@f5-sales-demo/pi-resource-management 22.8.1 → 22.8.3

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/pi-resource-management",
-	"version": "22.8.1",
+	"version": "22.8.3",
 	"description": "Shared resource management for F5 XC manifest parsing, validation, diff, and CRUD operations",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Robin Mordasiewicz",

package/src/defaults-metadata.generated.ts

@@ -1,6 +1,6 @@
 // AUTO-GENERATED by scripts/generate-defaults.ts — DO NOT EDIT BY HAND.
 // Per-kind defaults knowledge for minimum-settings export. Regenerate with: bun run generate-defaults
-// Source: https://github.com/f5-sales-demo/api-specs-enriched/releases/download/v4.0.0/minimal-export-defaults.json (api-specs-enriched 4.0.0)
+// Source: https://github.com/f5-sales-demo/api-specs-enriched/releases/download/v10.0.0/minimal-export-defaults.json (api-specs-enriched 10.0.0)
 import type { KindDefaultsMetadata } from "./defaults-metadata";
 
 export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
@@ -162,6 +162,9 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.detection_settings.enable_threat_campaigns": ["disable_threat_campaigns"],
 			"spec.detection_settings.signature_selection_setting.attack_type_settings": ["default_attack_type_settings"],
 			"spec.detection_settings.signature_selection_setting.default_attack_type_settings": ["attack_type_settings"],
+			"spec.detection_settings.signature_selection_setting.default_signature_setting": [
+				"signature_settings_by_accuracy",
+			],
 			"spec.detection_settings.signature_selection_setting.high_medium_accuracy_signatures": [
 				"high_medium_low_accuracy_signatures",
 				"only_high_accuracy_signatures",
@@ -174,6 +177,9 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 				"high_medium_accuracy_signatures",
 				"high_medium_low_accuracy_signatures",
 			],
+			"spec.detection_settings.signature_selection_setting.signature_settings_by_accuracy": [
+				"default_signature_setting",
+			],
 			"spec.detection_settings.stage_new_and_updated_signatures": ["disable_staging", "stage_new_signatures"],
 			"spec.detection_settings.stage_new_signatures": ["disable_staging", "stage_new_and_updated_signatures"],
 			"spec.detection_settings.violation_settings": ["default_violation_settings"],
@@ -502,6 +508,12 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.kubernetes_upgrade_drain.disable_upgrade_drain": ["enable_upgrade_drain"],
 			"spec.kubernetes_upgrade_drain.enable_upgrade_drain": ["disable_upgrade_drain"],
 			"spec.kubernetes_upgrade_drain.enable_upgrade_drain.disable_vega_upgrade_mode": ["enable_vega_upgrade_mode"],
+			"spec.kubernetes_upgrade_drain.enable_upgrade_drain.drain_max_unavailable_node_count": [
+				"drain_max_unavailable_node_percentage",
+			],
+			"spec.kubernetes_upgrade_drain.enable_upgrade_drain.drain_max_unavailable_node_percentage": [
+				"drain_max_unavailable_node_count",
+			],
 			"spec.kubernetes_upgrade_drain.enable_upgrade_drain.enable_vega_upgrade_mode": ["disable_vega_upgrade_mode"],
 			"spec.log_receiver": ["logs_streaming_disabled"],
 			"spec.logs_streaming_disabled": ["log_receiver"],
@@ -587,6 +599,8 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.voltstack_cluster_ar.sm_connection_public_ip": ["sm_connection_pvt_ip"],
 			"spec.voltstack_cluster_ar.sm_connection_pvt_ip": ["sm_connection_public_ip"],
 			"spec.voltstack_cluster_ar.storage_class_list": ["default_storage"],
+			"spec.waf_signatures.automatic": ["manual"],
+			"spec.waf_signatures.manual": ["automatic"],
