kubeagent 0.1.43 → 0.1.45

package/dist/diagnoser/tools.d.ts

@@ -1,119 +0,0 @@
-import { z } from "zod";
-export declare const safeActions: Set<string>;
-export declare const riskyActions: Set<string>;
-export declare function isActionSafe(action: string): boolean;
-export declare const kubectlGetLogsSchema: z.ZodObject<{
-    namespace: z.ZodString;
-    pod: z.ZodString;
-    container: z.ZodOptional<z.ZodString>;
-    tail: z.ZodDefault<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    namespace: string;
-    pod: string;
-    tail: number;
-    container?: string | undefined;
-}, {
-    namespace: string;
-    pod: string;
-    container?: string | undefined;
-    tail?: number | undefined;
-}>;
-export declare const kubectlDescribeSchema: z.ZodObject<{
-    namespace: z.ZodString;
-    resource_type: z.ZodEnum<["pod", "deployment", "service", "statefulset", "daemonset", "replicaset", "job", "cronjob", "ingress", "node", "persistentvolumeclaim", "configmap", "endpoints"]>;
-    name: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    namespace: string;
-    resource_type: "service" | "node" | "pod" | "deployment" | "statefulset" | "daemonset" | "replicaset" | "job" | "cronjob" | "ingress" | "persistentvolumeclaim" | "configmap" | "endpoints";
-}, {
-    name: string;
-    namespace: string;
-    resource_type: "service" | "node" | "pod" | "deployment" | "statefulset" | "daemonset" | "replicaset" | "job" | "cronjob" | "ingress" | "persistentvolumeclaim" | "configmap" | "endpoints";
-}>;
-export declare const restartPodSchema: z.ZodObject<{
-    namespace: z.ZodString;
-    pod: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    namespace: string;
-    pod: string;
-}, {
-    namespace: string;
-    pod: string;
-}>;
-export declare const rolloutRestartSchema: z.ZodObject<{
-    namespace: z.ZodString;
-    deployment: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    namespace: string;
-    deployment: string;
-}, {
-    namespace: string;
-    deployment: string;
-}>;
-export declare const scaleDeploymentSchema: z.ZodObject<{
-    namespace: z.ZodString;
-    deployment: z.ZodString;
-    replicas: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    namespace: string;
-    deployment: string;
-    replicas: number;
-}, {
-    namespace: string;
-    deployment: string;
-    replicas: number;
-}>;
-export declare const getEventsSchema: z.ZodObject<{
-    namespace: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    namespace: string;
-}, {
-    namespace: string;
-}>;
-export declare const setResourcesSchema: z.ZodObject<{
-    namespace: z.ZodString;
-    deployment: z.ZodString;
-    container: z.ZodOptional<z.ZodString>;
-    memory_request: z.ZodOptional<z.ZodString>;
-    memory_limit: z.ZodOptional<z.ZodString>;
-    cpu_request: z.ZodOptional<z.ZodString>;
-    cpu_limit: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    namespace: string;
-    deployment: string;
-    container?: string | undefined;
-    memory_request?: string | undefined;
-    memory_limit?: string | undefined;
-    cpu_request?: string | undefined;
-    cpu_limit?: string | undefined;
-}, {
-    namespace: string;
-    deployment: string;
-    container?: string | undefined;
-    memory_request?: string | undefined;
-    memory_limit?: string | undefined;
-    cpu_request?: string | undefined;
-    cpu_limit?: string | undefined;
-}>;
-export declare function getLogs(input: z.infer<typeof kubectlGetLogsSchema>, context?: {
-    context?: string;
-}): Promise<string>;
-export declare function describeResource(input: z.infer<typeof kubectlDescribeSchema>, context?: {
-    context?: string;
-}): Promise<string>;
-export declare function restartPod(input: z.infer<typeof restartPodSchema>, context?: {
-    context?: string;
-}): Promise<string>;
-export declare function rolloutRestart(input: z.infer<typeof rolloutRestartSchema>, context?: {
-    context?: string;
-}): Promise<string>;
-export declare function scaleDeployment(input: z.infer<typeof scaleDeploymentSchema>, context?: {
-    context?: string;
-}): Promise<string>;
-export declare function getEvents(input: z.infer<typeof getEventsSchema>, context?: {
-    context?: string;
-}): Promise<string>;
-export declare function setResources(input: z.infer<typeof setResourcesSchema>, context?: {
-    context?: string;
-}): Promise<string>;

