autocatalog-plugin-kubernetes 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jag Reehal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,19 @@
-# Temporary Holding Version
+# autocatalog-plugin-kubernetes
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Check the calls the catalog knows against who a cluster lets reach whom.
+
+```bash
+npm install -D autocatalog-plugin-kubernetes
+ac from-kubernetes k8s/
+```
+
+It reads Deployments, StatefulSets, Namespaces and NetworkPolicies and writes
+`autocatalog.network.json`. Commit it: the site says where a call, declared or
+traced, is one the network refuses, and where a service a gateway exposes can be
+reached around it. See [Network policy](https://jagreehal.github.io/autocatalog/docs/network).
+
+| Option                         | Does                                                      |
+| ------------------------------ | --------------------------------------------------------- |
+| `--root <dir>`                 | the repository to write into                              |
+| `--service <workload=catalog>` | a workload whose catalog name differs, repeatable         |
+| `--check`                      | fail when the committed file does not match the manifests |

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/bin.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import {
+  runFromKubernetes
+} from "./chunk-OSLDVR63.js";
+
+// src/bin.ts
+import { Command } from "commander";
+var program = new Command();
+var collect = (value, previous) => [...previous, value];
+program.name("autocatalog-from-kubernetes").description("Write autocatalog.network.json from Kubernetes manifests").argument("<manifests...>", "manifest files, or the folders that hold them").option(
+  "--service <workload=catalog>",
+  "a workload whose catalog name differs, repeatable",
+  collect,
+  []
+).option("--check", "fail when the committed file does not match these manifests").option("--root <dir>", "the repository to write into", ".").action(
+  async (manifests, opts) => {
+    process.exit(await runFromKubernetes({ ...opts, manifests }));
+  }
+);
+program.parseAsync(process.argv).catch((error) => {
+  console.error(error);
+  process.exit(1);
+});
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bin.ts"],"sourcesContent":["import { Command } from 'commander';\nimport { runFromKubernetes } from './index';\n\nconst program = new Command();\n\nconst collect = (value: string, previous: string[]) => [...previous, value];\n\nprogram\n  .name('autocatalog-from-kubernetes')\n  .description('Write autocatalog.network.json from Kubernetes manifests')\n  .argument('<manifests...>', 'manifest files, or the folders that hold them')\n  .option(\n    '--service <workload=catalog>',\n    'a workload whose catalog name differs, repeatable',\n    collect,\n    [],\n  )\n  .option('--check', 'fail when the committed file does not match these manifests')\n  .option('--root <dir>', 'the repository to write into', '.')\n  .action(\n    async (manifests: string[], opts: { service: string[]; check?: boolean; root: string }) => {\n      process.exit(await runFromKubernetes({ ...opts, manifests }));\n    },\n  );\n\nprogram.parseAsync(process.argv).catch((error: Error) => {\n  console.error(error);\n  process.exit(1);\n});\n"],"mappings":";;;;;;AAAA,SAAS,eAAe;AAGxB,IAAM,UAAU,IAAI,QAAQ;AAE5B,IAAM,UAAU,CAAC,OAAe,aAAuB,CAAC,GAAG,UAAU,KAAK;AAE1E,QACG,KAAK,6BAA6B,EAClC,YAAY,0DAA0D,EACtE,SAAS,kBAAkB,+CAA+C,EAC1E;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA,CAAC;AACH,EACC,OAAO,WAAW,6DAA6D,EAC/E,OAAO,gBAAgB,gCAAgC,GAAG,EAC1D;AAAA,EACC,OAAO,WAAqB,SAA+D;AACzF,YAAQ,KAAK,MAAM,kBAAkB,EAAE,GAAG,MAAM,UAAU,CAAC,CAAC;AAAA,EAC9D;AACF;AAEF,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,CAAC,UAAiB;AACvD,UAAQ,MAAM,KAAK;AACnB,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}

package/dist/chunk-OSLDVR63.js

@@ -0,0 +1,205 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import fs from "fs/promises";
+import path from "path";
+import {
+  writeNetworkFile
+} from "autocatalog-core";
+import kleur from "kleur";
+import { parseAllDocuments } from "yaml";
+import { z } from "zod";