 		},
 	},
 	certificate: {
@@ -1137,9 +1151,11 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.unhealthy_threshold",
 		],
 		fieldConflicts: {
+			"spec.default_jitter": ["jitter_percent"],
 			"spec.http_health_check": ["tcp_health_check", "udp_icmp_health_check"],
 			"spec.http_health_check.host_header": ["use_origin_server_name"],
 			"spec.http_health_check.use_origin_server_name": ["host_header"],
+			"spec.jitter_percent": ["default_jitter"],
 			"spec.tcp_health_check": ["http_health_check", "udp_icmp_health_check"],
 			"spec.udp_icmp_health_check": ["http_health_check", "tcp_health_check"],
 		},
@@ -1238,7 +1254,9 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 		minimumConfigFields: [
 			"spec.active_service_policies.policies",
 			"spec.advertise_custom.advertise_where",
+			"spec.advertise_dualstack_on_public.public_ip.name",
 			"spec.advertise_on_public.public_ip.name",
+			"spec.advertise_v6_on_public.public_ip.name",
 			"spec.api_rate_limit.custom_ip_allowed_list.rate_limiter_allowed_prefixes",
 			"spec.api_specification.api_definition.name",
 			"spec.api_specification.validation_all_spec_endpoints.fall_through_mode.fall_through_mode_custom.open_api_validation_rules",
@@ -1250,9 +1268,12 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.app_firewall.name",
 			"spec.bot_defense.policy.js_insertion_rules.rules",
 			"spec.bot_defense.policy.protected_app_endpoints",
-			"spec.bot_defense_advanced.js_insertion_rules.rules",
-			"spec.bot_defense_advanced.mobile.name",
-			"spec.bot_defense_advanced.web.name",
+			"spec.bot_defense_advanced_protection.both_web_and_mobile.js_insertion_rules.rules",
+			"spec.bot_defense_advanced_protection.both_web_and_mobile.mobile.name",
+			"spec.bot_defense_advanced_protection.both_web_and_mobile.web.name",
+			"spec.bot_defense_advanced_protection.mobile_only.mobile.name",
+			"spec.bot_defense_advanced_protection.web_only.js_insertion_rules.rules",
+			"spec.bot_defense_advanced_protection.web_only.web.name",
 			"spec.captcha_challenge.cookie_expiry",
 			"spec.client_side_defense.policy.js_insertion_rules.rules",
 			"spec.cookie_stickiness.name",
@@ -1325,9 +1346,41 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 		],
 		fieldConflicts: {
 			"spec.active_service_policies": ["no_service_policies", "service_policies_from_namespace"],
-			"spec.advertise_custom": ["advertise_on_public", "advertise_on_public_default_vip", "do_not_advertise"],
-			"spec.advertise_on_public": ["advertise_custom", "advertise_on_public_default_vip", "do_not_advertise"],
-			"spec.advertise_on_public_default_vip": ["advertise_custom", "advertise_on_public", "do_not_advertise"],
+			"spec.advertise_custom": [
+				"advertise_dualstack_on_public",
+				"advertise_on_public",
+				"advertise_on_public_default_vip",
+				"advertise_v6_on_public",
+				"do_not_advertise",
+			],
+			"spec.advertise_dualstack_on_public": [
+				"advertise_custom",
+				"advertise_on_public",
+				"advertise_on_public_default_vip",
+				"advertise_v6_on_public",
+				"do_not_advertise",
+			],
+			"spec.advertise_on_public": [
+				"advertise_custom",
+				"advertise_dualstack_on_public",
+				"advertise_on_public_default_vip",
+				"advertise_v6_on_public",
+				"do_not_advertise",
+			],
+			"spec.advertise_on_public_default_vip": [
+				"advertise_custom",
+				"advertise_dualstack_on_public",
+				"advertise_on_public",
+				"advertise_v6_on_public",
+				"do_not_advertise",
+			],
+			"spec.advertise_v6_on_public": [
+				"advertise_custom",