package/dist/kb/loader.d.ts

@@ -1 +0,0 @@
-export declare function buildSystemPrompt(kbDir: string): string;

package/dist/kb/writer.d.ts

@@ -1,12 +0,0 @@
-export declare function ensureKbDir(kbDir: string): void;
-export declare function writeClusterKb(kbDir: string, content: string): void;
-export declare function writeApplicationsKb(kbDir: string, content: string): void;
-export declare function writeProjectKb(kbDir: string, projectName: string, content: string): void;
-export declare function writeRunbook(kbDir: string, name: string, content: string): void;
-/**
- * Write a gave-up issue to the unresolved/ directory.
- * Files are named by issue key so repeated give-ups overwrite rather than accumulate.
- * The agent reads these as KB context on future runs.
- */
-export declare function writeUnresolved(kbDir: string, issueKey: string, content: string): void;
-export declare function writeIncident(kbDir: string, date: string, name: string, content: string): void;

package/dist/kubectl-config.d.ts

@@ -1,7 +0,0 @@
-export interface KubeContext {
-    name: string;
-    cluster: string;
-    current: boolean;
-}
-export declare function listContexts(): Promise<KubeContext[]>;
-export declare function pickContext(): Promise<string>;

package/dist/kubectl.d.ts

@@ -1,13 +0,0 @@
-export declare class KubectlError extends Error {
-    readonly stderr?: string | undefined;
-    readonly exitCode?: number | undefined;
-    constructor(message: string, stderr?: string | undefined, exitCode?: number | undefined);
-}
-export declare function parseKubectlJson(raw: string): unknown;
-export interface KubectlOptions {
-    context?: string;
-    namespace?: string;
-    timeout?: number;
-}
-export declare function kubectl(args: string[], options?: KubectlOptions): Promise<string>;
-export declare function kubectlJson(args: string[], options?: KubectlOptions): Promise<unknown>;

package/dist/monitor/checks.d.ts

@@ -1,71 +0,0 @@
-import type { Issue } from "./types.js";
-interface PodStatus {
-    metadata: {
-        name: string;
-        namespace: string;
-    };
-    status: {
-        phase: string;
-        reason?: string;
-        containerStatuses?: Array<{
-            name: string;
-            state: {
-                waiting?: {
-                    reason?: string;
-                };
-                terminated?: {
-                    reason?: string;
-                };
-                running?: Record<string, unknown>;
-            };
-            lastState?: {
-                terminated?: {
-                    reason?: string;
-                };
-            };
-            restartCount: number;
-        }>;
-    };
-}
-interface NodeStatus {
-    metadata: {
-        name: string;
-    };
-    status: {
-        conditions: Array<{
-            type: string;
-            status: string;
-            reason?: string;
-        }>;
-    };
-}
-export declare function findPodIssues(podList: {
-    items: PodStatus[];
-}): Issue[];
-interface JobStatus {
-    metadata: {
-        name: string;
-        namespace: string;
-    };
-    status: {
-        failed?: number;
-        succeeded?: number;
-        active?: number;
-        conditions?: Array<{
-            type: string;
-            status: string;
-            reason?: string;
-            message?: string;
-        }>;
-    };
-    spec?: {
-        backoffLimit?: number;
-    };
-}
-export declare function findJobIssues(jobList: {
-    items: JobStatus[];
-}): Issue[];
-export declare function findNodeIssues(nodeList: {
-    items: NodeStatus[];
-}): Issue[];
-export {};

