@oneuptime/common 14.0.1 → 14.0.3

package/build/dist/Utils/AiRemediation/KubectlPolicy.js

@@ -0,0 +1,2973 @@
+import { KubectlCommandTier, isProtectedKubernetesNamespace, } from "../../Types/Kubernetes/KubernetesClusterAiAccess";
+import { AiRemediationCommandPolicyVerdict, MAX_COMMAND_LENGTH_CHARS, } from "../../Types/AutoRemediation/AiRemediationCommandPlan";
+import CommandPolicy from "./CommandPolicy";
+/*
+ * kubectl normalizes "_" to "-" in long flag names (pflag's
+ * WordSepNormalizeFunc), so --as_group IS --as-group and
+ * --insecure_skip_tls_verify IS --insecure-skip-tls-verify. Every flag
+ * lookup here goes through this first, so an underscore spelling can never
+ * slip past a deny list; anything else that inspects kubectl flags (the
+ * Runner's argv guard) should use it too.
+ */
+export function normalizeKubectlFlagName(name) {
+    return (name || "").replace(/_/g, "-");
+}
+const MAX_TOKENS = 64;
+// Tokens made only of these survive a shell split unquoted.
+const SHELL_SAFE_TOKEN = /^[A-Za-z0-9_@%+=:,./-]+$/;
+/*
+ * ---- Flags -----------------------------------------------------------------
+ *
+ * kubectl parses flags with pflag, and this policy has to see the SAME
+ * positionals kubectl will see, or a resource kind can hide inside what we
+ * took for a flag value, and a flag value can pose as the verb. pflag's
+ * rules, which parseArgs() mirrors exactly:
+ *
+ *   - "--flag=value" carries its value inline. "--flag value" carries it in
+ *     the next token ONLY when the flag takes a value: a boolean flag never
+ *     consumes the next token, and neither does an optional-value flag
+ *     ("--cascade" alone means background; "--cascade=orphan" is a value).
+ *   - "-abc" is a cluster of short flags read letter by letter: each letter
+ *     is a boolean flag until one that takes a value, whose value is the
+ *     rest of the token ("-nweb") or, when nothing is left, the next token
+ *     ("-n web"). "-n=web" works too.
+ *   - A value flag takes the next token whatever it looks like: "-n -A" is
+ *     the namespace "-A".
+ *   - "--" ends flag parsing; everything after it is positional.
+ *   - "_" in a long flag name reads as "-" ("--all_namespaces"); see
+ *     normalizeKubectlFlagName, which runs before every lookup.
+ *   - A flag kubectl does not know is an error.
+ *   - The command is picked BEFORE flags are parsed (by cobra, not pflag),
+ *     and at that point any flag that is not a global flag is assumed to
+ *     take the next word as its value, whatever the verb makes of it later:
+ *     `kubectl --all events delete -n web` runs `delete --all events`, and
+ *     `kubectl cluster-info -A x dump` runs `cluster-info dump -A`. So only
+ *     GLOBAL_FLAGS may precede the verb (and, for SUBCOMMAND_VERBS, the
+ *     subcommand); every other flag must follow it. kubectl itself rejects
+ *     most of the other orderings ("flags cannot be placed before plugin
+ *     name"), so nothing that could have run is lost.
+ *
+ * Every flag OneUptime AI may use is listed here with its arity. A flag that
+ * is not listed is Denied: without knowing whether it swallows the next
+ * token we cannot know which token is the verb or the kind, so it is refused
+ * rather than guessed. kubectl rejects flags it does not know, so nothing
+ * that could have run is lost.
+ */
+var FlagArity;
+(function (FlagArity) {
+    // Never takes a value: "--all", "-A". ("--all=false" is the only value form.)
+    FlagArity["Boolean"] = "Boolean";
+    // Always takes a value: "-n web", "-nweb", "-n=web", "--namespace web".
+    FlagArity["Value"] = "Value";
+    /*
+     * Takes a value only when written "--flag=value". Written bare it means
+     * its default and never consumes the next token (pflag's NoOptDefVal).
+     */
+    FlagArity["OptionalValue"] = "OptionalValue";
+})(FlagArity || (FlagArity = {}));
+const KNOWN_FLAGS = {
+    // Global (any verb).
+    n: FlagArity.Value,
+    namespace: FlagArity.Value,
+    "request-timeout": FlagArity.Value,
+    "match-server-version": FlagArity.Boolean,
+    // Output and table shaping. The -o value itself is checked separately.
+    o: FlagArity.Value,
+    output: FlagArity.Value,
+    "allow-missing-template-keys": FlagArity.Boolean,
+    "show-labels": FlagArity.Boolean,
+    "show-kind": FlagArity.Boolean,
+    "show-managed-fields": FlagArity.Boolean,
+    "no-headers": FlagArity.Boolean,
+    "server-print": FlagArity.Boolean,
+    "ignore-not-found": FlagArity.Boolean,
+    "output-watch-events": FlagArity.Boolean,
+    L: FlagArity.Value,
+    "label-columns": FlagArity.Value,
+    "sort-by": FlagArity.Value,
+    "chunk-size": FlagArity.Value,
+    subresource: FlagArity.Value,
+    // Selecting objects.
+    A: FlagArity.Boolean,
+    "all-namespaces": FlagArity.Boolean,
+    all: FlagArity.Boolean,
+    l: FlagArity.Value,
+    selector: FlagArity.Value,
+    labels: FlagArity.Value,
+    "field-selector": FlagArity.Value,
+    // Streaming: booleans, but allowed only as "=false" (see STREAMING_FLAGS).
+    w: FlagArity.Boolean,
+    watch: FlagArity.Boolean,
+    "watch-only": FlagArity.Boolean,
+    follow: FlagArity.Boolean,
+    // logs.
+    c: FlagArity.Value,
+    container: FlagArity.Value,
+    since: FlagArity.Value,
+    "since-time": FlagArity.Value,
+    tail: FlagArity.Value,
+    "limit-bytes": FlagArity.Value,
+    "max-log-requests": FlagArity.Value,
+    "pod-running-timeout": FlagArity.Value,
+    previous: FlagArity.Boolean,
+    timestamps: FlagArity.Boolean,
+    "all-containers": FlagArity.Boolean,
+    "all-pods": FlagArity.Boolean,
+    "ignore-errors": FlagArity.Boolean,
+    "insecure-skip-tls-verify-backend": FlagArity.Boolean,
+    /*
+     * Three names mean different things on different verbs; the value form is
+     * the default and VERB_FLAG_OVERRIDES holds the exceptions:
+     *   -p         is --patch (value) on patch, --previous (boolean) on logs
+     *   --prefix   is a value on set env, a boolean on logs
+     *   --containers is -c (value) on set env/resources, a boolean on top pod
+     */
+    p: FlagArity.Value,
+    patch: FlagArity.Value,
+    prefix: FlagArity.Value,
+    containers: FlagArity.Value,
+    // describe, top, events, api-resources, version, explain, auth.
+    "show-events": FlagArity.Boolean,
+    sum: FlagArity.Boolean,
+    "use-protocol-buffers": FlagArity.Boolean,
+    "show-capacity": FlagArity.Boolean,
+    for: FlagArity.Value,
+    types: FlagArity.Value,
+    "api-group": FlagArity.Value,
+    categories: FlagArity.Value,
+    verbs: FlagArity.Value,
+    cached: FlagArity.Boolean,
+    namespaced: FlagArity.Boolean,
+    client: FlagArity.Boolean,
+    "api-version": FlagArity.Value,
+    list: FlagArity.Boolean,
+    q: FlagArity.Boolean,
+    quiet: FlagArity.Boolean,
+    // rollout, scale, delete, drain, cordon, label, annotate, taint, patch, set.
+    revision: FlagArity.Value,
+    "to-revision": FlagArity.Value,
+    timeout: FlagArity.Value,
+    "field-manager": FlagArity.Value,
+    replicas: FlagArity.Value,
+    r: FlagArity.Value,
+    "current-replicas": FlagArity.Value,
+    "resource-version": FlagArity.Value,
+    "grace-period": FlagArity.Value,
+    "pod-selector": FlagArity.Value,
+    "skip-wait-for-delete-timeout": FlagArity.Value,
+    force: FlagArity.Boolean,
+    now: FlagArity.Boolean,
+    wait: FlagArity.Boolean,
+    "ignore-daemonsets": FlagArity.Boolean,
+    "delete-emptydir-data": FlagArity.Boolean,
+    "delete-local-data": FlagArity.Boolean,
+    "disable-eviction": FlagArity.Boolean,
+    overwrite: FlagArity.Boolean,
+    local: FlagArity.Boolean,
+    record: FlagArity.Boolean,
+    "save-config": FlagArity.Boolean,
+    cascade: FlagArity.OptionalValue,
+    "dry-run": FlagArity.OptionalValue,
+    validate: FlagArity.OptionalValue,
+    type: FlagArity.Value,
+    image: FlagArity.Value,
+    env: FlagArity.Value,
+    e: FlagArity.Value,
+    from: FlagArity.Value,
+    keys: FlagArity.Value,
+    limits: FlagArity.Value,
+    requests: FlagArity.Value,
+    // create, expose, autoscale.
+    restart: FlagArity.Value,
+    schedule: FlagArity.Value,
+    port: FlagArity.Value,
+    "target-port": FlagArity.Value,
+    protocol: FlagArity.Value,
+    name: FlagArity.Value,
+    "external-ip": FlagArity.Value,
+    "cluster-ip": FlagArity.Value,
+    "load-balancer-ip": FlagArity.Value,
+    // Listed for their arity only: every write refuses them (OBJECT_OVERRIDE_FLAGS).
+    overrides: FlagArity.Value,
+    "override-type": FlagArity.Value,
+    "session-affinity": FlagArity.Value,
+    min: FlagArity.Value,
+    max: FlagArity.Value,
+    cpu: FlagArity.Value,
+    "cpu-percent": FlagArity.Value,
+    "from-literal": FlagArity.Value,
+    "append-hash": FlagArity.Boolean,
+    resource: FlagArity.Value,
+    "resource-name": FlagArity.Value,
+    verb: FlagArity.Value,
+    "non-resource-url": FlagArity.Value,
+    "aggregation-rule": FlagArity.Value,
+    role: FlagArity.Value,
+    clusterrole: FlagArity.Value,
+    group: FlagArity.Value,
+    serviceaccount: FlagArity.Value,
+    hard: FlagArity.Value,
+    scopes: FlagArity.Value,
+    "min-available": FlagArity.Value,
+    "max-unavailable": FlagArity.Value,
+    value: FlagArity.Value,
+    "global-default": FlagArity.Boolean,
+    description: FlagArity.Value,
+    "preemption-policy": FlagArity.Value,
+    class: FlagArity.Value,
+    rule: FlagArity.Value,
+    annotation: FlagArity.Value,
+    "default-backend": FlagArity.Value,
+    tcp: FlagArity.Value,
+    "node-port": FlagArity.Value,
+    clusterip: FlagArity.Value,
+    "docker-server": FlagArity.Value,
+    "docker-username": FlagArity.Value,
+    "docker-password": FlagArity.Value,
+    "docker-email": FlagArity.Value,
+    "windows-line-endings": FlagArity.Boolean,
+};
+const KNOWN_FLAG_ARITY = new Map(Object.entries(KNOWN_FLAGS));
+/*
+ * Flags whose meaning depends on the verb (see the note in KNOWN_FLAGS), and
+ * one that is Denied everywhere except on the verb where it is harmless
+ * (explain --recursive prints every field; -R/--recursive elsewhere walks a
+ * directory of manifests). The verb is the first positional; kubectl itself
+ * rejects a subcommand's boolean flag placed before the verb, so these can
+ * only ever follow it.
+ */
+const VERB_FLAG_OVERRIDES = {
+    logs: { p: FlagArity.Boolean, prefix: FlagArity.Boolean },
+    top: { containers: FlagArity.Boolean },
+    explain: { recursive: FlagArity.Boolean },
+};
+const VERB_FLAG_OVERRIDE_ARITY = new Map(Object.entries(VERB_FLAG_OVERRIDES).map(([verb, overrides]) => {
+    return [verb, new Map(Object.entries(overrides))];
+}));
+/*
+ * kubectl's global flags that OneUptime AI may use. They are the only flags
+ * allowed before the verb (see the Flags section): kubectl parses them at
+ * the root, so writing them first cannot shift which command runs.
+ */
+const GLOBAL_FLAGS = new Set([
+    "n",
+    "namespace",
+    "request-timeout",
+    "match-server-version",
+]);
+/*
+ * Verbs whose next positional is a subcommand (rollout status, set image,
+ * create job, auth can-i, cluster-info dump, top pod). The ordering rule
+ * applies between the verb and the subcommand as well.
+ */
+const SUBCOMMAND_VERBS = new Set([
+    "rollout",
+    "set",
+    "create",
+    "auth",
+    "cluster-info",
+    "top",
+]);
+/*
+ * Flags that are Denied wherever they appear, with why. Short and long
+ * spellings are both listed because a short flag can hide inside a cluster
+ * ("-As", "-pf") and is found letter by letter.
+ *
+ * kubectl v1.36's global flags are --as --as-group --as-uid --as-user-extra
+ * --cache-dir --certificate-authority --client-certificate --client-key
+ * --cluster --context --disable-compression --insecure-skip-tls-verify
+ * --kubeconfig --kuberc --log-flush-frequency --match-server-version
+ * -n/--namespace --password --profile --profile-output --request-timeout
+ * -s/--server --tls-server-name --token --user --username -v/--v --vmodule
+ * --warnings-as-errors. Every one of them except GLOBAL_FLAGS is listed
+ * here: each selects credentials, an identity or a cluster, writes a file
+ * on the Runner, or logs request bodies. (An unlisted flag is refused
+ * anyway; listing them names the reason.)
+ */
+const DENIED_FLAG_GROUPS = [
+    {
+        reason: "OneUptime AI may only use the cluster access it was given, never other credentials, another identity or another cluster",
+        flags: [
+            "kubeconfig",
+            "kuberc",
+            "token",
+            "server",
+            "s",
+            "as",
+            "as-group",
+            "as-uid",
+            "as-user-extra",
+            "context",
+            "cluster",
+            "user",
+            "username",
+            "password",
+            "client-certificate",
+            "client-key",
+            "certificate-authority",
+            "insecure-skip-tls-verify",
+            "tls-server-name",
+        ],
+    },
+    {
+        reason: "it makes kubectl read a file on the Runner (write templates and patches inline instead)",
+        flags: [
+            "filename",
+            "f",
+            "kustomize",
+            "k",
+            "recursive",
+            "R",
+            "patch-file",
+            "from-file",
+            "from-env-file",
+            "cert",
+            "key",
+        ],
+    },
+    {
+        reason: "it names the template that -o go-template-file reads from a file on the Runner (write it inline as -o go-template=... or -o jsonpath=... instead)",
+        flags: ["template"],
+    },
+    {
+        reason: "it turns kubectl into a raw API client",
+        flags: ["raw"],
+    },
+    {
+        reason: "it resolves Secret and ConfigMap references into their plaintext values (kubectl set env --list --resolve prints them)",
+        flags: ["resolve"],
+    },
+    {
+        reason: "kubectl's own logging, profiling and cache flags write on the Runner or print request bodies and credentials",
+        flags: [
+            "v",
+            "vmodule",
+            "log-file",
+            "log-dir",
+            "log-file-max-size",
+            "log-backtrace-at",
+            "log-flush-frequency",
+            "alsologtostderr",
+            "logtostderr",
+            "add-dir-header",
+            "one-output",
+            "skip-headers",
+            "skip-log-headers",
+            "stderrthreshold",
+            "profile",
+            "profile-output",
+            "cache-dir",
+        ],
+    },
+    {
+        reason: "it needs a terminal or an editor",
+        flags: ["i", "interactive", "t", "tty", "stdin", "edit"],
+    },
+    {
+        reason: "it has nothing to offer an SRE agent (kubectl explain documents resources)",
+        flags: ["h", "help", "warnings-as-errors", "disable-compression"],
+    },
+];
+const DENIED_FLAG_REASONS = new Map();
+for (const group of DENIED_FLAG_GROUPS) {
+    for (const flag of group.flags) {
+        DENIED_FLAG_REASONS.set(flag, group.reason);
+    }
+}
+/*
+ * Flags that keep kubectl running until it is killed. Boolean, so the only
+ * way to write them off is "=false", which is what the model should write
+ * on rollout status (which watches by default).
