each per-sandbox policy is named after and owned by and stamps the pod label its selector matches, while a workspace's create path composes no per-sandbox pod label and tracks no owner uid for one. Accepting the option here would declare a capability this path never serves — the silent downgrade this backend refuses on every other entry point — so it is refused before anything is sent. Drop egress.perSandbox from the configuration workspaces are created from (a backend serving task sandboxes can keep it), or create a task sandbox with it, where the method is present.`);
+    }
+}
+/**
+ * Refuse `config.egress.perSandbox` on the entry point that cannot carry it —
+ * `createKubernetesWorkspace`. See
+ * {@link KubernetesWorkspacePerSandboxEgressConfigError}.
+ *
+ * Deliberately not {@link assertPerSandboxEgressIsUsable}, which validates the
+ * same config for the path that DOES honour it: a workspace has nothing to
+ * validate the option for, whatever its `engine` or `admissionPolicyName` say,
+ * because it serves no `setNetworkPolicy` at all. Calling that validator here
+ * instead would be worse than saying nothing — it would report a
+ * `perSandbox` this deployment can use as if it were in use.
+ */
+export function assertWorkspaceCarriesNoPerSandboxEgress(egress) {
+    if (egress?.perSandbox === undefined)
+        return;
+    throw new KubernetesWorkspacePerSandboxEgressConfigError();
+}
+/**
+ * The ONE composer for a sandbox pod's `additionalPodMetadata.labels`.
+ *
+ * Every label this backend asks the controller to put on a POD is built
+ * here: the egress profile today, and whatever a later capability
+ * contributes through `extra` (a per-sandbox policy selector, for one). Two
+ * independent constructions would be two answers to "what labels is this pod
+ * selected by", and the policy selector is built from the same resolution —
+ * so a second builder would be a pod bound under a policy nobody checked.
+ *
+ * Deliberately NOT where `KubernetesBackendInternalConfig.claimLabels`
+ * goes. Those are a host's own bookkeeping on the CLAIM object's
+ * `metadata.labels`; putting them on the pod would change what selectors
+ * match a running sandbox, which is a different question on a different
+ * object.
+ *
+ * Returns an empty object when nothing applies, which every caller reads as
+ * "emit nothing at all" — that is what keeps an unprofiled body byte-identical.
+ *
+ * A key in `extra` that is ALSO the profile's is refused rather than merged
+ * either way round. Whichever won, the loser would be a label the translated
+ * policy's selector still expects: the profile's selector is built from this
+ * same resolution, so a pod carrying the other value is selected by no
+ * per-profile policy while `create()` reported the boundary verified. It is
+ * the same failure {@link egressProfileLabel} refuses the template key for,
+ * reached from the other direction.
+ */
+export function composeAdditionalPodLabels(egress, extra) {
+    const profile = egressProfileLabel(egress);
+    if (profile !== undefined && extra !== undefined && profile.key in extra) {
+        throw new KubernetesEgressProfileConfigError('profileLabelKey', profile.key, `is also the key another capability contributes to the same pod-label map (as ${JSON.stringify(extra[profile.key])}), and one of the two values would silently replace the other`);
+    }
+    return {
+        ...(profile !== undefined ? { [profile.key]: profile.value } : {}),
+        ...extra,
+    };
+}
+/**
+ * Why a claim the controller refused with `InvalidMetadata` was refused, in
+ * this backend's own terms — in practice a pod label whose domain is not in
+ * the controller's `allowed-label-domains` allowlist, which today means the
+ * egress profile's.
+ *
+ * NOT what an acquire throws. A refused claim comes out of `create()` as
+ * `KubernetesAcquireError { reason: 'claim-rejected' }` whether or not a
+ * profile is configured — one condition, one taxonomy, one `catch` — and this
+ * rides as that error's `cause`. Two classes for one controller condition
+ * would make a host's error handling correct or incorrect depending on
+ * whether `config.egress.profile` happened to be set.
+ *
+ * What it adds to the acquire error is what the controller cannot know: the
+ * map this backend actually sent, and the `config.egress.profileLabelKey`
+ * that moves the offending key to an allowed domain. It carries the whole map
+ * rather than the profile alone, and `profile` is optional, because the map is
+ * {@link composeAdditionalPodLabels}'s — the profile is the only thing in it
+ * today, and a later capability adding a second key would otherwise get an
+ * explanation that named a label it did not send.
+ *
+ * It carries the controller's OWN `reason` and `message` rather than a
+ * translation of them: the message agent-sandbox v1.0.2 writes names the
+ * offending key, the domain, the ConfigMap key to edit and its default, and
+ * no paraphrase of it would be as useful. Measured verbatim against a kind
+ * cluster running that controller:
+ *
+ * > invalid additionalPodMetadata: failed to validate label
+ * > "sandbox.namzu.ai/egress-profile": label domain "sandbox.namzu.ai" is
+ * > not in the allowlist (configure the allowed-label-domains key of the
+ * > agent-sandbox-config ConfigMap in the controller namespace; default:
+ * > sandbox.users.io)
+ *
+ * The refusal is raised as soon as that condition is read rather than after
+ * the readiness budget, because `InvalidMetadata` is one of
+ * `TERMINAL_CLAIM_REASONS` — nothing about it becomes true by waiting — and
+ * the claim is deleted on the way out, so a misconfigured profile costs one
+ * round trip rather than a minute of polling.
+ */
+export class KubernetesPodLabelsRejectedError extends Error {
+    requestedPodLabels;
+    claimName;
+    namespace;
+    controllerReason;
+    controllerMessage;
+    profile;
+    name = 'KubernetesPodLabelsRejectedError';
+    constructor(
+    /** Every label this backend put on the claim's `additionalPodMetadata`. */
+    requestedPodLabels, claimName, namespace, 
+    /** The controller's own condition `reason`, e.g. `InvalidMetadata`. */
+    controllerReason, 
+    /** The controller's own condition `message`, verbatim. */
+    controllerMessage, 
+    /** The egress profile among those labels, when one is configured. */
+    profile) {
+        super(`kubernetes: the controller refused SandboxClaim ${claimName} in namespace ${namespace} carrying the pod labels ${formatLabels(requestedPodLabels)} — ${controllerReason}: ${controllerMessage}. Those labels are written onto the claim's additionalPodMetadata.labels, so each key's domain has to appear in the controller's allowed-label-domains allowlist; add it there, or move the offending key to a domain that is already allowed${profile === undefined ? '' : ` (config.egress.profileLabelKey, for the egress profile ${profile.key}=${profile.value})`}. The claim has been deleted.`);
+        this.requestedPodLabels = requestedPodLabels;
+        this.claimName = claimName;
+        this.namespace = namespace;
+        this.controllerReason = controllerReason;
+        this.controllerMessage = controllerMessage;
+        this.profile = profile;
+    }
+}
+/**
+ * Named refusal for a bound pod that never carried a label this backend asked
+ * the controller to put on it — the egress profile's, today the only one
+ * {@link composeAdditionalPodLabels} produces, which is why the class is named
+ * for the LABEL rather than for the profile.
+ *
+ * This is the one failure this capability must not have quietly. An
+ * unlabelled pod handed back is a sandbox running under the DEFAULT policy
+ * while the host believes it is on a narrower profile — the translated
+ * policy's selector includes the profile label, so a pod without it is
+ * selected by neither this profile's policy nor, necessarily, anything else.
+ * Refusing is correct and waiting is correct; proceeding is not, so the
+ * acquire releases what it claimed and raises this instead.
+ *
+ * `missingLabel` is the pair that never arrived rather than "the profile", so
+ * the refusal stays true for whatever a later capability contributes to that
+ * same map: the wait in `readAddressedPod` already covers every entry of it,
+ * and this refusal covers exactly the same set.
+ */
+export class KubernetesPodLabelNotObservedError extends Error {
+    missingLabel;
+    subject;
+    observedLabels;
+    name = 'KubernetesPodLabelNotObservedError';
+    constructor(
+    /** The label this backend requested and never saw on the bound pod. */
+    missingLabel, subject, observedLabels) {
+        super(`kubernetes: refusing ${subject} — its pod never carried the label ${missingLabel.key}=${missingLabel.value} this backend asked the controller to put on it, within the readiness budget; the labels it did carry are ${formatLabels(observedLabels)}. The translated policy's selector includes that label, so admitting this pod would run it under whatever policy DOES select it rather than under the configured profile. The controller patches a claim's additionalPodMetadata.labels onto the pod it binds — a pod that never got them means the claim's metadata was not applied. Nothing was handed back and the claim was released.`);
+        this.missingLabel = missingLabel;
+        this.subject = subject;
+        this.observedLabels = observedLabels;
+    }
+}
+/** `true` unless the deployment asked for the single-object check by name. */
+export function egressUnionVerificationEnabled(egress) {
+    return egress !== undefined && egress.verify !== 'named-object-only';
+}
+/**
+ * What a translated policy's `podSelector`/`endpointSelector` matches: the
+ * template label, plus the profile label when one is configured. One
+ * function so the two manifest builders below and every reader of a
+ * translation agree on the selector down to the key order.
+ */
+export function egressPolicySelectorLabels(target) {
+    return {
+        ...sandboxTemplateLabel(target.sandboxTemplateName),
+        ...(target.profile !== undefined ? { [target.profile.key]: target.profile.value } : {}),
+    };
+}
+/**
+ * The longest name a Kubernetes object may carry. A `NetworkPolicy` name is a
+ * DNS subdomain, so 253 characters, and the API server refuses anything
+ * longer.
+ */
+const MAX_OBJECT_NAME_LENGTH = 253;
+/**
+ * `${sandboxTemplateName}-egress`, the name
+ * {@link KubernetesEgressConfig.networkPolicyName} defaults to — or
+ * `${sandboxTemplateName}-${profile}-egress` when a profile is configured,
+ * because one template under two profiles needs two policy objects and a
+ * single default name would have the second silently verify against the
+ * first's manifest.
+ *
+ * The profile is bounded at 63 characters on its own, but the CONCATENATION
+ * is what has to be a legal object name, and only this function knows both
+ * halves. Refused here, during host wiring, rather than as an API-server
+ * rejection on the first policy GET of the first `create()`: `networkPolicyName`
+ * is the way out and it is a config field, so this is a config error.
+ */
+export function defaultEgressPolicyName(sandboxTemplateName, profile) {
+    if (profile === undefined)
+        return `${sandboxTemplateName}-egress`;
+    const name = `${sandboxTemplateName}-${profile}-egress`;
+    if (name.length > MAX_OBJECT_NAME_LENGTH) {
+        throw new KubernetesEgressProfileConfigError('profile', profile, `makes the default egress policy name ${JSON.stringify(name)} ${name.length} characters long, past the ${MAX_OBJECT_NAME_LENGTH} an object name may carry — shorten the profile or the SandboxTemplate name, or set config.egress.networkPolicyName yourself`);
+    }
+    return name;
 }
 /**
  * Named refusal for a hostname allowlist with no FQDN-capable engine
@@ -97,18 +556,270 @@ export class KubernetesUnenforceableEgressPolicyError extends Error {
         this.policyKind = policyKind;
     }
 }
+/**
+ * Named refusal for a config value this backend can read but not use — today
+ * only a `public-internet` `exceptCidrs` entry that is not a CIDR. Thrown
+ * SYNCHRONOUSLY from `buildKubernetesBackend`, beside
+ * {@link KubernetesUnenforceableEgressPolicyError}, so a typo surfaces
+ * during host wiring rather than as a policy the API server rejects when an
+ * operator applies it.
+ */
+export class KubernetesEgressPolicyConfigError extends Error {
+    field;
+    name = 'KubernetesEgressPolicyConfigError';
+    constructor(field, reason) {
+        // `field` is relative to `config.egress`, not to `config.egress.policy`:
+        // the fields that land here live at BOTH levels — `policy.exceptCidrs`
+        // on the policy, `ciliumNarrowing` and `perSandbox.narrowing` beside
+        // it — and a prefix that assumed one of them sent a reader to a key
+        // that does not exist.
+        super(`kubernetes: config.egress.${field} is unusable: ${reason}`);
+        this.field = field;
+    }
+}
+/**
+ * Named refusal for `config.egress.ciliumNarrowing` set on a policy/engine
+ * combination it does not apply to. Thrown SYNCHRONOUSLY from
+ * {@link assertEgressPolicyIsEnforceable}, beside
+ * {@link KubernetesUnenforceableEgressPolicyError}, so a narrowing option
+ * that would silently do nothing is refused at host-wiring time rather than
+ * accepted and ignored.
+ */
+export class KubernetesEgressNarrowingUnsupportedError extends Error {
+    policyKind;
+    engine;
+    name = 'KubernetesEgressNarrowingUnsupportedError';
+    constructor(policyKind, engine) {
+        super(`kubernetes: config.egress.ciliumNarrowing is set, but config.egress.policy is '${policyKind}' under engine ${JSON.stringify(engine)}. Port, DNS-name and TLS-server-name narrowing only apply to a 'static' or 'resolver' hostname allowlist under engine: 'cilium' — set engine: 'cilium' with one of those policy kinds, or remove ciliumNarrowing. Refusing rather than silently ignoring an option that would never be applied.`);
+        this.policyKind = policyKind;
+        this.engine = engine;
+    }
+}
+/**
+ * The grammar a host refusal closes with: what an `allowedHosts` entry is.
