@paperclipai/plugin-kubernetes 0.1.0 → 2026.620.0-canary.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Paperclip AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/adapter-defaults.d.ts

@@ -0,0 +1,29 @@
+import type { AdapterRegistryEntry } from "./adapter-registry.js";
+export interface AdapterDefaults {
+    runtimeImage: string;
+    envKeys: string[];
+    allowFqdns: string[];
+    probeCommand: string[];
+    /** Non-secret env injected as the base layer for the Job (process-env wins on top). */
+    defaultEnv?: Record<string, string>;
+}
+export declare const KNOWN_ADAPTER_TYPES: ReadonlySet<string>;
+/**
+ * Resolve the runtime defaults for an adapter. When a `registry` is supplied it
+ * is authoritative (replace semantics): the type MUST be present and complete,
+ * else this throws. With no registry, falls back to the built-in REGISTRY.
+ */
+export declare function getAdapterDefaults(adapterType: string, registry?: readonly AdapterRegistryEntry[]): AdapterDefaults;
+/**
+ * Resolve the adapter type for a single run: prefer the run's adapter (the agent's,
+ * from the lease params) so one environment can serve mixed harnesses; fall back to
+ * the environment's configured default adapter when the run does not specify one.
+ */
+export declare function resolveRunAdapterType(runAdapterType: string | null | undefined, configAdapterType: string): string;
+/**
+ * Build the per-run env for the Job: the non-secret `defaultEnv` is the base
+ * and the process-env values (the secret API keys named by `envKeys`) override
+ * it. Pure for testability.
+ */
+export declare function buildAdapterEnv(defaults: AdapterDefaults, processEnv?: NodeJS.ProcessEnv): Record<string, string>;
+//# sourceMappingURL=adapter-defaults.d.ts.map

package/dist/adapter-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-defaults.d.ts","sourceRoot":"","sources":["../src/adapter-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AA+CD,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAkC,CAAC;AAqBvF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,GACzC,eAAe,CAajB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACzC,iBAAiB,EAAE,MAAM,GACxB,MAAM,CAGR;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,UAAU,GAAE,MAAM,CAAC,UAAwB,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB"}