+var labels = z.record(z.string(), z.string()).default({});
+var metadata = z.object({ name: z.string(), namespace: z.string().optional(), labels });
+var manifest = z.looseObject({ apiVersion: z.string(), kind: z.string(), metadata });
+var selector = z.object({
+  matchLabels: labels,
+  matchExpressions: z.array(
+    z.object({ key: z.string(), operator: z.string(), values: z.array(z.string()).default([]) })
+  ).default([])
+});
+var policyPeer = z.object({
+  podSelector: selector.optional(),
+  namespaceSelector: selector.optional(),
+  ipBlock: z.object({ cidr: z.string() }).optional()
+});
+var networkPolicy = z.object({
+  spec: z.object({
+    podSelector: selector.default({ matchLabels: {}, matchExpressions: [] }),
+    policyTypes: z.array(z.enum(["Ingress", "Egress"])).optional(),
+    ingress: z.array(z.object({ from: z.array(policyPeer).optional() })).optional(),
+    egress: z.array(z.object({ to: z.array(policyPeer).optional() })).optional()
+  })
+});
+var podTemplate = z.object({
+  spec: z.object({
+    template: z.object({ metadata: z.object({ labels }).default({ labels: {} }) })
+  })
+});
+var NAME_LABEL = "kubernetes.io/metadata.name";
+var OPERATORS = /* @__PURE__ */ new Set(["In", "NotIn", "Exists", "DoesNotExist"]);
+function holds(operator, value, values) {
+  switch (operator) {
+    case "In":
+      return value !== void 0 && values.includes(value);
+    case "NotIn":
+      return value === void 0 || !values.includes(value);
+    case "Exists":
+      return value !== void 0;
+    case "DoesNotExist":
+      return value === void 0;
+    default:
+      return false;
+  }
+}
+var selects = (wanted, have) => wanted === void 0 || Object.entries(wanted.matchLabels).every(([key, value]) => have[key] === value) && wanted.matchExpressions.every(
+  ({ key, operator, values }) => holds(operator, have[key], values)
+);
+var empty = (wanted) => wanted === void 0 || Object.keys(wanted.matchLabels).length === 0 && wanted.matchExpressions.length === 0;
+function readNetwork(texts, services = {}) {
+  const resources = texts.flatMap((text) => parseAllDocuments(text).map((document) => document.toJS())).flatMap((document) => {
+    const parsed = manifest.safeParse(document);
+    return parsed.success ? [parsed.data] : [];
+  });
+  const warnings = [];
+  const namespaceOf = (resource) => resource.metadata.namespace ?? "default";
+  const namespaceLabels = new Map(
+    resources.flatMap(
+      (resource) => resource.kind === "Namespace" ? [[resource.metadata.name, resource.metadata.labels]] : []
+    )
+  );
+  const labelsOfNamespace = (name) => ({
+    ...namespaceLabels.get(name),
+    [NAME_LABEL]: name
+  });
+  const pods = resources.flatMap((resource) => {
+    if (resource.kind !== "Deployment" && resource.kind !== "StatefulSet") return [];
+    const parsed = podTemplate.safeParse(resource);
+    return [
+      {
+        service: services[resource.metadata.name] ?? resource.metadata.name,
+        namespace: namespaceOf(resource),
+        labels: parsed.success ? parsed.data.spec.template.metadata.labels : {}
+      }
+    ];
+  });
+  const policies = resources.flatMap((resource) => {
+    if (resource.kind !== "NetworkPolicy") return [];
+    const parsed = networkPolicy.safeParse(resource);
+    if (!parsed.success) {
+      warnings.push(`NetworkPolicy ${namespaceOf(resource)}/${resource.metadata.name}: not read`);
+      return [];
+    }
+    return [
+      { name: resource.metadata.name, namespace: namespaceOf(resource), ...parsed.data.spec }
+    ];
+  });
+  const peersOf = (entry, namespace, where) => {
+    const unknown = [entry.podSelector, entry.namespaceSelector].flatMap(
+      (wanted) => wanted?.matchExpressions.filter(({ operator }) => !OPERATORS.has(operator)) ?? []
+    );
+    if (unknown.length > 0)
+      warnings.push(
+        `${where}: ${unknown.map(({ operator }) => operator).join(", ")} is not a selector operator, so that peer lets nothing through here`
+      );
+    if (entry.ipBlock)
+      return ["0.0.0.0/0", "::/0"].includes(entry.ipBlock.cidr) ? "anyone" : [{ external: true }];
+    if (entry.namespaceSelector && empty(entry.namespaceSelector) && empty(entry.podSelector))