package/dist/monitor/index.d.ts

@@ -1,27 +0,0 @@
-import { type KubectlOptions } from "../kubectl.js";
-import type { Issue } from "./types.js";
-export type IssueCallback = (issues: Issue[]) => void | Promise<void>;
-export type ResolveCallback = (resolvedKeys: string[]) => void | Promise<void>;
-export interface CheckSummary {
-    issues: Issue[];
-    podCount: number;
-    nodeCount: number;
-    namespaceCount: number;
-}
-export interface RunChecksScope {
-    /**
-     * Namespaces to scope the scan to. When set, kubectl queries are issued
-     * per-namespace (e.g. `kubectl get pods -n foo`) instead of the
-     * cluster-wide `--all-namespaces` form. Cluster-scoped queries
-     * (`get nodes`, `get namespaces`) are still attempted but their failures
-     * are tolerated so namespace-scoped service accounts can use `kubeagent check`.
-     */
-    namespaces?: string[];
-}
-export declare function runChecks(options: KubectlOptions): Promise<Issue[]>;
-export declare function runChecks(options: KubectlOptions, withSummary: true, scope?: RunChecksScope): Promise<CheckSummary>;
-export declare function computeResolvedKeys(activeKeys: Set<string>, currentKeys: Set<string>): string[];
-export declare function updateActiveKeys(activeKeys: Set<string>, resolvedKeys: string[], currentKeys: Set<string>): void;
-export declare function startMonitor(options: KubectlOptions, intervalMs: number, onIssues: IssueCallback, onResolved?: ResolveCallback, onFirstCycle?: () => void): {
-    stop: () => void;
-};

package/dist/monitor/resolve.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/monitor/resolve.test.js

@@ -1,21 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { computeResolvedKeys, updateActiveKeys } from "./index.js";
-describe("resolve tracking", () => {
-    it("returns keys that disappeared since last tick", () => {
-        const active = new Set(["pod_crashloop:prod:web", "pod_oom:prod:worker"]);
-        const current = new Set(["pod_oom:prod:worker"]);
-        expect(computeResolvedKeys(active, current)).toEqual(["pod_crashloop:prod:web"]);
-    });
-    it("returns empty array when nothing cleared", () => {
-        const active = new Set(["pod_crashloop:prod:web"]);
-        const current = new Set(["pod_crashloop:prod:web"]);
-        expect(computeResolvedKeys(active, current)).toEqual([]);
-    });
-    it("updates active set correctly after resolve", () => {
-        const active = new Set(["pod_crashloop:prod:web", "pod_oom:prod:worker"]);
-        const current = new Set(["pod_oom:prod:worker", "node_not_ready::node1"]);
-        const resolved = computeResolvedKeys(active, current);
-        updateActiveKeys(active, resolved, current);
-        expect([...active].sort()).toEqual(["node_not_ready::node1", "pod_oom:prod:worker"]);
-    });
-});

package/dist/monitor/scope.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/monitor/scope.test.js