+				"advertise_dualstack_on_public",
+				"advertise_on_public",
+				"advertise_on_public_default_vip",
+				"do_not_advertise",
+			],
 			"spec.api_rate_limit": ["disable_rate_limit", "rate_limit"],
 			"spec.api_rate_limit.bypass_rate_limiting_rules": [
 				"custom_ip_allowed_list",
@@ -1414,7 +1467,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.api_testing.every_month": ["every_day", "every_week"],
 			"spec.api_testing.every_week": ["every_day", "every_month"],
 			"spec.app_firewall": ["disable_waf"],
-			"spec.bot_defense": ["bot_defense_advanced", "disable_bot_defense"],
+			"spec.bot_defense": ["bot_defense_advanced_protection", "disable_bot_defense"],
 			"spec.bot_defense.disable_cors_support": ["enable_cors_support"],
 			"spec.bot_defense.enable_cors_support": ["disable_cors_support"],
 			"spec.bot_defense.policy.disable_js_insert": [
@@ -1439,29 +1492,52 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 				"js_insert_all_pages_except",
 			],
 			"spec.bot_defense.policy.mobile_sdk_config": ["disable_mobile_sdk"],
-			"spec.bot_defense_advanced": ["bot_defense", "disable_bot_defense"],
-			"spec.bot_defense_advanced.disable_js_insert": [
+			"spec.bot_defense_advanced_protection": ["bot_defense", "disable_bot_defense"],
+			"spec.bot_defense_advanced_protection.both_web_and_mobile": ["mobile_only", "web_only"],
+			"spec.bot_defense_advanced_protection.both_web_and_mobile.disable_js_insert": [
+				"js_insert_all_pages",
+				"js_insert_all_pages_except",
+				"js_insertion_rules",
+			],
+			"spec.bot_defense_advanced_protection.both_web_and_mobile.disable_mobile_sdk": ["mobile_sdk_config"],
+			"spec.bot_defense_advanced_protection.both_web_and_mobile.js_insert_all_pages": [
+				"disable_js_insert",
+				"js_insert_all_pages_except",
+				"js_insertion_rules",
+			],
+			"spec.bot_defense_advanced_protection.both_web_and_mobile.js_insert_all_pages_except": [
+				"disable_js_insert",
+				"js_insert_all_pages",
+				"js_insertion_rules",
+			],
+			"spec.bot_defense_advanced_protection.both_web_and_mobile.js_insertion_rules": [
+				"disable_js_insert",
+				"js_insert_all_pages",
+				"js_insert_all_pages_except",
+			],
+			"spec.bot_defense_advanced_protection.both_web_and_mobile.mobile_sdk_config": ["disable_mobile_sdk"],
+			"spec.bot_defense_advanced_protection.mobile_only": ["both_web_and_mobile", "web_only"],
+			"spec.bot_defense_advanced_protection.web_only": ["both_web_and_mobile", "mobile_only"],
+			"spec.bot_defense_advanced_protection.web_only.disable_js_insert": [
 				"js_insert_all_pages",
 				"js_insert_all_pages_except",
 				"js_insertion_rules",
 			],
-			"spec.bot_defense_advanced.disable_mobile_sdk": ["mobile_sdk_config"],
-			"spec.bot_defense_advanced.js_insert_all_pages": [
+			"spec.bot_defense_advanced_protection.web_only.js_insert_all_pages": [
 				"disable_js_insert",
 				"js_insert_all_pages_except",
 				"js_insertion_rules",
 			],
-			"spec.bot_defense_advanced.js_insert_all_pages_except": [
+			"spec.bot_defense_advanced_protection.web_only.js_insert_all_pages_except": [
 				"disable_js_insert",
 				"js_insert_all_pages",
 				"js_insertion_rules",
 			],
-			"spec.bot_defense_advanced.js_insertion_rules": [
+			"spec.bot_defense_advanced_protection.web_only.js_insertion_rules": [
 				"disable_js_insert",
 				"js_insert_all_pages",
 				"js_insert_all_pages_except",
 			],
-			"spec.bot_defense_advanced.mobile_sdk_config": ["disable_mobile_sdk"],
 			"spec.caching_policy": ["disable_caching"],