+      return "anyone";
+    const named = [
+      entry.namespaceSelector?.matchLabels[NAME_LABEL],
+      ...entry.namespaceSelector?.matchExpressions.flatMap(
+        ({ key, operator, values }) => key === NAME_LABEL && operator === "In" ? values : []
+      ) ?? []
+    ].filter((name) => name !== void 0);
+    const namespaces = !entry.namespaceSelector ? [namespace] : [.../* @__PURE__ */ new Set([...namespaceLabels.keys(), ...pods.map((p) => p.namespace), ...named])].filter(
+      (candidate) => selects(entry.namespaceSelector, labelsOfNamespace(candidate))
+    );
+    return namespaces.flatMap((candidate) => {
+      const inside = pods.filter((pod) => pod.namespace === candidate);
+      if (empty(entry.podSelector)) return [{ namespace: candidate }];
+      if (inside.length === 0) return [{ namespace: candidate, some: true }];
+      return inside.flatMap(
+        (pod) => selects(entry.podSelector, pod.labels) ? [{ service: pod.service }] : []
+      );
+    });
+  };
+  const workloads = pods.map((pod) => {
+    const selecting = policies.filter(
+      (policy) => policy.namespace === pod.namespace && selects(policy.podSelector, pod.labels)
+    );
+    const direction = (kind) => {
+      const applying = selecting.filter(
+        (policy) => (policy.policyTypes ?? ["Ingress", ...policy.egress ? ["Egress"] : []]).includes(kind)
+      );
+      if (applying.length === 0) return void 0;
+      const rules = applying.flatMap(
+        (policy) => (kind === "Ingress" ? policy.ingress ?? [] : policy.egress ?? []).map((rule) => ({
+          peers: "from" in rule ? rule.from : "to" in rule ? rule.to : void 0,
+          where: `NetworkPolicy ${policy.namespace}/${policy.name}`
+        }))
+      );
+      if (rules.some(({ peers: peers2 }) => peers2 === void 0 || peers2.length === 0)) return void 0;
+      const resolved = rules.flatMap(
+        ({ peers: peers2 = [], where }) => peers2.map((entry) => peersOf(entry, pod.namespace, where))
+      );
+      if (resolved.some((peer) => peer === "anyone")) return void 0;
+      const peers = resolved.flatMap((peer) => peer === "anyone" ? [] : peer);
+      return [...new Map(peers.map((p) => [JSON.stringify(p), p])).values()];
+    };
+    const ingress = direction("Ingress");
+    const egress = direction("Egress");
+    return {
+      service: pod.service,
+      namespace: pod.namespace,
+      ...ingress && { ingress },
+      ...egress && { egress }
+    };
+  });
+  return { file: { workloads }, warnings };
+}
+async function manifestFiles(given) {
+  if (!(await fs.stat(given)).isDirectory()) return [given];
+  const entries = await fs.readdir(given, { recursive: true, withFileTypes: true });
+  return entries.filter((entry) => entry.isFile() && /\.ya?ml$/i.test(entry.name)).map((entry) => path.join(entry.parentPath, entry.name)).sort();
+}
+async function runFromKubernetes(opts) {
+  const services = Object.fromEntries(
+    (opts.service ?? []).flatMap((pair) => {
+      const [workload, catalog] = pair.split("=");
+      return workload && catalog ? [[workload, catalog]] : [];
+    })
+  );
+  let read;
+  try {
+    const files = (await Promise.all(opts.manifests.map(manifestFiles))).flat();
+    read = readNetwork(await Promise.all(files.map((file) => fs.readFile(file, "utf8"))), services);
+  } catch (error) {
+    console.error(
+      kleur.red(
+        `\u2717 ${opts.manifests.join(", ")}: ${error instanceof Error ? error.message : String(error)}`
+      )
+    );
+    return 1;
+  }
+  for (const warning of read.warnings) console.warn(kleur.yellow(`! ${warning}`));
+  const root = path.resolve(opts.root);
+  const source = opts.manifests.map((file) => path.relative(root, path.resolve(file)).split(path.sep).join("/")).join(", ");
+  const result = await writeNetworkFile(root, { ...read.file, source }, { check: opts.check });
+  if (result === "stale") {
+    console.error(
+      kleur.red("\u2717 autocatalog.network.json does not match the manifests: run ac from-kubernetes")
+    );
+    return 1;
+  }
+  console.log(
+    `${result === "current" ? "\u2713 autocatalog.network.json is current" : "\u2713 wrote autocatalog.network.json"}: ${read.file.workloads.length} workloads`
