typekro 0.44.0 → 0.45.0

package/dist/factories/traefik/utils/index.d.ts

@@ -1,6 +1,11 @@
 /**
  * Traefik utilities.
  */
+export { TRAEFIK_ACCESS_LOG_DROPPED_HEADERS, TRAEFIK_CROWDSEC_ACCESS_LOG_FIELDS, traefikAccessLogFields, } from './access-log.js';
+export { type AwsNlbHealthCheckOptions, type AwsNlbServiceAnnotationOptions, awsNlbServiceAnnotations, } from './aws-nlb.js';
 export { applyTraefikOwnershipPins, applyTraefikSecurityPins, mapTraefikConfigToHelmValues, TRAEFIK_CONTAINER_SECURITY_CONTEXT, TRAEFIK_MAPPED_CHART_VERSION, TRAEFIK_OWNERSHIP_PINS, TRAEFIK_POD_SECURITY_CONTEXT, TRAEFIK_SECURITY_PINS, traefikEntrypointServiceType, type TraefikHelmValuesMapperOptions, type TraefikHelmValuesValidationContext, validateTraefikHelmValues, } from './helm-values-mapper.js';
 export { assertTraefikMiddlewareSpec, traefikMiddlewareKeys, validateTraefikMiddlewareSpec, } from './middleware-validation.js';
+export { assertTraefikProxyTrust, TRAEFIK_TRUSTED_IPS_VALIDATION_RULE, traefikBroadTrustWarnings, traefikProxyTrustIssues, traefikProxyTrustSchemaFieldValidations, } from './proxy-trust.js';
+export { parseTraefikTrustedRange, TRAEFIK_IPV4_MAPPED_PATTERN, TRAEFIK_TRUSTED_RANGE_PATTERN, type TraefikTrustedRange, } from './trusted-range.js';
+export { assertTraefikPlugins, traefikLocalPluginMountPath, traefikPluginIssues, traefikSecretValue, } from './plugins.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/factories/traefik/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,kCAAkC,EAClC,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACnC,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,kCAAkC,EAClC,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,mCAAmC,EACnC,yBAAyB,EACzB,uBAAuB,EACvB,uCAAuC,GACxC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}

package/dist/factories/traefik/utils/index.js

@@ -1,6 +1,11 @@
 /**
  * Traefik utilities.
  */
+export { TRAEFIK_ACCESS_LOG_DROPPED_HEADERS, TRAEFIK_CROWDSEC_ACCESS_LOG_FIELDS, traefikAccessLogFields, } from './access-log.js';
+export { awsNlbServiceAnnotations, } from './aws-nlb.js';
 export { applyTraefikOwnershipPins, applyTraefikSecurityPins, mapTraefikConfigToHelmValues, TRAEFIK_CONTAINER_SECURITY_CONTEXT, TRAEFIK_MAPPED_CHART_VERSION, TRAEFIK_OWNERSHIP_PINS, TRAEFIK_POD_SECURITY_CONTEXT, TRAEFIK_SECURITY_PINS, traefikEntrypointServiceType, validateTraefikHelmValues, } from './helm-values-mapper.js';
 export { assertTraefikMiddlewareSpec, traefikMiddlewareKeys, validateTraefikMiddlewareSpec, } from './middleware-validation.js';
+export { assertTraefikProxyTrust, TRAEFIK_TRUSTED_IPS_VALIDATION_RULE, traefikBroadTrustWarnings, traefikProxyTrustIssues, traefikProxyTrustSchemaFieldValidations, } from './proxy-trust.js';
+export { parseTraefikTrustedRange, TRAEFIK_IPV4_MAPPED_PATTERN, TRAEFIK_TRUSTED_RANGE_PATTERN, } from './trusted-range.js';
+export { assertTraefikPlugins, traefikLocalPluginMountPath, traefikPluginIssues, traefikSecretValue, } from './plugins.js';
 //# sourceMappingURL=index.js.map

package/dist/factories/traefik/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,kCAAkC,EAClC,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAG5B,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAGL,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,kCAAkC,EAClC,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAG5B,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,mCAAmC,EACnC,yBAAyB,EACzB,uBAAuB,EACvB,uCAAuC,GACxC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,GAE9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}