package/dist/adapter-defaults.js

@@ -0,0 +1,104 @@
+const REGISTRY = {
+    claude_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-claude:v1",
+        envKeys: ["ANTHROPIC_API_KEY"],
+        allowFqdns: ["api.anthropic.com"],
+        probeCommand: ["claude", "--version"],
+    },
+    codex_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-codex:v1",
+        envKeys: ["OPENAI_API_KEY"],
+        allowFqdns: ["api.openai.com"],
+        probeCommand: ["codex", "--version"],
+    },
+    gemini_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-gemini:v1",
+        envKeys: ["GOOGLE_API_KEY", "GEMINI_API_KEY"],
+        allowFqdns: ["generativelanguage.googleapis.com"],
+        probeCommand: ["gemini", "--version"],
+    },
+    cursor_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-cursor:v1",
+        envKeys: ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"],
+        allowFqdns: ["api.anthropic.com", "api.openai.com"],
+        probeCommand: ["cursor-agent", "--version"],
+    },
+    opencode_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-opencode:v1",
+        envKeys: ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "OPENROUTER_API_KEY"],
+        allowFqdns: ["api.anthropic.com", "api.openai.com", "openrouter.ai"],
+        probeCommand: ["opencode", "--version"],
+    },
+    acpx_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-acpx:v1",
+        envKeys: ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"],
+        allowFqdns: ["api.anthropic.com", "api.openai.com"],
+        probeCommand: ["acpx", "--version"],
+    },
+    pi_local: {
+        runtimeImage: "ghcr.io/paperclipai/agent-runtime-pi:v1",
+        envKeys: ["ANTHROPIC_API_KEY"],
+        allowFqdns: ["api.anthropic.com"],
+        probeCommand: ["pi", "--version"],
+    },
+};
+export const KNOWN_ADAPTER_TYPES = new Set(Object.keys(REGISTRY));
+function fromRegistryEntry(entry) {
+    // Only runtimeImage is strictly required. The array fields are optional and
+    // default to []: the operator emits them with `omitempty`, so a genuinely
+    // empty allowFqdns/envKeys/probeCommand arrives as undefined, which is valid
+    // (no extra egress / no forwarded secrets / no probe), NOT an error.
+    if (!entry.runtimeImage) {
+        throw new Error(`Adapter "${entry.adapterType}" is missing required runtime field: runtimeImage`);
+    }
+    return {
+        runtimeImage: entry.runtimeImage,
+        envKeys: entry.envKeys ?? [],
+        allowFqdns: entry.allowFqdns ?? [],
+        probeCommand: entry.probeCommand ?? [],
+        defaultEnv: entry.defaultEnv,
+    };
+}
+/**
+ * Resolve the runtime defaults for an adapter. When a `registry` is supplied it
+ * is authoritative (replace semantics): the type MUST be present and complete,
+ * else this throws. With no registry, falls back to the built-in REGISTRY.
+ */
+export function getAdapterDefaults(adapterType, registry) {
+    if (registry && registry.length > 0) {
+        const entry = registry.find((e) => e.adapterType === adapterType);
+        if (!entry) {
+            throw new Error(`Adapter "${adapterType}" is not in the configured adapter registry`);
+        }
+        return fromRegistryEntry(entry);
+    }
+    const defaults = REGISTRY[adapterType];
+    if (!defaults) {
+        throw new Error(`Unknown adapter type: ${adapterType}`);
+    }
+    return defaults;
+}
+/**
+ * Resolve the adapter type for a single run: prefer the run's adapter (the agent's,
+ * from the lease params) so one environment can serve mixed harnesses; fall back to
+ * the environment's configured default adapter when the run does not specify one.
+ */
+export function resolveRunAdapterType(runAdapterType, configAdapterType) {
+    const trimmed = typeof runAdapterType === "string" ? runAdapterType.trim() : "";
+    return trimmed.length > 0 ? trimmed : configAdapterType;
+}
+/**
+ * Build the per-run env for the Job: the non-secret `defaultEnv` is the base
+ * and the process-env values (the secret API keys named by `envKeys`) override
+ * it. Pure for testability.
+ */
+export function buildAdapterEnv(defaults, processEnv = process.env) {
+    const out = { ...(defaults.defaultEnv ?? {}) };
+    for (const k of defaults.envKeys) {
+        const v = processEnv[k];
+        if (v)
+            out[k] = v;
+    }
+    return out;
+}
+//# sourceMappingURL=adapter-defaults.js.map

package/dist/adapter-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-defaults.js","sourceRoot":"","sources":["../src/adapter-defaults.ts"],"names":[],"mappings":"AAWA,MAAM,QAAQ,GAAoC;IAChD,YAAY,EAAE;QACZ,YAAY,EAAE,6CAA6C;QAC3D,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,UAAU,EAAE,CAAC,mBAAmB,CAAC;QACjC,YAAY,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;KACtC;IACD,WAAW,EAAE;QACX,YAAY,EAAE,4CAA4C;QAC1D,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;KACrC;IACD,YAAY,EAAE;QACZ,YAAY,EAAE,6CAA6C;QAC3D,OAAO,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QAC7C,UAAU,EAAE,CAAC,mCAAmC,CAAC;QACjD,YAAY,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;KACtC;IACD,YAAY,EAAE;QACZ,YAAY,EAAE,6CAA6C;QAC3D,OAAO,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QAChD,UAAU,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QACnD,YAAY,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC;KAC5C;IACD,cAAc,EAAE;QACd,YAAY,EAAE,+CAA+C;QAC7D,OAAO,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,CAAC;QACtE,UAAU,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,CAAC;QACpE,YAAY,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;KACxC;IACD,UAAU,EAAE;QACV,YAAY,EAAE,2CAA2C;QACzD,OAAO,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QAChD,UAAU,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QACnD,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;KACpC;IACD,QAAQ,EAAE;QACR,YAAY,EAAE,yCAAyC;QACvD,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,UAAU,EAAE,CAAC,mBAAmB,CAAC;QACjC,YAAY,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;KAClC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEvF,SAAS,iBAAiB,CAAC,KAA2B;IACpD,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,YAAY,KAAK,CAAC,WAAW,mDAAmD,CACjF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,QAA0C;IAE1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,YAAY,WAAW,6CAA6C,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,cAAyC,EACzC,iBAAyB;IAEzB,MAAM,OAAO,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAyB,EACzB,aAAgC,OAAO,CAAC,GAAG;IAE3C,MAAM,GAAG,GAA2B,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/adapter-registry.d.ts