+ */
+const STREAMING_FLAGS = new Set([
+    "w",
+    "watch",
+    "watch-only",
+    "follow",
+]);
+/*
+ * Flags that replace the object kubectl generates with whatever their JSON
+ * describes (kubectl expose; see the header's Denied list). They stay in
+ * KNOWN_FLAGS with their real arity, so `--overrides '{...}'` is still split
+ * where kubectl splits it and the verb is still found, and every write that
+ * carries one is refused in evaluateArgs — in every spelling, because
+ * parseArgs files `--override_type` and `--overrides=x` under these names —
+ * as is an allowlist entry that spells one (readAllowlistEntry). A read
+ * keeps them: no read verb takes them (kubectl refuses the command) and a
+ * read creates nothing.
+ */
+const OBJECT_OVERRIDE_FLAGS = ["overrides", "override-type"];
+/*
+ * ---- Output formats --------------------------------------------------------
+ *
+ * -o/--output values, compared lowercased. Formats that take an argument
+ * must carry it inline after "=": -o jsonpath={.items[*].name}. Written bare
+ * they take it from --template, which is Denied, so the bare form is refused
+ * too. The *-file formats make kubectl read a path on the Runner and echo it
+ * — a Read-tier `get` would print the pod's ServiceAccount token — so they
+ * are Denied in every spelling (-o X=..., -oX=..., --output X=...,
+ * --output=X=...); anything not listed is refused rather than guessed.
+ */
+const OUTPUT_FORMATS = new Set([
+    "json",
+    "yaml",
+    "name",
+    "wide",
+    "plaintext",
+    "plaintext-openapiv2",
+]);
+const OUTPUT_FORMATS_WITH_ARGUMENT = new Set([
+    "jsonpath",
+    "jsonpath-as-json",
+    "go-template",
+    "template",
+    "custom-columns",
+]);
+const FILE_OUTPUT_FORMATS = new Set([
+    "go-template-file",
+    "templatefile",
+    "jsonpath-file",
+    "custom-columns-file",
+]);
+// ---- Verbs -------------------------------------------------------------------
+const READ_VERBS = new Set([
+    "get",
+    "describe",
+    "logs",
+    "top",
+    "events",
+    "api-resources",
+    "api-versions",
+    "version",
+    "explain",
+]);
+/*
+ * The write verbs that CAN be SafeWrite — rollout restart/undo/pause/resume,
+ * delete, scale, cordon, uncordon, label and annotate — each have their own
+ * branch in evaluateArgs, because each has its own "exactly one named
+ * object" shape. These are always at least RiskyWrite:
+ */
+const RISKY_WRITE_VERBS = new Set([
+    "patch",
+    "set",
+    "taint",
+    "drain",
+    "create",
+    "expose",
+    "autoscale",
+]);
+/*
+ * Verbs whose operands are node NAMES (or TYPE/NAME), and nodes live outside
+ * any namespace. taint acts on nodes too, but names its kind like any object
+ * verb ("taint nodes NAME ..."), so the kind rule reads it.
+ */
+const NODE_NAME_VERBS = new Set([
+    "cordon",
+    "uncordon",
+    "drain",
+]);
+/*
+ * Node verbs that move pods off a node in every namespace (a drain evicts
+ * them; a NoExecute taint makes the node evict them, and any taint decides
+ * which pods it keeps), with what the approval card says about each. They
+ * carry `requiresHuman`: nothing an operator sets on the cluster runs them
+ * unattended (see the header). A patch of a Node carries it too
+ * (NODE_PATCH_ALWAYS_HUMAN_REASON): a taint is only the Node's spec.taints.
+ * describeAlwaysHumanWrite() is the one place that reads these.
+ */
+const ALWAYS_HUMAN_VERB_REASONS = {
+    drain: "kubectl drain evicts every pod on the node, in every namespace (kube-system and the OneUptime agent's own included), so a human always approves it",
+    taint: "kubectl taint decides which pods a node keeps, in every namespace (kube-system and the OneUptime agent's own included; a NoExecute taint evicts the rest at once), so a human always approves it",
+};
+const NODE_PATCH_ALWAYS_HUMAN_REASON = "kubectl patch of a Node can set, replace or clear its taints, which decide which pods the node keeps, in every namespace (kube-system and the OneUptime agent's own included; a NoExecute taint evicts the rest at once), so a human always approves it, whatever the patch body says (kubectl cordon and uncordon change scheduling on one node without one)";
+/*
+ * The write verbs evaluateArgs tiers in a branch of their own (the ones that
+ * can be SafeWrite). With READ_VERBS, RISKY_WRITE_VERBS and the two
+ * read-only command groups below, these are every verb OneUptime AI may run;
+ * evaluateArgs refuses any other word as an unknown verb.
+ */
+const OWN_BRANCH_WRITE_VERBS = new Set([
+    "rollout",
+    "delete",
+    "scale",
+    "cordon",
+    "uncordon",
+    "label",
+    "annotate",
+]);
+const READ_COMMAND_GROUPS = new Set([
+    "cluster-info",
+    "auth",
+]);
+// Verbs whose subcommand must be written out for the command to run at all.
+const SUBCOMMAND_REQUIRED_VERBS = new Set([
+    "rollout",
+    "set",
+    "create",
+]);
+function isVerbOneUptimeAiMayRun(verb) {
+    return (READ_VERBS.has(verb) ||
+        RISKY_WRITE_VERBS.has(verb) ||
+        OWN_BRANCH_WRITE_VERBS.has(verb) ||
+        READ_COMMAND_GROUPS.has(verb));
+}
+/*
+ * Verbs with nothing to offer an SRE agent, or that open an interactive or
+ * long-lived channel, or that could rewrite objects from input we do not
+ * support. Listed explicitly so the reason names the verb; any verb not in
+ * any list is Denied too — kubectl runs a `kubectl-<verb>` plugin from the
+ * Runner's PATH for a word it does not know (and a kuberc alias for one it
+ * has been taught), so an unknown verb is never a guess we can afford.
+ */
+const DENIED_VERBS = new Set([
+    "kuberc",
+    "exec",
+    "attach",
+    "cp",
+    "port-forward",
+    "proxy",
+    "debug",
+    "run",
+    "edit",
+    "replace",
+    "apply",
+    "diff",
+    "kustomize",
+    "config",
+    "certificate",
+    "wait",
+    "plugin",
+    "completion",
+    "options",
+    "help",
+    "alpha",
+    "convert",
+]);
+/*
+ * Kinds whose deletion is either unrecoverable or cluster-wide. Deleting
+ * them is Denied even with a human in the loop — this lane is for fixing a
+ * workload, not for tearing down a cluster. Matched on normalizeKind(), so
+ * every spelling kubectl accepts is covered: plural, singular, short name,
+ * Kind case and group-qualified (`crd`, `CustomResourceDefinition`,
+ * `customresourcedefinitions.apiextensions.k8s.io`, `ns/prod`, ...).
+ * Resource CATEGORIES (all, api-extensions) are refused separately, in every
+ * write verb (see RESOURCE_CATEGORIES).
+ */
+const NEVER_DELETE_KINDS = new Set([
+    "namespace",
+    "node",
+    "persistentvolume",
+    "persistentvolumeclaim",
+    "customresourcedefinition",
+    "clusterrole",
+    "clusterrolebinding",
+    "role",
+    "rolebinding",
+    "storageclass",
+    "secret",
+    "priorityclass",
+    "apiservice",
+    "mutatingwebhookconfiguration",
+    "validatingwebhookconfiguration",
+    "validatingadmissionpolicy",
+    "validatingadmissionpolicybinding",
+    "mutatingadmissionpolicy",
+    "mutatingadmissionpolicybinding",
+    "certificatesigningrequest",
+]);
+/*
+ * Resource categories. kubectl expands a category into every kind that
+ * declares it (ReplaceAliases, through discovery) BEFORE it resolves types,
+ * so `kubectl delete api-extensions -l x` deletes CRDs, APIServices and
+ * admission webhooks although none of those kinds appears in the command.
+ * A category is therefore never allowed in a write, whatever the verb.
+ * `all` and `api-extensions` are the categories the API server itself
+ * defines (the only ones that can reach built-in kinds); the rest are the
+ * categories widely used operators give their custom resources — a custom
+ * category can only reach custom resources, which are RiskyWrite anyway, so
+ * this list is a clearer refusal, not the only line. Reads (`get all`)
+ * stay Read.
+ */
+const RESOURCE_CATEGORIES = new Set([
+    "all",
+    "api-extensions",
+    "crossplane",
+    "managed",
+    "composite",
+    "claim",
+    "knative",
+    "serving",
+    "eventing",
+    "istio-io",
+    "networking-istio-io",
+    "security-istio-io",
+    "telemetry-istio-io",
+    "extensions-istio-io",
+    "gateway-api",
+    "cert-manager",
+    "kyverno",
+    "cluster-api",
+    "tekton",
+    "tekton-pipelines",
+]);
+/*
+ * Kinds that decide who may do what. OneUptime AI never creates or changes
+ * them in any write verb — label and annotate included (a label on a
+ * ClusterRole can aggregate its rules into admin/edit/view) — because a new
+ * or widened binding is a privilege grant, not a fix; nor does it delete
+ * them (NEVER_DELETE_KINDS). Reading them stays Read: an investigation needs
+ * to see why something is Forbidden.
+ */
+const RBAC_KINDS = new Set([
+    "role",
+    "clusterrole",
+    "rolebinding",
+    "clusterrolebinding",
+]);
+/*
+ * Kinds that decide, for the whole cluster, what the API server admits and
+ * serves: admission webhooks and admission policies (and their bindings)
+ * accept, reject or rewrite every object written; an APIService routes a
+ * whole API group to a Service; a CRD defines (and converts) a whole kind.
+ * Emptying a webhook's rules, setting a policy binding to Audit or
+ * repointing an APIService switches a cluster control off as surely as
+ * deleting it (which NEVER_DELETE_KINDS already refuses) — the same reason
+ * Pod Security Admission labels are Denied. So every write verb on these is
+ * Denied; reading them stays Read.
+ */
+const ADMISSION_AND_API_EXTENSION_KINDS = new Set([
+    "mutatingwebhookconfiguration",
+    "validatingwebhookconfiguration",
+    "validatingadmissionpolicy",
+    "validatingadmissionpolicybinding",
+    "mutatingadmissionpolicy",
+    "mutatingadmissionpolicybinding",
+    "apiservice",
+    "customresourcedefinition",
+]);
+/*
+ * Kinds whose objects ARE credentials. OneUptime AI never reads, changes or
+ * deletes them, in any spelling kubectl accepts (secret, secrets, Secret,
+ * secrets.v1., secret/name, pods,secrets, ...): get/describe would print
+ * their values to the model, and label/annotate/patch with -o yaml print the
+ * whole object too, so the rule is per kind, not per verb. `all` does not
+ * include secrets, so `get all` stays Read. Pods and ConfigMaps can carry
+ * plaintext env values as well; those cannot be denied without blinding the
+ * investigation, so output redaction covers them, not this policy.
+ */
+const CREDENTIAL_KINDS = new Set(["secret"]);
+/*
+ * Verbs whose positionals name objects as "kind name..." or "kind/name...",
+ * where CREDENTIAL_KINDS is enforced. For rollout and set the objects follow
+ * the subcommand. Node verbs (cordon, drain) name nodes, logs names pods and
+ * the remaining verbs take no objects, so the kind cannot appear there.
+ */
+const OBJECT_VERBS = new Set([
+    "get",
+    "describe",
+    "delete",
+    "label",
+    "annotate",
+    "patch",
+    "scale",
+    "autoscale",
+    "expose",
+    "taint",
+    "rollout",
+    "set",
+]);
+/*
+ * Kinds whose deletion is a safe change: exactly one, and only the pod. A
+ * pod with a controller (ReplicaSet, StatefulSet, DaemonSet, Job) is
+ * recreated by it. A Job is NOT recreated by anything — a standalone Job (a
+ * migration, a one-off batch run) is simply gone, and a CronJob only starts
+ * a new one on its next schedule — so deleting a Job is RiskyWrite.
+ * Matched on builtinKind(), so a custom resource that happens to be called
+ * `pods.example.com` is not a pod.
+ */
+const SAFE_DELETE_KINDS = new Set(["pod"]);
+// The workloads `kubectl rollout restart/undo/pause/resume` acts on.
+const ROLLOUT_SAFE_KINDS = new Set([
+    "deployment",
+    "statefulset",
+    "daemonset",
+]);
+/*
+ * The workloads a safe `kubectl scale` may target — the ones whose scale
+ * subresource the kubernetes-agent chart's remediation RBAC grants.
+ */
+const SCALE_SAFE_KINDS = new Set([
+    "deployment",
+    "statefulset",
+    "replicaset",
+]);
+/*
+ * The kinds a safe label/annotate may target: a pod or a workload. A label
+ * on these is metadata a fix may need (quarantine a pod by dropping its
+ * `app` label, note a restart). On any other kind a label is a control:
+ * Pod Security Admission reads namespace labels, DaemonSet nodeSelectors and
+ * cloud load balancers read node labels, Services and NetworkPolicies select
+ * by label, ClusterRole aggregation reads role labels, and ServiceAccount /
+ * Ingress annotations bind cloud identities and inject proxy config.
+ */
+const LABEL_SAFE_KINDS = new Set([
+    "pod",
+    "deployment",
+    "statefulset",
+    "daemonset",
+    "replicaset",
+    "job",
+    "cronjob",
+]);
+/*
+ * Built-in kinds that live outside any namespace, and the API group each
+ * lives in. A write that names only these is not "in" the namespace its -n
+ * flag names (kubectl ignores -n for them), so the protected-namespace rule
+ * looks at the object instead. Matched on builtinKind(), never on
+ * normalizeKind(): `nodes.example.com` or `namespaces.example.com` is some
+ * custom resource that happens to borrow the name. Its scope is unknown
+ * here, so it is judged by the namespace -n names like any namespaced
+ * object — the reading that can only add a human, never remove one.
+ */
+const CLUSTER_SCOPED_KIND_GROUPS = {
+    node: "",
+    namespace: "",
+    persistentvolume: "",
+    customresourcedefinition: "apiextensions.k8s.io",
+    clusterrole: "rbac.authorization.k8s.io",
+    clusterrolebinding: "rbac.authorization.k8s.io",
+    storageclass: "storage.k8s.io",
+    priorityclass: "scheduling.k8s.io",
+    apiservice: "apiregistration.k8s.io",
+    mutatingwebhookconfiguration: "admissionregistration.k8s.io",
+    validatingwebhookconfiguration: "admissionregistration.k8s.io",
+    validatingadmissionpolicy: "admissionregistration.k8s.io",
+    validatingadmissionpolicybinding: "admissionregistration.k8s.io",
+    mutatingadmissionpolicy: "admissionregistration.k8s.io",
+    mutatingadmissionpolicybinding: "admissionregistration.k8s.io",
+    certificatesigningrequest: "certificates.k8s.io",
+    ingressclass: "networking.k8s.io",
+    runtimeclass: "node.k8s.io",
+    csidriver: "storage.k8s.io",
+    csinode: "storage.k8s.io",
+    volumeattachment: "storage.k8s.io",
+    flowschema: "flowcontrol.apiserver.k8s.io",
+    prioritylevelconfiguration: "flowcontrol.apiserver.k8s.io",
+};
+const CLUSTER_SCOPED_KINDS = new Set(Object.keys(CLUSTER_SCOPED_KIND_GROUPS));
+/*
+ * The API group of every built-in kind a SAFE or SCOPE decision names: the
+ * kinds in the *_SAFE_KINDS sets and the cluster-scoped kinds above.
+ * builtinKind() accepts a group-qualified spelling only in this group, so
+ * `deployments.apps/web` is a Deployment and `storageclasses.storage.k8s.io`
+ * a StorageClass, while `jobs.batch.volcano.sh`, `pods.example.com` or
+ * `nodes.example.com` is some custom resource: never a safe target, and
+ * never exempt from the namespace -n names.
+ */
+const BUILTIN_KIND_GROUPS = Object.assign({ pod: "", deployment: "apps", statefulset: "apps", daemonset: "apps", replicaset: "apps", job: "batch", cronjob: "batch" }, CLUSTER_SCOPED_KIND_GROUPS);
+/*
+ * Label / annotation key prefixes (the DNS part before "/") that belong to
+ * Kubernetes itself — kubernetes.io and k8s.io and every subdomain
+ * (pod-security.kubernetes.io, node-role.kubernetes.io,
+ * rbac.authorization.k8s.io, kubectl.kubernetes.io, ...) — or to the
+ * identity, admission and GitOps controllers that act on them. Writing one
+ * of these steers a controller rather than annotating an object, so it is
+ * RiskyWrite on any kind. Matched as the domain itself or a subdomain.