@@ -1,87 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { runChecks } from "./index.js";
-import * as kubectl from "../kubectl.js";
-describe("runChecks namespace scope", () => {
-    beforeEach(() => {
-        vi.restoreAllMocks();
-    });
-    it("queries per-namespace when scope.namespaces is set", async () => {
-        const calls = [];
-        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
-            calls.push(args);
-            return { items: [] };
-        });
-        await runChecks({}, true, { namespaces: ["foo", "bar"] });
-        // Pods: one per requested namespace, never --all-namespaces
-        const podCalls = calls.filter((c) => c[0] === "get" && c[1] === "pods");
-        expect(podCalls).toHaveLength(2);
-        expect(podCalls[0]).toEqual(["get", "pods", "-n", "foo"]);
-        expect(podCalls[1]).toEqual(["get", "pods", "-n", "bar"]);
-        expect(calls.some((c) => c.includes("--all-namespaces") && c[1] === "pods")).toBe(false);
-        // Jobs: same per-namespace pattern
-        const jobCalls = calls.filter((c) => c[0] === "get" && c[1] === "jobs");
-        expect(jobCalls).toHaveLength(2);
-        expect(jobCalls[0]).toContain("foo");
-        expect(jobCalls[1]).toContain("bar");
-        expect(calls.some((c) => c.includes("--all-namespaces") && c[1] === "jobs")).toBe(false);
-    });
-    it("uses --all-namespaces when no scope is given", async () => {
-        const calls = [];
-        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
-            calls.push(args);
-            return { items: [] };
-        });
-        await runChecks({});
-        expect(calls.some((c) => c[0] === "get" && c[1] === "pods" && c.includes("--all-namespaces"))).toBe(true);
-        expect(calls.some((c) => c[0] === "get" && c[1] === "jobs" && c.includes("--all-namespaces"))).toBe(true);
-    });
-    it("tolerates forbidden errors on cluster-scoped node queries", async () => {
-        // Simulate a namespace-scoped service account: pods succeed, nodes 403
-        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
-            if (args[1] === "nodes") {
-                throw new Error("Error from server (Forbidden): nodes is forbidden");
-            }
-            return { items: [] };
-        });
-        const result = await runChecks({}, true, { namespaces: ["foo"] });
-        expect(result.issues).toEqual([]);
-        expect(result.nodeCount).toBe(0);
-    });
-    it("reports namespaceCount = scope length when scoped (skips cluster ns list)", async () => {
-        const calls = [];
-        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
-            calls.push(args);
-            return { items: [] };
-        });
-        const result = await runChecks({}, true, { namespaces: ["foo", "bar", "baz"] });
-        expect(result.namespaceCount).toBe(3);
-        // Should not have called get namespaces — that's cluster-scoped and may 403.
-        expect(calls.some((c) => c[0] === "get" && c[1] === "namespaces")).toBe(false);
-    });
-    it("accumulates pod counts across namespaces", async () => {
-        const okPod = (ns, name) => ({
-            metadata: { name, namespace: ns },
-            status: { phase: "Running", containerStatuses: [] },
-        });
-        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
-            if (args[1] === "pods" && args[3] === "foo") {
-                return { items: [okPod("foo", "a"), okPod("foo", "b"), okPod("foo", "c")] };
-            }
-            if (args[1] === "pods" && args[3] === "bar") {
-                return { items: [okPod("bar", "x"), okPod("bar", "y")] };
-            }
-            return { items: [] };
-        });
-        const result = await runChecks({}, true, { namespaces: ["foo", "bar"] });
-        expect(result.podCount).toBe(5);
-    });
-    it("empty scope.namespaces is treated as no scope (all-namespaces)", async () => {
-        const calls = [];
-        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
-            calls.push(args);
-            return { items: [] };
-        });
-        await runChecks({}, true, { namespaces: [] });
-        expect(calls.some((c) => c[0] === "get" && c[1] === "pods" && c.includes("--all-namespaces"))).toBe(true);
-    });
-});

package/dist/monitor/types.d.ts

@@ -1,11 +0,0 @@
-export type Severity = "info" | "warning" | "critical";
-export type IssueKind = "pod_crashloop" | "pod_oom" | "pod_image_pull" | "pod_pending" | "pod_failed" | "pod_evicted" | "pod_error" | "node_not_ready" | "node_pressure" | "cert_expiring" | "resource_high" | "job_failed" | "rollout_stuck";
-export interface Issue {
-    kind: IssueKind;
-    severity: Severity;
-    namespace: string;
-    resource: string;
-    message: string;
-    details: Record<string, unknown>;
-    timestamp: Date;
-}

package/dist/notify/discord.d.ts

@@ -1,4 +0,0 @@
-import type { Issue } from "../monitor/types.js";
-import type { DiscordChannel } from "../config.js";
-export declare function sendDiscordQuestion(channel: DiscordChannel, question: string, choices: string[] | undefined, clusterContext?: string): Promise<void>;
-export declare function sendDiscord(issues: Issue[], channel: DiscordChannel, clusterContext?: string): Promise<void>;

package/dist/notify/index.d.ts

@@ -1,6 +0,0 @@
-import type { Issue } from "../monitor/types.js";
-import type { KubeAgentConfig, NotificationChannel } from "../config.js";
-export declare function sendNotification(issues: Issue[], config: KubeAgentConfig, clusterContext?: string): Promise<void>;
-export declare function broadcastQuestion(question: string, choices: string[] | undefined, config: KubeAgentConfig, clusterContext?: string): Promise<void>;
-export declare function sendResolve(resolvedKeys: string[], config: KubeAgentConfig, clusterContext?: string): Promise<void>;
-export declare function describeChannel(channel: NotificationChannel): string;

package/dist/notify/pagerduty.d.ts

@@ -1,9 +0,0 @@
-import type { Issue } from "../monitor/types.js";
-import type { PagerDutyChannel } from "../config.js";
-export declare function dedupKey(issue: Issue): string;
-export declare function sendPagerDuty(issues: Issue[], channel: PagerDutyChannel, clusterContext?: string): Promise<void>;
-export declare function resolvePagerDuty(dedupKeys: string[], channel: PagerDutyChannel): Promise<void>;
-export declare function testPagerDutyCredentials(routingKey: string): Promise<{
-    ok: boolean;
-    error?: string;
-}>;

package/dist/notify/pagerduty.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/notify/pagerduty.test.js