+ * Every translation in this module implements it, which is why nothing turns
+ * it off — see {@link KubernetesNetworkPolicyHostError}.
+ */
+const HOSTNAME_GRAMMAR_SENTENCE = "Entries are hostnames: 'api.example.com' for one host, '.example.com' for that domain and its subdomains.";
+/**
+ * Raised for an `allowedHosts` entry this backend will not translate.
+ *
+ * Named for the ENTRY rather than for a config field, because entries arrive
+ * from two directions: a host's `Sandbox.setNetworkPolicy` call, and the
+ * `allowedHosts` of a `static`/`resolver` `config.egress.policy`.
+ * `SandboxNetworkPolicy` names HOSTS: `api.example.com` for one host,
+ * `.example.com` for a domain and its subdomains. A glob, a URL, a port
+ * suffix or an address is refused rather than emitted, because a
+ * `CiliumNetworkPolicy` carrying one is an object the API server rejects on
+ * apply — or, worse, accepts as a name that resolves to nothing, which reads
+ * from the outside exactly like a policy that is working.
+ */
+export class KubernetesNetworkPolicyHostError extends Error {
+    host;
+    name = 'KubernetesNetworkPolicyHostError';
+    constructor(host, reason) {
+        super(`kubernetes: the allowedHosts entry ${JSON.stringify(host)} is refused: it ${reason}. ${HOSTNAME_GRAMMAR_SENTENCE} Nothing was written.`);
+        this.host = host;
+    }
+}
+/** A DNS name, lowercase, no scheme, no port, no wildcard. */
+const DNS_NAME = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$/;
+/**
+ * The one grammar an `allowedHosts` entry has to satisfy, on EVERY path that
+ * emits one.
+ *
+ * It lives here, beside the class it throws, rather than in the per-sandbox
+ * module that first needed it: it is called from {@link
+ * buildCiliumEgressManifest} — the single builder both translations go
+ * through — so the config-level allowlist and a `setNetworkPolicy` list are
+ * refused the SAME entries, by name, with nothing emitted. That is the
+ * contract {@link KubernetesNetworkPolicyHostError} already states — it
+ * names entries rather than a config field, for exactly this reason — and a
+ * grammar only ONE of the two translations enforces is not one the other has:
+ * that is how the config-level translation came to pass `'.com'`, `'.'`,
+ * `'..example.com'`, `'*'` and an IP literal straight into the emitted
+ * `toFQDNs`, where the per-sandbox path refused every one of them.
+ *
+ * The per-sandbox writer still calls it too — {@link normalizeHost}, which
+ * lowercases and then calls this — because there it also CANONICALISES the
+ * bytes, before the fence is read and before anything is queued.
+ */
+export function assertUsableHost(entry) {
+    // The two reasons the per-sandbox writer's own type check used to give
+    // first, kept apart here so an untyped caller meets the same sentence
+    // whichever path reached this — see the note on lowercasing below.
+    if (typeof entry !== 'string') {
+        throw new KubernetesNetworkPolicyHostError(String(entry), 'is not a string');
+    }
+    if (entry === '') {
+        throw new KubernetesNetworkPolicyHostError(entry, 'is empty');
+    }
+    const bare = entry.startsWith('.') ? entry.slice(1) : entry;
+    if (bare === '') {
+        throw new KubernetesNetworkPolicyHostError(entry, 'names no domain after its leading dot');
+    }
+    if (entry.includes('*')) {
+        throw new KubernetesNetworkPolicyHostError(entry, "contains a glob; a domain and its subdomains are written with a leading dot ('.example.com'), which becomes matchName plus matchPattern");
+    }
+    if (!DNS_NAME.test(bare)) {
+        throw new KubernetesNetworkPolicyHostError(entry, 'is not a DNS name (a scheme, a path, a port suffix and an IP address all land here; letter case is canonicalised before this check, so it is never the cause)');
+    }
+    if (bare.length > 253) {
+        throw new KubernetesNetworkPolicyHostError(entry, 'is longer than a DNS name may be');
+    }
+    // A leading-dot entry becomes `matchPattern: '*.<domain>'`, and a
+    // single-label domain there is a whole public suffix — `.com`, `.org`.
+    // That is not an allowlist entry: it admits every name under a registry
+    // the caller does not control. Cilium would match it if it were applied,
+    // which is why this is a refusal rather than a lenient pass, and the
+    // shipped admission fence refuses the same pattern for the per-sandbox
+    // writes it binds (its `matchConditions` scope it to the sandbox host's
+    // ServiceAccount, so an operator applying the config-level object is not
+    // covered by it — one more reason the refusal has to come from here).
+    if (entry.startsWith('.') && !bare.includes('.')) {
+        throw new KubernetesNetworkPolicyHostError(entry, "names a whole top-level domain ('.com' means every name under it); a domain entry needs at least two labels, as in '.example.com', and the '*.com' pattern this would emit is one the shipped admission policy refuses for the per-sandbox writes it binds");
+    }
+    // An IPv4 literal passes the grammar above — every label is digits, and
+    // digits are legal in a DNS label. It is still not a hostname: a DNS
+    // top-level label is never all-numeric, and Cilium's `matchName` is
+    // compared against names the DNS proxy SAW, which an address never is. A
+    // policy carrying one is admitted and matches nothing, which reads from
+    // outside exactly like a policy that is working.
+    const lastLabel = bare.slice(bare.lastIndexOf('.') + 1);
+    if (/^[0-9]+$/.test(lastLabel)) {
+        throw new KubernetesNetworkPolicyHostError(entry, 'ends in an all-numeric label, so it is an address rather than a hostname; toFQDNs matches names a DNS lookup returned, and an address is never one of them (use config.egress.policy for address-based egress)');
+    }
+}
+/**
+ * Every entry of one allowlist, judged by {@link assertUsableHost} — called
+ * from {@link buildCiliumEgressManifest} before anything is emitted, so BOTH
+ * translations refuse the same entries.
+ *
+ * The entry is lowercased for the DECISION and not for the bytes. The
+ * per-sandbox writer canonicalises before it validates (`normalizeHost`), so
+ * judging the lowercased form is what makes the two paths agree on WHICH
+ * entries are refused — while the emitted `matchName` stays the string the
+ * caller wrote, exactly as every release before this one emitted it. This
+ * call refuses what no translation can express, not what one of them would
+ * spell differently.
+ */
+function assertHostsAreUsable(allowedHosts) {
+    for (const host of allowedHosts) {
+        assertUsableHost(typeof host === 'string' ? host.toLowerCase() : host);
+    }
+}
+/**
+ * Every entry in `narrowing.ports`, `narrowing.hostPorts` and
+ * `narrowing.tlsPorts` is a port the API server will actually accept, none of
+ * those three is an explicitly empty array, and every DNS suffix
+ * `narrowing.dnsNames` names is a non-empty string — checked here,
+ * synchronously, for the same reason {@link assertEgressPolicyIsEnforceable}
+ * checks `exceptCidrs`: a value the API server rejects on apply would leave a
+ * policy that never verifies.
+ */
+/**
+ * Refuse a narrowing the API server would reject on apply, naming the field
+ * that has to change.
+ *
+ * `fieldPath` is how the refusal spells the option's location, because the
+ * same shape is configurable in two places now: `ciliumNarrowing` narrows the
+ * CONFIG-level translated policy, and `perSandbox.narrowing` narrows the
+ * per-sandbox policies a host writes through `setNetworkPolicy`. One
+ * validator, because they are one shape and two would disagree the first time
+ * either grew a field.
+ */
+export function assertCiliumNarrowingIsUsable(narrowing, fieldPath = 'ciliumNarrowing') {
+    const assertValidPort = (port, field) => {
+        if (typeof port !== 'number' || !Number.isInteger(port) || port < 1 || port > 65535) {
+            throw new KubernetesEgressPolicyConfigError(field, `${JSON.stringify(port)} is not a TCP port a NetworkPolicy/CiliumNetworkPolicy can carry (an integer 1-65535)`);
+        }
+    };
+    // `undefined` means "no restriction on this list" and is fine; `[]` is
+    // neither that nor a usable restriction — `narrowedHostFqdnRule` would
+    // emit `toPorts: [{ ports: [] }]` for it, a shape the API server rejects
+    // on apply. Refuse it here rather than let a typo (`ports: []` where
+    // `ports` was meant to be omitted) reach the cluster as a policy that
+    // never verifies.
+    const assertNotEmptyPortList = (ports, field) => {
+        if (ports !== undefined && ports.length === 0) {
+            throw new KubernetesEgressPolicyConfigError(field, 'must not be an empty array — omit the field entirely for no port restriction, or list at least one port');
+        }
+    };
+    assertNotEmptyPortList(narrowing.ports, `${fieldPath}.ports`);
+    for (const port of narrowing.ports ?? [])
+        assertValidPort(port, `${fieldPath}.ports`);
+    for (const [host, ports] of Object.entries(narrowing.hostPorts ?? {})) {
+        assertNotEmptyPortList(ports, `${fieldPath}.hostPorts[${JSON.stringify(host)}]`);
+        for (const port of ports) {
+            assertValidPort(port, `${fieldPath}.hostPorts[${JSON.stringify(host)}]`);
+        }
+    }
+    assertNotEmptyPortList(narrowing.tlsPorts, `${fieldPath}.tlsPorts`);
+    for (const port of narrowing.tlsPorts ?? [])
+        assertValidPort(port, `${fieldPath}.tlsPorts`);
+    if (typeof narrowing.dnsNames === 'object') {
+        const { clusterDomain, searchSuffixes } = narrowing.dnsNames;
+        if (clusterDomain !== undefined && clusterDomain.trim() === '') {
+            throw new KubernetesEgressPolicyConfigError(`${fieldPath}.dnsNames.clusterDomain`, 'must not be an empty string');
+        }
+        for (const suffix of searchSuffixes ?? []) {
+            if (typeof suffix !== 'string' || suffix.trim() === '') {
+                throw new KubernetesEgressPolicyConfigError(`${fieldPath}.dnsNames.searchSuffixes`, `${JSON.stringify(suffix)} is not a usable DNS suffix`);
+            }
+        }
+    }
+}
+/** Does `narrowing` actually ask for anything, or is every field off/absent. */
+function ciliumNarrowingIsActive(narrowing) {
+    if (narrowing === undefined)
+        return false;
+    if (narrowing.ports !== undefined)
+        return true;
+    if (narrowing.hostPorts !== undefined && Object.keys(narrowing.hostPorts).length > 0)
+        return true;
+    if (dnsNarrowingIsActive(narrowing.dnsNames))
+        return true;
+    if (narrowing.tlsServerNames === true)
+        return true;
+    return false;
+}
+function dnsNarrowingIsActive(dnsNames) {
+    return activeDnsNarrowing(dnsNames) !== undefined;
+}
+/** `dnsNames` reduced to the config it names, or `undefined` when it is off. `true` reduces to every default. */
+function activeDnsNarrowing(dnsNames) {
+    if (dnsNames === true)
+        return {};
+    if (typeof dnsNames === 'object' && dnsNames !== null)
+        return dnsNames;
+    return undefined;
+}
 /**
  * Synchronous, no-I/O precondition: can `policy.kind` be enforced under
- * `engine` at all. Deliberately decided from the KIND alone — a `resolver`
- * policy's `resolve()` is never invoked here, both because calling it just to
- * prove a refusal would be wasted work (and possibly a side effect the host
- * did not expect yet) and because this has to stay callable synchronously
- * from `buildKubernetesBackend`, which contacts nothing.
+ * `engine` at all, and — if `narrowing` is set — does it apply to this
+ * policy/engine combination. Deliberately decided from the KIND alone — a
+ * `resolver` policy's `resolve()` is never invoked here, both because calling
+ * it just to prove a refusal would be wasted work (and possibly a side effect
+ * the host did not expect yet) and because this has to stay callable
+ * synchronously from `buildKubernetesBackend`, which contacts nothing.
  */
-export function assertEgressPolicyIsEnforceable(policy, engine) {
+export function assertEgressPolicyIsEnforceable(policy, engine, narrowing) {
     if ((policy.kind === 'static' || policy.kind === 'resolver') && engine !== 'cilium') {
         throw new KubernetesUnenforceableEgressPolicyError(policy.kind);
     }
+    if (policy.kind === 'public-internet') {
+        for (const cidr of policy.exceptCidrs ?? []) {
+            if (parseCidr(cidr) === undefined) {
+                throw new KubernetesEgressPolicyConfigError('policy.exceptCidrs', `${JSON.stringify(cidr)} is not an IPv4 or IPv6 CIDR this backend can read. A NetworkPolicy ipBlock.except entry has to be a CIDR inside the block it carves out of, and an entry the API server rejects on apply would leave a policy that never verifies.`);
+            }
+        }
+    }
+    if (ciliumNarrowingIsActive(narrowing)) {
+        if (engine !== 'cilium' || (policy.kind !== 'static' && policy.kind !== 'resolver')) {
+            throw new KubernetesEgressNarrowingUnsupportedError(policy.kind, engine);
+        }
+        assertCiliumNarrowingIsUsable(narrowing);
+    }
 }
 /**
  * The cluster DNS egress rule every translated `NetworkPolicy` carries,
@@ -116,12 +827,125 @@ export function assertEgressPolicyIsEnforceable(policy, engine) {
  * allows the cluster's own DNS" section.
