@namzu/sandbox 26.0.0 → 28.0.0

package/dist/backends/kubernetes/objects.js.map

@@ -1 +1 @@
-{"version":3,"file":"objects.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAA;AAClD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,4BAA4B,CAAA;AACxE,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAE5C,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAA;AAuDtC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC9B,UAAsD,EACtD,IAAY;IAEZ,OAAO,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,IAAI,CAAA;AAChF,CAAC;AAqPD,6EAA6E;AAC7E,MAAM,UAAU,SAAS,CAAC,GAA4B;IACrD,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,CAAA;IAC1B,IAAI,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IACjF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,OAAO,KAAK,EAAE,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,EAAE,CAAA;IACtE,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,GAA4B;IACrD,IAAI,CAAC,GAAG,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAA;IAChC,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,IAAI,IAAI;QAAE,OAAO,KAAK,CAAA;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAA;IAC/B,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,GAA4B;IACxD,MAAM,KAAK,GAAG,GAAG,EAAE,MAAM,EAAE,KAAK,CAAA;IAChC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,4CAA4C,CAAA;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,oCAAoC,CAAA;AAEpF,+EAA+E;AAC/E,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC/C,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,CAAC,CAAC,CAAA;IAC3B,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,SAAS,GAA4B,EAAE,CAAA;IAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACnF,MAAM,MAAM,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAQ;QAClC,SAAS,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,WAA+B;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;SAClD,MAAM,CAAC,KAAK,CAAC,CAAA;IACf,OAAO,UAAU,MAAM,EAAE,CAAA;AAC1B,CAAC;AAuBD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACrD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AACtD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC5C,OAAO,yBAAyB,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAA;AAChE,CAAC;AA0BD,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAElD,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,IAAsC;IACrE,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAA;IACrC,MAAM,eAAe,GACpB,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,EAAE;QACvE,CAAC,CAAC,IAAI,CAAC,eAAe;QACtB,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC,2BAA2B,CAAC,CAAA;IACzD,MAAM,IAAI,GAAG;QACZ,cAAc,EAAE,WAAW,KAAK,SAAS;QACzC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAA;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAC5D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACzE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAsC;IACzE,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,gCAAgC,CAAC,CAAA;IACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AACxE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,OAA2B,EAAE,KAAa;IAC3E,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;AAC7D,CAAC;AAyDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IACjE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAChC,MAAM,YAAY,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,CAAA;IACnE,MAAM,KAAK,GAAyB,EAAE,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,qEAAqE;QACrE,qEAAqE;QACrE,6DAA6D;QAC7D,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACd,kJAAkJ,CAClJ,CAAA;QACF,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAC1E,CAAC;SAAM,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAC9F,CAAC;SAAM,CAAC;QACP,kEAAkE;QAClE,oEAAoE;QACpE,2DAA2D;QAC3D,mEAAmE;QACnE,gEAAgE;QAChE,MAAM,IAAI,KAAK,CACd,4LAA4L,CAC5L,CAAA;IACF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;IAElC,MAAM,SAAS,GAAyB,EAAE,CAAA;IAC1C,sEAAsE;IACtE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,WAAW,GAA2B;QAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,sBAAsB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE,CAAC,wCAAwC,CAAC,EAAE,KAAK,CAAC,sBAAsB,EAAE;YAC9E,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,KAAK,CAAC,WAAW;KACpB,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC7B,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,kEAAkE;YAClE,2DAA2D;YAC3D,mEAAmE;YACnE,oEAAoE;YACpE,gEAAgE;YAChE,+DAA+D;YAC/D,gEAAgE;YAChE,8DAA8D;YAC9D,8DAA8D;YAC9D,4BAA4B;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,2BAA2B,CAAC,EAAE,CAAC;gBACtE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CACd,iNAAiN,CACjN,CAAA;gBACF,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,OAAO,CAAC,eAAe;iBAC9B,CAAC,CAAA;YACH,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QACjF,CAAC;aAAM,CAAC;YACP,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrF,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC,CAAA;AAChC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CACnC,mBAA2B;IAE3B,OAAO,EAAE,CAAC,0BAA0B,CAAC,EAAE,mBAAmB,EAAE,CAAA;AAC7D,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAA;AAChE,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAA;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAA;AAC1D,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAA;AAErD,SAAS,OAAO,CAAC,KAAa;IAC7B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACpD,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAA;AACrH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,IAAY;IACxD,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,aAAqB;IACrE,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,kBAAkB,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAA;AAC9F,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,IAAY;IAC3D,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACzI,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACtD,OAAO,SAAS,iBAAiB,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,YAAY,CAAA;AACtG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,IAAY;IAC1D,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IAClE,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACzI,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACxC,SAAiB,EACjB,WAAmB,EACnB,iBAAyB;IAEzB,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,2BAA2B,OAAO,CAChF,GAAG,iBAAiB,IAAI,WAAW,EAAE,CACrC,EAAE,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,IAAY;IACtD,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACxE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAClD,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,OAAO,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,aAAqB;IACnE,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,uBAAuB,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAA;AAC1G,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC5D,OAAO,SAAS,6BAA6B,IAAI,+BAA+B,eAAe,OAAO,CAAC,SAAS,CAAC,kBAAkB,CAAA;AACpI,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,IAAY;IAChE,OAAO,GAAG,2BAA2B,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,SAAiB;IAClE,OAAO,SAAS,+BAA+B,IAAI,iCAAiC,eAAe,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAA;AAC9I,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,IAAY;IACtE,OAAO,GAAG,iCAAiC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,8BAA8B,CAAA;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAA;AAEtD,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACzD,OAAO,SAAS,gCAAgC,IAAI,kCAAkC,gCAAgC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACtI,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,IAAY;IAChE,OAAO,SAAS,gCAAgC,IAAI,kCAAkC,sCAAsC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC5I,CAAC"}
+{"version":3,"file":"objects.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAA;AAClD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,4BAA4B,CAAA;AACxE,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAE5C,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAA;AA0EtC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC9B,UAAsD,EACtD,IAAY;IAEZ,OAAO,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,IAAI,CAAA;AAChF,CAAC;AAqPD,6EAA6E;AAC7E,MAAM,UAAU,SAAS,CAAC,GAA4B;IACrD,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,CAAA;IAC1B,IAAI,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IACjF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,OAAO,KAAK,EAAE,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,EAAE,CAAA;IACtE,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,GAA4B;IACrD,IAAI,CAAC,GAAG,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAA;IAChC,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,IAAI,IAAI;QAAE,OAAO,KAAK,CAAA;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAA;IAC/B,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,GAA4B;IACxD,MAAM,KAAK,GAAG,GAAG,EAAE,MAAM,EAAE,KAAK,CAAA;IAChC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,4CAA4C,CAAA;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,oCAAoC,CAAA;AAEpF,+EAA+E;AAC/E,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC/C,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,CAAC,CAAC,CAAA;IAC3B,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,SAAS,GAA4B,EAAE,CAAA;IAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACnF,MAAM,MAAM,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAQ;QAClC,SAAS,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,WAA+B;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;SAClD,MAAM,CAAC,KAAK,CAAC,CAAA;IACf,OAAO,UAAU,MAAM,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;SAC5C,MAAM,CAAC,KAAK,CAAC,CAAA;IACf,OAAO,UAAU,MAAM,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gCAAgC,CAAA;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,mCAAmC,CAAA;AAElF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,oCAAoC,CAAA;AASpF,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,IAAsC;IACpE,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAA;IACrC,OAAO;QACN,EAAE,EAAE,WAAW,EAAE,CAAC,4BAA4B,CAAC;QAC/C,gBAAgB,EAAE,WAAW,EAAE,CAAC,+BAA+B,CAAC;QAChE,gBAAgB,EAAE,WAAW,EAAE,CAAC,gCAAgC,CAAC;KACjE,CAAA;AACF,CAAC;AAuBD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACrD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AACtD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC5C,OAAO,yBAAyB,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAA;AAChE,CAAC;AA+BD,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAElD,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,IAAsC;IACrE,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAA;IACrC,MAAM,eAAe,GACpB,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,EAAE;QACvE,CAAC,CAAC,IAAI,CAAC,eAAe;QACtB,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC,2BAA2B,CAAC,CAAA;IACzD,MAAM,IAAI,GAAG;QACZ,cAAc,EAAE,WAAW,KAAK,SAAS;QACzC