package/dist/factories/traefik/utils/middleware-validation.d.ts

@@ -1,20 +1,3 @@
-/**
- * `Middleware` spec validation.
- *
- * A Traefik `Middleware` configures exactly one behavior. Two keys in one
- * object is not a merge — Traefik picks one and silently drops the other — so
- * this is a real misconfiguration worth rejecting.
- *
- * The type system already makes it a compile error (see
- * `TraefikMiddlewareSpec`), but the same rule is re-checked at runtime for
- * JavaScript callers and for specs assembled dynamically.
- *
- * **Why this check is safe outside a status builder:** it only inspects which
- * KEYS a spec object carries, never their values. Keys are always written by
- * the author and are concrete in both direct and KRO mode, so this never
- * inspects a schema proxy. Value-level validation, which would have to reason
- * about refs, is deliberately absent.
- */
 /** The middleware keys a spec object carries, in declaration order. */
 export declare function traefikMiddlewareKeys(spec: unknown): readonly string[];
 /**

package/dist/factories/traefik/utils/middleware-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware-validation.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/middleware-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAKtE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CA+B9E;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAQ7E"}
+{"version":3,"file":"middleware-validation.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/middleware-validation.ts"],"names":[],"mappings":"AAqBA,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAKtE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CA+B9E;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAQ7E"}

package/dist/factories/traefik/utils/middleware-validation.js

@@ -1,20 +1,18 @@
-/**
- * `Middleware` spec validation.
- *
- * A Traefik `Middleware` configures exactly one behavior. Two keys in one
- * object is not a merge — Traefik picks one and silently drops the other — so
- * this is a real misconfiguration worth rejecting.
- *
- * The type system already makes it a compile error (see
- * `TraefikMiddlewareSpec`), but the same rule is re-checked at runtime for
- * JavaScript callers and for specs assembled dynamically.
- *
- * **Why this check is safe outside a status builder:** it only inspects which
- * KEYS a spec object carries, never their values. Keys are always written by
- * the author and are concrete in both direct and KRO mode, so this never
- * inspects a schema proxy. Value-level validation, which would have to reason
- * about refs, is deliberately absent.
- */
+// `Middleware` spec validation.
+//
+// A Traefik `Middleware` configures exactly one behavior. Two keys in one
+// object is not a merge — Traefik picks one and silently drops the other — so
+// this is a real misconfiguration worth rejecting.
+//
+// The type system already makes it a compile error (see
+// `TraefikMiddlewareSpec`), but the same rule is re-checked at runtime for
+// JavaScript callers and for specs assembled dynamically.
+//
+// **Why this check is safe outside a status builder:** it only inspects which
+// KEYS a spec object carries, never their values. Keys are always written by
+// the author and are concrete in both direct and KRO mode, so this never
+// inspects a schema proxy. Value-level validation, which would have to reason
+// about refs, is deliberately absent.
 import { TypeKroError } from '../../../core/errors.js';
 import { TRAEFIK_MIDDLEWARE_KINDS } from '../constants.js';
 const MIDDLEWARE_KIND_SET = new Set(TRAEFIK_MIDDLEWARE_KINDS);

package/dist/factories/traefik/utils/middleware-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware-validation.js","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/middleware-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAEnF,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,IAAa;IACjD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAChF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,4EAA4E,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAErE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CACT,yDAAyD,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,gCAAgC,SAAS,CAAC,MAAM,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACxF,wFAAwF;YACxF,uFAAuF;YACvF,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,+CAA+C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACvE,8BAA8B,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAa,EAAE,IAAY;IACrE,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,IAAI,YAAY,CACpB,+BAA+B,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC3D,iCAAiC,EACjC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,EAAE,CACpD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"middleware-validation.js","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/middleware-validation.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,mDAAmD;AACnD,EAAE;AACF,wDAAwD;AACxD,2EAA2E;AAC3E,0DAA0D;AAC1D,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,sCAAsC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAEnF,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,IAAa;IACjD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAChF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,4EAA4E,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAErE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CACT,yDAAyD,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,gCAAgC,SAAS,CAAC,MAAM,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACxF,wFAAwF;YACxF,uFAAuF;YACvF,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,+CAA+C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACvE,8BAA8B,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAa,EAAE,IAAY;IACrE,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,IAAI,YAAY,CACpB,+BAA+B,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC3D,iCAAiC,EACjC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,EAAE,CACpD,CAAC;AACJ,CAAC"}