  */
 const CLUSTER_DNS_EGRESS_RULE = {
-    to: [{ namespaceSelector: { matchLabels: { 'kubernetes.io/metadata.name': 'kube-system' } } }],
+    to: [
+        {
+            namespaceSelector: {
+                matchLabels: { 'kubernetes.io/metadata.name': 'kube-system' },
+            },
+        },
+    ],
+    ports: [
+        { protocol: 'UDP', port: 53 },
+        { protocol: 'TCP', port: 53 },
+    ],
+};
+/**
+ * DNS to the cluster resolver's own pods, which is narrower than
+ * {@link CLUSTER_DNS_EGRESS_RULE}'s whole-namespace rule and is what
+ * `'public-internet'` emits: that kind exists to name a destination set
+ * precisely, so it names the resolver precisely too. `kube-system` +
+ * `k8s-app: kube-dns` is the pairing CoreDNS ships under on every cluster
+ * this was checked against, and the same pairing the repo's own
+ * `k8s/manifests/networkpolicy.yaml` baseline already uses.
+ *
+ * `'deny-all'` keeps {@link CLUSTER_DNS_EGRESS_RULE} instead. It is not
+ * changed to this one: its emitted manifest is pinned byte-for-byte, because
+ * verification of the named object is an exact match and any change to the
+ * translation fails every `create()` on every deployment that already
+ * applied a policy.
+ */
+const KUBE_DNS_EGRESS_RULE = {
+    to: [
+        {
+            namespaceSelector: {
+                matchLabels: { 'kubernetes.io/metadata.name': 'kube-system' },
+            },
+            podSelector: { matchLabels: { 'k8s-app': 'kube-dns' } },
+        },
+    ],
     ports: [
         { protocol: 'UDP', port: 53 },
         { protocol: 'TCP', port: 53 },
     ],
 };
+/**
+ * What `'public-internet'` carves out of `0.0.0.0/0`, and why each entry is
+ * here. Order is part of the emitted manifest and therefore part of what
+ * verification compares, so it is fixed rather than sorted at build time.
+ *
+ *  - `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` — RFC 1918. The cluster
+ *    network, the node network and every other sandbox pod live in one of
+ *    them on every deployment this was checked against.
+ *  - `100.64.0.0/10` — RFC 6598 carrier-grade NAT, which several managed
+ *    Kubernetes offerings hand to pods or nodes. Missing from the policy the
+ *    agent-sandbox controller writes when a template declares no
+ *    `networkPolicy`, which is exactly why this check compares except lists
+ *    rather than trusting that a policy "looks restrictive".
+ *  - `169.254.0.0/16` — link-local, and with it `169.254.169.254`, the
+ *    instance-metadata address whose credentials are the reason a sandbox
+ *    reaching "only the internet" still must not reach sideways.
+ *  - `127.0.0.0/8` — loopback. Not routable off the pod, but a policy that
+ *    says "the public internet" should not say it admits loopback either.
+ *  - `168.63.129.16/32` — one cloud's platform endpoint, a single address
+ *    outside every range above that answers DNS and instance services.
+ */
+const PUBLIC_INTERNET_EXCLUDED_IPV4_CIDRS = [
+    '10.0.0.0/8',
+    '172.16.0.0/12',
+    '192.168.0.0/16',
+    '100.64.0.0/10',
+    '169.254.0.0/16',
+    '127.0.0.0/8',
+    '168.63.129.16/32',
+];
+/**
+ * The IPv6 equivalents: unique-local (`fc00::/7`), link-local
+ * (`fe80::/10`, which carries the v6 spelling of instance metadata) and
+ * loopback (`::1/128`). A cluster with no IPv6 at all is unaffected by the
+ * rule's presence — it names destinations nothing routes to.
+ */
+const PUBLIC_INTERNET_EXCLUDED_IPV6_CIDRS = ['fc00::/7', 'fe80::/10', '::1/128'];
+/**
+ * The one rule `'public-internet'` adds beside DNS: everything, minus the
+ * lists above, minus whatever the deployment added. No `ports`, because the
+ * kind is a statement about DESTINATIONS — a deployment that also wants to
+ * bound ports states that in its own applied policy, which this check then
+ * accepts as narrower.
+ *
+ * A deployment's own `exceptCidrs` are routed to the block of their own
+ * address family: a `NetworkPolicy` requires every `except` entry to sit
+ * inside the `cidr` it carves out of, so an IPv6 entry under the IPv4 block
+ * is rejected on apply.
+ */
+function publicInternetEgressRule(exceptCidrs) {
+    const extraV4 = [];
+    const extraV6 = [];
+    for (const cidr of exceptCidrs ?? []) {
+        const parsed = parseCidr(cidr);
+        // Unparseable entries are refused by `assertEgressPolicyIsEnforceable`
+        // at construction; reaching here with one would mean this function was
+        // called around it, so it is dropped rather than emitted.
+        if (parsed === undefined)
+            continue;
+        (parsed.version === 4 ? extraV4 : extraV6).push(cidr);
+    }
+    return {
+        to: [
+            {
+                ipBlock: {
+                    cidr: '0.0.0.0/0',
+                    except: [...PUBLIC_INTERNET_EXCLUDED_IPV4_CIDRS, ...extraV4],
+                },
+            },
+            {
+                ipBlock: {
+                    cidr: '::/0',
+                    except: [...PUBLIC_INTERNET_EXCLUDED_IPV6_CIDRS, ...extraV6],
+                },
+            },
+        ],
+    };
+}
 /**
  * Cilium requires DNS lookups to be explicitly allowed AND made visible to
  * the agent before `toFQDNs` enforcement can match anything a name resolves
@@ -156,9 +980,10 @@ const CILIUM_DNS_VISIBILITY_RULE = {
         },
     ],
 };
-function buildCoreNetworkPolicy(target, egress) {
+function buildCoreNetworkPolicy(target, policyKind, egress) {
     return {
         kind: 'NetworkPolicy',
+        policyKind,
         namespace: target.namespace,
         name: target.name,
         manifest: {
@@ -166,32 +991,305 @@ function buildCoreNetworkPolicy(target, egress) {
             kind: 'NetworkPolicy',
             metadata: { name: target.name, namespace: target.namespace },
             spec: {
-                podSelector: { matchLabels: sandboxTemplateLabel(target.sandboxTemplateName) },
+                podSelector: {
+                    matchLabels: egressPolicySelectorLabels(target),
+                },
                 policyTypes: ['Egress'],
                 egress,
             },
         },
     };
 }
-function buildCiliumNetworkPolicy(target, allowedHosts) {
+/** `[443]` — the TLS-port default for both `tlsServerNames` and `tlsPorts`. */
+const DEFAULT_TLS_PORTS = [443];
+/** `{ port: '443', protocol: 'TCP' }` — Cilium's port shape, ports spelled as strings. */
+function ciliumPortEntry(port) {
+    return { port: String(port), protocol: 'TCP' };
+}
+/**
+ * The refusal context of the PER-SANDBOX translation — `egress.perSandbox`,
+ * whose allowlist comes from a host's own `setNetworkPolicy` call.
+ *
+ * Shared deliberately: the per-sandbox writer refuses a host by this context
+ * before it reads the fence, and {@link buildCiliumEgressManifest} refuses the
+ * same host by the same context on the way through the translation, so the two
+ * cannot name different fields for one entry however the earlier check is
+ * reached or skipped.
+ */
+export const PER_SANDBOX_NARROWING_REFUSAL = {
+    fieldPath: 'config.egress.perSandbox.narrowing',
+};
+/**
+ * The refusal context of the config-level translation — `config.egress.policy`
+ * and its `config.egress.ciliumNarrowing`.
+ */
+export const CONFIG_LEVEL_NARROWING_REFUSAL = {
+    fieldPath: 'config.egress.ciliumNarrowing',
+};
+/**
+ * Refuse the one allowlist entry a narrowing option cannot express.
+ *
+ * `tlsServerNames` puts the entry on the rule as a TLS server name — one
+ * exact SNI value a handshake presents — and a `.domain` entry is a set of
+ * names no single SNI value means. Either way the emitted object would be
+ * applied without complaint — nothing refuses an operator's apply: the
+ * shipped admission fence's `matchConditions` scope it to the sandbox host's
+ * ServiceAccount, so the config-level object is not matched by it — read back
+ * deep-equal to what was sent, and deny what the caller asked to allow — the
+ * failure every other refusal in this module exists to prevent. Refused
+ * rather than translated another way,
+ * because both other ways are guesses: dropping the subdomains silently
+ * narrows what the caller asked for, and a wildcard SNI value is not
+ * something the Cilium versions these manifests are written against are
+ * known here to match — an SNI that matches nothing denies just as
+ * completely, and more quietly.
+ *
+ * One sentence, because one entry now means one thing: both translations turn
+ * `.domain` into `matchName: domain` PLUS `matchPattern: '*.domain'` — see
+ * {@link ciliumFqdnEntries} — and no single SNI value means that pair.
+ * `domain` alone denies every subdomain the pattern admits, and the entry as
+ * written is not a name any handshake presents at all.
+ *
+ * `context` is the field the refusal sends the reader to — see
+ * {@link HostsFitNarrowingContext}. A reader has to be sent to the field they
+ * actually set: passed as a loose string, an expanding caller was told to
+ * repair `config.egress.ciliumNarrowing` with the remedy that belongs to
+ * `config.egress.perSandbox.narrowing`, a message whose only repair is a field
+ * the entry never came from. Called from BOTH — the translation itself, so
+ * every caller is covered, and the per-sandbox writer, which refuses earlier
+ * still, before it reads the fence.
+ */
+export function assertHostsFitNarrowing(allowedHosts, narrowing, context) {
+    if (narrowing?.tlsServerNames !== true)
+        return;
+    for (const host of allowedHosts) {
+        if (!host.startsWith('.'))
+            continue;
+        throw new KubernetesNetworkPolicyHostError(host, `names a domain and its subdomains while ${context.fieldPath}.tlsServerNames is on; a TLS server name is one exact SNI value a handshake presents, and this entry becomes a name plus a '*.domain' pattern, which no single value means — list the exact hosts, or leave tlsServerNames off for a domain list`);
+    }
+}
+/**
+ * The port list a narrowed translation applies to `host`, before splitting
+ * out the TLS subset — see {@link KubernetesCiliumEgressNarrowing.ports}.
+ * `undefined` means no port restriction: the host's `toFQDNs` rule carries
+ * no `toPorts` at all.
+ */
+function narrowedHostPorts(host, narrowing) {
+    const explicit = narrowing.hostPorts?.[host] ?? narrowing.ports;
+    if (explicit !== undefined)
+        return explicit;
+    // `serverNames` needs a port to attach to — leaving this host with no
+    // port at all would mean either no `serverNames` rule (silently dropping
+    // the option) or one with no `toPorts`, which Cilium rejects on apply.
+    if (narrowing.tlsServerNames === true)
+        return narrowing.tlsPorts ?? DEFAULT_TLS_PORTS;
+    return undefined;
+}
+/**
+ * One host's `toFQDNs` rule under narrowing: the allowlist entry's `toFQDNs`
+ * entries, plus `toPorts` split into a `serverNames`-bearing entry for the
+ * host's TLS ports and a plain entry for whatever is left, when
+ * `tlsServerNames` is on.
+ *
+ * `fqdns` is {@link ciliumFqdnEntries} of the host's allowlist entry, passed
+ * in rather than derived here because the entry and the host are not always
+ * the same string: `.example.com` becomes `example.com` plus
+ * `*.example.com`. It is REQUIRED, with no `[{ matchName: host }]` default —
+ * a caller that omitted it would emit the entry unexpanded, which is the
+ * exact object this translation stopped producing.
+ *
+ * `serverNames` carries the allowlist ENTRY as written while the `toFQDNs`
+ * half carries the expansion of it. A TLS server name is one exact SNI value
+ * a handshake presents, and a `.example.com` entry — whose `toFQDNs` half is
+ * `example.com` PLUS `*.example.com` — has no single SNI value meaning that
+ * set: `example.com` would deny every subdomain the pattern admits, and
+ * `.example.com` is not a name any handshake ever presents. So
+ * {@link assertHostsFitNarrowing} refuses that one combination before this
+ * rule is built, from `buildCiliumEgressManifest` for every caller and from
+ * the per-sandbox writer before it reads the fence — which is why this
+ * function can still take `host` and the entry as one string.