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAA;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAC5D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACzE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAsC;IACzE,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,gCAAgC,CAAC,CAAA;IACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AACxE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,OAA2B,EAAE,KAAa;IAC3E,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;AAC7D,CAAC;AAyDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IACjE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAChC,MAAM,YAAY,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,CAAA;IACnE,MAAM,KAAK,GAAyB,EAAE,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,qEAAqE;QACrE,qEAAqE;QACrE,6DAA6D;QAC7D,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACd,kJAAkJ,CAClJ,CAAA;QACF,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAC1E,CAAC;SAAM,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAC9F,CAAC;SAAM,CAAC;QACP,kEAAkE;QAClE,oEAAoE;QACpE,2DAA2D;QAC3D,mEAAmE;QACnE,gEAAgE;QAChE,MAAM,IAAI,KAAK,CACd,4LAA4L,CAC5L,CAAA;IACF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;IAElC,MAAM,SAAS,GAAyB,EAAE,CAAA;IAC1C,sEAAsE;IACtE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,WAAW,GAA2B;QAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,sBAAsB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE,CAAC,wCAAwC,CAAC,EAAE,KAAK,CAAC,sBAAsB,EAAE;YAC9E,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,KAAK,CAAC,WAAW;KACpB,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC7B,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,kEAAkE;YAClE,2DAA2D;YAC3D,mEAAmE;YACnE,oEAAoE;YACpE,gEAAgE;YAChE,+DAA+D;YAC/D,gEAAgE;YAChE,8DAA8D;YAC9D,8DAA8D;YAC9D,4BAA4B;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,2BAA2B,CAAC,EAAE,CAAC;gBACtE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CACd,iNAAiN,CACjN,CAAA;gBACF,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,OAAO,CAAC,eAAe;iBAC9B,CAAC,CAAA;YACH,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QACjF,CAAC;aAAM,CAAC;YACP,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrF,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC,CAAA;AAChC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CACnC,mBAA2B;IAE3B,OAAO,EAAE,CAAC,0BAA0B,CAAC,EAAE,mBAAmB,EAAE,CAAA;AAC7D,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAA;AAChE,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAA;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAA;AAC1D,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAA;AAErD,SAAS,OAAO,CAAC,KAAa;IAC7B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACpD,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAA;AACrH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,IAAY;IACxD,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,aAAqB;IACrE,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,kBAAkB,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAA;AAC9F,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,IAAY;IAC3D,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACzI,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACtD,OAAO,SAAS,iBAAiB,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,YAAY,CAAA;AACtG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,IAAY;IAC1D,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IAClE,OAAO,SAAS,4BAA4B,IAAI,mBAAmB,eAAe,OAAO,CAAC,SAAS,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACzI,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACxC,SAAiB,EACjB,WAAmB,EACnB,iBAAyB;IAEzB,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,2BAA2B,OAAO,CAChF,GAAG,iBAAiB,IAAI,WAAW,EAAE,CACrC,EAAE,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,IAAY;IACtD,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACxE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAClD,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,OAAO,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,aAAqB;IACnE,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,uBAAuB,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAA;AAC1G,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC5D,OAAO,SAAS,6BAA6B,IAAI,+BAA+B,eAAe,OAAO,CAAC,SAAS,CAAC,kBAAkB,CAAA;AACpI,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,IAAY;IAChE,OAAO,GAAG,2BAA2B,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,SAAiB;IAClE,OAAO,SAAS,+BAA+B,IAAI,iCAAiC,eAAe,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAA;AAC9I,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,IAAY;IACtE,OAAO,GAAG,iCAAiC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,8BAA8B,CAAA;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAA;AAEtD,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACzD,OAAO,SAAS,gCAAgC,IAAI,kCAAkC,gCAAgC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AACtI,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,IAAY;IAChE,OAAO,SAAS,gCAAgC,IAAI,kCAAkC,sCAAsC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC5I,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,IAAY;IAC5D,OAAO,sBAAsB,OAAO,CAAC,SAAS,CAAC,eAAe,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;AAC9E,CAAC"}

package/dist/backends/kubernetes/per-sandbox-fence.d.ts

@@ -0,0 +1,194 @@
+/**
+ * What the per-sandbox egress fence is checked FOR, and the operator-pinned
+ * host set that tightens it.