package/dist/factories/traefik/utils/plugins.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Traefik plugin declarations (`experimental.plugins` / `experimental.localPlugins`).
+ */
+import type { TraefikLocalPluginDeclaration, TraefikPluginDeclaration } from '../types.js';
+export declare const TRAEFIK_PLUGIN_NAME: RegExp;
+/**
+ * Volume names raw chart values add to the Traefik pod, where they are
+ * literal: `volumes[].name` (with "." turned into "-", as the chart does),
+ * `persistence.name` and `deployment.additionalVolumes[].name`.
+ */
+export declare function traefikRawVolumeNames(values: Readonly<Record<string, unknown>>): string[];
+/** Where Traefik loads a local plugin from: `./plugins-local/src/<moduleName>`. */
+export declare function traefikLocalPluginMountPath(moduleName: string): string;
+/** Problems with plugin declarations; empty when there are none. */
+export declare function traefikPluginIssues(plugins?: Readonly<Record<string, TraefikPluginDeclaration>>, localPlugins?: Readonly<Record<string, TraefikLocalPluginDeclaration>>, rawVolumeNames?: readonly string[]): string[];
+/**
+ * Throw when a plugin declaration is malformed or unpinned.
+ *
+ * @throws {TypeKroError} With code `TRAEFIK_PLUGIN_INVALID`.
+ */
+export declare function assertTraefikPlugins(plugins?: Readonly<Record<string, TraefikPluginDeclaration>>, localPlugins?: Readonly<Record<string, TraefikLocalPluginDeclaration>>, rawVolumeNames?: readonly string[]): void;
+/**
+ * A plugin configuration value Traefik reads from a Secret in the Middleware's namespace.
+ *
+ * Traefik's CRD provider resolves `urn:k8s:secret:<secret>:<key>` strings at any
+ * depth of a `plugin` middleware's configuration. Only plugin configuration is
+ * resolved this way.
+ *
+ * @example
+ * ```typescript
+ * traefikPluginMiddleware({
+ *   name: 'bouncer', namespace: 'edge', plugin: 'crowdsec',
+ *   config: { apiKey: traefikSecretValue('bouncer-key', 'api-key') },
+ * });
+ * ```
+ */
+export declare function traefikSecretValue(secretName: string, key: string): string;
+//# sourceMappingURL=plugins.d.ts.map

package/dist/factories/traefik/utils/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/plugins.ts"],"names":[],"mappings":"AAAA;;GAEG;AAaH,OAAO,KAAK,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAM3F,eAAO,MAAM,mBAAmB,EAAE,MAAmC,CAAC;AA4BtE;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,EAAE,CAoBzF;AAUD,mFAAmF;AACnF,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAM,EAChE,YAAY,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAM,EAC1E,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,MAAM,EAAE,CAwDV;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,EAC5D,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC,EACtE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,IAAI,CAQN;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAe1E"}