+ */
+function narrowedHostFqdnRule(host, narrowing, fqdns) {
+    const ports = narrowedHostPorts(host, narrowing);
+    if (ports === undefined)
+        return { toFQDNs: fqdns };
+    if (narrowing.tlsServerNames !== true) {
+        return { toFQDNs: fqdns, toPorts: [{ ports: ports.map(ciliumPortEntry) }] };
+    }
+    const tlsPorts = narrowing.tlsPorts ?? DEFAULT_TLS_PORTS;
+    const tlsSubset = ports.filter((port) => tlsPorts.includes(port));
+    const rest = ports.filter((port) => !tlsPorts.includes(port));
+    const toPorts = [];
+    if (tlsSubset.length > 0) {
+        toPorts.push({ ports: tlsSubset.map(ciliumPortEntry), serverNames: [host] });
+    }
+    if (rest.length > 0)
+        toPorts.push({ ports: rest.map(ciliumPortEntry) });
+    return {
+        toFQDNs: fqdns,
+        ...(toPorts.length > 0 ? { toPorts } : {}),
+    };
+}
+/**
+ * One allowlist entry, expanded to the `toFQDNs` entries it means.
+ *
+ * `SandboxNetworkPolicy.allowedHosts`'s own grammar, which the SDK states —
+ * `packages/sdk/src/types/sandbox/index.ts`'s `allowedHosts` — and which
+ * `src/egress/allowlist.ts` implements for the docker backend: `api.example.com`
+ * is that host, and `.example.com` is the domain AND its subdomains. Cilium's
+ * `matchName` is an exact name and does not match across a `.`, so the domain
+ * form needs the name plus a `matchPattern` — `*.example.com` alone would
+ * admit `a.example.com` and not `example.com` itself.
+ *
+ * Used by BOTH translations. The config-level one used to emit a leading-dot
+ * entry verbatim instead, which no DNS answer carries and so denied the
+ * domain and every subdomain it was asked to allow, after a create that
+ * reported success — but "the config-level bytes are pinned" was never a
+ * contract the pinned bytes honoured, and one entry has to mean one thing on
+ * every backend.
+ */
+export function ciliumFqdnEntries(entry) {
+    if (!entry.startsWith('.'))
+        return [{ matchName: entry }];
+    const domain = entry.slice(1);
+    return [{ matchName: domain }, { matchPattern: `*.${domain}` }];
+}
+/**
+ * The DNS-visibility rule narrowed to the names an allowlist entry admits:
+ * an exact `matchName` per allowed host plus the host under every search
+ * suffix, and — for an entry that admits subdomains — the `matchPattern` that
+ * admits them, under the bare name and under every suffix as well. Replaces
+ * {@link CILIUM_DNS_VISIBILITY_RULE}'s `matchPattern: '*'`. See
+ * {@link KubernetesCiliumDnsNarrowing}.
+ *
+ * Both halves follow from {@link ciliumFqdnEntries}: the DNS proxy has to see
+ * exactly what the `toFQDNs` rule admits, or the half that learns addresses
+ * from a lookup never sees one the other half allows.
+ */
+function narrowedDnsVisibilityRule(allowedHosts, fallbackNamespace, dnsNames) {
+    const namespace = dnsNames.namespace ?? fallbackNamespace;
+    const clusterDomain = dnsNames.clusterDomain ?? 'cluster.local';
+    const suffixes = [
+        `${namespace}.svc.${clusterDomain}`,
+        `svc.${clusterDomain}`,
+        clusterDomain,
+        ...(dnsNames.searchSuffixes ?? []),
+    ];
+    const matchNames = [];
+    for (const entry of allowedHosts) {
+        // A `.domain` entry resolves through its subdomains as well, so the
+        // DNS proxy has to be allowed to SEE those lookups or `toFQDNs` never
+        // learns the addresses they resolve to.
+        const wildcard = entry.startsWith('.');
+        const host = wildcard ? entry.slice(1) : entry;
+        matchNames.push({ matchName: host });
+        if (wildcard)
+            matchNames.push({ matchPattern: `*.${host}` });
+        for (const suffix of suffixes) {
+            matchNames.push({ matchName: `${host}.${suffix}` });
+            // The suffixed names are here because a guest resolving a name
+            // with fewer dots than the cluster's `ndots` tries the search
+            // suffixes FIRST, and a lookup the DNS proxy refuses is not an
+            // NXDOMAIN the resolver walks past — it can fail the whole
+            // resolution. An entry that admits subdomains needs the pattern
+            // under each suffix too, or `a.example.com` fails on its first
+            // search-suffix attempt under a rule that allows it.
+            if (wildcard)
+                matchNames.push({ matchPattern: `*.${host}.${suffix}` });
+        }
+    }
+    return {
+        toEndpoints: CILIUM_DNS_VISIBILITY_RULE.toEndpoints,
+        toPorts: [
+            {
+                ports: [{ port: '53', protocol: 'ANY' }],
+                rules: { dns: matchNames },
+            },
+        ],
+    };
+}
+export function buildCiliumEgressManifest(options) {
+    const { narrowing, allowedHosts, refusalContext } = options;
+    // Before anything is emitted, and for EVERY caller — which is the point:
+    // an entry this backend will not translate is one whose object would be
+    // either rejected on apply or, worse, accepted as a name that matches
+    // nothing while the create reports success. The config-level allowlist
+    // used to reach this builder unvalidated, so `['.com']`, `['.']`,
+    // `['..example.com']`, `['*']` and an address were each emitted into
+    // `toFQDNs` — the first three as a `matchPattern` no fence covers on that
+    // path (the shipped one is scoped to the sandbox host's ServiceAccount),
+    // which turned a fail-closed no-op into a silent grant of every name under
+    // a public suffix. See {@link assertHostsAreUsable}.
+    assertHostsAreUsable(allowedHosts);
+    // A leading-dot entry under `tlsServerNames`
+    // would become `serverNames: ['.domain']` — not a name any handshake
+    // presents — and `['domain']` would deny every subdomain the `toFQDNs`
+    // half of the same rule admits; the object goes through with nothing
+    // objecting to it, and reads back deep-equal to what was sent, so nothing
+    // downstream would ever report it. (On the config-level path nothing
+    // objects to it at all: the shipped fence is scoped to the sandbox host's
+    // ServiceAccount and an operator's apply is not matched by it.)
+    //
+    // What this call guarantees, per caller shape: the per-sandbox writer
+    // refuses the same hosts earlier still, by name and by the same context
+    // (`per-sandbox-policy.ts`), and this call covers them again if that check
+    // is ever reached later or skipped; the config-level translation has no
+    // earlier check of its own and relies on this one entirely; and a direct
+    // call to this function is covered here too, whatever context it passes.
+    //
+    // The context decides ONE thing, because one thing is left to decide —
+    // which field the refusal names. It is required rather than derived, since
+    // nothing here can see the caller's config, and derived from the bytes is
+    // exactly how an expanding caller came to be sent to the config-level
+    // field for a repair that only exists under `perSandbox.narrowing`.
+    assertHostsFitNarrowing(allowedHosts, narrowing, refusalContext);
+    // Unnarrowed is the exact shape every release before #490 emitted — kept
+    // as its own branch, untouched, rather than folded into the narrowed one
+    // with every option defaulted off, so the byte-identical guarantee does
+    // not depend on the narrowed code path happening to reduce to it.
+    const narrowed = ciliumNarrowingIsActive(narrowing);
+    const activeDns = narrowed ? activeDnsNarrowing(narrowing.dnsNames) : undefined;
+    const dnsRule = activeDns !== undefined
+        ? narrowedDnsVisibilityRule(allowedHosts, options.namespace, activeDns)
+        : CILIUM_DNS_VISIBILITY_RULE;
+    const hostRules = narrowed
+        ? allowedHosts.map((host) => narrowedHostFqdnRule(host, narrowing, ciliumFqdnEntries(host)))
+        : [{ toFQDNs: allowedHosts.flatMap(ciliumFqdnEntries) }];
     return {
         kind: 'CiliumNetworkPolicy',
-        namespace: target.namespace,
-        name: target.name,
+        policyKind: options.policyKind,
+        namespace: options.namespace,
+        name: options.name,
         manifest: {
             apiVersion: `${CILIUM_NETWORK_POLICY_API_GROUP}/${CILIUM_NETWORK_POLICY_API_VERSION}`,
             kind: 'CiliumNetworkPolicy',
-            metadata: { name: target.name, namespace: target.namespace },
+            metadata: {
+                name: options.name,
+                namespace: options.namespace,
+                ...(options.ownerReferences !== undefined
+                    ? { ownerReferences: options.ownerReferences }
+                    : {}),
+            },
             spec: {
-                endpointSelector: { matchLabels: sandboxTemplateLabel(target.sandboxTemplateName) },
-                egress: [
-                    CILIUM_DNS_VISIBILITY_RULE,
-                    { toFQDNs: allowedHosts.map((host) => ({ matchName: host })) },
-                ],
+                endpointSelector: {
+                    matchLabels: options.selectorLabels,
+                },
+                egress: [dnsRule, ...hostRules],
             },
         },
     };
 }
+function buildCiliumNetworkPolicy(target, policyKind, allowedHosts, narrowing) {
+    return buildCiliumEgressManifest({
+        namespace: target.namespace,
+        name: target.name,
+        selectorLabels: egressPolicySelectorLabels(target),
+        allowedHosts,
+        policyKind,
+        ...(narrowing !== undefined ? { narrowing } : {}),
+        refusalContext: CONFIG_LEVEL_NARROWING_REFUSAL,
+    });
+}
 /**
  * The pure translation: an {@link EgressPolicy} plus the declared
  * {@link KubernetesEgressEngine} in, the concrete manifest this backend can
@@ -209,23 +1307,34 @@ function buildCiliumNetworkPolicy(target, allowedHosts) {
  * hosts against, and re-resolving on every `create()` would only produce a
  * value nothing downstream re-applies to the cluster.
  */
-export async function translateEgressPolicy(policy, engine, target) {
-    assertEgressPolicyIsEnforceable(policy, engine);
+export async function translateEgressPolicy(policy, engine, target, ciliumNarrowing) {
+    assertEgressPolicyIsEnforceable(policy, engine, ciliumNarrowing);
     switch (policy.kind) {
         case 'deny-all':
-            return buildCoreNetworkPolicy(target, [CLUSTER_DNS_EGRESS_RULE]);
+            return buildCoreNetworkPolicy(target, 'deny-all', [CLUSTER_DNS_EGRESS_RULE]);
+        case 'no-network':
+            // `policyTypes: ['Egress']` with an EMPTY rule list is the API's own
+            // spelling of "this pod sends nothing": the pod is in egress
+            // default-deny and no rule lets anything back out. Not even DNS —
+            // see the kind's own doc.
+            return buildCoreNetworkPolicy(target, 'no-network', []);
+        case 'public-internet':
+            return buildCoreNetworkPolicy(target, 'public-internet', [
+                KUBE_DNS_EGRESS_RULE,
+                publicInternetEgressRule(policy.exceptCidrs),
+            ]);
         case 'allow-all':
             // No `to`/`ports` on an egress rule matches every destination and
             // every port. `CLUSTER_DNS_EGRESS_RULE` is a strict subset of this,
             // so it is folded in rather than listed twice.
-            return buildCoreNetworkPolicy(target, [{}]);
+            return buildCoreNetworkPolicy(target, 'allow-all', [{}]);
         case 'static':
             // `assertEgressPolicyIsEnforceable` already threw above unless
             // `engine === 'cilium'`, so reaching here means it did not.
-            return buildCiliumNetworkPolicy(target, policy.allowedHosts);
+            return buildCiliumNetworkPolicy(target, 'static', policy.allowedHosts, ciliumNarrowing);
         case 'resolver': {
             const allowedHosts = await policy.resolve();
-            return buildCiliumNetworkPolicy(target, allowedHosts);
+            return buildCiliumNetworkPolicy(target, 'resolver', allowedHosts, ciliumNarrowing);
         }
         default: {
             const exhaustive = policy;
@@ -270,14 +1379,28 @@ export class KubernetesEgressPolicyMismatchError extends Error {
  * `../docker/index.ts`'s `assertNetworkCarriesThePolicy`, which inspects the
  * daemon's own `{{.Internal}}` flag instead of trusting a network's name.
  *
- * Checks exactly three things, each named separately in a mismatch so an
- * operator sees which one to fix:
+ * Checks four things, each named separately in a mismatch so an operator sees
+ * which one to fix:
+ *  - the object carries NO `specs` list. A `CiliumNetworkPolicy` carries
+ *    EITHER one `spec` or a `specs` list and a rule in either one enforces,
+ *    while every check below reads `spec` alone — so an object carrying both
+ *    would be compared on half of what it enforces. This is refused and not
+ *    read, because a comparison that accepts rules it never looked at is the
+ *    one answer this function must not give; the shipped admission fence
+ *    refuses a `specs` list for the same reason. The translation never emits
+ *    one, so its presence is drift and not an alternative spelling;
  *  - the selector (`podSelector` for `NetworkPolicy`, `endpointSelector` for
  *    `CiliumNetworkPolicy`) carries the expected template label:
  *  - `NetworkPolicy` additionally declares `policyTypes` including
  *    `'Egress'` — a `NetworkPolicy` with an `egress` array but no `'Egress'`
  *    in `policyTypes` enforces nothing on egress at all;
- *  - the `egress` rule array matches the translation exactly.
+ *  - the `egress` rule array matches the translation exactly;
+ *  - and, ONLY when the translation carries `metadata.ownerReferences` (the
+ *    per-sandbox policies of `per-sandbox-policy.ts`, never the operator's
+ *    own object), that the live object still carries each of them — an owner
+ *    reference dropped between the write and the read is a policy the
+ *    cluster will never collect with the sandbox it belongs to, which is the
+ *    leak the reference exists to prevent, and it is invisible in `spec`.