+  );
+  return 0;
+}
+
+export {
+  readNetwork,
+  runFromKubernetes
+};
+//# sourceMappingURL=chunk-OSLDVR63.js.map

package/dist/chunk-OSLDVR63.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport path from 'node:path';\nimport {\n  writeNetworkFile,\n  type NetworkFile,\n  type NetworkPeer,\n  type NetworkWorkload,\n} from 'autocatalog-core';\nimport kleur from 'kleur';\nimport { parseAllDocuments } from 'yaml';\nimport { z } from 'zod';\n\n// Who may reach whom, as Kubernetes says it: a NetworkPolicy selects pods in its\n// namespace and lists the peers each direction allows. A pod no policy selects\n// for a direction is open in that direction. Workloads are Deployments and\n// StatefulSets, each a catalog service by name.\n\nconst labels = z.record(z.string(), z.string()).default({});\n\nconst metadata = z.object({ name: z.string(), namespace: z.string().optional(), labels });\n\nconst manifest = z.looseObject({ apiVersion: z.string(), kind: z.string(), metadata });\n\ntype Manifest = z.infer<typeof manifest>;\n\nconst selector = z.object({\n  matchLabels: labels,\n  matchExpressions: z\n    .array(\n      z.object({ key: z.string(), operator: z.string(), values: z.array(z.string()).default([]) }),\n    )\n    .default([]),\n});\n\ntype Selector = z.infer<typeof selector>;\n\nconst policyPeer = z.object({\n  podSelector: selector.optional(),\n  namespaceSelector: selector.optional(),\n  ipBlock: z.object({ cidr: z.string() }).optional(),\n});\n\nconst networkPolicy = z.object({\n  spec: z.object({\n    podSelector: selector.default({ matchLabels: {}, matchExpressions: [] }),\n    policyTypes: z.array(z.enum(['Ingress', 'Egress'])).optional(),\n    ingress: z.array(z.object({ from: z.array(policyPeer).optional() })).optional(),\n    egress: z.array(z.object({ to: z.array(policyPeer).optional() })).optional(),\n  }),\n});\n\nconst podTemplate = z.object({\n  spec: z.object({\n    template: z.object({ metadata: z.object({ labels }).default({ labels: {} }) }),\n  }),\n});\n\n/** Kubernetes labels every namespace with its own name. */\nconst NAME_LABEL = 'kubernetes.io/metadata.name';\n\n/** Kubernetes' selector operators: anything else selects nothing. */\nconst OPERATORS = new Set(['In', 'NotIn', 'Exists', 'DoesNotExist']);\n\n/** Whether a label's value meets one selector expression. */\nfunction holds(operator: string, value: string | undefined, values: string[]): boolean {\n  switch (operator) {\n    case 'In':\n      return value !== undefined && values.includes(value);\n    case 'NotIn':\n      return value === undefined || !values.includes(value);\n    case 'Exists':\n      return value !== undefined;\n    case 'DoesNotExist':\n      return value === undefined;\n    default:\n      return false;\n  }\n}\n\n/** Whether a selector picks a set of labels: every label it names, and every expression. */\nconst selects = (wanted: Selector | undefined, have: Record<string, string>) =>\n  wanted === undefined ||\n  (Object.entries(wanted.matchLabels).every(([key, value]) => have[key] === value) &&\n    wanted.matchExpressions.every(({ key, operator, values }) =>\n      holds(operator, have[key], values),\n    ));\n\n/** A selector that picks everything. */\nconst empty = (wanted: Selector | undefined) =>\n  wanted === undefined ||\n  (Object.keys(wanted.matchLabels).length === 0 && wanted.matchExpressions.length === 0);\n\nexport interface KubernetesNetworkRead {\n  file: NetworkFile;\n  /** What the manifests hold that the file cannot say, in words. */\n  warnings: string[];\n}\n\n/** Who may reach each workload, and what it may reach. `services` maps a workload name to the catalog's. */\nexport function readNetwork(\n  texts: string[],\n  services: Record<string, string> = {},\n): KubernetesNetworkRead {\n  const resources = texts\n    .flatMap((text) => parseAllDocuments(text).map((document) => document.toJS()))\n    .flatMap((document) => {\n      const parsed = manifest.safeParse(document);\n\n      return parsed.success ? [parsed.data] : [];\n    });\n\n  const warnings: string[] = [];\n  const namespaceOf = (resource: Manifest) => resource.metadata.namespace ?? 