+ *
+ * `per-sandbox-policy.ts` used to prove the fence by GETting the
+ * `ValidatingAdmissionPolicy` and its binding and stopping at "the request
+ * succeeded". An object that exists is not an object that fences: a binding
+ * whose `validationActions` is `[Audit]` or `[Warn]` logs and admits, a
+ * binding that names another policy attaches nothing to this one, a policy
+ * with `failurePolicy: Ignore` admits whatever its expressions cannot
+ * evaluate, a binding whose namespace selector excludes the sandboxes'
+ * namespace never runs there, and a policy whose `matchConditions` name a
+ * different user never matches this host. Each reads, from the outside,
+ * exactly like an enforced fence, which is the failure the `no-network`
+ * baseline's check exists to prevent for its own object: that one compares the
+ * named object to the translation field by field, and refuses on any
+ * difference.
+ *
+ * This module is the same standard applied to the fence. It reads what the
+ * cluster stored and compares it, field by field, to what the writer relies
+ * on, and refuses with a named error carrying the field that failed — before
+ * anything is written.
+ *
+ * ## What it can and cannot prove
+ *
+ * It proves the CONFIGURATION of the fence: that the binding attaches this
+ * policy, denies, fails closed, covers the namespace and the verbs, and that
+ * the policy matches the configured identity. It does not evaluate the
+ * policy's CEL: whether the shipped expressions refuse what they claim is
+ * measured against an API server (see the header of
+ * `validatingadmissionpolicy-cilium.yaml`), not derivable from the stored
+ * object. The one exception is the companion policy below, whose expressions
+ * this module owns and compares verbatim.
+ *
+ * ## The operator-pinned host set
+ *
+ * The shipped fence bounds the SHAPE of what a host may write, not the names:
+ * any host holding the write verbs can grant any syntactically valid
+ * `toFQDNs` entry. `config.egress.perSandbox.permittedHostsParam` names a
+ * `ConfigMap` an operator maintains — the reviewed hostnames and ports — and
+ * a COMPANION policy (`validatingadmissionpolicy-cilium-permitted-hosts.yaml`)
+ * refuses, at admission, any `toFQDNs` name or port outside it. The backend
+ * reads the same ConfigMap and refuses locally, with a precise error instead
+ * of an opaque 403, but the admission rule stays the authority: the local
+ * check is a courtesy and a second reader, never the boundary.
+ *
+ * A companion rather than a change to the shipped policy because the shipped
+ * policy is already applied in clusters, and a host that does not configure
+ * the parameter must see byte-for-byte what it saw before. The companion
+ * covers CREATE and UPDATE only: a DELETE never widens, and a missing
+ * parameter must not make `setNetworkPolicy([])` — the revoke — impossible.
+ */
+import { type KubernetesPerSandboxEgressConfig, type KubernetesPermittedHostsParam } from './egress-policy.js';
+import { type KubernetesClient } from './k8s-client.js';
+/** The admission object a fence finding is about. */
+export type FenceObjectKind = 'ValidatingAdmissionPolicy' | 'ValidatingAdmissionPolicyBinding';
+/**
+ * Raised when the fence EXISTS but would not enforce what this backend relies
+ * on — `validationActions` without `Deny`, a binding that names another
+ * policy, `failurePolicy: Ignore`, a namespace selector that leaves the
+ * sandboxes' namespace out, a `matchConditions` that names another identity,
+ * a companion policy whose expressions are not the ones this version ships,
+ * or a binding whose parameter is not the configured one.
+ *
+ * Its own class rather than a reuse of
+ * `KubernetesAdmissionFenceMissingError`, because the operator's action
+ * differs: that error says to apply a manifest, this one says an applied
+ * object is wrong and names the field. `field` is the dotted path inside
+ * `resourceKind`, `expected` what the writer needs and `actual` what the
+ * cluster holds.
+ */
+export declare class KubernetesAdmissionFenceInertError extends Error {
+    readonly resourceKind: FenceObjectKind;
+    readonly objectName: string;
+    readonly field: string;
+    readonly expected: string;
+    readonly actual: string;
+    readonly name = "KubernetesAdmissionFenceInertError";
+    constructor(resourceKind: FenceObjectKind, objectName: string, field: string, expected: string, actual: string);
+}
+/**
+ * Raised when `permittedHostsParam` is configured and the ConfigMap it names
+ * cannot be used: absent, unreadable, or not in the shape the companion
+ * policy reads. Every `setNetworkPolicy` call that grants a host is refused
+ * with it, and nothing is written.