  *
  * Never mutates and never creates — a 404/410 is refused, not repaired.
  */
@@ -298,6 +1421,24 @@ export async function verifyEgressPolicyApplied(client, translated, signal) {
     const expectedSpec = translated.manifest.spec;
     const actualSpec = resource?.spec ?? {};
     const selectorKey = translated.kind === 'CiliumNetworkPolicy' ? 'endpointSelector' : 'podSelector';
+    // First, and before anything is compared: an object carrying a `specs`
+    // list is refused rather than read. Everything below reads `spec`, and a
+    // `CiliumNetworkPolicy` rule in a `specs` entry enforces exactly as one in
+    // `spec` does — so comparing `spec` and reporting a match would be
+    // accepting rules this function never looked at, which is the one answer it
+    // must not give. `readCiliumEgressPolicies` reads both spellings and
+    // `decideEgressUnion` refuses a `specs` entry that widens; this is the
+    // other half of the same rule, for the callers that run this check ALONE —
+    // `verify: 'named-object-only'`, and the per-sandbox read-back — and it is
+    // what makes the named-object exemption in `decideEgressUnion` sound rather
+    // than merely narrower. The translation never emits a `specs` list, and the
+    // shipped admission fence refuses one for the same reason.
+    const actualSpecs = resource?.specs;
+    if (actualSpecs !== undefined && actualSpecs !== null) {
+        throw new KubernetesEgressPolicyMismatchError(translated.kind, path, `specs is ${JSON.stringify(actualSpecs)}, and the translation never emits one — ${translated.kind === 'CiliumNetworkPolicy'
+            ? 'a CiliumNetworkPolicy carries EITHER one spec or a specs list, and a rule in either one enforces'
+            : 'a NetworkPolicy has no specs field at all'}, while this check reads spec.${selectorKey}${translated.kind === 'NetworkPolicy' ? ', spec.policyTypes' : ''} and spec.egress and nothing else — so anything a specs list enforces is egress this comparison never read`);
+    }
     if (!isDeepStrictEqual(actualSpec[selectorKey], expectedSpec[selectorKey])) {
         throw new KubernetesEgressPolicyMismatchError(translated.kind, path, `spec.${selectorKey} is ${JSON.stringify(actualSpec[selectorKey])}, expected ${JSON.stringify(expectedSpec[selectorKey])} — the label every Sandbox this backend creates carries`);
     }
@@ -310,5 +1451,1183 @@ export async function verifyEgressPolicyApplied(client, translated, signal) {
     if (!isDeepStrictEqual(actualSpec.egress, expectedSpec.egress)) {
         throw new KubernetesEgressPolicyMismatchError(translated.kind, path, `spec.egress is ${JSON.stringify(actualSpec.egress)}, expected ${JSON.stringify(expectedSpec.egress)}`);
     }
+    // Last, and only for a translation that asked for one: an object written
+    // with an owner reference and read back without it is a policy that
+    // outlives its sandbox. The operator-applied objects this function's other
+    // caller checks carry none, so they never reach this branch.
+    const expectedOwners = translated.manifest.metadata?.ownerReferences;
+    if (expectedOwners !== undefined) {
+        const actualOwners = resource?.metadata
+            ?.ownerReferences;
+        const held = Array.isArray(actualOwners) ? actualOwners : [];
+        for (const owner of expectedOwners) {
+            if (held.some((entry) => isDeepStrictEqual(entry, owner)))
+                continue;
+            throw new KubernetesEgressPolicyMismatchError(translated.kind, path, `metadata.ownerReferences is ${JSON.stringify(actualOwners)}, expected it to carry ${JSON.stringify(owner)} — without that entry the cluster never collects this policy with the object it belongs to, so it would outlive the sandbox it was written for`);
+        }
+    }
+}
+function parseIpv4(text) {
+    const parts = text.split('.');
+    if (parts.length !== 4)
+        return undefined;
+    let value = 0n;
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return undefined;
+        const octet = Number(part);
+        if (octet > 255)
+            return undefined;
+        value = (value << 8n) | BigInt(octet);
+    }
+    return value;
+}
+function parseIpv6(text) {
+    // An embedded IPv4 tail (`::ffff:10.0.0.1`) is legal and is how a
+    // dual-stack cluster spells a v4 address in a v6 field.
+    let head = text;
+    let tail = 0n;
+    let tailGroups = 0;
+    const lastColon = text.lastIndexOf(':');
+    if (lastColon >= 0 && text.slice(lastColon + 1).includes('.')) {
+        const embedded = parseIpv4(text.slice(lastColon + 1));
+        if (embedded === undefined)
+            return undefined;
+        head = text.slice(0, lastColon + 1);
+        tail = embedded;
+        tailGroups = 2;
+    }
+    const halves = head.split('::');
+    if (halves.length > 2)
+        return undefined;
+    const readGroups = (part) => {
+        if (part === '')
+            return [];
+        const groups = [];
+        for (const group of part.split(':')) {
+            if (group === '')
+                continue;
+            if (!/^[0-9a-fA-F]{1,4}$/.test(group))
+                return undefined;
+            groups.push(BigInt(Number.parseInt(group, 16)));
+        }
+        return groups;
+    };
+    const left = readGroups(halves[0] ?? '');
+    const right = readGroups(halves[1] ?? '');
+    if (left === undefined || right === undefined)
+        return undefined;
+    const present = left.length + right.length + tailGroups;
+    if (present > 8)
+        return undefined;
+    if (halves.length === 1 && present !== 8)
+        return undefined;
+    const zeros = 8 - present;
+    const groups = [...left, ...Array.from({ length: zeros }, () => 0n), ...right];
+    let value = 0n;
+    for (const group of groups)
+        value = (value << 16n) | group;
+    if (tailGroups === 2)
+        value = (value << 32n) | tail;
+    return value;
+}
+/**
+ * A CIDR, or `undefined` when it is not one this check can read. Host bits
+ * are masked off rather than rejected: `10.0.0.1/8` and `10.0.0.0/8` name the
+ * same block, and an operator who wrote the first meant the second.
+ */
+export function parseCidr(text) {
+    if (typeof text !== 'string')
+        return undefined;
+    const slash = text.indexOf('/');
+    if (slash < 0)
+        return undefined;
+    const address = text.slice(0, slash);
+    const prefix = text.slice(slash + 1);
+    if (!/^\d{1,3}$/.test(prefix))
+        return undefined;
+    const bits = Number(prefix);
+    if (address.includes(':')) {
+        const value = parseIpv6(address);
+        if (value === undefined || bits > 128)
+            return undefined;
+        return { version: 6, base: maskAddress(value, bits, 128), bits };
+    }
+    const value = parseIpv4(address);
+    if (value === undefined || bits > 32)
+        return undefined;
+    return { version: 4, base: maskAddress(value, bits, 32), bits };
+}
+function maskAddress(value, bits, width) {
+    if (bits === 0)
+        return 0n;
+    const host = BigInt(width - bits);
+    return (value >> host) << host;
+}
+/** Every address of `inner` is an address of `outer`. */
+function cidrContains(outer, inner) {
+    if (outer.version !== inner.version)
+        return false;
+    if (outer.bits > inner.bits)
+        return false;
+    const width = outer.version === 4 ? 32 : 128;
+    return maskAddress(inner.base, outer.bits, width) === outer.base;
+}
+/** They share at least one address — i.e. one contains the other. */
+function cidrsOverlap(a, b) {
+    return cidrContains(a, b) || cidrContains(b, a);
+}
+/**
+ * The cluster resolver's identity as a `PolicyPeer` — shared by
+ * {@link egressAllowance} (reading a Cilium DNS-visibility rule into its
+ * core-shaped equivalent) and {@link reachesResolverAtDnsPort} (deciding
+ * whether some OTHER policy's rule reaches it), so there is one definition of
+ * "this peer is the cluster resolver" rather than two that could drift apart.
+ */
+const RESOLVER_PEER = {
+    kind: 'selector',
+    namespaceSelector: {
+        matchLabels: { 'kubernetes.io/metadata.name': 'kube-system' },
+    },
+    podSelector: { matchLabels: { 'k8s-app': 'kube-dns' } },
+    text: 'the cluster resolver',
+};
+function readPortRanges(ports, defaultProtocol) {
+    const entries = readList(ports);
+    if (entries === 'unreadable')
+        return 'unreadable';
+    // Absent or empty `ports` on an egress rule means EVERY port.
+    if (entries === undefined || entries.length === 0)
+        return 'all';
+    const ranges = [];
+    for (const entry of entries) {
+        if (!isRecord(entry))
+            return 'unreadable';
+        const rawProtocol = entry.protocol;
+        if (rawProtocol !== undefined && typeof rawProtocol !== 'string')
+            return 'unreadable';
+        const protocol = rawProtocol === undefined
+            ? defaultProtocol
+            : rawProtocol.toUpperCase() === 'ANY'
+                ? undefined
+                : rawProtocol.toUpperCase();
+        const endPort = entry.endPort;
+        if (endPort !== undefined && typeof endPort !== 'number')
+            return 'unreadable';
+        const raw = entry.port;
+        if (raw === undefined) {
+            ranges.push(protocol === undefined ? {} : { protocol });
+            continue;
+        }
+        const port = typeof raw === 'number' ? raw : typeof raw === 'string' ? Number(raw) : Number.NaN;
+        // A NAMED container port. Resolving it needs the destination pod's own
+        // container spec, which this check never has.
+        if (!Number.isInteger(port))
+            return 'unreadable';
+        ranges.push({
+            ...(protocol !== undefined ? { protocol } : {}),
+            start: port,
+            ...(typeof endPort === 'number' ? { end: endPort } : {}),
+        });
+    }
+    return ranges;
+}
+function readCorePeer(peer) {
+    if (!isRecord(peer))
+        return undefined;
+    const { ipBlock, podSelector, namespaceSelector } = peer;
+    if (ipBlock !== undefined) {
+        if (!isRecord(ipBlock))
+            return undefined;
+        const cidr = parseCidr(ipBlock.cidr);
+        if (cidr === undefined)
+            return undefined;
+        const rawExcept = readList(ipBlock.except);
+        if (rawExcept === 'unreadable')
+            return undefined;
+        const except = [];
+        for (const entry of rawExcept ?? []) {
+            const parsed = parseCidr(entry);
+            if (parsed === undefined)
+                return undefined;
+            except.push(parsed);
+        }
+        return { kind: 'cidr', cidr, except, text: JSON.stringify(ipBlock) };
+    }
+    if (podSelector === undefined && namespaceSelector === undefined) {
+        // A peer naming none of the three constrains nothing. The API server
+        // rejects it on admission, so an object carrying one did not come from
+        // there and is not read as anything.
+        return undefined;
+    }
+    if (!selectorIsReadable(podSelector) || !selectorIsReadable(namespaceSelector))
+        return undefined;
+    return {
+        kind: 'selector',
+        ...(namespaceSelector !== undefined ? { namespaceSelector } : {}),
+        ...(podSelector !== undefined ? { podSelector } : {}),
+        text: JSON.stringify(peer),
+    };
+}
+/**
+ * The allowance a translated policy expresses. See {@link EgressAllowance}.
+ */
+export function egressAllowance(translated) {
+    const spec = translated.manifest.spec;
+    // This module built the manifest a line ago, so `spec.egress` is always a
+    // list here; the narrowing exists so the allowance is derived from the
+    // object itself rather than from a second statement of what each kind
+    // permits, and an impossible shape yields an allowance that permits
+    // nothing rather than one that permits anything.
+    const emitted = readList(spec.egress);
+    const rules = emitted === undefined || emitted === 'unreadable' ? [] : emitted;
+    if (translated.kind === 'CiliumNetworkPolicy') {
+        const fqdns = [];
+        // The DNS-visibility rule is the one entry among `rules` whose
+        // `toEndpoints` names the cluster resolver — narrowed or not, it always
+        // reuses `CILIUM_DNS_VISIBILITY_RULE.toEndpoints` verbatim (see
+        // `narrowedDnsVisibilityRule` and `buildCiliumNetworkPolicy`), so a deep
+        // equality check finds it regardless of which branch built this rule.
+        const dnsVisibilityRule = rules.find((rule) => isRecord(rule) &&
+            isDeepStrictEqual(rule.toEndpoints, CILIUM_DNS_VISIBILITY_RULE.toEndpoints));
+        for (const rule of rules) {
+            if (!isRecord(rule))
+                continue;
+            const hostNames = readList(rule.toFQDNs);
+            if (hostNames === undefined || hostNames === 'unreadable')
+                continue;
+            // This module built `rule` a few lines above (see the comment at the
+            // top of this function), so its `toPorts` is always in the shape
+            // `readCiliumRulePorts` reads — 'unreadable' cannot happen for a
+            // manifest this file emitted, and 'all' is the safe fallback if it
+            // somehow did, since that is what an absent `toPorts` also means.