@@ -0,0 +1,64 @@
+import { z } from "zod";
+/**
+ * One declarative agent-harness ("adapter") entry. Governs picker availability
+ * and, for sandboxed (Kubernetes) runs, the runtime wiring.
+ *
+ * NOTE: this shape is intentionally duplicated across the package boundary. It
+ * MUST stay structurally in sync with:
+ *   - server `@paperclipai/shared` `adapterRegistryEntrySchema` (the parser side)
+ *   - operator `AdapterRegistryEntry` Go struct (PAPERCLIP_ADAPTERS emitter)
+ * The duplication is deliberate: this plugin is standalone-installable and must
+ * not pull in heavy workspace packages at runtime.
+ */
+export declare const adapterRegistryEntrySchema: z.ZodObject<{
+    adapterType: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    runtimeImage: z.ZodOptional<z.ZodString>;
+    envKeys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    allowFqdns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    probeCommand: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    defaultEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strict", z.ZodTypeAny, {
+    adapterType: string;
+    enabled: boolean;
+    runtimeImage?: string | undefined;
+    envKeys?: string[] | undefined;
+    allowFqdns?: string[] | undefined;
+    probeCommand?: string[] | undefined;
+    defaultEnv?: Record<string, string> | undefined;
+}, {
+    adapterType: string;
+    enabled?: boolean | undefined;
+    runtimeImage?: string | undefined;
+    envKeys?: string[] | undefined;
+    allowFqdns?: string[] | undefined;
+    probeCommand?: string[] | undefined;
+    defaultEnv?: Record<string, string> | undefined;
+}>;
+export declare const adapterRegistrySchema: z.ZodArray<z.ZodObject<{
+    adapterType: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    runtimeImage: z.ZodOptional<z.ZodString>;
+    envKeys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    allowFqdns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    probeCommand: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    defaultEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strict", z.ZodTypeAny, {
+    adapterType: string;
+    enabled: boolean;
+    runtimeImage?: string | undefined;
+    envKeys?: string[] | undefined;
+    allowFqdns?: string[] | undefined;
+    probeCommand?: string[] | undefined;
+    defaultEnv?: Record<string, string> | undefined;
+}, {
+    adapterType: string;
+    enabled?: boolean | undefined;
+    runtimeImage?: string | undefined;
+    envKeys?: string[] | undefined;
+    allowFqdns?: string[] | undefined;
+    probeCommand?: string[] | undefined;
+    defaultEnv?: Record<string, string> | undefined;
+}>, "many">;
+export type AdapterRegistryEntry = z.infer<typeof adapterRegistryEntrySchema>;
+//# sourceMappingURL=adapter-registry.d.ts.map