package/dist/factories/traefik/utils/plugins.js

@@ -0,0 +1,175 @@
+/**
+ * Traefik plugin declarations (`experimental.plugins` / `experimental.localPlugins`).
+ */
+// Traefik downloads a registry plugin from plugins.traefik.io at startup and,
+// when `hash` is set, compares the SHA-256 of the downloaded archive with it
+// and refuses to load a mismatch (`pkg/plugins/manager.go`, InstallPlugin).
+// Without a hash it only asks the registry whether the archive is intact, so
+// whoever controls the registry, the network path or a re-tagged version
+// decides what code runs inside the edge. That is why `hash` is required here.
+//
+// To find the hash, download the archive the edge would fetch and hash it:
+//   curl -sL https://plugins.traefik.io/public/download/<moduleName>/<version> | sha256sum
+// Traefik's own error for a wrong hash also prints the hash it computed.
+import { TypeKroError } from '../../../core/errors.js';
+// Plugin names become CLI flag segments (`--experimental.plugins.<name>...`)
+// and `Middleware.spec.plugin` keys, so they stay to one flag-safe word.
+// Exported for integrations that name a plugin (CrowdSec's bouncer); not
+// re-exported from `typekro/traefik`.
+export const TRAEFIK_PLUGIN_NAME = /^[A-Za-z][A-Za-z0-9_-]*$/;
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+// The chart writes `moduleName`, `version`, a local plugin's `volumeName` and
+// `subPath`, and inline source file names into its templates unescaped. A
+// quote or newline there would add YAML of the caller's choosing (another
+// argument, mount or manifest) behind every check TypeKro runs on the values,
+// so each is held to the characters its real form uses.
+// A Go module path: letters, digits and `-._~/`.
+const MODULE_NAME = /^[A-Za-z0-9][A-Za-z0-9._~/-]*$/;
+// A release tag such as `v1.4.2` or `v2.0.0-rc.1+build.5`.
+const VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
+// A Kubernetes volume name (DNS-1123 label).
+const VOLUME_NAME = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/;
+// A relative path inside the volume.
+const SUB_PATH = /^[A-Za-z0-9._-][A-Za-z0-9._/-]*$/;
+// A ConfigMap key: `[-._a-zA-Z0-9]+`, at most 253 characters, and neither
+// `.`, `..` nor anything starting with `..` (Kubernetes' IsConfigMapKey).
+const FILE_NAME = /^[-._A-Za-z0-9]{1,253}$/;
+// A local plugin's name becomes a volume name (`inlinePlugin`) and part of the
+// ConfigMap the chart creates, `<release>-local-plugin-<name>`, so it must be
+// a DNS-1123 label. The release part is at most 63 characters (the chart
+// truncates it), so that name is at most 63 + 14 + 63 = 140 characters, well
+// inside the 253 a ConfigMap name allows.
+const LOCAL_PLUGIN_NAME = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/;
+// Volumes the chart itself adds to the pod, which an inline plugin's volume
+// (named after the plugin) would collide with.
+const CHART_VOLUME_NAMES = new Set(['data', 'tmp', 'plugins', 'hub-token', 'traefik-extra-config']);
+/**
+ * Volume names raw chart values add to the Traefik pod, where they are
+ * literal: `volumes[].name` (with "." turned into "-", as the chart does),
+ * `persistence.name` and `deployment.additionalVolumes[].name`.
+ */
+export function traefikRawVolumeNames(values) {
+    const names = [];
+    const nameOf = (entry) => typeof entry === 'object' && entry !== null ? Reflect.get(entry, 'name') : undefined;
+    const listNames = (list, transform) => {
+        if (!Array.isArray(list))
+            return;
+        for (const entry of list) {
+            const name = nameOf(entry);
+            // A templated name is only known at render time; skip it.
+            if (typeof name === 'string' && !name.includes('{{'))
+                names.push(transform(name));
+        }
+    };
+    listNames(values.volumes, (name) => name.replaceAll('.', '-'));
+    const persistenceName = nameOf(values.persistence);
+    if (typeof persistenceName === 'string')
+        names.push(persistenceName);
+    const deployment = values.deployment;
+    if (typeof deployment === 'object' && deployment !== null) {
+        listNames(Reflect.get(deployment, 'additionalVolumes'), (name) => name);
+    }
+    return names;
+}
+function isConfigMapKey(key) {
+    return FILE_NAME.test(key) && key !== '.' && !key.startsWith('..');
+}
+function hasParentSegment(path) {
+    return path.split('/').includes('..');
+}
+/** Where Traefik loads a local plugin from: `./plugins-local/src/<moduleName>`. */
+export function traefikLocalPluginMountPath(moduleName) {
+    return `/plugins-local/src/${moduleName}`;
+}
+/** Problems with plugin declarations; empty when there are none. */
+export function traefikPluginIssues(plugins = {}, localPlugins = {}, rawVolumeNames = []) {
+    const issues = [];
+    const takenVolumeNames = new Set([...CHART_VOLUME_NAMES, ...rawVolumeNames]);
+    for (const [name, plugin] of Object.entries(plugins)) {
+        if (!TRAEFIK_PLUGIN_NAME.test(name)) {
+            issues.push(`plugin name ${name} must match ${TRAEFIK_PLUGIN_NAME}.`);
+        }
+        if (!MODULE_NAME.test(plugin.moduleName)) {
+            issues.push(`plugin ${name} needs a Go module path as its moduleName.`);
+        }
+        if (!VERSION.test(plugin.version) || plugin.version === 'latest') {
+            issues.push(`plugin ${name} needs an exact version, not ${JSON.stringify(plugin.version)}.`);
+        }
+        if (!SHA256_HEX.test(plugin.hash)) {
+            issues.push(`plugin ${name} hash must be the archive's SHA-256 as 64 lowercase hex digits.`);
+        }
+    }
+    for (const [name, plugin] of Object.entries(localPlugins)) {
+        if (!LOCAL_PLUGIN_NAME.test(name)) {
+            issues.push(`local plugin name ${name} must be a DNS-1123 label (lowercase letters, digits and "-", ` +
+                'at most 63 characters): the chart uses it in a volume and a ConfigMap name.');
+        }
+        else if (plugin.type === 'inlinePlugin' && takenVolumeNames.has(name)) {
+            issues.push(`local plugin name ${name} is a volume name the pod already has (the chart's own, ` +
+                'or one from raw volumes, persistence or deployment.additionalVolumes).');
+        }
+        if (name in plugins)
+            issues.push(`plugin ${name} is declared both as a registry and a local plugin.`);
+        if (!MODULE_NAME.test(plugin.moduleName) || plugin.moduleName.includes('..')) {
+            issues.push(`local plugin ${name} needs a Go module path without ".." as its moduleName.`);
+        }
+        if (plugin.type === 'inlinePlugin') {
+            const files = Object.keys(plugin.source);
+            if (files.length === 0)
+                issues.push(`local plugin ${name} has no source files.`);
+            for (const file of files.filter((file) => !isConfigMapKey(file))) {
+                issues.push(`local plugin ${name} source file ${JSON.stringify(file)} must be a ConfigMap key ` +
+                    '(letters, digits, "-", "_" and ".", not "." or starting with "..").');
+            }
+        }
+        else {
+            if (!VOLUME_NAME.test(plugin.volumeName)) {
+                issues.push(`local plugin ${name} volumeName must be a Kubernetes volume name.`);
+            }
+            if (plugin.subPath !== undefined &&
+                (!SUB_PATH.test(plugin.subPath) || hasParentSegment(plugin.subPath))) {
+                issues.push(`local plugin ${name} subPath must be a relative path without "..".`);
+            }
+        }
+    }
+    return issues;
+}
+/**
+ * Throw when a plugin declaration is malformed or unpinned.
+ *
+ * @throws {TypeKroError} With code `TRAEFIK_PLUGIN_INVALID`.
+ */
+export function assertTraefikPlugins(plugins, localPlugins, rawVolumeNames) {
+    const issues = traefikPluginIssues(plugins, localPlugins, rawVolumeNames);
+    if (issues.length === 0)
+        return;
+    throw new TypeKroError(`Invalid Traefik plugin declaration: ${issues.join(' ')}`, 'TRAEFIK_PLUGIN_INVALID', { issues });
+}
+/**
+ * A plugin configuration value Traefik reads from a Secret in the Middleware's namespace.
+ *
+ * Traefik's CRD provider resolves `urn:k8s:secret:<secret>:<key>` strings at any
+ * depth of a `plugin` middleware's configuration. Only plugin configuration is
+ * resolved this way.
+ *
+ * @example
+ * ```typescript
+ * traefikPluginMiddleware({
+ *   name: 'bouncer', namespace: 'edge', plugin: 'crowdsec',
+ *   config: { apiKey: traefikSecretValue('bouncer-key', 'api-key') },
+ * });
+ * ```
+ */
+export function traefikSecretValue(secretName, key) {
+    // Traefik splits the URN on ':' and expects exactly five parts.
+    for (const [what, value] of [
+        ['secret name', secretName],
+        ['key', key],
+    ]) {
+        if (value === '' || value.includes(':')) {
+            throw new TypeKroError(`Invalid Traefik secret reference: the ${what} must be non-empty and contain no ":".`, 'TRAEFIK_SECRET_REFERENCE_INVALID', { secretName, key });
+        }
+    }
+    return `urn:k8s:secret:${secretName}:${key}`;
+}
+//# sourceMappingURL=plugins.js.map