+            const portsRead = readCiliumRulePorts(rule);
+            const ports = portsRead.ok ? portsRead.ports : 'all';
+            for (const entry of hostNames) {
+                if (isRecord(entry) && typeof entry.matchName === 'string') {
+                    fqdns.push({ host: entry.matchName, ports });
+                }
+            }
+        }
+        // This module built `dnsVisibilityRule` above (when it exists at all —
+        // every Cilium translation this function reads carries one), so
+        // `readCiliumRuleDnsNames` failing to read it, or reading a wildcard,
+        // cannot mean anything other than "not narrowed": 'all' is the safe
+        // fallback, the same reasoning `readCiliumRulePorts`'s own fallback above
+        // already relies on.
+        const dnsNamesRead = dnsVisibilityRule === undefined ? undefined : readCiliumRuleDnsNames(dnsVisibilityRule);
+        const dnsNarrowedTo = dnsNamesRead?.ok === true && dnsNamesRead.names !== 'all' ? dnsNamesRead.names : 'all';
+        return {
+            // The core-shaped reading of CILIUM_DNS_VISIBILITY_RULE — the one
+            // place in this module where one resource's rule is restated in the
+            // other's vocabulary, so that a core policy allowing exactly cluster
+            // DNS is not reported as widening a translation that already allows
+            // it. Nothing else about a Cilium translation is restated: an
+            // allowlist of names has no core spelling at all.
+            destinations: [{ peer: RESOLVER_PEER, ports: [{ start: 53 }] }],
+            fqdns,
+            dnsNarrowedTo,
+            permitsEverything: false,
+            permitsNothing: false,
+            policyKind: translated.policyKind,
+            namedObject: { kind: translated.kind, name: translated.name },
+        };
+    }
+    const destinations = [];
+    let permitsEverything = false;
+    for (const rule of rules) {
+        if (!isRecord(rule))
+            continue;
+        const ports = readPortRanges(rule.ports, 'TCP');
+        if (ports === 'unreadable')
+            continue;
+        const to = readList(rule.to);
+        if (to === 'unreadable')
+            continue;
+        if (to === undefined || to.length === 0) {
+            destinations.push({ peer: { kind: 'everything' }, ports });
+            if (ports === 'all')
+                permitsEverything = true;
+            continue;
+        }
+        for (const peer of to) {
+            const read = readCorePeer(peer);
+            if (read !== undefined)
+                destinations.push({ peer: read, ports });
+        }
+    }
+    return {
+        destinations,
+        fqdns: [],
+        // A core `NetworkPolicy` translation never narrows DNS — it has no L7
+        // concept to narrow with — so the DNS-widening check in
+        // `coreEgressRuleVerdict`/`ciliumEgressRuleVerdict` never fires against
+        // this allowance.
+        dnsNarrowedTo: 'all',
+        permitsEverything,
+        permitsNothing: rules.length === 0,
+        policyKind: translated.policyKind,
+        namedObject: { kind: translated.kind, name: translated.name },
+    };
+}
+// ---------------------------------------------------------------------------
+// Is one policy's rule inside the translation
+// ---------------------------------------------------------------------------
+function protocolCovers(allowed, wanted) {
+    // `undefined` on the allowed side is EVERY protocol; on the wanted side it
+    // is also every protocol, which only an every-protocol allowance covers.
+    return allowed === undefined || allowed === wanted;
+}
+function portRangeCovers(allowed, wanted) {
+    if (!protocolCovers(allowed.protocol, wanted.protocol))
+        return false;
+    if (allowed.start === undefined)
+        return true;
+    if (wanted.start === undefined)
+        return false;
+    const allowedEnd = allowed.end ?? allowed.start;
+    const wantedEnd = wanted.end ?? wanted.start;
+    return wanted.start >= allowed.start && wantedEnd <= allowedEnd;
+}
+function portsCover(allowed, wanted) {
+    if (allowed === 'all')
+        return true;
+    return allowed.some((range) => portRangeCovers(range, wanted));
+}
+/** Every constraint `outer` places, `inner` places too — so `inner` selects a subset. */
+function selectorIsNarrower(outer, inner) {
+    if (outer === undefined)
+        return true;
+    if (!isRecord(outer))
+        return false;
+    const outerLabels = outer.matchLabels;
+    const outerExpressions = readList(outer.matchExpressions);
+    if (outerExpressions === 'unreadable')
+        return false;
+    if (outerLabels === undefined && (outerExpressions ?? []).length === 0) {
+        // An EMPTY selector is "everything of this kind", which every selector
+        // of that kind is inside.
+        return true;
+    }
+    if (inner === undefined || !isRecord(inner))
+        return false;
+    if (outerLabels !== undefined) {
+        if (!isRecord(outerLabels))
+            return false;
+        const innerLabels = inner.matchLabels;
+        if (!isRecord(innerLabels))
+            return false;
+        for (const [key, value] of Object.entries(outerLabels)) {
+            if (!Object.hasOwn(innerLabels, key) || innerLabels[key] !== value)
+                return false;
+        }
+    }
+    const innerExpressions = readList(inner.matchExpressions);
+    if (innerExpressions === 'unreadable')
+        return false;
+    for (const expression of outerExpressions ?? []) {
+        if (!(innerExpressions ?? []).some((candidate) => isDeepStrictEqual(candidate, expression))) {
+            return false;
+        }
+    }
+    return true;
+}
+/** Is every address `wanted` admits also admitted by `allowed`. */
+function peerIsWithin(allowed, wanted) {
+    if (allowed.kind === 'everything')
+        return true;
+    if (wanted.kind === 'everything')
+        return false;
+    if (allowed.kind === 'cidr') {
+        if (wanted.kind !== 'cidr')
+            return false;
+        if (!cidrContains(allowed.cidr, wanted.cidr))
+            return false;
+        // Every hole the allowance carves out of its block has to be a hole in
+        // this peer too, or this peer reaches an address the translation does
+        // not allow. Coverage by a UNION of the peer's own `except` entries is
+        // not attempted: one entry has to contain it.
+        for (const hole of allowed.except) {
+            if (!cidrsOverlap(hole, wanted.cidr))
+                continue;
+            if (!wanted.except.some((own) => cidrContains(own, hole)))
+                return false;
+        }
+        return true;
+    }
+    if (wanted.kind !== 'selector')
+        return false;
+    // A namespaceSelector the allowance omits means "this namespace"; a peer
+    // that names namespaces reaches further than that.
+    if (allowed.namespaceSelector === undefined && wanted.namespaceSelector !== undefined) {
+        return false;
+    }
+    return (selectorIsNarrower(allowed.namespaceSelector, wanted.namespaceSelector) &&
+        selectorIsNarrower(allowed.podSelector, wanted.podSelector));
+}
+function destinationIsAllowed(allowance, peer, ports) {
+    const wanted = ports === 'all' ? [{}] : ports;
+    return wanted.every((range) => allowance.destinations.some((destination) => peerIsWithin(destination.peer, peer) && portsCover(destination.ports, range)));
+}
+/** Is every port `wanted` reaches on `host` also allowed by some `fqdns` entry naming it. */
+function fqdnIsAllowed(allowance, host, ports) {
+    const wanted = ports === 'all' ? [{}] : ports;
+    return wanted.every((range) => allowance.fqdns.some((entry) => entry.host === host && portsCover(entry.ports, range)));
+}
+/** Does `ports` (as a CANDIDATE rule's own port list) reach TCP or UDP 53 at all. */
+function coversDnsPort(ports) {
+    if (ports === 'all')
+        return true;
+    return ports.some((range) => {
+        if (range.protocol !== undefined && range.protocol !== 'UDP' && range.protocol !== 'TCP') {
+            return false;
+        }
+        if (range.start === undefined)
+            return true;
+        return range.start <= 53 && (range.end ?? range.start) >= 53;
+    });
+}
+/**
+ * Does a candidate rule's `peer`+`ports` reach the cluster resolver on the DNS
+ * port at all — the precondition for the DNS-widening check both
+ * {@link coreEgressRuleVerdict} and {@link ciliumEgressRuleVerdict} apply
+ * before falling back to the ordinary peer/port `destinationIsAllowed` check.
+ */
+function reachesResolverAtDnsPort(peer, ports) {
+    return peerIsWithin(peer, RESOLVER_PEER) && coversDnsPort(ports);
+}
+function describePeer(peer) {
+    if (peer.kind === 'everything')
+        return 'every destination';
+    return peer.text;
+}
+function describePorts(ports) {
+    if (ports === 'all')
+        return 'every port';
+    return ports
+        .map((range) => range.start === undefined
+        ? `every ${range.protocol ?? ''} port`.trim()
+        : `${range.protocol ?? 'any'} ${range.start}${range.end !== undefined ? `-${range.end}` : ''}`)
+        .join(', ');
+}
+function coreEgressRuleVerdict(rule, allowance) {
+    // Under a translation that permits nothing, the rule's own shape does not
+    // matter and is not read: ANY egress rule on a policy selecting this pod
+    // lets something out.
+    if (allowance.permitsNothing) {
+        return {
+            beyond: true,
+            detail: 'an egress rule, where the configured translation permits no egress at all',
+        };
+    }
+    if (!isRecord(rule))
+        return {
+            beyond: 'unknown',
+            detail: 'an egress rule that is not an object',
+        };
+    const ports = readPortRanges(rule.ports, 'TCP');
+    if (ports === 'unreadable') {
+        return {
+            beyond: 'unknown',
+            detail: 'a ports entry this check cannot read',
+        };
+    }
+    const to = readList(rule.to);
+    if (to === 'unreadable') {
+        return { beyond: 'unknown', detail: "a 'to' that is not a list of peers" };
+    }
+    if (to === undefined || to.length === 0) {
+        // No `to` on an egress rule means EVERY destination.
+        return allowance.permitsEverything
+            ? { beyond: false }
+            : {
+                beyond: true,
+                detail: `no 'to' peers, so every destination is reachable on ${describePorts(ports)}`,
+            };
+    }
+    for (const peer of to) {
+        const read = readCorePeer(peer);
+        if (read === undefined) {
+            return {
+                beyond: 'unknown',
+                detail: `a 'to' peer this check cannot read (${JSON.stringify(peer)})`,
+            };
+        }
+        // A plain `NetworkPolicy` has no L7 concept, so it cannot express the DNS
+        // restriction `ciliumNarrowing.dnsNames` narrows to — a core rule
+        // reaching the resolver on the DNS port always resolves every name, and
+        // that is wider than a narrowed translation whatever its own peer/port
+        // shape says. This has to be decided BEFORE `destinationIsAllowed`
+        // below: that check only reasons about reachability, and our own
+        // translation's `destinations` entry for the resolver is peer/port-only
+        // too, so a plain kube-dns rule would otherwise read as `within` a
+        // translation it actually resolves every name for.
+        if (allowance.dnsNarrowedTo !== 'all' && reachesResolverAtDnsPort(read, ports)) {
+            return {
+                beyond: true,
+                detail: `a 'to' peer ${describePeer(read)} on ${describePorts(ports)} reaching the cluster resolver's DNS port with no DNS-name restriction — a plain NetworkPolicy cannot narrow lookups the way the configured translation's ciliumNarrowing.dnsNames does, so this rule resolves every name the narrowed policy does not`,
+            };
+        }
+        if (!destinationIsAllowed(allowance, read, ports)) {
+            const wideOpen = corePeerIsWideOpen(peer) === true;
+            return {
+                beyond: true,
+                detail: `${wideOpen ? 'a wide-open ' : 'a '}'to' peer ${describePeer(read)} on ${describePorts(ports)}, which a '${allowance.policyKind}' translation does not allow`,
+            };
+        }
+    }
+    return { beyond: false };
+}
+/** Every `to…` field the Cilium CRD declares. A rule naming none of them is port-only. */
+const CILIUM_DESTINATION_FIELDS = [
+    'toEndpoints',
+    'toEntities',
+    'toCIDR',
+    'toCIDRSet',
+    'toFQDNs',
+    'toServices',
+    'toGroups',
+    'toNodes',
+];
+/**
+ * The label set a Cilium endpoint selector names, read back as the core
+ * `namespaceSelector`/`podSelector` pair it is equivalent to, so the one
+ * `peerIsWithin` serves both resource kinds. `undefined` when the selector
+ * uses anything this reading cannot map — a label source that is not a pod
+ * label, or a match expression.
+ */
+function ciliumEndpointPeer(selector) {
+    if (!isRecord(selector))
+        return undefined;
+    if (selector.matchExpressions !== undefined)
+        return undefined;
+    const matchLabels = selector.matchLabels;
+    if (!isRecord(matchLabels))
+        return undefined;
+    const podLabels = {};
+    let namespace;
+    for (const [rawKey, value] of Object.entries(matchLabels)) {
+        if (typeof value !== 'string')
+            return undefined;
+        const key = ciliumSelectorKey(rawKey);
+        if (key === undefined)
+            return undefined;
+        if (key === 'io.kubernetes.pod.namespace') {
+            namespace = value;
+            continue;
+        }
+        podLabels[key] = value;
+    }
+    return {
+        kind: 'selector',
+        ...(namespace !== undefined
+            ? {
+                namespaceSelector: {
+                    matchLabels: { 'kubernetes.io/metadata.name': namespace },
+                },
+            }
+            : {}),
+        podSelector: { matchLabels: podLabels },
+        text: JSON.stringify(selector),
+    };
+}
+function readCiliumRulePorts(rule) {
+    // A Cilium rule carries its ports one level deeper, and a port entry with
+    // no protocol means ANY rather than TCP.