package/dist/adapter-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-registry.d.ts","sourceRoot":"","sources":["../src/adapter-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;EAU5B,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;WAAsC,CAAC;AAEzE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/adapter-registry.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+/**
+ * One declarative agent-harness ("adapter") entry. Governs picker availability
+ * and, for sandboxed (Kubernetes) runs, the runtime wiring.
+ *
+ * NOTE: this shape is intentionally duplicated across the package boundary. It
+ * MUST stay structurally in sync with:
+ *   - server `@paperclipai/shared` `adapterRegistryEntrySchema` (the parser side)
+ *   - operator `AdapterRegistryEntry` Go struct (PAPERCLIP_ADAPTERS emitter)
+ * The duplication is deliberate: this plugin is standalone-installable and must
+ * not pull in heavy workspace packages at runtime.
+ */
+export const adapterRegistryEntrySchema = z
+    .object({
+    adapterType: z.string().min(1),
+    enabled: z.boolean().default(true),
+    runtimeImage: z.string().optional(),
+    envKeys: z.array(z.string()).optional(),
+    allowFqdns: z.array(z.string()).optional(),
+    probeCommand: z.array(z.string()).optional(),
+    defaultEnv: z.record(z.string()).optional(),
+})
+    .strict();
+export const adapterRegistrySchema = z.array(adapterRegistryEntrySchema);
+//# sourceMappingURL=adapter-registry.js.map

package/dist/adapter-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-registry.js","sourceRoot":"","sources":["../src/adapter-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC"}

package/dist/cilium-network-policy.d.ts

@@ -0,0 +1,8 @@
+export interface BuildCiliumNetworkPolicyInput {
+    namespace: string;
+    paperclipServerNamespace: string;
+    egressAllowFqdns: string[];
+    egressAllowCidrs: string[];
+}
+export declare function buildCiliumNetworkPolicyManifest(input: BuildCiliumNetworkPolicyInput): Record<string, unknown>;
+//# sourceMappingURL=cilium-network-policy.d.ts.map

package/dist/cilium-network-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cilium-network-policy.d.ts","sourceRoot":"","sources":["../src/cilium-network-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,MAAM,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAMD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwD9G"}

package/dist/cilium-network-policy.js

@@ -0,0 +1,57 @@
+// Design note: no ingress rules are defined here. Paperclip-server does NOT
+// push to agent pods — agents make outbound (egress) callbacks to
+// paperclip-server on port 3100. If server→agent push is ever needed, add a
+// targeted ingress rule scoped to the paperclip-server endpoint selector.
+export function buildCiliumNetworkPolicyManifest(input) {
+    const egress = [];
+    egress.push({
+        toEndpoints: [
+            { matchLabels: { "k8s:io.kubernetes.pod.namespace": "kube-system", "k8s-app": "kube-dns" } },
+        ],
+        toPorts: [
+            {
+                ports: [
+                    { port: "53", protocol: "UDP" },
+                    { port: "53", protocol: "TCP" },
+                ],
+                rules: { dns: [{ matchPattern: "*" }] },
+            },
+        ],
+    });
+    if (input.egressAllowFqdns.length > 0) {
+        egress.push({
+            toFQDNs: input.egressAllowFqdns.map((fqdn) => ({ matchName: fqdn })),
+            toPorts: [{ ports: [{ port: "443", protocol: "TCP" }] }],
+        });
+    }
+    egress.push({
+        toEndpoints: [
+            {
+                matchLabels: {
+                    "k8s:io.kubernetes.pod.namespace": input.paperclipServerNamespace,
+                    app: "paperclip-server",
+                },
+            },
+        ],
+        toPorts: [{ ports: [{ port: "3100", protocol: "TCP" }] }],
+    });
+    if (input.egressAllowCidrs.length > 0) {
+        egress.push({
+            toCIDRSet: input.egressAllowCidrs.map((cidr) => ({ cidr })),
+        });
+    }
+    return {
+        apiVersion: "cilium.io/v2",
+        kind: "CiliumNetworkPolicy",
+        metadata: {
+            name: "paperclip-egress-fqdn",
+            namespace: input.namespace,
+            labels: { "paperclip.io/managed-by": "paperclip-k8s-plugin" },
+        },
+        spec: {
+            endpointSelector: { matchLabels: { "paperclip.io/role": "agent" } },
+            egress,
+        },
+    };
+}
+//# sourceMappingURL=cilium-network-policy.js.map