+ */
+const RESERVED_KEY_DOMAINS = [
+    "kubernetes.io",
+    "k8s.io",
+    "gatekeeper.sh",
+    "kyverno.io",
+    "argoproj.io",
+    "eks.amazonaws.com",
+    "iam.gke.io",
+    "azure.workload.identity",
+];
+/*
+ * Pod Security Admission's namespace labels. Lowering or removing them lets
+ * privileged pods into the namespace, which is never a fix OneUptime AI
+ * makes (Denied, in label, annotate and patch alike).
+ */
+const POD_SECURITY_KEY_DOMAIN = "pod-security.kubernetes.io";
+/*
+ * The AppArmor profile as an annotation on a pod (or a pod template):
+ * `container.apparmor.security.beta.kubernetes.io/<container>: unconfined`.
+ * It is the deprecated spelling of securityContext.appArmorProfile (the API
+ * server copies it into that field when it creates a pod, for as long as it
+ * supports the annotation) and a Pod Security Standards baseline control of
+ * its own, so a patch body may not name one, like a POD_SECURITY_PATCH_KEYS
+ * field. Matched as this domain or a subdomain of it.
+ */
+const APPARMOR_ANNOTATION_KEY_DOMAIN = "apparmor.security.beta.kubernetes.io";
+/*
+ * ClusterRole aggregation: a ClusterRole labelled with one of these has its
+ * rules merged into admin / edit / view (and so granted to everyone bound
+ * to them). That is an RBAC grant, Denied like creating a binding.
+ */
+const RBAC_AGGREGATION_KEY_PREFIX = "rbac.authorization.k8s.io/aggregate-to-";
+/*
+ * Field names a `kubectl patch` body may never touch, matched by key name
+ * (case-insensitively) anywhere in the body — strategic-merge and merge
+ * patches as keys, JSON patches as path segments. Bodies are JSON only (a
+ * body JSON.parse rejects is Denied outright; see findPatchBodyProblem), so
+ * the walker sees exactly the keys kubectl applies. Each one
+ * changes which identity, privileges, host access, Secrets or program a pod
+ * runs with. With write RBAC on a workload that is the same as running any
+ * image as any ServiceAccount in the namespace and reading every Secret it
+ * can mount, which no approval card should be asked to wave through. Image,
+ * env values, resources and replicas stay patchable (set image / set env /
+ * set resources say the same thing more plainly). A patch that replaces or
+ * removes an object ABOVE these fields drops them without naming any; that
+ * is refused by findPodSpecReplacement (see POD_SPEC_PATH_STEPS).
+ *
+ * The host and isolation fields cover every control of the Pod Security
+ * Standards baseline profile (and the restricted profile adds nothing
+ * outside securityContext and volumes): the host namespaces (hostNetwork,
+ * hostPID, hostIPC), hostPath volumes, a container port's hostPort (it binds
+ * the node's own IP), and — under securityContext — privileged,
+ * capabilities, hostProcess, SELinux, AppArmor, seccomp, procMount and
+ * sysctls; plus what weakens a pod's isolation outside those: hostUsers
+ * (true, the default, takes away the user namespace false gives the pod),
+ * runtimeClassName (it can move the pod off a sandboxed runtime) and
+ * shareProcessNamespace. Two baseline controls are refused beside this list,
+ * because a name alone does not say what they are: the AppArmor annotation
+ * (APPARMOR_ANNOTATION_KEY_DOMAIN) and the host of a probe or lifecycle hook
+ * (HOST_FIELD_HANDLER_KEYS; `host` elsewhere is no pod field).
+ */
+const POD_SECURITY_PATCH_KEYS = new Set([
+    "serviceAccountName",
+    "serviceAccount",
+    "automountServiceAccountToken",
+    "securityContext",
+    "privileged",
+    "capabilities",
+    "hostPath",
+    "hostNetwork",
+    "hostPID",
+    "hostIPC",
+    "hostPort",
+    "hostUsers",
+    "runtimeClassName",
+    "shareProcessNamespace",
+    "volumes",
+    "volumeMounts",
+    "initContainers",
+    "ephemeralContainers",
+    "command",
+    "args",
+    "envFrom",
+    "secretKeyRef",
+    "secretRef",
+    "secretName",
+].map((key) => {
+    return key.toLowerCase();
+}));
+/*
+ * kubectl create's subcommands and their aliases, exactly as cobra matches
+ * them (case-sensitively). Anything else is not a create subcommand:
+ * kubectl would look for a `kubectl-create-<name>` plugin on the Runner's
+ * PATH, so it is Denied rather than tiered.
+ */
+const CREATE_SUBCOMMANDS = {
+    namespace: "namespace",
+    ns: "namespace",
+    quota: "resourcequota",
+    resourcequota: "resourcequota",
+    secret: "secret",
+    configmap: "configmap",
+    cm: "configmap",
+    serviceaccount: "serviceaccount",
+    sa: "serviceaccount",
+    service: "service",
+    svc: "service",
+    deployment: "deployment",
+    deploy: "deployment",
+    clusterrole: "clusterrole",
+    clusterrolebinding: "clusterrolebinding",
+    role: "role",
+    rolebinding: "rolebinding",
+    poddisruptionbudget: "poddisruptionbudget",
+    pdb: "poddisruptionbudget",
+    priorityclass: "priorityclass",
+    pc: "priorityclass",
+    job: "job",
+    cronjob: "cronjob",
+    cj: "cronjob",
+    ingress: "ingress",
+    ing: "ingress",
+    token: "token",
+};
+/*
+ * What `kubectl create <subcommand>` makes that OneUptime AI never makes:
+ * RBAC objects and ServiceAccounts decide who may do what, and a new
+ * ServiceAccount is an identity for someone to bind.
+ */
+const DENIED_CREATE_KINDS = new Set([
+    "clusterrole",
+    "clusterrolebinding",
+    "role",
+    "rolebinding",
+    "serviceaccount",
+]);
+/*
+ * `kubectl create` subcommands that start a NEW workload running the image
+ * named in the command: kubectl requires --image for both (it refuses them
+ * without one), so every such command runs an arbitrary image as a new
+ * program in the cluster — Denied, like `create job --image`.
+ */
+const IMAGE_WORKLOAD_CREATE_KINDS = new Set([
+    "deployment",
+    "cronjob",
+]);
+// Cluster-scoped objects `kubectl create` can make (for the namespace rule).
+const CLUSTER_SCOPED_CREATE_KINDS = new Set([
+    "namespace",
+    "priorityclass",
+]);
+/*
+ * kubectl set's subcommands OneUptime AI may use (set serviceaccount and set
+ * subject are Denied by name; anything else is not a set subcommand).
+ */
+const SET_SUBCOMMANDS = new Set([
+    "env",
+    "image",
+    "resources",
+    "selector",
+]);
+const KIND_ALIASES = {
+    po: "pod",
+    pods: "pod",
+    pod: "pod",
+    jobs: "job",
+    job: "job",
+    cj: "cronjob",
+    cronjobs: "cronjob",
+    cronjob: "cronjob",
+    deploy: "deployment",
+    deployments: "deployment",
+    deployment: "deployment",
+    sts: "statefulset",
+    statefulsets: "statefulset",
+    statefulset: "statefulset",
+    ds: "daemonset",
+    daemonsets: "daemonset",
+    daemonset: "daemonset",
+    rs: "replicaset",
+    replicasets: "replicaset",
+    replicaset: "replicaset",
+    rc: "replicationcontroller",
+    replicationcontrollers: "replicationcontroller",
+    replicationcontroller: "replicationcontroller",
+    hpa: "horizontalpodautoscaler",
+    horizontalpodautoscalers: "horizontalpodautoscaler",
+    horizontalpodautoscaler: "horizontalpodautoscaler",
+    svc: "service",
+    services: "service",
+    service: "service",
+    ep: "endpoints",
+    endpoints: "endpoints",
+    cm: "configmap",
+    configmaps: "configmap",
+    configmap: "configmap",
+    sa: "serviceaccount",
+    serviceaccounts: "serviceaccount",
+    serviceaccount: "serviceaccount",
+    ing: "ingress",
+    ingresses: "ingress",
+    ingress: "ingress",
+    ingressclasses: "ingressclass",
+    ingressclass: "ingressclass",
+    netpol: "networkpolicy",
+    networkpolicies: "networkpolicy",
+    networkpolicy: "networkpolicy",
+    pdb: "poddisruptionbudget",
+    poddisruptionbudgets: "poddisruptionbudget",
+    poddisruptionbudget: "poddisruptionbudget",
+    quota: "resourcequota",
+    resourcequotas: "resourcequota",
+    resourcequota: "resourcequota",
+    limits: "limitrange",
+    limitranges: "limitrange",
+    limitrange: "limitrange",
+    ns: "namespace",
+    namespaces: "namespace",
+    namespace: "namespace",
+    no: "node",
+    nodes: "node",
+    node: "node",
+    pv: "persistentvolume",
+    persistentvolumes: "persistentvolume",
+    persistentvolume: "persistentvolume",
+    pvc: "persistentvolumeclaim",
+    persistentvolumeclaims: "persistentvolumeclaim",
+    persistentvolumeclaim: "persistentvolumeclaim",
+    crd: "customresourcedefinition",
+    crds: "customresourcedefinition",
+    customresourcedefinitions: "customresourcedefinition",
+    customresourcedefinition: "customresourcedefinition",
+    roles: "role",
+    role: "role",
+    rolebindings: "rolebinding",
+    rolebinding: "rolebinding",
+    clusterroles: "clusterrole",
+    clusterrole: "clusterrole",
+    clusterrolebindings: "clusterrolebinding",
+    clusterrolebinding: "clusterrolebinding",
+    sc: "storageclass",
+    storageclasses: "storageclass",
+    storageclass: "storageclass",
+    secrets: "secret",
+    secret: "secret",
+    pc: "priorityclass",
+    priorityclasses: "priorityclass",
+    priorityclass: "priorityclass",
+    apiservices: "apiservice",
+    apiservice: "apiservice",
+    mutatingwebhookconfigurations: "mutatingwebhookconfiguration",
+    mutatingwebhookconfiguration: "mutatingwebhookconfiguration",
+    validatingwebhookconfigurations: "validatingwebhookconfiguration",
+    validatingwebhookconfiguration: "validatingwebhookconfiguration",
+    validatingadmissionpolicies: "validatingadmissionpolicy",
+    validatingadmissionpolicy: "validatingadmissionpolicy",
+    validatingadmissionpolicybindings: "validatingadmissionpolicybinding",
+    validatingadmissionpolicybinding: "validatingadmissionpolicybinding",
+    mutatingadmissionpolicies: "mutatingadmissionpolicy",
+    mutatingadmissionpolicy: "mutatingadmissionpolicy",
+    mutatingadmissionpolicybindings: "mutatingadmissionpolicybinding",
+    mutatingadmissionpolicybinding: "mutatingadmissionpolicybinding",
+    csr: "certificatesigningrequest",
+    certificatesigningrequests: "certificatesigningrequest",
+    certificatesigningrequest: "certificatesigningrequest",
+    runtimeclasses: "runtimeclass",
+    runtimeclass: "runtimeclass",
+    csidrivers: "csidriver",
+    csidriver: "csidriver",
+    csinodes: "csinode",
+    csinode: "csinode",
+    volumeattachments: "volumeattachment",
+    volumeattachment: "volumeattachment",
+    flowschemas: "flowschema",
+    flowschema: "flowschema",
+    prioritylevelconfigurations: "prioritylevelconfiguration",
+    prioritylevelconfiguration: "prioritylevelconfiguration",
+};
+/*
+ * The kind a token names, for the DENY lists: lowercased, the head of a
+ * group-qualified form ("pods.v1." / "deployments.apps" / "secrets.foo.io"
+ * all keep the leading segment) mapped through KIND_ALIASES. Folding every
+ * group into the built-in kind is the safe side for a deny list — a custom
+ * `secrets.example.io` is refused like a Secret — and for a rule that can
+ * only ADD a human (a Namespace object named kube-system). It must never be
+ * used to decide that something is SAFE, or that a write is cluster-scoped
+ * and so outside the namespace -n names (see builtinKind()).
+ */
+function normalizeKind(token) {
+    const lower = token.toLowerCase();
+    const head = lower.split(".")[0] || lower;
+    return Object.prototype.hasOwnProperty.call(KIND_ALIASES, head)
+        ? KIND_ALIASES[head]
+        : head;
+}
+/*
+ * The built-in kind a token names, for the SAFE sets and the cluster-scoped
+ * rule — or undefined when it is not one of BUILTIN_KIND_GROUPS in that
+ * kind's own API group. kubectl (schema.ParseResourceArg) reads a token with
+ * two dots or more first as "RESOURCE.VERSION.GROUP" and then as
+ * "RESOURCE.GROUP", and one with a single dot only as "RESOURCE.GROUP"
+ * ("pods." and "pods.v1." name the core group). So `deployments.apps`,
+ * `deployments.v1.apps`, `pods.v1.`, `storageclasses.storage.k8s.io` and
+ * `clusterroles.v1.rbac.authorization.k8s.io` are the built-in kinds, and
+ * `pods.example.com`, `nodes.v1.example.com` or `jobs.batch.volcano.sh` are
+ * custom resources.
+ */
+function builtinKind(token) {
+    const lower = token.toLowerCase();
+    const parts = lower.split(".");
+    const head = parts[0] || "";
+    if (!Object.prototype.hasOwnProperty.call(KIND_ALIASES, head)) {
+        return undefined;
+    }
+    const kind = KIND_ALIASES[head];
+    if (!Object.prototype.hasOwnProperty.call(BUILTIN_KIND_GROUPS, kind)) {
+        return undefined;
+    }
+    if (parts.length === 1) {
+        return kind;
+    }
+    const group = BUILTIN_KIND_GROUPS[kind];
+    // RESOURCE.GROUP
+    if (parts.slice(1).join(".") === group) {
+        return kind;
+    }
+    // RESOURCE.VERSION.GROUP
+    if (parts.length >= 3 && parts.slice(2).join(".") === group) {
+        return kind;
+    }
+    return undefined;
+}
+/*
+ * True when every object a node verb names is a node: a bare NAME, or a
+ * TYPE/NAME whose type is the built-in Node (kubectl's cordon, uncordon and
+ * drain read "nodes/NAME" and also accept any other TYPE/NAME, such as a
+ * custom `nodes.example.com/x`, which then is not a node at all).
+ */
+function namesOnlyNodes(nodeTokens) {
+    return nodeTokens.every((token) => {
+        const slash = token.indexOf("/");
+        return slash < 0 || builtinKind(token.slice(0, slash)) === "node";
+    });
+}
+/*
+ * The kinds named by the positionals after a verb, read the way kubectl's
+ * resource builder reads them: either "kind name1 name2" (the first token
+ * is the kind, possibly "pod,job"; the rest are names) or "kind/name
+ * kind2/name2" (every token carries its own kind). Mixing the two is an
+ * error in kubectl; here it just names both kinds, which is the safe side.
+ */
+function namedKinds(resourceTokens) {
+    const kinds = new Set();
+    const rawKinds = [];
+    const names = [];
+    let namedCount = 0;
+    for (let i = 0; i < resourceTokens.length; i++) {
+        const token = resourceTokens[i];
+        if (token.includes("/")) {
+            const slash = token.indexOf("/");
+            const rawKind = token.slice(0, slash);
+            rawKinds.push(rawKind);
+            kinds.add(normalizeKind(rawKind));
+            names.push(token.slice(slash + 1));
+            namedCount++;
+        }
+        else if (i === 0) {
+            for (const part of token.split(",")) {
+                rawKinds.push(part);
+                kinds.add(normalizeKind(part));
+            }
+        }
+        else {
+            names.push(token);
+            namedCount++;
+        }
+    }
+    return { kinds, rawKinds, namedCount, names };
+}
+/*
+ * True when the objects are exactly ONE named object of ONE kind — the
+ * shape every SafeWrite needs. A bare kind is every object of that kind to
+ * kubectl's rollout verbs, and a comma list of kinds or several names is
+ * several objects.