package/dist/factories/traefik/utils/plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/plugins.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,2FAA2F;AAC3F,yEAAyE;AAEzE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,6EAA6E;AAC7E,yEAAyE;AACzE,yEAAyE;AACzE,sCAAsC;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAW,0BAA0B,CAAC;AACtE,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,8EAA8E;AAC9E,wDAAwD;AACxD,iDAAiD;AACjD,MAAM,WAAW,GAAG,gCAAgC,CAAC;AACrD,2DAA2D;AAC3D,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAChD,6CAA6C;AAC7C,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAC3D,qCAAqC;AACrC,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AACpD,0EAA0E;AAC1E,0EAA0E;AAC1E,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAC5C,+EAA+E;AAC/E,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,0CAA0C;AAC1C,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AACjE,4EAA4E;AAC5E,+CAA+C;AAC/C,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEpG;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAyC;IAC7E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,KAAc,EAAW,EAAE,CACzC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,SAAS,GAAG,CAAC,IAAa,EAAE,SAAmC,EAAE,EAAE;QACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QACjC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,0DAA0D;YAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC;IACF,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,OAAO,eAAe,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1D,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,OAAO,sBAAsB,UAAU,EAAE,CAAC;AAC5C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CACjC,UAA8D,EAAE,EAChE,eAAwE,EAAE,EAC1E,iBAAoC,EAAE;IAEtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,kBAAkB,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;IAC7E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,eAAe,mBAAmB,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,4CAA4C,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,gCAAgC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,iEAAiE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CACT,qBAAqB,IAAI,gEAAgE;gBACvF,6EAA6E,CAChF,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CACT,qBAAqB,IAAI,0DAA0D;gBACjF,wEAAwE,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,IAAI,OAAO;YACjB,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,qDAAqD,CAAC,CAAC;QACnF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,yDAAyD,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,uBAAuB,CAAC,CAAC;YACjF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CACT,gBAAgB,IAAI,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B;oBACjF,qEAAqE,CACxE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,+CAA+C,CAAC,CAAC;YACnF,CAAC;YACD,IACE,MAAM,CAAC,OAAO,KAAK,SAAS;gBAC5B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EACpE,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,gDAAgD,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA4D,EAC5D,YAAsE,EACtE,cAAkC;IAElC,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,IAAI,YAAY,CACpB,uCAAuC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EACzD,wBAAwB,EACxB,EAAE,MAAM,EAAE,CACX,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,GAAW;IAChE,gEAAgE;IAChE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,aAAa,EAAE,UAAU,CAAC;QAC3B,CAAC,KAAK,EAAE,GAAG,CAAC;KACJ,EAAE,CAAC;QACX,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,yCAAyC,IAAI,wCAAwC,EACrF,kCAAkC,EAClC,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,kBAAkB,UAAU,IAAI,GAAG,EAAE,CAAC;AAC/C,CAAC"}