'default';\n\n  const namespaceLabels = new Map(\n    resources.flatMap((resource) =>\n      resource.kind === 'Namespace'\n        ? [[resource.metadata.name, resource.metadata.labels] as const]\n        : [],\n    ),\n  );\n\n  const labelsOfNamespace = (name: string) => ({\n    ...namespaceLabels.get(name),\n    [NAME_LABEL]: name,\n  });\n\n  const pods = resources.flatMap((resource) => {\n    if (resource.kind !== 'Deployment' && resource.kind !== 'StatefulSet') return [];\n\n    const parsed = podTemplate.safeParse(resource);\n\n    return [\n      {\n        service: services[resource.metadata.name] ?? resource.metadata.name,\n        namespace: namespaceOf(resource),\n        labels: parsed.success ? parsed.data.spec.template.metadata.labels : {},\n      },\n    ];\n  });\n\n  const policies = resources.flatMap((resource) => {\n    if (resource.kind !== 'NetworkPolicy') return [];\n\n    const parsed = networkPolicy.safeParse(resource);\n\n    if (!parsed.success) {\n      warnings.push(`NetworkPolicy ${namespaceOf(resource)}/${resource.metadata.name}: not read`);\n\n      return [];\n    }\n\n    return [\n      { name: resource.metadata.name, namespace: namespaceOf(resource), ...parsed.data.spec },\n    ];\n  });\n\n  /** The peers one `from` or `to` entry allows, from the policy in `namespace`. */\n  const peersOf = (\n    entry: z.infer<typeof policyPeer>,\n    namespace: string,\n    where: string,\n  ): NetworkPeer[] | 'anyone' => {\n    const unknown = [entry.podSelector, entry.namespaceSelector].flatMap(\n      (wanted) => wanted?.matchExpressions.filter(({ operator }) => !OPERATORS.has(operator)) ?? [],\n    );\n\n    if (unknown.length > 0)\n      warnings.push(\n        `${where}: ${unknown.map(({ operator }) => operator).join(', ')} is not a selector operator, so that peer lets nothing through here`,\n      );\n\n    if (entry.ipBlock)\n      return ['0.0.0.0/0', '::/0'].includes(entry.ipBlock.cidr) ? 'anyone' : [{ external: true }];\n\n    // Every pod in every namespace: anyone in the cluster.\n    if (entry.namespaceSelector && empty(entry.namespaceSelector) && empty(entry.podSelector))\n      return 'anyone';\n\n    // The namespaces this entry covers: its own without a namespace selector. One\n    // these files do not declare, such as the gateway's, is known by its name label.\n    const named = [\n      entry.namespaceSelector?.matchLabels[NAME_LABEL],\n      ...(entry.namespaceSelector?.matchExpressions.flatMap(({ key, operator, values }) =>\n        key === NAME_LABEL && operator === 'In' ? values : [],\n      ) ?? []),\n    ].filter((name): name is string => name !== undefined);\n\n    const namespaces = !entry.namespaceSelector\n      ? [namespace]\n      : [...new Set([...namespaceLabels.keys(), ...pods.map((p) => p.namespace), ...named])].filter(\n          (candidate) => selects(entry.namespaceSelector, labelsOfNamespace(candidate)),\n        );\n\n    return namespaces.flatMap((candidate): NetworkPeer[] => {\n      const inside = pods.filter((pod) => pod.namespace === candidate);\n\n      // A whole namespace, or one whose workloads these files do not hold, such as the gateway's.\n      if (empty(entry.podSelector)) return [{ namespace: candidate }];\n\n      // Some pods of a namespace these files hold no workloads of, such as the\n      // gateway's: which ones cannot be told, so never all of it.\n      if (inside.length === 0) return [{ namespace: candidate, some: true }];\n\n      return inside.flatMap((pod) =>\n        selects(entry.podSelector, pod.labels) ? [{ service: pod.service }] : [],\n      );\n    });\n  };\n\n  const workloads: NetworkWorkload[] = pods.map((pod) => {\n    const selecting = policies.filter(\n      (policy) => policy.namespace === pod.namespace && selects(policy.podSelector, pod.labels),\n    );\n\n    const direction = (kind: 'Ingress' | 'Egress'): NetworkPeer[] | undefined => {\n      // Without policyTypes, a policy restricts ingress, and egress too when it lists egress rules.\n      const applying = selecting.filter((policy) =>\n        (policy.policyTypes ?? ['Ingress', ...