+    const toPorts = readList(rule.toPorts);
+    if (toPorts === 'unreadable') {
+        return { ok: false, detail: 'a toPorts that is not a list' };
+    }
+    const portEntries = [];
+    for (const entry of toPorts ?? []) {
+        if (!isRecord(entry)) {
+            return { ok: false, detail: 'a toPorts entry that is not an object' };
+        }
+        const list = readList(entry.ports);
+        if (list === 'unreadable') {
+            return { ok: false, detail: 'a toPorts ports field that is not a list' };
+        }
+        // An entry with no `ports` at all bounds nothing, so the rule reaches
+        // every port — exactly what an absent `toPorts` means.
+        if (list === undefined || list.length === 0) {
+            portEntries.length = 0;
+            break;
+        }
+        portEntries.push(...list);
+    }
+    const ports = readPortRanges(portEntries, undefined);
+    if (ports === 'unreadable') {
+        return { ok: false, detail: 'a toPorts entry this check cannot read' };
+    }
+    return { ok: true, ports };
+}
+/**
+ * A Cilium rule's `toPorts[].rules.dns`, read into the exact-name list it
+ * restricts lookups to, or `'all'` when the rule does not restrict DNS at
+ * all. Shared by {@link egressAllowance} (reading OUR OWN narrowed
+ * DNS-visibility rule into {@link EgressAllowance.dnsNarrowedTo}) and
+ * {@link ciliumEgressRuleVerdict} (deciding whether a CANDIDATE rule's own
+ * restriction is narrow enough to not widen it) — one reading of "what names
+ * does this Cilium rule let resolve", not two that could disagree.
+ *
+ * A `toPorts` entry with no `rules` at all, or a `rules.dns` entry carrying
+ * `matchPattern` rather than `matchName`, both read as `'all'`: an absent L7
+ * restriction resolves every name by definition, and this check does not
+ * attempt to decide whether some wildcard pattern is a subset of an exact
+ * name list — `'all'` is the conservative (never under-counts a widening)
+ * answer for a shape it cannot reduce further.
+ */
+function readCiliumRuleDnsNames(rule) {
+    const toPorts = readList(rule.toPorts);
+    if (toPorts === 'unreadable')
+        return { ok: false };
+    const names = [];
+    for (const entry of toPorts ?? []) {
+        if (!isRecord(entry))
+            return { ok: false };
+        if (entry.rules === undefined)
+            return { ok: true, names: 'all' };
+        if (!isRecord(entry.rules))
+            return { ok: false };
+        const dns = readList(entry.rules.dns);
+        if (dns === 'unreadable')
+            return { ok: false };
+        if (dns === undefined)
+            return { ok: true, names: 'all' };
+        for (const item of dns) {
+            if (!isRecord(item))
+                return { ok: false };
+            if (typeof item.matchName === 'string') {
+                names.push(item.matchName);
+                continue;
+            }
+            // `matchPattern` (Cilium's glob syntax) or anything else this reading
+            // does not recognise — both are read as unrestricted rather than
+            // guessed at, per the doc comment above.
+            return { ok: true, names: 'all' };
+        }
+    }
+    return { ok: true, names };
+}
+function ciliumEgressRuleVerdict(rule, allowance) {
+    if (allowance.permitsNothing) {
+        return {
+            beyond: true,
+            detail: 'an egress rule, where the configured translation permits no egress at all',
+        };
+    }
+    if (!isRecord(rule))
+        return {
+            beyond: 'unknown',
+            detail: 'an egress rule that is not an object',
+        };
+    const portsRead = readCiliumRulePorts(rule);
+    if (!portsRead.ok) {
+        return { beyond: 'unknown', detail: portsRead.detail };
+    }
+    const ports = portsRead.ports;
+    const fields = new Map();
+    for (const field of CILIUM_DESTINATION_FIELDS) {
+        const list = readList(rule[field]);
+        if (list === 'unreadable') {
+            return {
+                beyond: 'unknown',
+                detail: `a ${field} that is not a list of peers`,
+            };
+        }
+        if (list !== undefined && list.length > 0)
+            fields.set(field, list);
+    }
+    if (fields.size === 0) {
+        return allowance.permitsEverything
+            ? { beyond: false }
+            : {
+                beyond: true,
+                detail: `a port-only egress rule, so every destination is reachable on ${describePorts(ports)}`,
+            };
+    }
+    for (const entity of fields.get('toEntities') ?? []) {
+        if (typeof entity !== 'string') {
+            return {
+                beyond: 'unknown',
+                detail: 'a toEntities entry that is not an entity name',
+            };
+        }
+        if (!allowance.permitsEverything) {
+            return {
+                beyond: true,
+                detail: `toEntities '${entity}', which a '${allowance.policyKind}' translation does not allow`,
+            };
+        }
+    }
+    for (const field of ['toCIDR', 'toCIDRSet']) {
+        for (const entry of fields.get(field) ?? []) {
+            const peer = field === 'toCIDR'
+                ? readCorePeer({ ipBlock: { cidr: entry } })
+                : isRecord(entry)
+                    ? readCorePeer({
+                        ipBlock: { cidr: entry.cidr, except: entry.except },
+                    })
+                    : undefined;
+            if (peer === undefined) {
+                return {
+                    beyond: 'unknown',
+                    detail: `a ${field} entry this check cannot read`,
+                };
+            }
+            if (!destinationIsAllowed(allowance, peer, ports)) {
+                return {
+                    beyond: true,
+                    detail: `${field} ${describePeer(peer)} on ${describePorts(ports)}, which a '${allowance.policyKind}' translation does not allow`,
+                };
+            }
+        }
+    }
+    for (const entry of fields.get('toFQDNs') ?? []) {
+        if (!isRecord(entry)) {
+            return {
+                beyond: 'unknown',
+                detail: 'a toFQDNs entry that is not an object',
+            };
+        }
+        const matchName = entry.matchName;
+        if (typeof matchName !== 'string' || !fqdnIsAllowed(allowance, matchName, ports)) {
+            return {
+                beyond: true,
+                detail: `toFQDNs ${JSON.stringify(entry)} on ${describePorts(ports)}, which a '${allowance.policyKind}' translation does not allow`,
+            };
+        }
+    }
+    for (const selector of fields.get('toEndpoints') ?? []) {
+        const peer = ciliumEndpointPeer(selector);
+        if (peer === undefined) {
+            return {
+                beyond: 'unknown',
+                detail: 'a toEndpoints entry this check cannot read as a selector',
+            };
+        }
+        // See the matching comment in `coreEgressRuleVerdict`: reachability alone
+        // cannot tell a plain kube-dns rule from a narrowed one, so this has to
+        // run before `destinationIsAllowed` below. Unlike a core rule, a Cilium
+        // one CAN narrow DNS on its own `toPorts.rules.dns` — read it and accept
+        // the rule only when what it names is a subset of what our own
+        // translation narrows to.
+        if (allowance.dnsNarrowedTo !== 'all' && reachesResolverAtDnsPort(peer, ports)) {
+            const narrowedTo = allowance.dnsNarrowedTo;
+            const candidate = readCiliumRuleDnsNames(rule);
+            const isSubset = candidate.ok &&
+                candidate.names !== 'all' &&
+                candidate.names.every((n) => narrowedTo.includes(n));
+            if (!isSubset) {
+                return {
+                    beyond: true,
+                    detail: `toEndpoints ${describePeer(peer)} on ${describePorts(ports)} reaching the cluster resolver's DNS port with ${candidate.ok && candidate.names !== 'all' ? 'a rules.dns list this check cannot confirm is a subset of' : 'no rules.dns restriction at least as narrow as'} the configured translation's ciliumNarrowing.dnsNames`,
+                };
+            }
+            continue;
+        }
+        if (!destinationIsAllowed(allowance, peer, ports)) {
+            return {
+                beyond: true,
+                detail: `toEndpoints ${describePeer(peer)} on ${describePorts(ports)}, which a '${allowance.policyKind}' translation does not allow`,
+            };
+        }
+    }
+    for (const field of ['toServices', 'toGroups', 'toNodes']) {
+        if (fields.has(field)) {
+            return {
+                beyond: 'unknown',
+                detail: `a ${field} rule, whose destinations this check cannot enumerate`,
+            };
+        }
+    }
+    return { beyond: false };
+}
+function unreadableEgressPolicy(kind, name, detail) {
+    return {
+        kind,
+        name,
+        selects: 'unknown',
+        enforcesEgress: false,
+        rules: [],
+        unreadable: detail,
+    };
+}
+/**
+ * Is this the object `config.egress` named — see
+ * {@link EgressPolicyDocument.namedObject}.
+ *
+ * Read off the allowance rather than passed in, so every caller of
+ * {@link readCoreEgressPolicies}/{@link readCiliumEgressPolicies} that built
+ * its allowance with {@link egressAllowance} gets the marking without having
+ * to remember a second argument, and the readers stay a function of "(items,
+ * this pod, what the translation allows)".
+ *
+ * For a core `NetworkPolicy` the name is the whole answer. For a
+ * `CiliumNetworkPolicy` it is not: the CRD carries EITHER one `spec` or a
+ * `specs` list, `verifyEgressPolicyApplied` reads the former and refuses an
+ * object carrying the latter, so the reader marks only the document built
+ * from `item.spec` and lets a `specs` entry be judged by the union rule like
+ * any other object's rules — see {@link EgressPolicyDocument.namedObject}.
+ *
+ * Deliberately NOT applied to an unreadable document: an object at the named
+ * name that could not be read keeps its `not-evaluable` verdict, which refuses
+ * — a fail-closed answer for a shape whose exact comparison already refused it
+ * earlier on the create path.
+ */
+function isNamedObject(allowance, kind, name) {
+    return allowance.namedObject.kind === kind && allowance.namedObject.name === name;
+}
+/** Every core `NetworkPolicy` in the list, reduced to {@link EgressPolicyDocument}. */
+export function readCoreEgressPolicies(items, target, allowance) {
+    return items.map((item, index) => {
+        const name = policyName(item, index);
+        if (!isRecord(item)) {
+            return unreadableEgressPolicy('NetworkPolicy', name, 'a list entry that is not a policy object');
+        }
+        const spec = item.spec;
+        if (!isRecord(spec)) {
+            return unreadableEgressPolicy('NetworkPolicy', name, 'a spec that is not an object');
+        }
+        const policyTypes = readList(spec.policyTypes);
+        if (policyTypes === 'unreadable') {
+            return unreadableEgressPolicy('NetworkPolicy', name, 'a spec.policyTypes that is not a list');
+        }
+        const rules = readList(spec.egress);
+        if (rules === 'unreadable') {
+            return unreadableEgressPolicy('NetworkPolicy', name, 'a spec.egress that is not a list of rules');
+        }
+        // An ABSENT `policyTypes` is defaulted by the API server from the blocks
+        // the object carries: Egress appears exactly when `spec.egress` does.
+        // This is the opposite of the ingress default, where Egress's absence is
+        // the thing that has to be spelled out.
+        const enforcesEgress = policyTypes === undefined ? rules !== undefined : policyTypes.includes('Egress');
+        return {
+            kind: 'NetworkPolicy',
+            name,
+            ...(isNamedObject(allowance, 'NetworkPolicy', name) ? { namedObject: true } : {}),
+            selects: matchesLabelSelector(spec.podSelector, target.podLabels),
+            enforcesEgress,
+            // An `egress` block under a `policyTypes` that leaves Egress out is
+            // ignored by the API server itself: it neither bounds nor widens.
+            rules: enforcesEgress
+                ? (rules ?? []).map((rule) => coreEgressRuleVerdict(rule, allowance))
+                : [],
+        };
+    });
+}
+/** Every `CiliumNetworkPolicy` in the list, reduced the same way. */
+export function readCiliumEgressPolicies(items, target, allowance) {
+    const identity = ciliumIdentityLabels(target.podLabels, target.namespace);
+    const documents = [];
+    for (const [index, item] of items.entries()) {
+        const name = policyName(item, index);
+        if (!isRecord(item)) {
+            documents.push(unreadableEgressPolicy('CiliumNetworkPolicy', name, 'a list entry that is not a policy object'));
+            continue;
+        }
+        // The CRD carries EITHER one `spec` or a `specs` list, and a rule in
+        // either enforces. Reading only `spec` would miss a whole policy.
+        //
+        // The two spellings are NOT equal where the named-object exemption is
+        // concerned — see {@link EgressPolicyDocument.namedObject}. The exact
+        // comparison the exemption leans on reads `spec` and refuses an object
+        // carrying a `specs` list, so `spec` is the one document that earns the
+        // marking; a `specs` entry is read as an ordinary policy's rules and is
+        // judged by the union rule, which is what refuses one that widens.