package/dist/cilium-network-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cilium-network-policy.js","sourceRoot":"","sources":["../src/cilium-network-policy.ts"],"names":[],"mappings":"AAOA,4EAA4E;AAC5E,kEAAkE;AAClE,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,UAAU,gCAAgC,CAAC,KAAoC;IACnF,MAAM,MAAM,GAA8B,EAAE,CAAC;IAE7C,MAAM,CAAC,IAAI,CAAC;QACV,WAAW,EAAE;YACX,EAAE,WAAW,EAAE,EAAE,iCAAiC,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;SAC7F;QACD,OAAO,EAAE;YACP;gBACE,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC/B,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;iBAChC;gBACD,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;aACxC;SACF;KACF,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC;QACV,WAAW,EAAE;YACX;gBACE,WAAW,EAAE;oBACX,iCAAiC,EAAE,KAAK,CAAC,wBAAwB;oBACjE,GAAG,EAAE,kBAAkB;iBACxB;aACF;SACF;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC;YACV,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,UAAU,EAAE,cAAc;QAC1B,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE;YACR,IAAI,EAAE,uBAAuB;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,EAAE,yBAAyB,EAAE,sBAAsB,EAAE;SAC9D;QACD,IAAI,EAAE;YACJ,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE;YACnE,MAAM;SACP;KACF,CAAC;AACJ,CAAC"}

package/dist/image-allowlist.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Glob matching for image references.
+ * - `*` matches any sequence of characters EXCEPT `/` (so a wildcard doesn't span path segments)
+ * - `?` matches exactly one character (excluding `/`)
+ */
+export declare function globMatch(pattern: string, value: string): boolean;
+export interface ResolveImageInput {
+    imageOverride?: string | null;
+}
+export interface ResolveImageDefaults {
+    runtimeImage: string;
+}
+export interface ResolveImageConfig {
+    imageAllowList: string[];
+    imageRegistry?: string;
+}
+export declare function resolveImage(target: ResolveImageInput, defaults: ResolveImageDefaults, config: ResolveImageConfig): string;
+//# sourceMappingURL=image-allowlist.d.ts.map

package/dist/image-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-allowlist.d.ts","sourceRoot":"","sources":["../src/image-allowlist.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAUjE;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,iBAAiB,EACzB,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAWR"}

package/dist/image-allowlist.js

@@ -0,0 +1,39 @@
+/**
+ * Glob matching for image references.
+ * - `*` matches any sequence of characters EXCEPT `/` (so a wildcard doesn't span path segments)
+ * - `?` matches exactly one character (excluding `/`)
+ */
+export function globMatch(pattern, value) {
+    const re = new RegExp("^" +
+        pattern
+            .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+            .replace(/\*/g, "[^/]*")
+            .replace(/\?/g, "[^/]") +
+        "$");
+    return re.test(value);
+}
+export function resolveImage(target, defaults, config) {
+    if (target.imageOverride) {
+        if (!config.imageAllowList.some((p) => globMatch(p, target.imageOverride))) {
+            throw new Error(`Image override "${target.imageOverride}" is not in allowlist`);
+        }
+        return target.imageOverride;
+    }
+    if (config.imageRegistry) {
+        return rewriteRegistry(defaults.runtimeImage, config.imageRegistry);
+    }
+    return defaults.runtimeImage;
+}
+function rewriteRegistry(image, registry) {
+    // image is like "ghcr.io/paperclipai/agent-runtime-claude:v1"
+    // we want to replace the first two path segments (host + org) with `registry`
+    const cleanRegistry = registry.replace(/\/+$/, "");
+    const colonIdx = image.lastIndexOf(":");
+    const tag = colonIdx >= 0 ? image.slice(colonIdx) : "";
+    const path = colonIdx >= 0 ? image.slice(0, colonIdx) : image;
+    const segments = path.split("/");
+    // Strip the host+org (first two segments), keep the image name
+    const imageName = segments.slice(2).join("/") || segments[segments.length - 1];
+    return `${cleanRegistry}/${imageName}${tag}`;
+}
+//# sourceMappingURL=image-allowlist.js.map