(policy.egress ? ['Egress'] : [])]).includes(kind),\n      );\n\n      if (applying.length === 0) return undefined;\n\n      const rules = applying.flatMap((policy) =>\n        (kind === 'Ingress' ? (policy.ingress ?? []) : (policy.egress ?? [])).map((rule) => ({\n          peers: 'from' in rule ? rule.from : 'to' in rule ? rule.to : undefined,\n          where: `NetworkPolicy ${policy.namespace}/${policy.name}`,\n        })),\n      );\n\n      // A rule with no peers, missing or empty, lets everyone through.\n      if (rules.some(({ peers }) => peers === undefined || peers.length === 0)) return undefined;\n\n      const resolved = rules.flatMap(({ peers = [], where }) =>\n        peers.map((entry) => peersOf(entry, pod.namespace, where)),\n      );\n\n      // Anyone, or the whole internet, opens the direction as surely as no policy does.\n      if (resolved.some((peer) => peer === 'anyone')) return undefined;\n\n      const peers = resolved.flatMap((peer) => (peer === 'anyone' ? [] : peer));\n\n      return [...new Map(peers.map((p) => [JSON.stringify(p), p])).values()];\n    };\n\n    const ingress = direction('Ingress');\n    const egress = direction('Egress');\n\n    return {\n      service: pod.service,\n      namespace: pod.namespace,\n      ...(ingress && { ingress }),\n      ...(egress && { egress }),\n    };\n  });\n\n  return { file: { workloads }, warnings };\n}\n\n/** A file as given, or every YAML file below a folder, in path order. */\nasync function manifestFiles(given: string): Promise<string[]> {\n  if (!(await fs.stat(given)).isDirectory()) return [given];\n\n  const entries = await fs.readdir(given, { recursive: true, withFileTypes: true });\n\n  return entries\n    .filter((entry) => entry.isFile() && /\\.ya?ml$/i.test(entry.name))\n    .map((entry) => path.join(entry.parentPath, entry.name))\n    .sort();\n}\n\nexport async function runFromKubernetes(opts: {\n  manifests: string[];\n  root: string;\n  service?: string[];\n  check?: boolean;\n}): Promise<number> {\n  const services = Object.fromEntries(\n    (opts.service ?? []).flatMap((pair) => {\n      const [workload, catalog] = pair.split('=');\n\n      return workload && catalog ? [[workload, catalog]] : [];\n    }),\n  );\n\n  let read: KubernetesNetworkRead;\n\n  try {\n    const files = (await Promise.all(opts.manifests.map(manifestFiles))).flat();\n\n    read = readNetwork(await Promise.all(files.map((file) => fs.readFile(file, 'utf8'))), services);\n  } catch (error) {\n    console.error(\n      kleur.red(\n        `✗ ${opts.manifests.join(', ')}: ${error instanceof Error ? error.message : String(error)}`,\n      ),\n    );\n\n    return 1;\n  }\n\n  for (const warning of read.warnings) console.warn(kleur.yellow(`! ${warning}`));\n\n  const root = path.resolve(opts.root);\n\n  const source = opts.manifests\n    .map((file) => path.relative(root, path.resolve(file)).split(path.sep).join('/'))\n    .join(', ');\n\n  const result = await writeNetworkFile(root, { ...read.file, source }, { check: opts.check });\n\n  if (result === 'stale') {\n    console.error(\n      kleur.red('✗ autocatalog.network.json does not match the manifests: run ac from-kubernetes'),\n    );\n\n    return 1;\n  }\n\n  console.log(\n    `${result === 'current' ? '✓ autocatalog.network.json is current' : '✓ wrote autocatalog.network.json'}: ${read.file.workloads.length} workloads`,\n  );\n\n  return 0;\n}\n"],"mappings":";;;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB;AAAA,EACE;AAAA,OAIK;AACP,OAAO,WAAW;AAClB,SAAS,yBAAyB;AAClC,SAAS,SAAS;AAOlB,IAAM,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAE1D,IAAM,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC;AAExF,IAAM,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;AAIrF,IAAM,WAAW,EAAE,OAAO;AAAA,EACxB,aAAa;AAAA,EACb,kBAAkB,EACf;AAAA,IACC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;AAAA,EAC7F,EACC,QAAQ,CAAC,CAAC;AACf,CAAC;AAID,IAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,aAAa,SAAS,SAAS;AAAA,EAC/B,mBAAmB,SAAS,SAAS;AAAA,EACrC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AACnD,CAAC;AAED,IAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,MAAM,EAAE,OAAO;AAAA,IACb,aAAa,SAAS,QAAQ,EAAE,aAAa,CAAC,GAAG,kBAAkB,CAAC,EAAE,CAAC;AAAA,IACvE