+ */
+function isOneNamedObject(targets) {
+    return targets.namedCount === 1 && targets.rawKinds.length === 1;
+}
+// True when every kind is built in and in `allowed` (see builtinKind()).
+function everyBuiltinKindIn(targets, allowed) {
+    return (targets.rawKinds.length > 0 &&
+        targets.rawKinds.every((rawKind) => {
+            const kind = builtinKind(rawKind);
+            return kind !== undefined && allowed.has(kind);
+        }));
+}
+/*
+ * The commands that read the words after their objects as updates, KEY=VALUE
+ * or KEY- (kubectl's GetResourcesAndPairs for label, annotate and set image,
+ * SplitEnvironmentFromResources for set env, and taint's own split): for
+ * these, and only these, the objects end at the first such word. (taint also
+ * ends them at a KEY:EFFECT word; reading that as one more object only adds
+ * an object.) Every other verb hands kubectl's resource builder ALL of its
+ * words, `=` or not, and kubectl goes on to the next object when one fails:
+ * checked with the pinned kubectl v1.36.4 against a fake API server, `get
+ * pod/a=b secret/s` prints the Secret and `patch pod/a=b node/n1` patches
+ * the Node, each after the missing pod's error.
+ */
+function readsObjectsThenPairs(verb, subcommand) {
+    if (verb === "label" || verb === "annotate" || verb === "taint") {
+        return true;
+    }
+    return verb === "set" && (subcommand === "image" || subcommand === "env");
+}
+/*
+ * The object tokens of a command, split the way kubectl splits positionals:
+ * the words after the verb (and the subcommand, for rollout and set) — for
+ * the commands that take updates (readsObjectsThenPairs), only the leading
+ * words that are not KEY=VALUE or KEY- pairs. So `label pod web-1 app=web`
+ * names only the pod, and `label pod web-1 secret/rotated=true` names no
+ * Secret, while `get pod/a=b secret/s` names the Secret. For set selector
+ * the last word is the selector expression, not an object; it is kept here,
+ * which can only add an object to what the deny lists read.
+ */
+function objectTokens(verb, positionals) {
+    const start = verb === "rollout" || verb === "set" ? 2 : 1;
+    const words = positionals.slice(start);
+    if (!readsObjectsThenPairs(verb, (positionals[1] || "").toLowerCase())) {
+        return words;
+    }
+    const tokens = [];
+    for (const token of words) {
+        if (token.includes("=") || token.endsWith("-")) {
+            break;
+        }
+        tokens.push(token);
+    }
+    return tokens;
+}
+/*
+ * The objects a write names: after the verb for delete, after the verb's
+ * object tokens for the other object verbs (after the subcommand for
+ * rollout and set), and none for node verbs and create. evaluateArgs and
+ * the allowlist's reading of an entry (allowlistMayPromote) both use this,
+ * so the two can never disagree about what a command acts on.
+ */
+function commandTargets(verb, positionals) {
+    if (verb === "delete") {
+        return namedKinds(positionals.slice(1));
+    }
+    return OBJECT_VERBS.has(verb)
+        ? namedKinds(objectTokens(verb, positionals))
+        : namedKinds([]);
+}
+/*
+ * True when one of the objects is the built-in Node, in any spelling kubectl
+ * resolves to it (builtinKind(): node, nodes, no, Node, nodes.v1., no/NAME).
+ * A custom resource that borrows the name (`nodes.example.com`) is not.
+ */
+function namesBuiltinNode(targets) {
+    return targets.rawKinds.some((rawKind) => {
+        return builtinKind(rawKind) === "node";
+    });
+}
+/*
+ * Why nothing an operator sets on the cluster runs this write unattended —
+ * a drain, a taint, or a patch of a Node (see the header) — or undefined.
+ * A write that gets a reason here carries `requiresHuman`, and an allowlist
+ * entry that names one pre-approves nothing.
+ */
+function describeAlwaysHumanWrite(verb, targets) {
+    if (Object.prototype.hasOwnProperty.call(ALWAYS_HUMAN_VERB_REASONS, verb)) {
+        return ALWAYS_HUMAN_VERB_REASONS[verb];
+    }
+    if (verb === "patch" && namesBuiltinNode(targets)) {
+        return NODE_PATCH_ALWAYS_HUMAN_REASON;
+    }
+    return undefined;
+}
+/*
+ * The label / annotation KEYS a label or annotate command writes or removes:
+ * the pair tokens after the objects, "KEY=VALUE" (the key is before the
+ * first "=") or "KEY-" (removal). Values are never inspected, so a reserved
+ * string in a value is just text.
+ */
+function labelKeys(verb, positionals) {
+    const start = 1 + objectTokens(verb, positionals).length;
+    const keys = [];
+    for (const token of positionals.slice(start)) {
+        const eq = token.indexOf("=");
+        if (eq >= 0) {
+            keys.push(token.slice(0, eq));
+        }
+        else if (token.endsWith("-")) {
+            keys.push(token.slice(0, -1));
+        }
+    }
+    return keys;
+}
+// The DNS prefix of a label key ("pod-security.kubernetes.io/enforce"), lowercased.
+function keyDomain(key) {
+    const slash = key.indexOf("/");
+    return slash >= 0 ? key.slice(0, slash).toLowerCase() : "";
+}
+function isDomainOrSubdomain(domain, of) {
+    return domain === of || domain.endsWith(`.${of}`);
+}
+function isReservedKey(key) {
+    const domain = keyDomain(key);
+    return (domain.length > 0 &&
+        RESERVED_KEY_DOMAINS.some((reserved) => {
+            return isDomainOrSubdomain(domain, reserved);
+        }));
+}
+function isPodSecurityKey(key) {
+    return isDomainOrSubdomain(keyDomain(key), POD_SECURITY_KEY_DOMAIN);
+}
+function isAppArmorAnnotationKey(key) {
+    return isDomainOrSubdomain(keyDomain(key), APPARMOR_ANNOTATION_KEY_DOMAIN);
+}
+function isRbacAggregationKey(key) {
+    return key.toLowerCase().startsWith(RBAC_AGGREGATION_KEY_PREFIX);
+}
+const MAX_PATCH_BODY_DEPTH = 64;
+/*
+ * findForbiddenJsonField's answer for a body nested past
+ * MAX_PATCH_BODY_DEPTH. It can never equal a field it reports, which are
+ * POD_SECURITY_PATCH_KEYS, Pod Security Admission label keys, AppArmor
+ * annotation keys and a probe's or hook's host (httpGet.host).
+ */
+const PATCH_BODY_TOO_DEEP = "\0too-deep";
+/*
+ * Why a `kubectl patch` body may not run, or null. The body must be JSON,
+ * and the JSON is walked for POD_SECURITY_PATCH_KEYS, Pod Security
+ * Admission labels, AppArmor annotations and the host of a probe or
+ * lifecycle hook (keys, and the path/from of JSON-patch operations,
+ * decoded, so a \u escape or a ~1 cannot hide a name).
+ *
+ * Why JSON only: kubectl sends a body whose first non-space byte is "{" to
+ * the API server byte for byte, and decodes every other body as YAML 1.1
+ * (apimachinery's yaml.ToJSON) — including a "[" body such as a JSON patch.
+ * YAML honours type tags, anchors, aliases and merge keys, so `!!binary
+ * c2VydmljZUFjY291bnROYW1l` is the key serviceAccountName although that
+ * word appears nowhere in the text; no scan of the text can see what
+ * kubectl will apply. A body that IS valid JSON decodes to the same keys
+ * and paths either way: in JSON, tag, anchor and merge-key syntax can only
+ * sit inside quoted strings, where YAML reads it as plain text, and a
+ * repeated key keeps its last value in JSON.parse and in kubectl alike.
+ * Every patch a fix needs can be written as JSON.
+ *
+ * A body that names no forbidden field can still drop them by replacing or
+ * removing what holds them; findPodSpecReplacement refuses that, for the
+ * patch types kubectl could apply the body as (`patchTypes`, see
+ * readPatchTypes).
+ */
+function findPatchBodyProblem(body, patchTypes) {
+    let parsed = undefined;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch (_a) {
+        return `kubectl patch with a body that is not JSON is never allowed for OneUptime AI: kubectl reads any other body as YAML, whose tags, anchors and merge keys can spell a field name that appears nowhere in the text (write the patch body as JSON, e.g. -p '{"spec":{"replicas":3}}')`;
+    }
+    const field = findForbiddenJsonField(parsed, 0, "");
+    if (field === PATCH_BODY_TOO_DEEP) {
+        return `kubectl patch with a body nested more than ${MAX_PATCH_BODY_DEPTH} levels deep is never allowed for OneUptime AI (no fix needs one)`;
+    }
+    if (field !== null) {
+        return isPodSecurityKey(field)
+            ? `kubectl patch of ${field} is never allowed for OneUptime AI: Pod Security Admission reads these labels to decide whether privileged pods may run in a namespace`
+            : `kubectl patch that touches ${field} is never allowed for OneUptime AI: it changes which identity, privileges, host access, Secrets or program a pod runs with (patch other fields, or use set image / set env / set resources)`;
+    }
+    return findPodSpecReplacement(parsed, patchTypes);
+}
+/*
+ * ---- Patches that replace what holds the pod-security fields ---------------
+ *
+ * POD_SECURITY_PATCH_KEYS are matched by NAME, which only sees a patch that
+ * spells one. A patch that replaces or removes an object ABOVE them drops
+ * them without naming any. Checked against the pinned kubectl v1.36.4 with
+ * `patch --local` on a Deployment whose pod runs as a restricted
+ * ServiceAccount with a securityContext, a command and a volume:
+ *   - strategic merge (the default type): `"$patch": "replace"` in the pod
+ *     spec (or in template, or spec) leaves only what the patch lists —
+ *     serviceAccountName back to default, securityContext and volumes
+ *     gone; `$retainKeys` in the pod spec clears every field it does not
+ *     list; a `{"$patch": "replace"}` element in the containers list drops
+ *     every container's command, securityContext, env and volumeMounts; a
+ *     `{"name": X, "$patch": "delete"}` element removes container X; null
+ *     for the pod spec or the containers list removes it;
+ *   - merge (--type=merge, RFC 7386): a list is replaced wholesale, so
+ *     `{"containers": [{"name": "web", "image": "x"}]}` leaves one container
+ *     with nothing but a name and an image; null removes, and a scalar
+ *     replaces;
+ *   - JSON patch: replace or remove of /spec/template/spec,
+ *     /spec/template/spec/containers or /spec/template/spec/containers/0
+ *     (/spec/containers/0 on a Pod), and an add whose path is an existing
+ *     object member — add replaces it — do the same.
+ *
+ * So nothing on the path from the object down to a pod-security field may be
+ * replaced, removed, reordered or filtered. That path is POD_SPEC_PATH_STEPS
+ * from the top of the body: through spec, template and jobTemplate (the pod
+ * template of a Pod, a workload, a Job, a CronJob, a PodTemplate, and the
+ * custom workloads that copy that layout) to the pod spec, then its
+ * containers list, one container, its env list, one env entry and its
+ * valueFrom. Refused along that path:
+ *   - any strategic-merge directive — a key starting with "$" ($patch,
+ *     $retainKeys, $setElementOrder/..., $deleteFromPrimitiveList/...) — in
+ *     a map on it, a `{"$patch": ...}` element of a list on it included;
+ *   - null for a key on it, or a value of the wrong shape (a scalar or a
+ *     list where the object goes, anything but a list where a list goes);
+ *   - under a merge patch, any value for the containers or env list;
+ *   - a JSON-patch remove, replace, move or copy whose path or from is on it
+ *     (the whole object, "", included), and an add whose path is on it and
+ *     names an object member rather than a list position.
+ * Anything off that path — metadata and the pod template's labels and
+ * annotations, replicas, the update strategy, a container's image or
+ * resources, an env entry's value — stays patchable: a strategic-merge patch
+ * that names one container and sets its image or resources, a JSON-patch
+ * replace of /spec/replicas or /spec/template/spec/containers/0/image, a
+ * merge patch of metadata/annotations. Adding a list element (a new env
+ * entry, or a new container, whose fields the name check reads) is not a
+ * replacement. Keys are matched case-insensitively, like the name check.
+ */
+// The patch types kubectl patch accepts for --type (it lowercases the value).
+var PatchType;
+(function (PatchType) {
+    PatchType["Strategic"] = "strategic";
+    PatchType["Merge"] = "merge";
+    PatchType["Json"] = "json";
+})(PatchType || (PatchType = {}));
+const PATCH_TYPES = [
+    PatchType.Strategic,
+    PatchType.Merge,
+    PatchType.Json,
+];
+/*
+ * The types kubectl could apply a body as: strategic merge when --type is
+ * not given, else every --type value (pflag keeps the last one; reading all
+ * of them is the safe side). A value kubectl does not know makes it refuse
+ * the command, so it is read as every type.
+ */
+function readPatchTypes(typeValues) {
+    const types = new Set();
+    if (typeValues.length === 0) {
+        types.add(PatchType.Strategic);
+        return types;
+    }
+    for (const value of typeValues) {
+        const known = PATCH_TYPES.find((type) => {
+            return type === value.trim().toLowerCase();
+        });
+        if (known) {
+            types.add(known);
+        }
+        else {
+            for (const type of PATCH_TYPES) {
+                types.add(type);
+            }
+        }
+    }
+    return types;
+}
+// Where a patch is on the path from the object to the pod-security fields.
+var PodSpecPathStep;
+(function (PodSpecPathStep) {
+    // The object, spec, template, jobTemplate — and the pod spec itself.
+    PodSpecPathStep["PodSpecOrAbove"] = "PodSpecOrAbove";
+    PodSpecPathStep["ContainerList"] = "ContainerList";
+    PodSpecPathStep["Container"] = "Container";
+    PodSpecPathStep["EnvList"] = "EnvList";
+    PodSpecPathStep["EnvEntry"] = "EnvEntry";
+    PodSpecPathStep["ValueFrom"] = "ValueFrom";
+})(PodSpecPathStep || (PodSpecPathStep = {}));
+/*
+ * The steps down the path, by lowercased key. A list step's elements are the
+ * step in LIST_ELEMENT_STEPS. A key not listed for a step leaves the path.
+ */
+const POD_SPEC_PATH_STEPS = {
+    [PodSpecPathStep.PodSpecOrAbove]: {
+        spec: PodSpecPathStep.PodSpecOrAbove,
+        template: PodSpecPathStep.PodSpecOrAbove,
+        jobtemplate: PodSpecPathStep.PodSpecOrAbove,
+        containers: PodSpecPathStep.ContainerList,
+    },
+    [PodSpecPathStep.ContainerList]: {},
+    [PodSpecPathStep.Container]: { env: PodSpecPathStep.EnvList },
+    [PodSpecPathStep.EnvList]: {},
+    [PodSpecPathStep.EnvEntry]: { valuefrom: PodSpecPathStep.ValueFrom },
+    [PodSpecPathStep.ValueFrom]: {},
+};
+const LIST_ELEMENT_STEPS = new Map([
+    [PodSpecPathStep.ContainerList, PodSpecPathStep.Container],
+    [PodSpecPathStep.EnvList, PodSpecPathStep.EnvEntry],
+]);
+function nextPodSpecPathStep(step, key) {
+    const listElement = LIST_ELEMENT_STEPS.get(step);
+    if (listElement) {
+        return listElement;
+    }
+    const steps = POD_SPEC_PATH_STEPS[step];
+    const lower = key.toLowerCase();
+    return Object.prototype.hasOwnProperty.call(steps, lower)
+        ? steps[lower]
+        : undefined;
+}
+// What the refusals say a replacement drops.
+const POD_SPEC_REPLACEMENT_DROPS = "it replaces or removes a pod spec, a container or what holds them, and so drops the securityContext, serviceAccountName, command, args, volumes, volumeMounts and Secret references under it without naming any of them";
+const POD_SPEC_REPLACEMENT_INSTEAD = "patch the field itself (such as one container's image or resources, named in a strategic-merge patch, or /spec/template/spec/containers/0/image in a JSON patch), or use set image / set env / set resources";
+// A JSON-pointer segment: "~1" is "/" and "~0" is "~" (RFC 6901, in that order).
+const JSON_POINTER_SLASH_ESCAPE = /~1/g;
+const JSON_POINTER_TILDE_ESCAPE = /~0/g;
+function decodeJsonPointerSegment(segment) {
+    return segment
+        .replace(JSON_POINTER_SLASH_ESCAPE, "/")
+        .replace(JSON_POINTER_TILDE_ESCAPE, "~");
+}
+// A list position in a JSON-patch path: an index, or "-" (the end).