package/dist/image-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-allowlist.js","sourceRoot":"","sources":["../src/image-allowlist.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,KAAa;IACtD,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,GAAG;QACD,OAAO;aACJ,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;aACpC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;aACvB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QACzB,GAAG,CACN,CAAC;IACF,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAeD,MAAM,UAAU,YAAY,CAC1B,MAAyB,EACzB,QAA8B,EAC9B,MAA0B;IAE1B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,aAAc,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,aAAa,uBAAuB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,MAAM,CAAC,aAAa,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,eAAe,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,QAAQ,CAAC,YAAY,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,QAAgB;IACtD,8DAA8D;IAC9D,8EAA8E;IAC9E,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,+DAA+D;IAC/D,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/E,OAAO,GAAG,aAAa,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;AAC/C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { default as manifest } from "./manifest.js";
+export { default as plugin } from "./plugin.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { default as manifest } from "./manifest.js";
+export { default as plugin } from "./plugin.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/job-orchestrator.d.ts

@@ -0,0 +1,24 @@
+import type { KubeClients } from "./kube-client.js";
+import type { SandboxOrchestrator, SandboxStatus } from "./sandbox-orchestrator.js";
+export declare class JobTimeoutError extends Error {
+    constructor(namespace: string, name: string, timeoutMs: number);
+}
+export declare function createJob(clients: KubeClients, namespace: string, manifest: Record<string, unknown>): Promise<{
+    uid: string;
+}>;
+export type JobStatus = SandboxStatus;
+export declare function getJobStatus(clients: KubeClients, namespace: string, name: string): Promise<JobStatus>;
+export declare function findPodForJob(clients: KubeClients, namespace: string, jobName: string): Promise<string | null>;
+export declare function streamPodLogs(clients: KubeClients, namespace: string, podName: string, onChunk: (stream: "stdout" | "stderr", text: string) => Promise<void>): Promise<void>;
+export declare function deleteJob(clients: KubeClients, namespace: string, name: string): Promise<void>;
+export declare function waitForJobCompletion(clients: KubeClients, namespace: string, name: string, opts?: {
+    timeoutMs: number;
+    pollMs?: number;
+}): Promise<JobStatus>;
+/**
+ * Job-backed conformance to SandboxOrchestrator. Plugin.ts imports THIS value
+ * (the swap point) — to use a different backend, swap this import for another
+ * module exposing a SandboxOrchestrator-shaped default export.
+ */
+export declare const jobOrchestrator: SandboxOrchestrator;
+//# sourceMappingURL=job-orchestrator.d.ts.map

package/dist/job-orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-orchestrator.d.ts","sourceRoot":"","sources":["../src/job-orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAEpF,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAI/D;AAED,wBAAsB,SAAS,CAC7B,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAK1B;AAED,MAAM,MAAM,SAAS,GAAG,aAAa,CAAC;AAEtC,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,SAAS,CAAC,CAoBpB;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACpE,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,SAAS,CAC7B,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAyC,GAClF,OAAO,CAAC,SAAS,CAAC,CASpB;AAMD;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,mBAO7B,CAAC"}