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA,IAC7D,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,SAAS;AAAA,IAC9E,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7E,CAAC;AACH,CAAC;AAED,IAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,MAAM,EAAE,OAAO;AAAA,IACb,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AAAA,EAC/E,CAAC;AACH,CAAC;AAGD,IAAM,aAAa;AAGnB,IAAM,YAAY,oBAAI,IAAI,CAAC,MAAM,SAAS,UAAU,cAAc,CAAC;AAGnE,SAAS,MAAM,UAAkB,OAA2B,QAA2B;AACrF,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO,UAAU,UAAa,OAAO,SAAS,KAAK;AAAA,IACrD,KAAK;AACH,aAAO,UAAU,UAAa,CAAC,OAAO,SAAS,KAAK;AAAA,IACtD,KAAK;AACH,aAAO,UAAU;AAAA,IACnB,KAAK;AACH,aAAO,UAAU;AAAA,IACnB;AACE,aAAO;AAAA,EACX;AACF;AAGA,IAAM,UAAU,CAAC,QAA8B,SAC7C,WAAW,UACV,OAAO,QAAQ,OAAO,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,MAAM,KAAK,GAAG,MAAM,KAAK,KAC7E,OAAO,iBAAiB;AAAA,EAAM,CAAC,EAAE,KAAK,UAAU,OAAO,MACrD,MAAM,UAAU,KAAK,GAAG,GAAG,MAAM;AACnC;AAGJ,IAAM,QAAQ,CAAC,WACb,WAAW,UACV,OAAO,KAAK,OAAO,WAAW,EAAE,WAAW,KAAK,OAAO,iBAAiB,WAAW;AAS/E,SAAS,YACd,OACA,WAAmC,CAAC,GACb;AACvB,QAAM,YAAY,MACf,QAAQ,CAAC,SAAS,kBAAkB,IAAI,EAAE,IAAI,CAAC,aAAa,SAAS,KAAK,CAAC,CAAC,EAC5E,QAAQ,CAAC,aAAa;AACrB,UAAM,SAAS,SAAS,UAAU,QAAQ;AAE1C,WAAO,OAAO,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC;AAAA,EAC3C,CAAC;AAEH,QAAM,WAAqB,CAAC;AAC5B,QAAM,cAAc,CAAC,aAAuB,SAAS,SAAS,aAAa;AAE3E,QAAM,kBAAkB,IAAI;AAAA,IAC1B,UAAU;AAAA,MAAQ,CAAC,aACjB,SAAS,SAAS,cACd,CAAC,CAAC,SAAS,SAAS,MAAM,SAAS,SAAS,MAAM,CAAU,IAC5D,CAAC;AAAA,IACP;AAAA,EACF;AAEA,QAAM,oBAAoB,CAAC,UAAkB;AAAA,IAC3C,GAAG,gBAAgB,IAAI,IAAI;AAAA,IAC3B,CAAC,UAAU,GAAG;AAAA,EAChB;AAEA,QAAM,OAAO,UAAU,QAAQ,CAAC,aAAa;AAC3C,QAAI,SAAS,SAAS,gBAAgB,SAAS,SAAS,cAAe,QAAO,CAAC;AAE/E,UAAM,SAAS,YAAY,UAAU,QAAQ;AAE7C,WAAO;AAAA,MACL;AAAA,QACE,SAAS,SAAS,SAAS,SAAS,IAAI,KAAK,SAAS,SAAS;AAAA,QAC/D,WAAW,YAAY,QAAQ;AAAA,QAC/B,QAAQ,OAAO,UAAU,OAAO,KAAK,KAAK,SAAS,SAAS,SAAS,CAAC;AAAA,MACxE;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,WAAW,UAAU,QAAQ,CAAC,aAAa;AAC/C,QAAI,SAAS,SAAS,gBAAiB,QAAO,CAAC;AAE/C,UAAM,SAAS,cAAc,UAAU,QAAQ;AAE/C,QAAI,CAAC,OAAO,SAAS;AACnB,eAAS,KAAK,iBAAiB,YAAY,QAAQ,CAAC,IAAI,SAAS,SAAS,IAAI,YAAY;AAE1F,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA,MACL,EAAE,MAAM,SAAS,SAAS,MAAM,WAAW,YAAY,QAAQ,GAAG,GAAG,OAAO,KAAK,KAAK;AAAA,IACxF;AAAA,EACF,CAAC;AAGD,QAAM,UAAU,CACd,OACA,WACA,UAC6B;AAC7B,UAAM,UAAU,CAAC,MAAM,aAAa,MAAM,iBAAiB,EAAE;AAAA,MAC3D,CAAC,WAAW,QAAQ,iBAAiB,OAAO,CAAC,EAAE,SAAS,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,KAAK,CAAC;AAAA,IAC9F;AAEA,QAAI,QAAQ,SAAS;AACnB,eAAS;AAAA,QACP,GAAG,KAAK,KAAK,QAAQ,IAAI,CAAC,EAAE,SAAS,MAAM,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA,MACjE;AAEF,QAAI,MAAM;AACR,aAAO,CAAC,aAAa,MAAM,EAAE,SAAS,MAAM,QAAQ,IAAI,IAAI,WAAW,CAAC,EAAE,UAAU,KAAK,CAAC;AAG5F,QAAI,MAAM,qBAAqB,MAAM,MAAM,iBAAiB,KAAK,MAAM,MAAM,WAAW;AACtF,aAAO;AAIT,UAAM,QAAQ;AAAA,MACZ,MAAM,mBAAmB,YAAY,UAAU;AAAA,MAC/C,GAAI,MAAM,mBAAmB,iBAAiB;AAAA,QAAQ,CAAC,EAAE,KAAK,UAAU,OAAO,MAC7E,QAAQ,cAAc,aAAa,OAAO,SAAS,CAAC;AAAA,MACtD,KAAK,CAAC;AAAA,IACR,EAAE,OAAO,CAAC,SAAyB,SAAS,MAAS;AAErD,UAAM,aAAa,CAAC,MAAM,oBACtB,CAAC,SAAS,IACV,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,gBAAgB,KAAK,GAAG,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,GAAG,KAAK,CAAC,CAAC,EAAE;AAAA,MACnF,CAAC,cAAc,QAAQ,MAAM,mBAAmB,kBAAkB,SAAS,CAAC;AAAA,IAC9E;AAEJ,WAAO,WAAW,QAAQ,CAAC,cAA6B;AACtD,YAAM,SAAS,KAAK,OAAO,CAAC,QAAQ,IAAI,cAAc,SAAS;AAG/D,UAAI,MAAM,MAAM,WAAW,EAAG,QAAO,CAAC,EAAE,WAAW,UAAU,CAAC;AAI9D,UAAI,OAAO,WAAW,EAAG,QAAO,CAAC,EAAE,WAAW,WAAW,MAAM,KAAK,CAAC;AAErE,aAAO,OAAO;AAAA,QAAQ,CAAC,QACrB,QAAQ,MAAM,aAAa,IAAI,MAAM,IAAI,CAAC,EAAE,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC;AAAA,MACzE;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,YAA+B,KAAK,IAAI,CAAC,QAAQ;AACrD,UAAM,YAAY,SAAS;AAAA,MACzB,CAAC,WAAW,OAAO,cAAc,IAAI,aAAa,QAAQ,OAAO,aAAa,IAAI,MAAM;AAAA,IAC1F;AAEA,UAAM,YAAY,CAAC,SAA0D;AAE3E,YAAM,WAAW,UAAU;AAAA,QAAO,CAAC,YAChC,OAAO,eAAe,CAAC,WAAW,GAAI,OAAO,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAE,GAAG,SAAS,IAAI;AAAA,MACzF;AAEA,UAAI,SAAS,WAAW,EAAG,QAAO;AAElC,YAAM,QAAQ,SAAS;AAAA,QAAQ,CAAC,YAC7B,SAAS,YAAa,OAAO,WAAW,CAAC,IAAM,OAAO,UAAU,CAAC,GAAI,IAAI,CAAC,UAAU;AAAA,UACnF,OAAO,UAAU,OAAO,KAAK,OAAO,QAAQ,OAAO,KAAK,KAAK;AAAA,UAC7D,OAAO