+ */
+export declare class KubernetesPermittedHostsParamError extends Error {
+    readonly param: KubernetesPermittedHostsParam;
+    readonly name = "KubernetesPermittedHostsParamError";
+    constructor(param: KubernetesPermittedHostsParam, reason: string, cause?: unknown);
+}
+/**
+ * Raised when a `setNetworkPolicy` call names a host or a port the
+ * operator-pinned set does not contain. Local, named and before any write; the
+ * admission policy would refuse the same body with an opaque 403.
+ *
+ * `hosts` are the `allowedHosts` entries as written; `ports` are the numbers
+ * outside the set, and `unrestrictedPortsFor` the hosts whose rule carries no
+ * port restriction at all — every port is outside any list.
+ */
+export declare class KubernetesPermittedHostsError extends Error {
+    readonly param: KubernetesPermittedHostsParam;
+    readonly hosts: readonly string[];
+    readonly ports: readonly number[];
+    readonly unrestrictedPortsFor: readonly string[];
+    readonly name = "KubernetesPermittedHostsError";
+    constructor(param: KubernetesPermittedHostsParam, hosts: readonly string[], ports: readonly number[], unrestrictedPortsFor: readonly string[]);
+}
+/** The verbs of a `CiliumNetworkPolicy` write the shipped main policy covers. */
+export declare const FENCE_OPERATIONS: readonly ["CREATE", "UPDATE", "DELETE"];
+/** The verbs the companion covers: a DELETE never widens, see the module header. */
+export declare const COMPANION_OPERATIONS: readonly ["CREATE", "UPDATE"];
+/** What the writer needs of the shipped main fence, read from the cluster. */
+export interface FenceObjects {
+    readonly policyName: string;
+    readonly policy: unknown;
+    readonly bindingName: string;
+    readonly binding: unknown;
+}
+/**
+ * The main fence: attached, denying, fail-closed, covering the namespace and
+ * every verb the host issues, and — when configured — matching the host.
+ */
+export declare function assertFenceEnforces(fence: FenceObjects, namespace: string, perSandbox: Pick<KubernetesPerSandboxEgressConfig, 'hostIdentity'>): void;
+/** The companion policy's name: the main policy's, with this appended. */
+export declare const PERMITTED_HOSTS_POLICY_SUFFIX = "-hosts";
+/**
+ * The companion's names, derived rather than configured: one more name to
+ * keep in step with an applied object is one more way for the check to read
+ * the wrong object.
+ */
+export declare function permittedHostsFenceNames(perSandbox: KubernetesPerSandboxEgressConfig): {
+    readonly policyName: string;
+    readonly bindingName: string;
+};
+/** The companion's `spec.paramKind`. */
+export declare const PERMITTED_HOSTS_PARAM_KIND: {
+    readonly apiVersion: "v1";
+    readonly kind: "ConfigMap";
+};
+/**
+ * The companion's variables and validation, VERBATIM. Owned here, compared
+ * against the cluster's copy by {@link assertPermittedHostsFenceEnforces} and
+ * against the shipped YAML by a test, so the three cannot drift: an applied
+ * companion with an edited expression is a fence this backend cannot vouch
+ * for, and is refused as one.
+ *
+ * Read as: every egress rule that carries `toFQDNs` must carry `toPorts`, every
+ * port of which is in `data.ports`; and every `toFQDNs` entry is a `matchName`
+ * in `data.hosts` or a `matchPattern` in `data.patterns`. Lists are
+ * newline-separated strings because a ConfigMap holds strings; a key that is
+ * missing makes the expression error, and `failurePolicy: Fail` makes an
+ * error a refusal.
+ */
+export declare const PERMITTED_HOSTS_VARIABLES: readonly {
+    readonly name: string;
+    readonly expression: string;
+}[];
+export declare const PERMITTED_HOSTS_VALIDATIONS: readonly {
+    readonly expression: string;
+}[];
+/**
+ * The companion policy and its binding, compared to what this version ships.
+ * Everything {@link assertFenceEnforces} proves for the main fence, over
+ * CREATE and UPDATE, plus: the parameter kind, the variables and validation
+ * verbatim, and a binding whose `paramRef` is THIS ConfigMap, by name, and
+ * denies when it is missing — a binding with no parameter, or one that lets a
+ * missing parameter through, pins nothing.