@@ -1,97 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-const mockFetch = vi.fn();
-vi.stubGlobal("fetch", mockFetch);
-const channel = { type: "pagerduty", routing_key: "R0123456789abcdef", severity: "warning" };
-const issue = { kind: "pod_crashloop", severity: "critical", namespace: "prod", resource: "api-web", message: "Pod crash-looping (3 times)", details: {}, timestamp: new Date("2026-01-01T00:00:00Z") };
-describe("sendPagerDuty", () => {
-    beforeEach(() => {
-        mockFetch.mockReset();
-        mockFetch.mockResolvedValue({ ok: true, status: 202, json: async () => ({ status: "success" }) });
-    });
-    it("POSTs to PagerDuty Events API v2", async () => {
-        const { sendPagerDuty } = await import("./pagerduty.js");
-        await sendPagerDuty([issue], channel, "hetzner-prod");
-        expect(mockFetch.mock.calls[0][0]).toBe("https://events.pagerduty.com/v2/enqueue");
-    });
-    it("sends trigger with correct dedup_key", async () => {
-        const { sendPagerDuty } = await import("./pagerduty.js");
-        await sendPagerDuty([issue], channel);
-        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
-        expect(body.event_action).toBe("trigger");
-        expect(body.dedup_key).toBe("kubeagent:pod_crashloop:prod:api-web");
-        expect(body.routing_key).toBe("R0123456789abcdef");
-    });
-    it("maps critical severity correctly", async () => {
-        const { sendPagerDuty } = await import("./pagerduty.js");
-        await sendPagerDuty([{ ...issue, severity: "critical" }], channel);
-        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
-        expect(body.payload.severity).toBe("critical");
-    });
-    it("maps warning severity correctly", async () => {
-        const { sendPagerDuty } = await import("./pagerduty.js");
-        await sendPagerDuty([{ ...issue, severity: "warning" }], channel);
-        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
-        expect(body.payload.severity).toBe("warning");
-    });
-    it("maps info severity correctly", async () => {
-        const { sendPagerDuty } = await import("./pagerduty.js");
-        await sendPagerDuty([{ ...issue, severity: "info" }], channel);
-        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
-        expect(body.payload.severity).toBe("info");
-    });
-    it("fires one request per issue", async () => {
-        const { sendPagerDuty } = await import("./pagerduty.js");
-        await sendPagerDuty([issue, { ...issue, kind: "pod_oom", resource: "worker" }], channel);
-        expect(mockFetch).toHaveBeenCalledTimes(2);
-    });
-    it("does not throw on non-2xx", async () => {
-        mockFetch.mockResolvedValue({ ok: false, status: 400, statusText: "Bad Request", json: async () => ({}) });
-        const { sendPagerDuty } = await import("./pagerduty.js");
-        await expect(sendPagerDuty([issue], channel)).resolves.not.toThrow();
-    });
-});
-describe("resolvePagerDuty", () => {
-    beforeEach(() => {
-        mockFetch.mockReset();
-        mockFetch.mockResolvedValue({ ok: true, status: 202, json: async () => ({}) });
-    });
-    it("sends resolve events for each dedup key", async () => {
-        const { resolvePagerDuty } = await import("./pagerduty.js");
-        await resolvePagerDuty(["kubeagent:pod_crashloop:prod:api-web", "kubeagent:pod_oom:prod:worker"], channel);
-        expect(mockFetch).toHaveBeenCalledTimes(2);
-        const body0 = JSON.parse(mockFetch.mock.calls[0][1].body);
-        expect(body0.event_action).toBe("resolve");
-        expect(body0.dedup_key).toBe("kubeagent:pod_crashloop:prod:api-web");
-    });
-    it("does not throw on error", async () => {
-        mockFetch.mockRejectedValue(new Error("network failure"));
-        const { resolvePagerDuty } = await import("./pagerduty.js");
-        await expect(resolvePagerDuty(["kubeagent:pod_crashloop:prod:api-web"], channel)).resolves.not.toThrow();
-    });
-});
-describe("testPagerDutyCredentials", () => {
-    beforeEach(() => {
-        mockFetch.mockReset();
-        mockFetch.mockResolvedValue({ ok: true, status: 202, json: async () => ({}) });
-    });
-    it("returns ok:true when trigger succeeds", async () => {
-        const { testPagerDutyCredentials } = await import("./pagerduty.js");
-        const result = await testPagerDutyCredentials("R0123456789abcdef");
-        expect(result.ok).toBe(true);
-        expect(result.error).toBeUndefined();
-    });
-    it("returns ok:false with error when trigger fails", async () => {
-        mockFetch.mockResolvedValue({ ok: false, status: 400, statusText: "Bad Request", json: async () => ({ message: "Invalid routing key" }) });
-        const { testPagerDutyCredentials } = await import("./pagerduty.js");
-        const result = await testPagerDutyCredentials("bad-key");
-        expect(result.ok).toBe(false);
-        expect(result.error).toBe("Invalid routing key");
-    });
-    it("returns ok:false on network error", async () => {
-        mockFetch.mockRejectedValue(new Error("ECONNREFUSED"));
-        const { testPagerDutyCredentials } = await import("./pagerduty.js");
-        const result = await testPagerDutyCredentials("R0123456789abcdef");
-        expect(result.ok).toBe(false);
-        expect(result.error).toBe("ECONNREFUSED");
-    });
-});