+const JSON_PATCH_LIST_POSITION = /^(-|[0-9]+)$/;
+function describePodSpecPath(segments) {
+    return segments.length === 0 ? "the whole object" : `/${segments.join("/")}`;
+}
+function isPlainObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isListStep(step) {
+    return LIST_ELEMENT_STEPS.has(step);
+}
+/*
+ * Why a parsed patch body replaces or removes something on the pod-spec path
+ * (see the section above), or null.
+ */
+function findPodSpecReplacement(parsed, patchTypes) {
+    if (Array.isArray(parsed)) {
+        for (const operation of parsed) {
+            if (!isPlainObject(operation)) {
+                continue;
+            }
+            const problem = findJsonPatchReplacement(operation);
+            if (problem) {
+                return problem;
+            }
+        }
+        return null;
+    }
+    if (!isPlainObject(parsed)) {
+        return null;
+    }
+    return findObjectPatchReplacement(parsed, PodSpecPathStep.PodSpecOrAbove, [], patchTypes, 0);
+}
+// A strategic-merge or merge body, walked down the pod-spec path only.
+function findObjectPatchReplacement(map, step, segments, patchTypes, depth) {
+    // findForbiddenJsonField already refused a body this deep.
+    if (depth > MAX_PATCH_BODY_DEPTH) {
+        return null;
+    }
+    for (const [key, value] of Object.entries(map)) {
+        if (key.startsWith("$")) {
+            return `kubectl patch with the strategic-merge directive "${key}" at ${describePodSpecPath(segments)} is never allowed for OneUptime AI: ${POD_SPEC_REPLACEMENT_DROPS} (${POD_SPEC_REPLACEMENT_INSTEAD})`;
+        }
+        const next = nextPodSpecPathStep(step, key);
+        if (next === undefined) {
+            continue;
+        }
+        const where = describePodSpecPath([...segments, key]);
+        if (value === null) {
+            return `kubectl patch that sets ${where} to null is never allowed for OneUptime AI: ${POD_SPEC_REPLACEMENT_DROPS} (${POD_SPEC_REPLACEMENT_INSTEAD})`;
+        }
+        if (!isListStep(next)) {
+            if (!isPlainObject(value)) {
+                return `kubectl patch that sets ${where} to something other than an object is never allowed for OneUptime AI: ${POD_SPEC_REPLACEMENT_DROPS} (${POD_SPEC_REPLACEMENT_INSTEAD})`;
+            }
+            const problem = findObjectPatchReplacement(value, next, [...segments, key], patchTypes, depth + 1);
+            if (problem) {
+                return problem;
+            }
+            continue;
+        }
+        if (patchTypes.has(PatchType.Merge)) {
+            return `kubectl patch --type=merge that sets ${where} is never allowed for OneUptime AI: a merge patch replaces a list wholesale, so ${POD_SPEC_REPLACEMENT_DROPS} (use a strategic-merge patch that names the container, or set image / set env / set resources)`;
+        }
+        if (!Array.isArray(value)) {
+            return `kubectl patch that sets ${where} to something other than a list is never allowed for OneUptime AI: ${POD_SPEC_REPLACEMENT_DROPS} (${POD_SPEC_REPLACEMENT_INSTEAD})`;
+        }
+        const element = LIST_ELEMENT_STEPS.get(next);
+        for (let index = 0; index < value.length; index++) {
+            const item = value[index];
+            if (!isPlainObject(item)) {
+                continue;
+            }
+            const problem = findObjectPatchReplacement(item, element, [...segments, key, String(index)], patchTypes, depth + 2);
+            if (problem) {
+                return problem;
+            }
+        }
+    }
+    return null;
+}
+function readJsonPatchTarget(pointer) {
+    // "" is the whole object; every other pointer starts with "/".
+    const segments = pointer === ""
+        ? []
+        : pointer.split("/").slice(1).map(decodeJsonPointerSegment);
+    let step = PodSpecPathStep.PodSpecOrAbove;
+    let isListPosition = false;
+    for (const segment of segments) {
+        isListPosition = isListStep(step) && JSON_PATCH_LIST_POSITION.test(segment);
+        const next = nextPodSpecPathStep(step, segment);
+        if (next === undefined) {
+            return undefined;
+        }
+        step = next;
+    }
+    return { step, isListPosition };
+}
+function findJsonPatchReplacement(operation) {
+    const op = operation["op"];
+    const path = operation["path"];
+    const from = operation["from"];
+    // test only compares; add inserts at a list position and replaces a member.
+    if (op === "test") {
+        return null;
+    }
+    if (typeof path === "string") {
+        const target = readJsonPatchTarget(path);
+        if (target && !(op === "add" && target.isListPosition)) {
+            return `kubectl patch with a JSON-patch "${String(op)}" of ${describeJsonPointer(path)} is never allowed for OneUptime AI: ${POD_SPEC_REPLACEMENT_DROPS} (${POD_SPEC_REPLACEMENT_INSTEAD})`;
+        }
+    }
+    if (typeof from === "string" && op !== "add") {
+        if (readJsonPatchTarget(from)) {
+            return `kubectl patch with a JSON-patch "${String(op)}" from ${describeJsonPointer(from)} is never allowed for OneUptime AI: ${POD_SPEC_REPLACEMENT_DROPS} (${POD_SPEC_REPLACEMENT_INSTEAD})`;
+        }
+    }
+    return null;
+}
+function describeJsonPointer(pointer) {
+    return pointer === "" ? "the whole object" : pointer;
+}
+/*
+ * The probe and lifecycle-hook handlers whose `host` the Pod Security
+ * Standards baseline refuses (its Host Probes / Lifecycle Hooks control,
+ * Kubernetes v1.34+): a liveness, readiness or startup probe, or a postStart
+ * or preStop hook, with httpGet.host or tcpSocket.host makes the kubelet
+ * connect from the node to any address it names instead of to the pod. The
+ * name check reads `host` only as a member of one of these (lowercased): a
+ * `host` anywhere else, such as an Ingress rule's, is no pod field.
+ */
+const HOST_FIELD_HANDLER_KEYS = new Set([
+    "httpget",
+    "tcpsocket",
+]);
+const HANDLER_HOST_KEY = "host";
+/*
+ * Why a key (or a JSON-pointer segment) may not appear in a patch body, as
+ * the field to name, or null. `parentKey` is the key of the object that
+ * holds it ("" at the top, and for a list element), for the fields that are
+ * forbidden only where they sit (HOST_FIELD_HANDLER_KEYS).
+ */
+function forbiddenFieldInName(name, parentKey) {
+    if (POD_SECURITY_PATCH_KEYS.has(name.toLowerCase())) {
+        return name;
+    }
+    if (isPodSecurityKey(name) || isAppArmorAnnotationKey(name)) {
+        return name;
+    }
+    if (name.toLowerCase() === HANDLER_HOST_KEY &&
+        HOST_FIELD_HANDLER_KEYS.has(parentKey.toLowerCase())) {
+        return `${parentKey}.${name}`;
+    }
+    return null;
+}
+// A JSON pointer ("/spec/template/spec/volumes/-"), decoded segment by segment.
+function jsonPointerSegments(pointer) {
+    return pointer.split("/").map(decodeJsonPointerSegment);
+}
+// A JSON-pointer path ("/spec/template/spec/volumes/-"), segment by segment.
+function forbiddenFieldInPath(path) {
+    const segments = jsonPointerSegments(path);
+    for (let index = 0; index < segments.length; index++) {
+        const found = forbiddenFieldInName(segments[index], index > 0 ? segments[index - 1] : "");
+        if (found) {
+            return found;
+        }
+    }
+    return null;
+}
+/*
+ * The first forbidden field a parsed patch body names (see
+ * forbiddenFieldInName), PATCH_BODY_TOO_DEEP, or null. `parentKey` is the
+ * key that holds `value` — for a JSON-patch operation's value, the last
+ * segment of its path, so `{"op": "add", "path": ".../httpGet", "value":
+ * {"host": ...}}` is read like the same object written in place.
+ */
+function findForbiddenJsonField(value, depth, parentKey) {
+    // Nesting this deep is not a patch a fix needs; refuse rather than recurse.
+    if (depth > MAX_PATCH_BODY_DEPTH) {
+        return PATCH_BODY_TOO_DEEP;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            const found = findForbiddenJsonField(item, depth + 1, "");
+            if (found) {
+                return found;
+            }
+        }
+        return null;
+    }
+    if (value === null || typeof value !== "object") {
+        return null;
+    }
+    const record = value;
+    const isJsonPatchOperation = Object.prototype.hasOwnProperty.call(record, "op");
+    const operationPath = record["path"];
+    const operationValueParent = isJsonPatchOperation && typeof operationPath === "string"
+        ? jsonPointerSegments(operationPath).pop() || ""
+        : "";
+    for (const [key, child] of Object.entries(record)) {
+        const keyProblem = forbiddenFieldInName(key, parentKey);
+        if (keyProblem) {
+            return keyProblem;
+        }
+        /*
+         * Strategic-merge directives name the list they edit after the slash:
+         * "$setElementOrder/volumes", "$deleteFromPrimitiveList/args".
+         */
+        if (key.startsWith("$") && key.includes("/")) {
+            const directiveProblem = forbiddenFieldInName(key.slice(key.indexOf("/") + 1), parentKey);
+            if (directiveProblem) {
+                return directiveProblem;
+            }
+        }
+        if (isJsonPatchOperation &&
+            (key === "path" || key === "from") &&
+            typeof child === "string") {
+            const pathProblem = forbiddenFieldInPath(child);
+            if (pathProblem) {
+                return pathProblem;
+            }
+        }
+        const found = findForbiddenJsonField(child, depth + 1, isJsonPatchOperation && key === "value" ? operationValueParent : key);
+        if (found) {
+            return found;
+        }
+    }
+    return null;
+}
+// Same bounds CommandPolicy applies to the Bash lane's allowlist.
+const MAX_ALLOWLIST_PATTERNS = 100;
+const MAX_ALLOWLIST_PATTERN_LENGTH = 500;
+/*
+ * Exported so the server's save validation and the AI page's form
+ * validation hold entries to exactly the bounds matchesAllowlist reads.
+ */
+export const KUBECTL_ALLOWLIST_MAX_PATTERNS = MAX_ALLOWLIST_PATTERNS;
+export const KUBECTL_ALLOWLIST_MAX_PATTERN_LENGTH = MAX_ALLOWLIST_PATTERN_LENGTH;
+function isFlagToken(token) {
+    return token.startsWith("-") && token !== "-";
+}
+// What tokenize() says for a command (or an allowlist entry) with no verb.
+const NO_VERB_MESSAGE = "The command names no kubectl verb.";
+// A word that holds whitespace was quoted together (see readAllowlistEntry).
+const WHITESPACE_REGEX = /\s/;
+/*
+ * Flags whose value picks WHICH objects (or namespace) a command acts on —
+ * the namespace, a selector, --all, the source object of --from — so a `*`
+ * in their value makes an allowlist entry broad.
+ */
+const WIDENING_FLAGS = [
+    "n",
+    "namespace",
+    "l",
+    "selector",
+    "field-selector",
+    "pod-selector",
+    "all",
+    "A",
+    "all-namespaces",
+    "from",
+];
+// For the "write the subcommand out" message.
+const SUBCOMMAND_EXAMPLES = {
+    rollout: "restart deployment/web -n web",
+    set: "image deployment/web * -n web",
+    create: "job manual-run --from=cronjob/nightly -n web",
+    auth: "can-i get pods",
+    top: "pod -n web",
+};
+function subcommandExample(verb) {
+    const example = Object.prototype.hasOwnProperty.call(SUBCOMMAND_EXAMPLES, verb)
+        ? SUBCOMMAND_EXAMPLES[verb]
+        : undefined;
+    return example ? `, as in "kubectl ${verb} ${example}"` : "";
+}
+function hasWildcard(token) {
+    return token.includes("*");
+}
+/*
+ * Whether evaluateForAutoExecution can ever promote a command this entry
+ * matches through the allowlist: never a read (it runs anyway), and never a
+ * drain, a taint or a patch that names a Node (it always needs a human;
+ * describeAlwaysHumanWrite reads the entry's objects exactly as it reads a
+ * command's, so `kubectl patch node * -p *` promotes nothing). A `*` where
+ * the kind goes may still stand for a Node, but it stands for every other
+ * kind as well, so such an entry is broad, and the Node commands it matches
+ * need a human all the same.
+ */
+function allowlistMayPromote(parsed) {
+    const verb = parsed.positionals[0] || "";
+    const subcommand = parsed.positionals[1] || "";
+    if (READ_VERBS.has(verb) || READ_COMMAND_GROUPS.has(verb)) {
+        return false;
+    }
+    if (describeAlwaysHumanWrite(verb, commandTargets(verb, parsed.positionals)) !==
+        undefined) {
+        return false;
+    }
+    return !(verb === "rollout" &&
+        (subcommand === "status" || subcommand === "history"));
+}
+/*
+ * The commands whose words after the objects are UPDATES kubectl requires
+ * (label, annotate, set image, and set env unless -e/--env/--from supply the
+ * variables): with no update word, kubectl refuses the command outright.
+ */
+function readsUpdatePairs(verb, subcommand, flags) {
+    if (verb === "label" || verb === "annotate") {
+        return true;
+    }
+    if (verb !== "set") {
+        return false;
+    }
+    if (subcommand === "image") {
+        return true;
+    }
+    return (subcommand === "env" &&
+        !flags.has("e") &&
+        !flags.has("env") &&
+        !flags.has("from"));
+}
+/*
+ * An update word (KEY=VALUE or KEY-) in an allowlist entry: every word it
+ * matches is one too, so it can never stand for another object.
+ */
+function isUpdatePairToken(token) {
+    return token.includes("=") || (token.endsWith("-") && token !== "-");
+}
+/*
+ * One pattern token against one argv token (see the allowlist section in the
+ * header). A flag is matched only by the same flag spelled literally: the
+ * part up to "=" must be equal, and only a value after "=" may glob. A `*`
+ * never matches whitespace; whitespace runs inside a quoted token must line
+ * up with whitespace in the pattern (runs are collapsed on both sides).
+ */
+function allowlistTokenMatches(pattern, token) {
+    if (isFlagToken(token) || isFlagToken(pattern)) {
+        if (!isFlagToken(token) || !isFlagToken(pattern)) {
+            return false;
+        }
+        const tokenEq = token.indexOf("=");
+        const patternEq = pattern.indexOf("=");
+        if (tokenEq < 0 || patternEq < 0) {
+            return pattern === token;
+        }
+        if (pattern.slice(0, patternEq) !== token.slice(0, tokenEq)) {
+            return false;
+        }
+        return globWithinToken(pattern.slice(patternEq + 1), token.slice(tokenEq + 1));
+    }
+    return globWithinToken(pattern, token);
+}
+function globWithinToken(pattern, text) {
+    const patternPieces = pattern.trim().split(/\s+/);
+    const textPieces = text.trim().split(/\s+/);
+    if (patternPieces.length !== textPieces.length) {
+        return false;
+    }
+    for (let i = 0; i < patternPieces.length; i++) {
+        if (!CommandPolicy.globMatches(patternPieces[i], textPieces[i])) {
+            return false;
+        }
+    }
+    return true;
+}
+// A replica count kubectl scale takes: digits only.
+const REPLICA_COUNT_PATTERN = /^[0-9]+$/;
+export default class KubectlPolicy {
+    /*
+     * Split a command line into an argv the way a POSIX shell would split it
+     * for quoting purposes ONLY: single quotes, double quotes, backslash
+     * escapes. No expansion, no operators, no redirection — those characters
+     * stay literal inside their token. The command must fit on one line.