package/dist/job-orchestrator.js

@@ -0,0 +1,90 @@
+export class JobTimeoutError extends Error {
+    constructor(namespace, name, timeoutMs) {
+        super(`Job ${namespace}/${name} did not complete within ${timeoutMs}ms`);
+        this.name = "JobTimeoutError";
+    }
+}
+export async function createJob(clients, namespace, manifest) {
+    const result = await clients.batch.createNamespacedJob({ namespace, body: manifest });
+    const uid = result.metadata?.uid;
+    if (!uid)
+        throw new Error("Job created without a UID");
+    return { uid };
+}
+export async function getJobStatus(clients, namespace, name) {
+    const result = await clients.batch.readNamespacedJobStatus({ namespace, name });
+    const body = result ?? {};
+    const status = body.status ?? {};
+    const active = status.active ?? 0;
+    const succeeded = status.succeeded ?? 0;
+    const failed = status.failed ?? 0;
+    const conditions = status.conditions ?? [];
+    const completed = conditions.find((c) => c.type === "Complete" && c.status === "True");
+    const failedCond = conditions.find((c) => c.type === "Failed" && c.status === "True");
+    if (failedCond || failed > 0) {
+        return { phase: "Failed", complete: false, active, succeeded, failed, reason: failedCond?.reason, message: failedCond?.message };
+    }
+    if (completed || succeeded > 0) {
+        return { phase: "Succeeded", complete: true, active, succeeded, failed };
+    }
+    if (active > 0) {
+        return { phase: "Running", complete: false, active, succeeded, failed };
+    }
+    return { phase: "Pending", complete: false, active, succeeded, failed };
+}
+export async function findPodForJob(clients, namespace, jobName) {
+    const result = await clients.core.listNamespacedPod({
+        namespace,
+        labelSelector: `job-name=${jobName}`,
+    });
+    const items = (result.items) ?? [];
+    const running = items.find((p) => p.status?.phase === "Running");
+    return (running ?? items[0])?.metadata?.name ?? null;
+}
+export async function streamPodLogs(clients, namespace, podName, onChunk) {
+    // V1 limitation: readNamespacedPodLog returns combined stdout (the kubectl-style
+    // log view). stderr is not separately exposed via this API path — agent
+    // containers that need stderr/stdout separation should use a sidecar log
+    // scraper or wrap their CLI to emit structured output on stdout. We always
+    // emit chunks as "stdout"; the "stderr" callback slot in SandboxOrchestrator
+    // is unused by the Job-backed implementation.
+    const result = await clients.core.readNamespacedPodLog({ namespace, name: podName });
+    const text = result ?? "";
+    if (text.length > 0)
+        await onChunk("stdout", text);
+}
+export async function deleteJob(clients, namespace, name) {
+    await clients.batch.deleteNamespacedJob({
+        namespace,
+        name,
+        propagationPolicy: "Foreground",
+    });
+}
+export async function waitForJobCompletion(clients, namespace, name, opts = { timeoutMs: 120_000, pollMs: 2000 }) {
+    const deadline = Date.now() + opts.timeoutMs;
+    const pollMs = opts.pollMs ?? 2000;
+    while (Date.now() < deadline) {
+        const status = await getJobStatus(clients, namespace, name);
+        if (status.phase === "Succeeded" || status.phase === "Failed")
+            return status;
+        await sleep(pollMs);
+    }
+    throw new JobTimeoutError(namespace, name, opts.timeoutMs);
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Job-backed conformance to SandboxOrchestrator. Plugin.ts imports THIS value
+ * (the swap point) — to use a different backend, swap this import for another
+ * module exposing a SandboxOrchestrator-shaped default export.
+ */
+export const jobOrchestrator = {
+    claim: createJob,
+    getStatus: getJobStatus,
+    findPod: findPodForJob,
+    streamLogs: streamPodLogs,
+    release: deleteJob,
+    waitForCompletion: waitForJobCompletion,
+};
+//# sourceMappingURL=job-orchestrator.js.map