,iBAAiB,OAAO,SAAS,IAAI,OAAO,IAAI;AAAA,QACzD,EAAE;AAAA,MACJ;AAGA,UAAI,MAAM,KAAK,CAAC,EAAE,OAAAA,OAAM,MAAMA,WAAU,UAAaA,OAAM,WAAW,CAAC,EAAG,QAAO;AAEjF,YAAM,WAAW,MAAM;AAAA,QAAQ,CAAC,EAAE,OAAAA,SAAQ,CAAC,GAAG,MAAM,MAClDA,OAAM,IAAI,CAAC,UAAU,QAAQ,OAAO,IAAI,WAAW,KAAK,CAAC;AAAA,MAC3D;AAGA,UAAI,SAAS,KAAK,CAAC,SAAS,SAAS,QAAQ,EAAG,QAAO;AAEvD,YAAM,QAAQ,SAAS,QAAQ,CAAC,SAAU,SAAS,WAAW,CAAC,IAAI,IAAK;AAExE,aAAO,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;AAAA,IACvE;AAEA,UAAM,UAAU,UAAU,SAAS;AACnC,UAAM,SAAS,UAAU,QAAQ;AAEjC,WAAO;AAAA,MACL,SAAS,IAAI;AAAA,MACb,WAAW,IAAI;AAAA,MACf,GAAI,WAAW,EAAE,QAAQ;AAAA,MACzB,GAAI,UAAU,EAAE,OAAO;AAAA,IACzB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,MAAM,EAAE,UAAU,GAAG,SAAS;AACzC;AAGA,eAAe,cAAc,OAAkC;AAC7D,MAAI,EAAE,MAAM,GAAG,KAAK,KAAK,GAAG,YAAY,EAAG,QAAO,CAAC,KAAK;AAExD,QAAM,UAAU,MAAM,GAAG,QAAQ,OAAO,EAAE,WAAW,MAAM,eAAe,KAAK,CAAC;AAEhF,SAAO,QACJ,OAAO,CAAC,UAAU,MAAM,OAAO,KAAK,YAAY,KAAK,MAAM,IAAI,CAAC,EAChE,IAAI,CAAC,UAAU,KAAK,KAAK,MAAM,YAAY,MAAM,IAAI,CAAC,EACtD,KAAK;AACV;AAEA,eAAsB,kBAAkB,MAKpB;AAClB,QAAM,WAAW,OAAO;AAAA,KACrB,KAAK,WAAW,CAAC,GAAG,QAAQ,CAAC,SAAS;AACrC,YAAM,CAAC,UAAU,OAAO,IAAI,KAAK,MAAM,GAAG;AAE1C,aAAO,YAAY,UAAU,CAAC,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC;AAAA,IACxD,CAAC;AAAA,EACH;AAEA,MAAI;AAEJ,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,GAAG,KAAK;AAE1E,WAAO,YAAY,MAAM,QAAQ,IAAI,MAAM,IAAI,CAAC,SAAS,GAAG,SAAS,MAAM,MAAM,CAAC,CAAC,GAAG,QAAQ;AAAA,EAChG,SAAS,OAAO;AACd,YAAQ;AAAA,MACN,MAAM;AAAA,QACJ,UAAK,KAAK,UAAU,KAAK,IAAI,CAAC,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,aAAW,WAAW,KAAK,SAAU,SAAQ,KAAK,MAAM,OAAO,KAAK,OAAO,EAAE,CAAC;AAE9E,QAAM,OAAO,KAAK,QAAQ,KAAK,IAAI;AAEnC,QAAM,SAAS,KAAK,UACjB,IAAI,CAAC,SAAS,KAAK,SAAS,MAAM,KAAK,QAAQ,IAAI,CAAC,EAAE,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG,CAAC,EAC/E,KAAK,IAAI;AAEZ,QAAM,SAAS,MAAM,iBAAiB,MAAM,EAAE,GAAG,KAAK,MAAM,OAAO,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;AAE3F,MAAI,WAAW,SAAS;AACtB,YAAQ;AAAA,MACN,MAAM,IAAI,sFAAiF;AAAA,IAC7F;AAEA,WAAO;AAAA,EACT;AAEA,UAAQ;AAAA,IACN,GAAG,WAAW,YAAY,+CAA0C,uCAAkC,KAAK,KAAK,KAAK,UAAU,MAAM;AAAA,EACvI;AAEA,SAAO;AACT;","names":["peers"]}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+import { NetworkFile } from 'autocatalog-core';
+
+interface KubernetesNetworkRead {
+    file: NetworkFile;
+    /** What the manifests hold that the file cannot say, in words. */
+    warnings: string[];
+}
+/** Who may reach each workload, and what it may reach. `services` maps a workload name to the catalog's. */
+declare function readNetwork(texts: string[], services?: Record<string, string>): KubernetesNetworkRead;
+declare function runFromKubernetes(opts: {
+    manifests: string[];
+    root: string;
+    service?: string[];
+    check?: boolean;
+}): Promise<number>;
+
+export { type KubernetesNetworkRead, readNetwork, runFromKubernetes };

package/dist/index.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import {
+  readNetwork,
+  runFromKubernetes
+} from "./chunk-OSLDVR63.js";
+export {
+  readNetwork,
+  runFromKubernetes
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "autocatalog-plugin-kubernetes",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "ac from-kubernetes: check calls against who a cluster lets reach whom.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jagreehal/autocatalog.git",
+    "directory": "packages/events/plugin-kubernetes"
+  },
+  "homepage": "https://jagreehal.github.io/autocatalog",
+  "bugs": {
+    "url": "https://github.com/jagreehal/autocatalog/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "autocatalog-from-kubernetes": "./dist/bin.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "autocatalog": {
+    "plugin": {
+      "command": "from-kubernetes",
+      "description": "Read the network policies of Kubernetes manifests",
+      "entry": "./dist/bin.js"
+    }
+  },
+  "dependencies": {
+    "commander": "^15.0.0",
+    "kleur": "^4.1.5",
+    "yaml": "^2.9.1",
+    "zod": "^4.6.5",
+    "autocatalog-core": "0.10.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.4",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.3"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run"
+  }
 }