package/dist/factories/traefik/utils/proxy-trust.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Which upstream sources a Traefik entrypoint believes.
+ */
+import type { TraefikHelmValues } from '../types.js';
+/**
+ * Admission rule on each KRO-mode `trustedIPs` list: every entry in the strict
+ * format and not `/0`.
+ *
+ * The API server estimates a CEL rule's cost from the schema, so the list
+ * carries `maxItems=64` and its items `maxLength=43` (through a SimpleSchema
+ * custom type); without those bounds `matches()` would exceed the CRD budget.
+ * The rendered values also keep only entries in the strict format (see
+ * `traefikStrictTrustedIPs`), as a second line of defence.
+ */
+export declare const TRAEFIK_TRUSTED_IPS_VALIDATION_RULE: string;
+/**
+ * Problems with the proxy trust in final chart values; empty when there are none.
+ *
+ * Schema references under `ports` are skipped: KRO mode checks those on the
+ * CRD. In `env` and `envFrom` nothing on the CRD checks them, so a value the
+ * guard cannot see counts as a problem.
+ */
+export declare function traefikProxyTrustIssues(values: TraefikHelmValues): string[];
+/**
+ * Throw when final chart values trust every source for PROXY protocol or forwarded headers,
+ * or carry trust settings whose value TypeKro cannot see.
+ *
+ * @throws {TypeKroError} With code `TRAEFIK_UNTRUSTED_PROXY_SOURCE`.
+ */
+export declare function assertTraefikProxyTrust(values: TraefikHelmValues): void;
+/**
+ * Warnings for trusted ranges that are legal but very broad: an IPv4 prefix
+ * shorter than /8 or an IPv6 prefix shorter than /16.
+ */
+export declare function traefikBroadTrustWarnings(values: TraefikHelmValues): string[];
+/** `schemaFieldValidations` refusing `/0` trusted ranges on a KRO instance. */
+export declare function traefikProxyTrustSchemaFieldValidations(): Record<string, string>;
+/**
+ * A `trustedIPs` value for the chart, holding a KRO schema reference to the
+ * entries that pass the strict format.
+ *
+ * Direct mode sees concrete lists, which the guard checks whole. In KRO mode
+ * the CRD refuses the same entries at admission; this filter is the second
+ * line of defence, keeping only entries that are one valid range (and, unless
+ * `allowAnySource`, not `/0`). A dropped entry narrows trust; it never widens it.
+ */
+export declare function traefikStrictTrustedIPs<T>(ranges: T, allowAnySource: boolean): T;
+//# sourceMappingURL=proxy-trust.d.ts.map

package/dist/factories/traefik/utils/proxy-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-trust.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/proxy-trust.ts"],"names":[],"mappings":"AAAA;;GAEG;AAiDH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAOrD;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC,QAAwD,CAAC;AAkGzG;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAe3E;AAmRD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAavE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,EAAE,CA6B7E;AAED,+EAA+E;AAC/E,wBAAgB,uCAAuC,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,GAAG,CAAC,CAahF"}