package/dist/notify/setup.d.ts

@@ -1,9 +0,0 @@
-import type { NotificationChannel, SlackChannel, TelegramChannel } from "../config.js";
-import type { WebhookChannel, PagerDutyChannel, DiscordChannel, TeamsChannel } from "../config.js";
-export declare function setupSlack(): Promise<SlackChannel | null>;
-export declare function setupTelegram(): Promise<TelegramChannel | null>;
-export declare function setupWebhook(): Promise<WebhookChannel | null>;
-export declare function setupPagerDuty(): Promise<PagerDutyChannel | null>;
-export declare function setupDiscord(): Promise<DiscordChannel | null>;
-export declare function setupTeams(): Promise<TeamsChannel | null>;
-export declare function interactiveAddChannel(): Promise<NotificationChannel | null>;

package/dist/notify/slack.d.ts

@@ -1,4 +0,0 @@
-import type { Issue } from "../monitor/types.js";
-import type { SlackChannel } from "../config.js";
-export declare function sendSlackQuestion(channel: SlackChannel, question: string, choices: string[] | undefined, clusterContext?: string): Promise<void>;
-export declare function sendSlack(issues: Issue[], channel: SlackChannel, clusterContext?: string): Promise<void>;

package/dist/notify/ssrf-guard.d.ts

@@ -1,5 +0,0 @@
-/**
- * Returns true if the URL is safe to fetch (public host, valid scheme).
- * Returns false for invalid URLs or hosts in any blocked range.
- */
-export declare function isSafeWebhookUrl(rawUrl: string): Promise<boolean>;

package/dist/notify/teams.d.ts

@@ -1,3 +0,0 @@
-import type { Issue } from "../monitor/types.js";
-import type { TeamsChannel } from "../config.js";
-export declare function sendTeams(issues: Issue[], channel: TeamsChannel, clusterContext?: string): Promise<void>;

package/dist/notify/telegram.d.ts

@@ -1,9 +0,0 @@
-import type { Issue } from "../monitor/types.js";
-import type { TelegramChannel } from "../config.js";
-export declare function sendTelegramQuestion(channel: TelegramChannel, question: string, choices: string[] | undefined, clusterContext?: string): Promise<void>;
-export declare function sendTelegram(issues: Issue[], channel: TelegramChannel, clusterContext?: string): Promise<void>;
-export declare function autoDetectTelegramChatId(botToken: string): Promise<string | null>;
-export declare function testTelegramCredentials(botToken: string, chatId: string): Promise<{
-    ok: boolean;
-    error?: string;
-}>;

package/dist/notify/webhook.d.ts

@@ -1,3 +0,0 @@
-import type { Issue } from "../monitor/types.js";
-import type { WebhookChannel } from "../config.js";
-export declare function sendWebhook(issues: Issue[], channel: WebhookChannel, clusterContext?: string): Promise<void>;

package/dist/notify/webhook.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/notify/webhook.test.js