+     */
+    static tokenize(command) {
+        const text = (command || "").trim();
+        if (!text) {
+            return { errorMessage: "Empty command." };
+        }
+        if (text.length > MAX_COMMAND_LENGTH_CHARS) {
+            return {
+                errorMessage: `Command exceeds the ${MAX_COMMAND_LENGTH_CHARS}-character limit.`,
+            };
+        }
+        if (text.includes("\n") || text.includes("\r") || text.includes("\0")) {
+            return { errorMessage: "A kubectl command must be a single line." };
+        }
+        const args = [];
+        let current = "";
+        let inSingle = false;
+        let inDouble = false;
+        let hasToken = false;
+        for (let i = 0; i < text.length; i++) {
+            const ch = text[i];
+            if (inSingle) {
+                if (ch === "'") {
+                    inSingle = false;
+                }
+                else {
+                    current += ch;
+                }
+                continue;
+            }
+            if (inDouble) {
+                if (ch === '"') {
+                    inDouble = false;
+                }
+                else if (ch === "\\" && i + 1 < text.length) {
+                    const next = text[i + 1];
+                    if (next === '"' || next === "\\") {
+                        current += next;
+                        i++;
+                    }
+                    else {
+                        current += ch;
+                    }
+                }
+                else {
+                    current += ch;
+                }
+                continue;
+            }
+            if (ch === "'") {
+                inSingle = true;
+                hasToken = true;
+                continue;
+            }
+            if (ch === '"') {
+                inDouble = true;
+                hasToken = true;
+                continue;
+            }
+            if (ch === "\\" && i + 1 < text.length) {
+                current += text[i + 1];
+                hasToken = true;
+                i++;
+                continue;
+            }
+            if (ch === " " || ch === "\t") {
+                if (hasToken) {
+                    args.push(current);
+                    current = "";
+                    hasToken = false;
+                }
+                continue;
+            }
+            current += ch;
+            hasToken = true;
+        }
+        if (inSingle || inDouble) {
+            return { errorMessage: "Unbalanced quotes in the command." };
+        }
+        if (hasToken) {
+            args.push(current);
+        }
+        if (args.length === 0) {
+            return { errorMessage: "Empty command." };
+        }
+        if (args.length > MAX_TOKENS) {
+            return {
+                errorMessage: `A kubectl command may have at most ${MAX_TOKENS} arguments.`,
+            };
+        }
+        // The model may or may not write the binary name; the Runner adds it.
+        if (args[0].toLowerCase() === "kubectl") {
+            args.shift();
+        }
+        if (args.length === 0) {
+            return { errorMessage: NO_VERB_MESSAGE };
+        }
+        return { args };
+    }
+    // Tokenize, then evaluate.
+    static evaluateCommand(command) {
+        const tokenized = KubectlPolicy.tokenize(command);
+        if (!tokenized.args) {
+            return {
+                tier: KubectlCommandTier.Denied,
+                reason: tokenized.errorMessage || "Could not parse the command.",
+                args: [],
+                verb: "",
+                displayCommand: (command || "").trim().slice(0, 200),
+            };
+        }
+        return KubectlPolicy.evaluateArgs(tokenized.args);
+    }
+    /*
+     * The evaluation proper, on an argv. The Runner calls this on the argv it
+     * received so its verdict never depends on re-tokenizing a string the
+     * same way the server did.
+     */
+    static evaluateArgs(rawArgs) {
+        const args = (rawArgs || []).filter((arg) => {
+            return typeof arg === "string";
+        });
+        const displayCommand = KubectlPolicy.renderDisplayCommand(args);
+        const deny = (reason, verb = "") => {
+            return {
+                tier: KubectlCommandTier.Denied,
+                reason,
+                args,
+                verb,
+                displayCommand,
+            };
+        };
+        if (args.length === 0) {
+            return deny(NO_VERB_MESSAGE);
+        }
+        if (args.length > MAX_TOKENS) {
+            return deny(`A kubectl command may have at most ${MAX_TOKENS} arguments.`);
+        }
+        for (const arg of args) {
+            if (arg.includes("\n") || arg.includes("\r") || arg.includes("\0")) {
+                return deny("Arguments may not contain line breaks.");
+            }
+        }
+        const parsed = KubectlPolicy.parseArgs(args);
+        const rawVerb = parsed.positionals[0] || "";
+        const verb = rawVerb.toLowerCase();
+        // A denied verb is the most useful thing to say, whatever its flags.
+        if (DENIED_VERBS.has(verb)) {
+            return deny(`kubectl ${verb} is not allowed for OneUptime AI`, verb);
+        }
+        // Credential / cluster-selection / file / unknown flags: never.
+        if (parsed.violation) {
+            return deny(parsed.violation);
+        }
+        if (!verb) {
+            return deny(NO_VERB_MESSAGE);
+        }
+        /*
+         * cobra matches commands case-sensitively: "Get" is not the get command,
+         * and kubectl would look for a kubectl-Get plugin on the Runner's PATH
+         * and run it. The same holds one level down for subcommands.
+         */
+        if (rawVerb !== verb) {
+            return deny(`kubectl matches commands case-sensitively, so "${rawVerb}" is not kubectl ${verb}: kubectl would look for a kubectl-${rawVerb} plugin on the Runner (write the verb in lowercase)`, verb);
+        }
+        const rawSubcommand = parsed.positionals[1] || "";
+        const subcommand = rawSubcommand.toLowerCase();
+        if (SUBCOMMAND_VERBS.has(verb) && rawSubcommand !== subcommand) {
+            return deny(`kubectl matches commands case-sensitively, so "${rawSubcommand}" is not the kubectl ${verb} ${subcommand} command (write the subcommand in lowercase)`, `${verb} ${subcommand}`);
+        }
+        const streamingProblem = KubectlPolicy.findStreamingFlag(parsed.flags);
+        if (streamingProblem) {
+            return deny(streamingProblem);
+        }
+        const outputProblem = KubectlPolicy.findOutputFormatProblem(parsed.flags);
+        if (outputProblem) {
+            return deny(outputProblem);
+        }
+        /*
+         * The namespace, resolved from -n / --namespace in every spelling
+         * parseArgs accepts (-n X, -nX, -n=X, --namespace X, --namespace=X).
+         * pflag keeps the LAST value of a repeated flag, so `-n web ... -n
+         * kube-system` would run in kube-system while a reader (or an allowlist
+         * pattern) saw web first: a namespace set twice is refused outright.
+         */
+        const namespaceValues = [
+            ...(parsed.flags.get("n") || []),
+            ...(parsed.flags.get("namespace") || []),
+        ];
+        if (namespaceValues.length > 1) {
+            return deny(`the namespace is set more than once (${namespaceValues
+                .map((value) => {
+                return `"${value}"`;
+            })
+                .join(", ")}); kubectl silently uses the last one, so set -n once`, verb);
+        }
+        const namespace = namespaceValues[0];
+        const hasAllNamespaces = parsed.flags.has("A") || parsed.flags.has("all-namespaces");
+        const hasAll = parsed.flags.has("all");
+        /*
+         * A field selector selects exactly like a label selector (kubectl's
+         * builder visits every match), so for a write both are "a selector".
+         */
+        const hasSelector = parsed.flags.has("l") ||
+            parsed.flags.has("selector") ||
+            parsed.flags.has("field-selector");
+        const hasForce = parsed.flags.has("force");
+        // The objects a write names (see commandTargets).
+        const targets = commandTargets(verb, parsed.positionals);
+        /*
+         * Set for a drain, a taint and a patch of a Node: the write carries
+         * requiresHuman, whatever tier it gets (see the header).
+         */
+        const alwaysHumanReason = describeAlwaysHumanWrite(verb, targets);
+        const createKind = verb === "create" &&
+            Object.prototype.hasOwnProperty.call(CREATE_SUBCOMMANDS, rawSubcommand)
+            ? CREATE_SUBCOMMANDS[rawSubcommand]
+            : undefined;
+        /*
+         * Where a write lands, for the protected-namespace rule. Nodes and the
+         * other built-in cluster-scoped kinds have no namespace (kubectl ignores
+         * -n for them); what could be protected there is a Namespace object
+         * itself. Only the built-in kinds in their own API group count
+         * (builtinKind()): a custom resource that borrows a built-in name —
+         * `annotate nodes.example.com x -n kube-system` — has a scope this
+         * policy cannot see, so it is judged by the namespace -n names.
+         */
+        const isClusterScopedWrite = (NODE_NAME_VERBS.has(verb) &&
+            namesOnlyNodes(parsed.positionals.slice(1))) ||
+            (createKind !== undefined &&
+                CLUSTER_SCOPED_CREATE_KINDS.has(createKind)) ||
+            everyBuiltinKindIn(targets, CLUSTER_SCOPED_KINDS);
+        let protectedNamespace = undefined;
+        /*
+         * A Namespace object named after a protected namespace is protected
+         * whatever -n says. That test reads the folded kind (normalizeKind), so
+         * a custom resource that borrows the name `namespaces` and is NAMED
+         * kube-system needs a human too: the folded reading can only add a
+         * human, never remove one.
+         */
+        if (!isClusterScopedWrite && isProtectedKubernetesNamespace(namespace)) {
+            protectedNamespace = namespace.trim().toLowerCase();
+        }
+        else if (targets.kinds.has("namespace")) {
+            const protectedObject = targets.names.find((name) => {
+                return isProtectedKubernetesNamespace(name);
+            });
+            protectedNamespace = protectedObject
+                ? protectedObject.trim().toLowerCase()
+                : undefined;
+        }
+        /*
+         * The result for a command that may run. A write that lands in (or
+         * targets) a protected namespace is lifted from SafeWrite to RiskyWrite
+         * and marked, and a drain, a taint or a patch of a Node is marked too,
+         * so evaluateForAutoExecution never runs either unattended.
+         */
+        const allowed = (tier, reason, verbLabel) => {
+            const result = {
+                tier,
+                reason,
+                args,
+                verb: verbLabel,
+                displayCommand,
+            };
+            if (namespace !== undefined) {
+                result.namespace = namespace;
+            }
+            if (tier === KubectlCommandTier.Read) {
+                return result;
+            }
+            if (alwaysHumanReason !== undefined) {
+                result.requiresHuman = true;
+                result.reason = alwaysHumanReason;
+            }
+            if (!protectedNamespace) {
+                return result;
+            }
+            result.protectedNamespace = protectedNamespace;
+            /*
+             * Built on result.reason, so a write that needs a human for both
+             * reasons (a patch of a Node and of a workload in kube-system) says
+             * both.
+             */
+            if (tier === KubectlCommandTier.SafeWrite) {
+                result.tier = KubectlCommandTier.RiskyWrite;
+                result.reason = `${result.reason}, but it changes the protected namespace ${protectedNamespace}, so a human must approve it`;
+            }
+            else {
+                result.reason = `${result.reason}; it changes the protected namespace ${protectedNamespace}, which always needs a human`;
+            }
+            return result;
+        };
+        // Kinds for messages: normalized for labels, as written for "not a ...".
+        const kindList = Array.from(targets.kinds).join(",");
+        const writtenKindList = targets.rawKinds.join(",");
+        // ---- Credentials -----------------------------------------------------
+        if (OBJECT_VERBS.has(verb)) {
+            for (const kind of targets.kinds) {
+                if (CREDENTIAL_KINDS.has(kind)) {
+                    return deny(`kubectl ${verb} on Secret objects is never allowed for OneUptime AI: it never reads, changes or deletes Secrets, whose values would otherwise reach the model and the job record (describe the workload that uses the Secret instead)`, `${verb} ${kind}`);
+                }
+            }
+        }
+        if (verb === "create") {
+            // `create token` mints a ServiceAccount token and prints it.
+            if (subcommand === "token") {
+                return deny("kubectl create token mints a credential and prints it; OneUptime AI never handles credentials", "create token");
+            }
+            if (normalizeKind(subcommand) === "secret") {
+                return deny("kubectl create secret is never allowed for OneUptime AI: it would put credential values in the command, the approval card and the job record (OneUptime AI never handles credentials)", "create secret");
+            }
+            const deniedCreateKind = createKind && DENIED_CREATE_KINDS.has(createKind)
+                ? createKind
+                : RBAC_KINDS.has(normalizeKind(subcommand))
+                    ? normalizeKind(subcommand)
+                    : undefined;
+            if (deniedCreateKind) {
+                return deny(`kubectl create ${subcommand} is never allowed for OneUptime AI: roles, role bindings and ServiceAccounts decide who may do what in the cluster, and creating one is a privilege grant, not a fix (a human makes RBAC changes)`, `create ${deniedCreateKind}`);
+            }
+            if (!createKind) {
+                return deny(`kubectl create ${rawSubcommand || "(missing subcommand)"} is not a kubectl create subcommand OneUptime AI may run (for a word it does not know, kubectl would look for a kubectl-create-${rawSubcommand || "<name>"} plugin on the Runner and run it)`, `create ${subcommand}`);
+            }
+            if (IMAGE_WORKLOAD_CREATE_KINDS.has(createKind)) {
+                return deny(`kubectl create ${createKind} starts a new workload running the image named in its --image flag (kubectl requires one): a new program in the cluster, not a fix. OneUptime AI changes existing workloads (set image, rollout undo) and re-runs an existing CronJob with kubectl create job NAME --from=cronjob/NAME`, `create ${createKind}`);
+            }
+            if (createKind === "job") {
+                if (parsed.flags.has("image")) {
+                    return deny("kubectl create job --image runs an arbitrary image in the cluster; OneUptime AI only re-runs an existing CronJob: kubectl create job NAME --from=cronjob/NAME", "create job");
+                }
+                const fromValues = parsed.flags.get("from") || [];
+                const from = fromValues.length === 1 ? fromValues[0] : "";
+                const slash = from.indexOf("/");
+                const fromName = slash > 0 ? from.slice(slash + 1) : "";
+                const isCronJobRef = slash > 0 &&
+                    builtinKind(from.slice(0, slash)) === "cronjob" &&
+                    fromName.length > 0 &&
+                    !fromName.includes("/");
+                if (!isCronJobRef) {
+                    return deny("kubectl create job may only re-run an existing CronJob: kubectl create job NAME --from=cronjob/NAME", "create job");
+                }
+                if (parsed.positionals.length > 3) {
+                    return deny("kubectl create job --from=cronjob/NAME takes one job NAME and no command (the CronJob's own spec runs)", "create job");
+                }
+            }
+        }
+        if (verb === "set") {
+            if (subcommand === "serviceaccount" || subcommand === "sa") {
+                return deny("kubectl set serviceaccount is never allowed for OneUptime AI: it changes the identity a workload's pods run as, and with it every permission and Secret they can reach", "set serviceaccount");
+            }
+            if (subcommand === "subject") {
+                return deny("kubectl set subject is never allowed for OneUptime AI: adding users, groups or ServiceAccounts to a role binding is a privilege grant, not a fix", "set subject");
+            }
+            if (!SET_SUBCOMMANDS.has(subcommand)) {
+                return deny(`kubectl set ${rawSubcommand || "(missing subcommand)"} is not allowed`, `set ${subcommand}`);
+            }
+            if (subcommand === "env") {
+                for (const from of parsed.flags.get("from") || []) {
+                    if (CREDENTIAL_KINDS.has(normalizeKind(from.split("/")[0] || ""))) {
+                        return deny("kubectl set env --from=secret/... wires a Secret's keys into the workload's environment; OneUptime AI never attaches Secrets to workloads (set plain values, or --from=configmap/...)", "set env");
+                    }
+                }
+            }
+        }
+        // ---- Read tier -------------------------------------------------------
+        if (READ_VERBS.has(verb)) {
+            return allowed(KubectlCommandTier.Read, `kubectl ${verb} only reads the cluster`, verb);
+        }
+        if (verb === "cluster-info") {
+            if (subcommand === "dump") {
+                return deny("kubectl cluster-info dump exports the whole cluster; inspect specific resources instead", "cluster-info dump");
+            }
+            return allowed(KubectlCommandTier.Read, "kubectl cluster-info only reads the cluster", verb);
+        }
+        if (verb === "auth") {
+            if (subcommand === "can-i" || subcommand === "whoami") {
+                return allowed(KubectlCommandTier.Read, `kubectl auth ${subcommand} only reads the cluster`, `auth ${subcommand}`);
+            }
+            return deny(`kubectl auth ${subcommand || "(missing subcommand)"} is not allowed`, `auth ${subcommand}`);
+        }
+        if (verb === "rollout" &&
+            (subcommand === "status" || subcommand === "history")) {
+            return allowed(KubectlCommandTier.Read, `kubectl rollout ${subcommand} only reads the cluster`, `rollout ${subcommand}`);
+        }
+        // ---- Write tiers -----------------------------------------------------
+        /*
+         * --overrides decides what kubectl expose creates, so the command no
+         * longer says it (see the header and OBJECT_OVERRIDE_FLAGS).