+        const named = isNamedObject(allowance, 'CiliumNetworkPolicy', name);
+        const specDocuments = [];
+        if (item.spec !== undefined && item.spec !== null) {
+            specDocuments.push({ spec: item.spec, isTheSpec: true });
+        }
+        const more = readList(item.specs);
+        if (more === 'unreadable') {
+            documents.push(unreadableEgressPolicy('CiliumNetworkPolicy', name, 'a specs that is not a list of rule specs'));
+            continue;
+        }
+        for (const spec of more ?? [])
+            specDocuments.push({ spec, isTheSpec: false });
+        if (specDocuments.length === 0) {
+            documents.push(unreadableEgressPolicy('CiliumNetworkPolicy', name, 'neither a spec nor a specs list'));
+            continue;
+        }
+        for (const { spec, isTheSpec } of specDocuments) {
+            const document = readCiliumEgressRuleSpec(spec, name, identity, allowance, named && isTheSpec);
+            if (document !== undefined)
+                documents.push(document);
+        }
+    }
+    return documents;
+}
+/**
+ * One `spec`/`specs` entry. `undefined` when it is node-scoped — see below.
+ *
+ * `isTheNamedSpec` is true only for the document built from the named
+ * object's own `spec` — the one {@link verifyEgressPolicyApplied} compared to
+ * the translation. A `specs` entry never is; see
+ * {@link EgressPolicyDocument.namedObject} for why that distinction is
+ * load-bearing rather than bookkeeping.
+ */
+function readCiliumEgressRuleSpec(spec, name, identity, allowance, isTheNamedSpec) {
+    const unreadable = (detail) => unreadableEgressPolicy('CiliumNetworkPolicy', name, detail);
+    if (!isRecord(spec))
+        return unreadable('a rule spec that is not an object');
+    // A node-scoped rule selects nodes, never pods.
+    if (spec.nodeSelector !== undefined)
+        return undefined;
+    const rules = readList(spec.egress);
+    if (rules === 'unreadable')
+        return unreadable('a spec.egress that is not a list of rules');
+    const egressDeny = readList(spec.egressDeny);
+    if (egressDeny === 'unreadable')
+        return unreadable('a spec.egressDeny that is not a list of rules');
+    let enforcesEgress = rules !== undefined || egressDeny !== undefined;
+    const enableDefaultDeny = spec.enableDefaultDeny;
+    if (enableDefaultDeny !== undefined) {
+        if (!isRecord(enableDefaultDeny))
+            return unreadable('an enableDefaultDeny that is not an object');
+        const forEgress = enableDefaultDeny.egress;
+        if (forEgress !== undefined && typeof forEgress !== 'boolean') {
+            return unreadable('an enableDefaultDeny.egress that is not a boolean');
+        }
+        if (forEgress === false)
+            enforcesEgress = false;
+    }
+    return {
+        kind: 'CiliumNetworkPolicy',
+        name,
+        ...(isTheNamedSpec ? { namedObject: true } : {}),
+        selects: matchesLabelSelector(spec.endpointSelector, identity, ciliumSelectorKey),
+        enforcesEgress,
+        // `egressDeny` rules are not read: a deny rule can only narrow what
+        // leaves the pod, and this check refuses widening. Allow rules are read
+        // whatever `enableDefaultDeny` says, because what a rule admits it
+        // admits — it simply may not be the policy that default-denies.
+        rules: (rules ?? []).map((rule) => ciliumEgressRuleVerdict(rule, allowance)),
+    };
+}
+/**
+ * The union rule, applied. Pure — no I/O, no client, no clock — so every
+ * shape that has to be refused can be asserted one per test.
+ *
+ * Kubernetes UNIONS every policy selecting a pod: traffic leaves if ANY
+ * selecting policy allows it. So one policy allowing more than the
+ * translation is the finding however many narrower ones sit beside it, and a
+ * pod no policy default-denies has no egress boundary at all whatever the
+ * named object says.
+ *
+ * The named object's `spec` is the one document whose rules are not judged
+ * here — see {@link EgressPolicyDocument.namedObject} — and it was compared to
+ * the translation by {@link verifyEgressPolicyApplied} on the same create path
+ * just before. Its SELECTOR and its egress-scoping still decide, which is what
+ * keeps "nothing bounds this pod" answerable for a deployment whose only
+ * policy is that one; and a document built from a `specs` entry is judged here
+ * like any other object's, because the exempting comparison refuses an object
+ * carrying a `specs` list rather than reading one.
+ */
+export function decideEgressUnion(documents, allowance) {
+    const examined = [];
+    let enforcing = 0;
+    let widening;
+    let undecided;
+    for (const document of documents) {
+        const base = { kind: document.kind, name: document.name };
+        if (document.unreadable !== undefined) {
+            const entry = {
+                ...base,
+                verdict: 'not-evaluable',
+                detail: document.unreadable,
+            };
+            examined.push(entry);
+            undecided ??= entry;
+            continue;
+        }
+        if (document.selects === 'no') {
+            examined.push({ ...base, verdict: 'does-not-select' });
+            continue;
+        }
+        if (document.selects === 'unknown') {
+            const entry = {
+                ...base,
+                verdict: 'not-evaluable',
+                detail: 'its selector uses something this check cannot evaluate against pod labels',
+            };
+            examined.push(entry);
+            undecided ??= entry;
+            continue;
+        }
+        // The named object's `spec` rules were just compared to the translation
+        // by `verifyEgressPolicyApplied`, field by field, which is the one
+        // judgement about them that a `toFQDNs`-by-`matchName` allowance cannot
+        // reproduce — see {@link EgressPolicyDocument.namedObject}. So the union
+        // rule does not judge them; judging them here is what made the check
+        // refuse the object it had just told an operator to apply. Everything
+        // below still applies, which is how a pod whose only policy is the named
+        // one is still known to be in egress default-deny. Only that `spec`
+        // document carries the marking: a `specs` entry is judged here like any
+        // other rules.
+        if (document.namedObject !== true) {
+            const beyondRule = document.rules.find((rule) => rule.beyond === true);
+            if (beyondRule !== undefined) {
+                const entry = {
+                    ...base,
+                    verdict: 'widens-egress',
+                    ...(beyondRule.detail !== undefined ? { detail: beyondRule.detail } : {}),
+                };
+                examined.push(entry);
+                widening ??= entry;
+                continue;
+            }
+            const unknownRule = document.rules.find((rule) => rule.beyond === 'unknown');
+            if (unknownRule !== undefined) {
+                const entry = {
+                    ...base,
+                    verdict: 'not-evaluable',
+                    ...(unknownRule.detail !== undefined ? { detail: unknownRule.detail } : {}),
+                };
+                examined.push(entry);
+                undecided ??= entry;
+                continue;
+            }
+        }
+        if (!document.enforcesEgress) {
+            examined.push({
+                ...base,
+                verdict: 'not-egress-scoped',
+                detail: 'it selects the pod but default-denies nothing on egress',
+            });
+            continue;
+        }
+        examined.push({ ...base, verdict: 'within' });
+        enforcing += 1;
+    }
+    if (widening !== undefined) {
+        return {
+            examined,
+            refusal: {
+                kind: 'policy-widens-egress',
+                summary: `${widening.kind}/${widening.name} selects this pod and allows ${widening.detail ?? 'egress the configured translation does not'}.`,
+            },
+        };
+    }
+    if (undecided !== undefined) {
+        return {
+            examined,
+            refusal: {
+                kind: 'not-evaluable',
+                summary: `${undecided.kind}/${undecided.name} contains ${undecided.detail ?? 'something this check cannot evaluate'}, so what this pod may reach cannot be decided from the cluster's own objects.`,
+            },
+        };
+    }
+    // `allow-all` asks for no boundary, so a pod nothing default-denies is
+    // exactly what it configured; every other kind needs a policy that
+    // actually puts this pod in egress default-deny, or the translation is a
+    // manifest nobody enforces.
+    if (enforcing === 0 && !allowance.permitsEverything) {
+        return {
+            examined,
+            refusal: {
+                kind: 'no-enforcing-policy',
+                summary: `no applied policy puts this pod in egress default-deny, so a '${allowance.policyKind}' translation bounds nothing it sends.`,
+            },
+        };
+    }
+    return { examined };
+}
+/**
+ * The named refusal. Distinct from {@link KubernetesEgressPolicyMismatchError}
+ * — which is about the ONE named object drifting from the translation — and
+ * from `KubernetesIngressPolicyError`, which is about the agent port being
+ * reachable. An operator debugging a release that ships all three tells them
+ * apart by class and by the first clause of the message.
+ *
+ * It carries the pod's labels and EVERY policy examined, with a verdict each,
+ * because that list is the operator's whole debugging session: "why does my
+ * policy not count?" is answered by the line saying it did not select these
+ * labels.
+ */
+export class KubernetesEgressPolicyUnionError extends Error {
+    refusal;
+    subject;
+    podLabels;
+    policyKind;
+    examined;
+    unread;
+    name = 'KubernetesEgressPolicyUnionError';
+    constructor(refusal, subject, podLabels, policyKind, examined, summary, 
+    /** Empty on every decision made from policies that WERE read. */
+    unread = []) {
+        super(`kubernetes: refusing ${subject} — ${summary} config.egress.policy is '${policyKind}' and the pod's labels are ${formatLabels(podLabels)}. ${formatExaminedEgress(examined, unread)} Kubernetes UNIONS every policy selecting a pod, so what leaves this pod is everything ANY of them allows — a second policy widens egress however exactly the named object matches. ${formatEgressRemedy(refusal, unread)}`);
+        this.refusal = refusal;
+        this.subject = subject;
+        this.podLabels = podLabels;
+        this.policyKind = policyKind;
+        this.examined = examined;
+        this.unread = unread;
+    }
+}
+function formatExaminedEgress(examined, unread) {
+    const lines = examined.map((entry) => {
+        const detail = entry.detail !== undefined ? ` (${entry.detail})` : '';
+        return `${entry.kind}/${entry.name}: ${entry.verdict}${detail}`;
+    });
+    const read = lines.length === 0
+        ? 'No policy was read from the collections this check could enumerate.'
+        : `Policies examined: ${lines.join('; ')}.`;
+    if (unread.length === 0)
+        return read;
+    const missing = unread
+        .map((source) => `${source.resource} at ${source.path} (${source.why}: ${source.reason})`)
+        .join('; ');
+    return `${read} NOT read, so nothing below is a statement about it: ${missing}.`;
+}
+function formatEgressRemedy(refusal, unread) {
+    if (refusal === 'not-evaluable') {
+        const forbidden = unread.some((source) => source.why === 'forbidden');
+        return `${forbidden ? "Grant this backend's ServiceAccount 'list' on that resource, " : 'Fix or remove the policy named above, '}or set egress.verify: 'named-object-only' to check only the one named object, as every release before this one did.`;
+    }
+    if (refusal === 'no-enforcing-policy') {
+        return "Apply a NetworkPolicy whose podSelector matches the labels above and whose policyTypes includes 'Egress' (packages/sandbox/k8s/manifests/networkpolicy.yaml is this repo's baseline), or set egress.verify: 'named-object-only' if the boundary lives somewhere a namespaced Role cannot read.";
+    }
+    return "Narrow or delete the policy named above so that nothing selecting these pods allows more than config.egress does, or set egress.verify: 'named-object-only' to go back to checking only the named object.";
+}
+// ---------------------------------------------------------------------------
+// The I/O half
+// ---------------------------------------------------------------------------
+/**
+ * Verify-not-trust, widened from one object to the union: list the
+ * namespace's policies, evaluate every one that selects this pod against the
+ * configured translation, and refuse unless nothing lets out more than
+ * `config.egress` says. The named object's `spec` document is the one
+ * exception, and it was compared to the translation by
+ * {@link verifyEgressPolicyApplied} on this same create path just before this
+ * one — see {@link EgressPolicyDocument.namedObject}: a Cilium object that
+ * carries a `specs` list is refused there outright, so a `specs` entry is
+ * judged HERE, like any other object's rules.
+ *
+ * Runs beside the ingress check on every create path — before the POST for a
+ * directly created Sandbox, where the labels are known and a refusal leaves
+ * nothing behind, and after the bind for a claimed one, where the pool's own
+ * template decides the labels and a refusal releases the claim through the
+ * acquire path's cleanup.
+ */
+export async function verifyEgressPolicyUnion(client, translated, target, signal) {
+    const allowance = egressAllowance(translated);
+    const documents = [];
+    try {
+        documents.push(...readCoreEgressPolicies(await listPolicies(client, networkPolicyCollectionPath(target.namespace), 'networkpolicies', signal), target, allowance));
+        if (target.engine === 'cilium') {
+            documents.push(...readCiliumEgressPolicies(await listPolicies(client, ciliumNetworkPolicyCollectionPath(target.namespace), 'ciliumnetworkpolicies', signal), target, allowance));
+        }
+    }
+    catch (err) {
+        if (!(err instanceof UnreadPolicyCollection))
+            throw err;
+        throw new KubernetesEgressPolicyUnionError('not-evaluable', target.subject, target.podLabels, allowance.policyKind, decideEgressUnion(documents, allowance).examined, err.summary, [err.source]);
+    }
+    const decision = decideEgressUnion(documents, allowance);
+    if (decision.refusal === undefined)
+        return;
+    throw new KubernetesEgressPolicyUnionError(decision.refusal.kind, target.subject, target.podLabels, allowance.policyKind, decision.examined, decision.refusal.summary);
 }
 //# sourceMappingURL=egress-policy.js.map