@@ -1,74 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-const mockFetch = vi.fn();
-vi.stubGlobal("fetch", mockFetch);
-// Mock DNS so the SSRF guard resolves example.com to a public address without
-// real network access, keeping tests hermetic.
-const mockLookup = vi.fn();
-vi.mock("node:dns", () => ({
-    promises: { lookup: (...args) => mockLookup(...args) },
-}));
-const channel = { type: "webhook", url: "https://example.com/hook", secret: "testsecret", severity: "warning" };
-const issue = { kind: "pod_crashloop", severity: "critical", namespace: "prod", resource: "api-web", message: "Pod crash-looping", details: { restartCount: 3 }, timestamp: new Date("2026-01-01T00:00:00Z") };
-describe("sendWebhook", () => {
-    beforeEach(() => {
-        mockFetch.mockReset();
-        mockFetch.mockResolvedValue({ ok: true, status: 200, statusText: "OK" });
-        mockLookup.mockReset();
-        mockLookup.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
-    });
-    it("POSTs to the configured URL", async () => {
-        const { sendWebhook } = await import("./webhook.js");
-        await sendWebhook([issue], channel, "hetzner-prod");
-        expect(mockFetch).toHaveBeenCalledOnce();
-        expect(mockFetch.mock.calls[0][0]).toBe("https://example.com/hook");
-        expect(mockFetch.mock.calls[0][1].method).toBe("POST");
-    });
-    it("sends Authorization: Bearer header when secret is set", async () => {
-        const { sendWebhook } = await import("./webhook.js");
-        await sendWebhook([issue], channel, "hetzner-prod");
-        expect(mockFetch.mock.calls[0][1].headers["Authorization"]).toBe("Bearer testsecret");
-    });
-    it("omits Authorization header when no secret", async () => {
-        const noSecretChannel = { ...channel, secret: undefined };
-        const { sendWebhook } = await import("./webhook.js");
-        await sendWebhook([issue], noSecretChannel);
-        expect(mockFetch.mock.calls[0][1].headers["Authorization"]).toBeUndefined();
-    });
-    it("includes cluster, timestamp, and issues in payload", async () => {
-        const { sendWebhook } = await import("./webhook.js");
-        await sendWebhook([issue], channel, "hetzner-prod");
-        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
-        expect(body.cluster).toBe("hetzner-prod");
-        expect(body.issues).toHaveLength(1);
-        expect(body.issues[0].kind).toBe("pod_crashloop");
-    });
-    it("does not throw on non-2xx response", async () => {
-        mockFetch.mockResolvedValue({ ok: false, status: 500, statusText: "Error" });
-        const { sendWebhook } = await import("./webhook.js");
-        await expect(sendWebhook([issue], channel)).resolves.not.toThrow();
-    });
-    it("does not throw on network error", async () => {
-        mockFetch.mockRejectedValue(new Error("network failure"));
-        const { sendWebhook } = await import("./webhook.js");
-        await expect(sendWebhook([issue], channel)).resolves.not.toThrow();
-    });
-    it("rejects invalid URL without throwing", async () => {
-        const badChannel = { ...channel, url: "not-a-url" };
-        const { sendWebhook } = await import("./webhook.js");
-        await expect(sendWebhook([issue], badChannel)).resolves.not.toThrow();
-        expect(mockFetch).not.toHaveBeenCalled();
-    });
-    it("blocks SSRF: does not fetch a literal private/metadata IP", async () => {
-        const metaChannel = { ...channel, url: "http://169.254.169.254/latest/meta-data/" };
-        const { sendWebhook } = await import("./webhook.js");
-        await expect(sendWebhook([issue], metaChannel)).resolves.not.toThrow();
-        expect(mockFetch).not.toHaveBeenCalled();
-    });
-    it("blocks SSRF: does not fetch a hostname resolving to loopback", async () => {
-        mockLookup.mockResolvedValue([{ address: "127.0.0.1", family: 4 }]);
-        const rebindChannel = { ...channel, url: "https://internal.evil.example/hook" };
-        const { sendWebhook } = await import("./webhook.js");
-        await expect(sendWebhook([issue], rebindChannel)).resolves.not.toThrow();
-        expect(mockFetch).not.toHaveBeenCalled();
-    });
-});