+         */
+        const overrideFlag = OBJECT_OVERRIDE_FLAGS.find((flag) => {
+            return parsed.flags.has(flag);
+        });
+        if (overrideFlag !== undefined) {
+            const label = SUBCOMMAND_VERBS.has(verb)
+                ? `${verb} ${subcommand}`
+                : verb;
+            return deny(`kubectl ${label} with --${overrideFlag} is never allowed for OneUptime AI: --overrides (merged as --override-type says) replaces the object kubectl expose generates with whatever its JSON describes, of any kind and in any namespace (a ClusterRoleBinding, a PriorityClass, a Job running any image), so the command no longer says what it creates (write the Service kubectl expose makes with its own flags: --port, --target-port, --name, --type, --protocol)`, label);
+        }
+        if (hasAllNamespaces) {
+            const label = verb === "rollout" ? `rollout ${subcommand}` : verb;
+            return deny(`kubectl ${label} across all namespaces is not allowed`, label);
+        }
+        /*
+         * A ClusterRole aggregation label names the grant it makes, so the
+         * refusal names it too. Aggregation reads labels only; the same key as
+         * an annotation is refused as a plain RBAC write below.
+         */
+        const clusterRoleAggregationKey = verb === "label" && targets.kinds.has("clusterrole")
+            ? labelKeys(verb, parsed.positionals).find(isRbacAggregationKey)
+            : undefined;
+        if (OBJECT_VERBS.has(verb)) {
+            for (const kind of targets.kinds) {
+                if (RESOURCE_CATEGORIES.has(kind)) {
+                    return deny(`kubectl ${verb} on the resource category "${kind}" is never allowed for OneUptime AI: kubectl expands a category into every kind in it (api-extensions alone covers CRDs, APIServices and admission webhooks), so name the kind instead`, `${verb} ${kind}`);
+                }
+                // Deleting these is refused by NEVER_DELETE_KINDS, with its own reason.
+                if (verb === "delete") {
+                    continue;
+                }
+                if (RBAC_KINDS.has(kind)) {
+                    if (clusterRoleAggregationKey) {
+                        return deny(`kubectl ${verb} of ${clusterRoleAggregationKey} on a ClusterRole is never allowed for OneUptime AI: it merges the role's rules into admin/edit/view and so grants them to everyone bound to those, a privilege grant, not a fix`, `${verb} clusterrole`);
+                    }
+                    return deny(`kubectl ${verb} on ${kind} objects is never allowed for OneUptime AI: roles and role bindings decide who may do what in the cluster, and changing them is a privilege grant, not a fix (a human makes RBAC changes)`, `${verb} ${kind}`);
+                }
+                if (ADMISSION_AND_API_EXTENSION_KINDS.has(kind)) {
+                    return deny(`kubectl ${verb} on ${kind} objects is never allowed for OneUptime AI: admission webhooks and policies, APIServices and CRDs decide what the API server admits and serves for the whole cluster, and changing one can switch a cluster control off as surely as deleting it (a human makes that change)`, `${verb} ${kind}`);
+                }
+            }
+        }
+        // Pod Security Admission's namespace labels, whichever namespaces they reach.
+        if ((verb === "label" || verb === "annotate") &&
+            targets.kinds.has("namespace")) {
+            const podSecurityKey = labelKeys(verb, parsed.positionals).find(isPodSecurityKey);
+            if (podSecurityKey) {
+                return deny(`kubectl ${verb} of ${podSecurityKey} on a namespace is never allowed for OneUptime AI: pod-security.kubernetes.io keys are Pod Security Admission's controls, which decide whether privileged pods may run there`, `${verb} namespace`);
+            }
+        }
+        /*
+         * A write to Namespace objects must name each one. A selector, --all or
+         * a bare kind reaches Namespace objects the command never names —
+         * kube-system's among them — so the protected-namespace rule, which
+         * reads the names, could not see it (see the header). Deleting a
+         * Namespace is refused outright above (NEVER_DELETE_KINDS). Only the
+         * built-in Namespace kind counts (builtinKind()): a custom resource that
+         * borrows the name is judged by the namespace -n names.
+         */
+        if (verb !== "delete" &&
+            targets.rawKinds.some((rawKind) => {
+                return builtinKind(rawKind) === "namespace";
+            }) &&
+            (hasSelector || hasAll || targets.namedCount === 0)) {
+            return deny(`kubectl ${verb} of Namespace objects ${hasSelector || hasAll
+                ? "by a selector or --all"
+                : "without naming any"} is never allowed for OneUptime AI: it can change kube-system's Namespace object (or another protected one) without naming it, so name each Namespace object (namespace/NAME)`, `${verb} namespace`);
+        }
+        if (verb === "rollout") {
+            const rolloutVerb = `rollout ${subcommand}`;
+            if (subcommand !== "restart" &&
+                subcommand !== "undo" &&
+                subcommand !== "pause" &&
+                subcommand !== "resume") {
+                return deny(`kubectl rollout ${subcommand || "(missing subcommand)"} is not allowed`, rolloutVerb);
+            }
+            if (hasSelector || hasAll) {
+                return allowed(KubectlCommandTier.RiskyWrite, `kubectl ${rolloutVerb} with a selector or --all touches many workloads at once`, rolloutVerb);
+            }
+            if (targets.namedCount === 0) {
+                return allowed(KubectlCommandTier.RiskyWrite, `kubectl ${rolloutVerb} names no workload, and kubectl reads a bare kind as every ${kindList || "workload"} in the namespace (name one: TYPE/NAME)`, rolloutVerb);
+            }
+            if (!isOneNamedObject(targets)) {
+                return allowed(KubectlCommandTier.RiskyWrite, `kubectl ${rolloutVerb} names several workloads at once`, rolloutVerb);
+            }
+            if (!everyBuiltinKindIn(targets, ROLLOUT_SAFE_KINDS)) {
+                return allowed(KubectlCommandTier.RiskyWrite, `kubectl ${rolloutVerb} on ${writtenKindList} is not a Deployment, StatefulSet or DaemonSet rollout`, rolloutVerb);
+            }
+            return allowed(KubectlCommandTier.SafeWrite, `kubectl ${rolloutVerb} of one named workload is a controller-managed, reversible change`, rolloutVerb);
+        }
+        if (verb === "delete") {
+            if (hasAll) {
+                return deny("kubectl delete --all is not allowed", "delete");
+            }
+            if (parsed.positionals.length < 2) {
+                return deny("kubectl delete needs a resource kind and name", "delete");
+            }
+            for (const kind of targets.kinds) {
+                if (NEVER_DELETE_KINDS.has(kind)) {
+                    return deny(`deleting ${kind} objects is never allowed for OneUptime AI`, "delete " + kind);
+                }
+            }
+            const verbLabel = `delete ${kindList}`;
+            if (targets.namedCount === 0 && !hasSelector) {
+                return deny("kubectl delete needs the name of the object to delete (or a selector, which needs approval)", verbLabel);
+            }
+            if (!hasSelector &&
+                !hasForce &&
+                isOneNamedObject(targets) &&
+                everyBuiltinKindIn(targets, SAFE_DELETE_KINDS)) {
+                return allowed(KubectlCommandTier.SafeWrite, "deleting one named pod is a bounded change: its controller recreates it", verbLabel);
+            }
+            return allowed(KubectlCommandTier.RiskyWrite, hasForce
+                ? "force-deleting skips graceful termination"
+                : hasSelector
+                    ? "deleting by selector can remove many objects at once"
+                    : targets.namedCount > 1
+                        ? "deleting several objects at once"
+                        : targets.kinds.has("job")
+                            ? "a deleted Job is gone for good: no controller recreates it"
+                            : `deleting ${writtenKindList} objects changes what is deployed`, verbLabel);
+        }
+        if (verb === "scale") {
+            if (hasAll || hasSelector) {
+                return allowed(KubectlCommandTier.RiskyWrite, "kubectl scale with a selector or --all touches many objects at once", verb);
+            }
+            const replicas = parsed.flags.get("replicas") || [];
+            if (replicas.length === 0) {
+                return deny("kubectl scale needs --replicas", verb);
+            }
+            if (!isOneNamedObject(targets)) {
+                return allowed(KubectlCommandTier.RiskyWrite, "kubectl scale names several workloads (or none) at once", verb);
+            }
+            if (!everyBuiltinKindIn(targets, SCALE_SAFE_KINDS)) {
+                return allowed(KubectlCommandTier.RiskyWrite, `kubectl scale of ${writtenKindList} is not a safe change (only a Deployment, StatefulSet or ReplicaSet is)`, verb);
+            }
+            for (const value of replicas) {
+                const count = value.trim();
+                if (!REPLICA_COUNT_PATTERN.test(count)) {
+                    return allowed(KubectlCommandTier.RiskyWrite, `--replicas=${value} is not a replica count kubectl scale can apply safely`, verb);
+                }
+                if (parseInt(count, 10) === 0) {
+                    return allowed(KubectlCommandTier.RiskyWrite, "scaling to zero replicas stops the workload: an outage, not a reversible nudge", verb);
+                }
+            }
+            return allowed(KubectlCommandTier.SafeWrite, "kubectl scale of one named workload to a non-zero count is a reversible change", verb);
+        }
+        if (verb === "cordon" || verb === "uncordon") {
+            if (hasAll || hasSelector) {
+                return allowed(KubectlCommandTier.RiskyWrite, `kubectl ${verb} with a selector or --all touches many nodes at once`, verb);
+            }
+            const nodes = parsed.positionals.slice(1);
+            const node = nodes[0] || "";
+            const namesOneNode = nodes.length === 1 &&
+                (!node.includes("/") ||
+                    builtinKind(node.slice(0, node.indexOf("/"))) === "node");
+            if (!namesOneNode) {
+                return allowed(KubectlCommandTier.RiskyWrite, `kubectl ${verb} of anything but one named node touches several nodes (or none) at once`, verb);
+            }
+            return allowed(KubectlCommandTier.SafeWrite, `kubectl ${verb} of one node is a reversible change`, verb);
+        }
+        if (verb === "label" || verb === "annotate") {
+            const keys = labelKeys(verb, parsed.positionals);
+            if (hasAll || hasSelector) {
+                return allowed(KubectlCommandTier.RiskyWrite, `kubectl ${verb} with a selector or --all touches many objects at once`, verb);
+            }
+            if (!isOneNamedObject(targets)) {
+                return allowed(KubectlCommandTier.RiskyWrite, `kubectl ${verb} names several objects (or none) at once`, verb);
+            }
+            if (!everyBuiltinKindIn(targets, LABEL_SAFE_KINDS)) {
+                return allowed(KubectlCommandTier.RiskyWrite, `${verb === "label" ? "labels" : "annotations"} on ${writtenKindList} can steer admission, scheduling, identity or traffic (only a pod or workload is a safe target)`, verb);
+            }
+            const reservedKey = keys.find(isReservedKey);
+            if (reservedKey) {
+                return allowed(KubectlCommandTier.RiskyWrite, `${reservedKey} is a key Kubernetes or a cluster controller acts on, not a plain ${verb === "label" ? "label" : "annotation"}`, verb);
+            }
+            return allowed(KubectlCommandTier.SafeWrite, `kubectl ${verb} of one named pod or workload is a reversible change`, verb);
+        }
+        if (verb === "patch") {
+            const bodies = [
+                ...(parsed.flags.get("p") || []),
+                ...(parsed.flags.get("patch") || []),
+            ];
+            const patchTypes = readPatchTypes(parsed.flags.get("type") || []);
+            for (const body of bodies) {
+                const problem = findPatchBodyProblem(body, patchTypes);
+                if (problem) {
+                    return deny(problem, "patch");
+                }
+            }
+        }
+        if (RISKY_WRITE_VERBS.has(verb)) {
+            const verbLabel = verb === "set" || verb === "create" ? `${verb} ${subcommand}` : verb;
+            return allowed(KubectlCommandTier.RiskyWrite, `kubectl ${verbLabel} can change what is deployed or affect many pods, so a human must approve it`, verbLabel);
+        }
+        return deny(`kubectl ${verb} is not a command OneUptime AI may run (for a word it does not know, kubectl would look for a kubectl-${verb} plugin on the Runner and run it)`, verb);
+    }
+    /*
+     * The remediation verdict for one command under a cluster's settings.
+     * Read and SafeWrite auto-approve; RiskyWrite auto-approves only when the
+     * cluster bypasses approvals or the operator allowlisted its exact shape
+     * (matchesAllowlist: token by token, see the allowlist section in the
+     * header); Denied stays Denied; and a write in a protected namespace, a
+     * node drain, a taint and a patch of a Node always need a human. Suggest
+     * mode never consults this — everything there is RequiresApproval by
+     * construction.
+     */
+    static evaluateForAutoExecution(data) {
+        const result = KubectlPolicy.evaluateCommand(data.command);
+        if (result.tier === KubectlCommandTier.Denied) {
+            return {
+                verdict: AiRemediationCommandPolicyVerdict.Denied,
+                tier: result.tier,
+                reason: `Denied by the kubectl command policy: ${result.reason}. This command cannot run even with human approval.`,
+            };
+        }
+        if (result.tier === KubectlCommandTier.Read) {
+            return {
+                verdict: AiRemediationCommandPolicyVerdict.AutoApproved,
+                tier: result.tier,
+                reason: result.reason,
+            };
+        }
+        /*
+         * Before SafeWrite, bypass and the allowlist: nothing an operator set on
+         * the cluster lets OneUptime AI change kube-system on its own.
+         */
+        if (result.protectedNamespace) {
+            return {
+                verdict: AiRemediationCommandPolicyVerdict.RequiresApproval,
+                tier: result.tier,
+                reason: `Requires human approval: ${result.reason}. Neither bypassing approvals nor the cluster's allowlist applies in ${result.protectedNamespace}.`,
+                requiresHuman: true,
+            };
+        }
+        // Nor does anything let it drain, taint or patch a node on its own.
+        if (result.requiresHuman) {
+            return {
+                verdict: AiRemediationCommandPolicyVerdict.RequiresApproval,
+                tier: result.tier,
+                reason: `Requires human approval: ${result.reason}. Neither bypassing approvals nor the cluster's allowlist applies to a node drain or taint, or to a patch of a Node.`,
+                requiresHuman: true,
+            };
+        }
+        if (result.tier === KubectlCommandTier.SafeWrite) {
+            return {
+                verdict: AiRemediationCommandPolicyVerdict.AutoApproved,
+                tier: result.tier,
+                reason: result.reason,
+            };
+        }
+        if (data.bypassApproval === true) {
+            return {
+                verdict: AiRemediationCommandPolicyVerdict.AutoApproved,
+                tier: result.tier,
+                reason: `Riskier change (${result.reason}) allowed without approval: the cluster bypasses approvals.`,
+            };
+        }
+        if (KubectlPolicy.matchesAllowlist({
+            args: result.args,
+            allowlistPatterns: data.allowlistPatterns,
+        })) {
+            return {
+                verdict: AiRemediationCommandPolicyVerdict.AutoApproved,
+                tier: result.tier,
+                reason: "Matched the cluster's kubectl allowlist.",
+            };
+        }
+        return {
+            verdict: AiRemediationCommandPolicyVerdict.RequiresApproval,
+            tier: result.tier,
+            reason: `Requires human approval: ${result.reason}.`,
+        };
+    }
+    /*
+     * Whether a cluster allowlist pattern names this argv (without the
+     * leading "kubectl"), token by token — the semantics are spelled out in
+     * the allowlist section of the header. Tier-blind on purpose: callers
+     * (evaluateForAutoExecution) decide which tiers the allowlist may promote.
+     */
+    static matchesAllowlist(data) {
+        const args = (data.args || []).filter((arg) => {
+            return typeof arg === "string";
+        });
+        if (args.length === 0) {
+            return false;
+        }
+        const patterns = (data.allowlistPatterns || [])
+            .filter((pattern) => {
+            return typeof pattern === "string" && pattern.trim().length > 0;
+        })
+            .slice(0, MAX_ALLOWLIST_PATTERNS);
+        for (const pattern of patterns) {
+            /*
+             * An entry describeAllowlistPatternProblem refuses is skipped, so what
+             * the matcher reads and what the server and the AI page accept are
+             * one set — including an entry stored before a rule was added.