+ */
+export declare function assertPermittedHostsFenceEnforces(fence: FenceObjects, namespace: string, perSandbox: Pick<KubernetesPerSandboxEgressConfig, 'hostIdentity'>, param: KubernetesPermittedHostsParam): void;
+/** The permitted set, as read from the ConfigMap. */
+export interface PermittedHosts {
+    readonly hosts: ReadonlySet<string>;
+    readonly patterns: ReadonlySet<string>;
+    readonly ports: ReadonlySet<number>;
+}
+/**
+ * Parse the ConfigMap's `data`, with the same grammar the writer's hosts go
+ * through ({@link assertUsableHost}), so a parameter cannot permit a name the
+ * writer would refuse to emit.
+ */
+export declare function parsePermittedHosts(param: KubernetesPermittedHostsParam, configMap: unknown): PermittedHosts;
+/** GET and parse the parameter. A missing or unreadable ConfigMap refuses. */
+export declare function readPermittedHosts(client: KubernetesClient, param: KubernetesPermittedHostsParam, signal?: AbortSignal): Promise<PermittedHosts>;
+/**
+ * Refuse, locally, any host or port outside the permitted set. `hosts` are the
+ * canonical `allowedHosts` entries and `portsFor` the port list the writer's
+ * narrowing will emit for an entry (`undefined`: no restriction).
+ *
+ * A `.domain` entry becomes a `matchName` plus a `matchPattern`, and the
+ * admission rule checks each against its own list, so both must be present.
+ */
+export declare function assertWithinPermittedHosts(param: KubernetesPermittedHostsParam, permitted: PermittedHosts, hosts: readonly string[], portsFor: (host: string) => readonly number[] | undefined): void;
+//# sourceMappingURL=per-sandbox-fence.d.ts.map

package/dist/backends/kubernetes/per-sandbox-fence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"per-sandbox-fence.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/per-sandbox-fence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAIH,OAAO,EACN,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAElC,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAEN,KAAK,gBAAgB,EAErB,MAAM,iBAAiB,CAAA;AAOxB,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,2BAA2B,GAAG,kCAAkC,CAAA;AAE9F;;;;;;;;;;;;;;GAcG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAI3D,QAAQ,CAAC,YAAY,EAAE,eAAe;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAPxB,SAAkB,IAAI,wCAAuC;gBAGnD,YAAY,EAAE,eAAe,EAC7B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAMxB;AAED;;;;;GAKG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAI3D,QAAQ,CAAC,KAAK,EAAE,6BAA6B;IAH9C,SAAkB,IAAI,wCAAuC;gBAGnD,KAAK,EAAE,6BAA6B,EAC7C,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,OAAO;CAOhB;AAED;;;;;;;;GAQG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;IAItD,QAAQ,CAAC,KAAK,EAAE,6BAA6B;IAC7C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE;IACjC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE;IANjD,SAAkB,IAAI,mCAAkC;gBAG9C,KAAK,EAAE,6BAA6B,EACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,oBAAoB,EAAE,SAAS,MAAM,EAAE;CAkBjD;AAqBD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,yCAA0C,CAAA;AACvE,oFAAoF;AACpF,eAAO,MAAM,oBAAoB,+BAAgC,CAAA;AA2NjE,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CACzB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,IAAI,CAAC,gCAAgC,EAAE,cAAc,CAAC,GAChE,IAAI,CAEN;AAiDD,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,WAAW,CAAA;AAErD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,gCAAgC,GAAG;IACvF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC5B,CAGA;AAED,wCAAwC;AACxC,eAAO,MAAM,0BAA0B;;;CAAmD,CAAA;AAE1F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC3B,EAQA,CAAA;AAED,eAAO,MAAM,2BAA2B,EAAE,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EASjF,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAChD,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,IAAI,CAAC,gCAAgC,EAAE,cAAc,CAAC,EAClE,KAAK,EAAE,6BAA6B,GAClC,IAAI,CA6EN;AAMD,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACnC;AAiCD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,6BAA6B,EACpC,SAAS,EAAE,OAAO,GAChB,cAAc,CA8DhB;AAED,8EAA8E;AAC9E,wBAAsB,kBAAkB,CACvC,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,6BAA6B,EACpC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,cAAc,CAAC,CA0BzB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,6BAA6B,EACpC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,GAAG,SAAS,GACvD,IAAI,CAmBN"}