package/dist/job-orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-orchestrator.js","sourceRoot":"","sources":["../src/job-orchestrator.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,SAAiB,EAAE,IAAY,EAAE,SAAiB;QAC5D,KAAK,CAAC,OAAO,SAAS,IAAI,IAAI,4BAA4B,SAAS,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAoB,EACpB,SAAiB,EACjB,QAAiC;IAEjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAI,MAA0C,CAAC,QAAQ,EAAE,GAAG,CAAC;IACtE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACvD,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAoB,EACpB,SAAiB,EACjB,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,GAAI,MAAkC,IAAI,EAAE,CAAC;IACvD,MAAM,MAAM,GAAI,IAAI,CAAC,MAAkC,IAAI,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAI,MAAM,CAAC,MAAiB,IAAI,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAI,MAAM,CAAC,SAAoB,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAI,MAAM,CAAC,MAAiB,IAAI,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAI,MAAM,CAAC,UAAoF,IAAI,EAAE,CAAC;IACtH,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACtF,IAAI,UAAU,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACnI,CAAC;IACD,IAAI,SAAS,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAoB,EACpB,SAAiB,EACjB,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,SAAS;QACT,aAAa,EAAE,YAAY,OAAO,EAAE;KACrC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAE,MAAsF,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpH,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC;IACjE,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,OAAqE;IAErE,iFAAiF;IACjF,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAI,MAAiB,IAAI,EAAE,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAoB,EACpB,SAAiB,EACjB,IAAY;IAEZ,MAAM,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACtC,SAAS;QACT,IAAI;QACJ,iBAAiB,EAAE,YAAY;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoB,EACpB,SAAiB,EACjB,IAAY,EACZ,OAA+C,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;IAEnF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QAC7E,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAwB;IAClD,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE,YAAY;IACvB,OAAO,EAAE,aAAa;IACtB,UAAU,EAAE,aAAa;IACzB,OAAO,EAAE,SAAS;IAClB,iBAAiB,EAAE,oBAAoB;CACxC,CAAC"}

package/dist/kube-client.d.ts

@@ -0,0 +1,15 @@
+import { KubeConfig, CoreV1Api, BatchV1Api, CustomObjectsApi, NetworkingV1Api, RbacAuthorizationV1Api } from "@kubernetes/client-node";
+export interface CreateKubeConfigInput {
+    inCluster?: boolean;
+    kubeconfig?: string;
+}
+export declare function createKubeConfig(input: CreateKubeConfigInput): KubeConfig;
+export interface KubeClients {
+    core: CoreV1Api;
+    batch: BatchV1Api;
+    custom: CustomObjectsApi;
+    networking: NetworkingV1Api;
+    rbac: RbacAuthorizationV1Api;
+}
+export declare function makeKubeClients(kc: KubeConfig): KubeClients;
+//# sourceMappingURL=kube-client.d.ts.map

package/dist/kube-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kube-client.d.ts","sourceRoot":"","sources":["../src/kube-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU,CAWzE;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,sBAAsB,CAAC;CAC9B;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,UAAU,GAAG,WAAW,CAQ3D"}

package/dist/kube-client.js

@@ -0,0 +1,23 @@
+import { KubeConfig, CoreV1Api, BatchV1Api, CustomObjectsApi, NetworkingV1Api, RbacAuthorizationV1Api, } from "@kubernetes/client-node";
+export function createKubeConfig(input) {
+    const kc = new KubeConfig();
+    if (input.inCluster) {
+        kc.loadFromCluster();
+        return kc;
+    }
+    if (input.kubeconfig && input.kubeconfig.trim().length > 0) {
+        kc.loadFromString(input.kubeconfig);
+        return kc;
+    }
+    throw new Error("createKubeConfig requires either inCluster=true or a kubeconfig string");
+}
+export function makeKubeClients(kc) {
+    return {
+        core: kc.makeApiClient(CoreV1Api),
+        batch: kc.makeApiClient(BatchV1Api),
+        custom: kc.makeApiClient(CustomObjectsApi),
+        networking: kc.makeApiClient(NetworkingV1Api),
+        rbac: kc.makeApiClient(RbacAuthorizationV1Api),
+    };
+}
+//# sourceMappingURL=kube-client.js.map

package/dist/kube-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kube-client.js","sourceRoot":"","sources":["../src/kube-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAOjC,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,EAAE,GAAG,IAAI,UAAU,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;AAC5F,CAAC;AAUD,MAAM,UAAU,eAAe,CAAC,EAAc;IAC5C,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC;QACjC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC;QAC1C,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC;QAC7C,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,sBAAsB,CAAC;KAC/C,CAAC;AACJ,CAAC"}