+             */
+            const patternArgs = KubectlPolicy.readAllowlistEntry(pattern).args;
+            if (!patternArgs || patternArgs.length !== args.length) {
+                continue;
+            }
+            const matches = patternArgs.every((patternToken, index) => {
+                return allowlistTokenMatches(patternToken, args[index]);
+            });
+            if (matches) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /*
+     * Why an allowlist entry cannot work, in words for the person typing it —
+     * or null when it is valid. This is the ONE definition of a valid entry
+     * (see the allowlist section of the header): the server validates saves
+     * with it, the AI page validates its form with it, and matchesAllowlist
+     * skips every entry it refuses, so no entry is stored that the matcher
+     * would silently ignore. (The entry count is checked by the callers
+     * against KUBECTL_ALLOWLIST_MAX_PATTERNS.)
+     */
+    static describeAllowlistPatternProblem(pattern) {
+        return KubectlPolicy.readAllowlistEntry(pattern).problem || null;
+    }
+    /*
+     * Does this allowlist entry pre-approve riskier changes beyond the objects
+     * it names? True when a `*` stands for the namespace, for an object the
+     * command acts on, or for a selector or --from source — see the allowlist
+     * section of the header. The AI page asks for an explicit confirmation
+     * before saving a broad entry.
+     *
+     * The entry is read with the policy's own tokenizer and flag parser, the
+     * way matchesAllowlist reads it (a leading "kubectl" is dropped once, in
+     * any case), so every spelling of -n (`-n *`, `-n=*`, `--namespace=*`, a
+     * cluster such as `-An *`) is seen, and a value flag's `*` (`-p *`,
+     * `--replicas *`) is never mistaken for an object. An invalid entry is
+     * never broad: it is refused before anyone could be asked to confirm it.
+     */
+    static isBroadAllowlistPattern(pattern) {
+        const entry = KubectlPolicy.readAllowlistEntry(pattern);
+        if (!entry.parsed) {
+            return false;
+        }
+        const parsed = entry.parsed;
+        const verb = parsed.positionals[0] || "";
+        const subcommand = parsed.positionals[1] || "";
+        /*
+         * Reads, drains, taints and patches of a Node are never promoted: the
+         * entry pre-approves nothing.
+         */
+        if (!allowlistMayPromote(parsed)) {
+            return false;
+        }
+        for (const flag of WIDENING_FLAGS) {
+            for (const value of parsed.flags.get(flag) || []) {
+                if (value.includes("*")) {
+                    return true;
+                }
+            }
+        }
+        // A wildcard in create's positionals names the NEW object, not an existing one.
+        if (verb === "create") {
+            return false;
+        }
+        let operands = parsed.positionals.slice(SUBCOMMAND_VERBS.has(verb) ? 2 : 1);
+        // kubectl set selector reads its LAST word as the selector expression.
+        if (verb === "set" && subcommand === "selector") {
+            operands = operands.slice(0, -1);
+        }
+        if (!readsUpdatePairs(verb, subcommand, parsed.flags)) {
+            return operands.some(hasWildcard);
+        }
+        /*
+         * label, annotate, set image and set env read their operands the way
+         * kubectl's GetResourcesAndPairs does: objects first, then the updates
+         * (KEY=VALUE or KEY-), and an object after an update is an error. So a
+         * wildcard can stand for an object only before the first update, and
+         * only when another word follows it: a wildcard that is the LAST word
+         * is read either as the update or as one more object with no update at
+         * all, which kubectl refuses ("at least one ... update is required").
+         */
+        for (let i = 0; i < operands.length; i++) {
+            const operand = operands[i];
+            if (isUpdatePairToken(operand)) {
+                return false;
+            }
+            if (hasWildcard(operand) && i < operands.length - 1) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /*
+     * An allowlist entry read the way matchesAllowlist reads it: its argv
+     * (the optional leading "kubectl" dropped by tokenize) and its parse when
+     * it is valid, or the problem that makes it invalid.
+     */
+    static readAllowlistEntry(pattern) {
+        if (typeof pattern !== "string" || pattern.trim().length === 0) {
+            return { problem: "An allowlist entry cannot be blank." };
+        }
+        if (pattern.length > MAX_ALLOWLIST_PATTERN_LENGTH) {
+            return {
+                problem: `An allowlist entry can be at most ${MAX_ALLOWLIST_PATTERN_LENGTH} characters long.`,
+            };
+        }
+        const shown = pattern.trim();
+        const namesNoCommand = `"${shown}" names no kubectl command: write out the command it pre-approves, such as "kubectl set image deployment/web * -n web".`;
+        const tokenized = KubectlPolicy.tokenize(pattern);
+        if (!tokenized.args) {
+            return {
+                problem: tokenized.errorMessage === NO_VERB_MESSAGE
+                    ? namesNoCommand
+                    : `"${shown}" cannot be read as one kubectl command: ${tokenized.errorMessage || "it could not be split into words."}`,
+            };
+        }
+        /*
+         * One word after the optional "kubectl" can only match a one-word
+         * command, and none is ever pre-approved: a read runs anyway, and every
+         * write verb needs an object (and a change) to act on, so kubectl
+         * refuses it bare. Quotes around a full command (a pasted JSON list, a
+         * quoted line) make it one word too.
+         */
+        const quotedWords = `"${shown}" has quotes around several words where the kubectl verb goes, so they are read as one word (as in a pasted JSON list, or a full command in quotes). Write each entry on its own line without quotes or brackets, such as kubectl set image deployment/web * -n web.`;
+        if (tokenized.args.length === 1) {
+            return {
+                problem: WHITESPACE_REGEX.test(tokenized.args[0])
+                    ? quotedWords
+                    : `"${shown}" is only one word after the optional "kubectl", so it could only match a one-word command, and a one-word command is never pre-approved (a read runs anyway; kubectl refuses a write verb with nothing to act on). Write out the full command it pre-approves, such as "kubectl set image deployment/web * -n web".`,
+            };
+        }
+        const parsed = KubectlPolicy.parseArgs(tokenized.args);
+        const verb = parsed.positionals[0];
+        if (verb === undefined) {
+            return { problem: namesNoCommand };
+        }
+        if (WHITESPACE_REGEX.test(verb)) {
+            return { problem: quotedWords };
+        }
+        if (hasWildcard(verb)) {
+            return {
+                problem: `"${shown}" has a * where the kubectl verb goes. A * stands for exactly one word, and the first word is the verb (the leading "kubectl" is optional and never needs a wildcard), so write the verb out, as in "kubectl set image deployment/web * -n web".`,
+            };
+        }
+        if (verb !== verb.toLowerCase()) {
+            return {
+                problem: `"${shown}" can never match a command that runs: kubectl matches commands case-sensitively, so "${verb}" is not kubectl ${verb.toLowerCase()} (write the verb in lowercase).`,
+            };
+        }
+        if (!isVerbOneUptimeAiMayRun(verb)) {
+            return {
+                problem: `"${shown}" can never match a command that runs: kubectl ${verb} is not a command OneUptime AI may run.`,
+            };
+        }
+        if (SUBCOMMAND_VERBS.has(verb)) {
+            const subcommand = parsed.positionals[1];
+            if (subcommand === undefined) {
+                if (SUBCOMMAND_REQUIRED_VERBS.has(verb)) {
+                    return {
+                        problem: `"${shown}" names no kubectl ${verb} subcommand: write it out${subcommandExample(verb)}.`,
+                    };
+                }
+            }
+            else if (hasWildcard(subcommand)) {
+                return {
+                    problem: `"${shown}" has a * where the kubectl ${verb} subcommand goes: a * stands for exactly one word, and the subcommand decides what kind of change runs, so write it out${subcommandExample(verb)}.`,
+                };
+            }
+            else if (subcommand !== subcommand.toLowerCase()) {
+                return {
+                    problem: `"${shown}" can never match a command that runs: kubectl matches commands case-sensitively, so "${subcommand}" is not the kubectl ${verb} ${subcommand.toLowerCase()} command (write the subcommand in lowercase).`,
+                };
+            }
+        }
+        if (parsed.violation) {
+            return {
+                problem: `"${shown}" can never match a command that runs: ${parsed.violation}.`,
+            };
+        }
+        /*
+         * Refused by evaluateArgs rather than by the parser (see
+         * OBJECT_OVERRIDE_FLAGS), so every command such an entry could match is
+         * Denied all the same.
+         */
+        const overrideFlag = OBJECT_OVERRIDE_FLAGS.find((flag) => {
+            return parsed.flags.has(flag);
+        });
+        if (overrideFlag !== undefined) {
+            return {
+                problem: `"${shown}" can never match a command that runs: the --${overrideFlag} flag is never allowed for OneUptime AI, because --overrides lets kubectl expose create an object of any kind, in any namespace, instead of the Service the command names.`,
+            };
+        }
+        return { args: tokenized.args, parsed };
+    }
+    static isReadOnly(command) {
+        return (KubectlPolicy.evaluateCommand(command).tier === KubectlCommandTier.Read);
+    }
+    /*
+     * Render an argv back to the one-line form humans read on approval cards
+     * and in the activity feed. Tokens that would not survive a shell split
+     * are single-quoted, so the rendering round-trips through tokenize().
+     */
+    static renderDisplayCommand(args) {
+        const rendered = ["kubectl"];
+        for (const arg of args) {
+            if (arg === "") {
+                rendered.push("''");
+            }
+            else if (SHELL_SAFE_TOKEN.test(arg)) {
+                rendered.push(arg);
+            }
+            else {
+                rendered.push(`'${arg.replace(/'/g, `'\\''`)}'`);
+            }
+        }
+        return rendered.join(" ");
+    }
+    /*
+     * What a flag name means here: its arity, and whether it may be used at
+     * all. `verb` is the first positional seen so far (undefined before it),
+     * for the few flags whose meaning depends on it.
+     */
+    static lookupFlag(name, verb) {
+        var _a;
+        const override = verb !== undefined
+            ? (_a = VERB_FLAG_OVERRIDE_ARITY.get(verb)) === null || _a === void 0 ? void 0 : _a.get(name)
+            : undefined;
+        if (override) {
+            return { arity: override };
+        }
+        const denyReason = DENIED_FLAG_REASONS.get(name);
+        if (denyReason) {
+            return {
+                arity: FlagArity.Boolean,
+                problem: `is not allowed: ${denyReason}`,
+            };
+        }
+        const arity = KNOWN_FLAG_ARITY.get(name);
+        if (arity) {
+            return { arity };
+        }
+        return {
+            arity: FlagArity.Boolean,
+            problem: "is not a kubectl flag OneUptime AI may use (an unknown flag could hide the verb or the resource behind its value, so it is refused rather than guessed)",
+        };
+    }
+    // Streaming flags may only ever be switched off explicitly.
+    static findStreamingFlag(flags) {
+        for (const name of STREAMING_FLAGS) {
+            const values = flags.get(name);
+            if (!values) {
+                continue;
+            }
+            for (const value of values) {
+                if (value !== "false") {
+                    const shown = name.length === 1 ? `-${name}` : `--${name}`;
+                    return `the ${shown} flag streams until kubectl is killed; OneUptime AI reads a bounded snapshot (${shown}=false is fine)`;
+                }
+            }
+        }
+        return null;
+    }
+    // Every -o/--output value must be an inline format kubectl prints itself.
+    static findOutputFormatProblem(flags) {
+        const values = [
+            ...(flags.get("o") || []),
+            ...(flags.get("output") || []),
+        ];
+        for (const value of values) {
+            const lower = value.toLowerCase();
+            const eq = lower.indexOf("=");
+            const format = eq >= 0 ? lower.slice(0, eq) : lower;
+            if (FILE_OUTPUT_FORMATS.has(format)) {
+                return `the output format "${value}" makes kubectl read a file on the Runner and echo it; write the template inline (-o jsonpath=..., -o go-template=..., -o custom-columns=...)`;
+            }
+            /*
+             * A template format without its template would take it from
+             * --template, which is Denied, so the bare form can never run.
+             */
+            if (OUTPUT_FORMATS_WITH_ARGUMENT.has(format)) {
+                if (eq < 0) {
+                    return `the output format "${value}" needs its template inline: -o ${format}=... (--template is not allowed)`;
+                }
+                continue;
+            }
+            if (eq >= 0 || !OUTPUT_FORMATS.has(format)) {
+                return `the output format "${value}" is not one OneUptime AI may use (json, yaml, name, wide, jsonpath=..., go-template=..., custom-columns=...)`;
+            }
+        }
+        return null;
+    }
+    /*
+     * Split an argv into positionals and flags exactly as pflag will (see the
+     * Flags section above). Never throws and never stops early: it records the
+     * first problem and keeps going, so the caller can still name the verb.
+     */
+    static parseArgs(args) {
+        const positionals = [];
+        const flags = new Map();
+        const problems = [];
+        let verb = undefined;
+        let subcommand = undefined;
+        let afterDoubleDash = false;
+        const record = (name, value) => {
+            const existing = flags.get(name) || [];
+            existing.push(value);
+            flags.set(name, existing);
+        };
+        /*
+         * True once the positionals name the command kubectl will run: the verb,
+         * plus its subcommand for SUBCOMMAND_VERBS. Until then only GLOBAL_FLAGS
+         * may appear (see the Flags section: kubectl picks the command first and
+         * would take the word after any other flag as that flag's value).
+         */
+        const commandFound = () => {
+            return (verb !== undefined &&
+                (!SUBCOMMAND_VERBS.has(verb) || subcommand !== undefined));
+        };
+        const orderingProblem = (name, shown) => {
+            if (commandFound() || GLOBAL_FLAGS.has(name)) {
+                return null;
+            }
+            const after = verb === undefined ? "the verb" : `the kubectl ${verb} subcommand`;
+            return `the ${shown} flag must come after ${after}: kubectl picks the command before it parses flags and would take the word after this flag as its value`;
+        };
+        for (let i = 0; i < args.length; i++) {
+            const token = args[i];
+            if (afterDoubleDash || !token.startsWith("-") || token === "-") {
+                positionals.push(token);
+                if (verb === undefined) {
+                    verb = token.toLowerCase();
+                }
+                else if (subcommand === undefined) {
+                    subcommand = token.toLowerCase();
+                }
+                continue;
+            }
+            if (token === "--") {
+                if (!commandFound()) {
+                    problems.push(`"--" must come after the verb`);
+                }
+                afterDoubleDash = true;
+                continue;
+            }
+            if (token.startsWith("--")) {
+                const eq = token.indexOf("=");
+                const rawName = eq >= 0 ? token.slice(2, eq) : token.slice(2);
+                const name = normalizeKubectlFlagName(rawName);
+                if (!name || name.startsWith("-")) {
+                    problems.push(`"${token}" is not valid flag syntax`);
+                    continue;
+                }
+                const rule = KubectlPolicy.lookupFlag(name, verb);
+                const ordering = orderingProblem(name, `--${rawName}`);
+                if (rule.problem) {
+                    problems.push(`the --${rawName} flag ${rule.problem}`);
+                }
+                else if (ordering) {
+                    problems.push(ordering);
+                }
+                if (eq >= 0) {
+                    record(name, token.slice(eq + 1));
+                }
+                else if (rule.arity === FlagArity.Value && i + 1 < args.length) {
+                    record(name, args[i + 1]);
+                    i++;
+                }
+                else {
+                    record(name, "");
+                }
+                continue;
+            }
+            // "-abc": a cluster of short flags, read letter by letter like pflag.
+            let rest = token.slice(1);
+            while (rest.length > 0) {
+                const letter = rest.charAt(0);
+                const rule = KubectlPolicy.lookupFlag(letter, verb);
+                const where = token === `-${letter}` || token.startsWith(`-${letter}=`)
+                    ? ""
+                    : ` (in "${token}")`;
+                const ordering = orderingProblem(letter, `-${letter}${where}`);
+                if (rule.problem) {
+                    problems.push(`the -${letter} flag${where} ${rule.problem}`);
+                }
+                else if (ordering) {
+                    problems.push(ordering);
+                }
+                // "-n=web"
+                if (rest.charAt(1) === "=") {
+                    record(letter, rest.slice(2));
+                    break;
+                }
+                // A boolean (or optional-value) letter: the next letter is another flag.
+                if (rule.arity !== FlagArity.Value) {
+                    record(letter, "");
+                    rest = rest.slice(1);
+                    continue;
+                }
+                // "-nweb"
+                if (rest.length > 1) {
+                    record(letter, rest.slice(1));
+                    break;
+                }
+                // "-n web"
+                if (i + 1 < args.length) {
+                    record(letter, args[i + 1]);
+                    i++;
+                }
+                else {
+                    record(letter, "");
+                }
+                break;
+            }
+        }
+        return { positionals, flags, violation: problems[0] };
+    }
+}
+//# sourceMappingURL=KubectlPolicy.js.map