 			"spec.caching_policy.default_cache_action.cache_disabled": ["cache_ttl_default", "cache_ttl_override"],
 			"spec.caching_policy.default_cache_action.cache_ttl_default": ["cache_disabled", "cache_ttl_override"],
@@ -1583,7 +1659,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.disable_api_definition": ["api_specification"],
 			"spec.disable_api_discovery": ["enable_api_discovery"],
 			"spec.disable_api_testing": ["api_testing"],
-			"spec.disable_bot_defense": ["bot_defense", "bot_defense_advanced"],
+			"spec.disable_bot_defense": ["bot_defense", "bot_defense_advanced_protection"],
 			"spec.disable_caching": ["caching_policy"],
 			"spec.disable_client_side_defense": ["client_side_defense"],
 			"spec.disable_ip_reputation": ["enable_ip_reputation"],
@@ -1593,7 +1669,13 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.disable_threat_mesh": ["enable_threat_mesh"],
 			"spec.disable_trust_client_ip_headers": ["enable_trust_client_ip_headers"],
 			"spec.disable_waf": ["app_firewall"],
-			"spec.do_not_advertise": ["advertise_custom", "advertise_on_public", "advertise_on_public_default_vip"],
+			"spec.do_not_advertise": [
+				"advertise_custom",
+				"advertise_dualstack_on_public",
+				"advertise_on_public",
+				"advertise_on_public_default_vip",
+				"advertise_v6_on_public",
+			],
 			"spec.enable_api_discovery": ["disable_api_discovery"],
 			"spec.enable_api_discovery.api_crawler.api_crawler_config": ["disable_api_crawler"],
 			"spec.enable_api_discovery.api_crawler.disable_api_crawler": ["api_crawler_config"],
@@ -2119,11 +2201,13 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.custom_proxy.proxy_port",
 			"spec.dc_cluster_group_sli.name",
 			"spec.dc_cluster_group_slo.name",
+			"spec.eks_k8s.enable_anti_affinity.rules",
 			"spec.local_vrf.sli_config.static_routes.static_routes",
 			"spec.local_vrf.sli_config.static_v6_routes.static_routes",
 			"spec.local_vrf.slo_config.static_routes.static_routes",
 			"spec.local_vrf.slo_config.static_v6_routes.static_routes",
 			"spec.log_receiver_with_net.log_receiver.name",
+			"spec.private_adn.private_adn",
 			"spec.site_mesh_group_on_slo.site_mesh_group.name",
 			"spec.upgrade_settings.kubernetes_upgrade_drain.enable_upgrade_drain.drain_node_timeout",
 		],
@@ -2135,6 +2219,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.aws": [
 				"azure",
 				"baremetal",
+				"eks_k8s",
 				"equinix",
 				"gcp",
 				"kvm",
@@ -2147,6 +2232,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.azure": [
 				"aws",
 				"baremetal",
+				"eks_k8s",
 				"equinix",
 				"gcp",
 				"kvm",
@@ -2159,6 +2245,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.baremetal": [
 				"aws",
 				"azure",
+				"eks_k8s",
 				"equinix",
 				"gcp",
 				"kvm",
@@ -2170,7 +2257,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			],
 			"spec.block_all_services": ["blocked_services"],
 			"spec.blocked_services": ["block_all_services"],
-			"spec.custom_proxy": ["f5_proxy"],
+			"spec.custom_proxy": ["f5_proxy", "private_adn"],
 			"spec.custom_proxy.disable_re_tunnel": ["enable_re_tunnel"],
 			"spec.custom_proxy.enable_re_tunnel": ["disable_re_tunnel"],
 			"spec.custom_proxy.password.blindfold_secret_info": ["clear_secret_info"],
@@ -2187,6 +2274,21 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.dns_ntp_config.custom_ntp": ["f5_ntp_default"],
 			"spec.dns_ntp_config.f5_dns_default": ["custom_dns"],
 			"spec.dns_ntp_config.f5_ntp_default": ["custom_ntp"],
+			"spec.eks_k8s": [
+				"aws",
+				"azure",
+				"baremetal",
+				"equinix",
+				"gcp",
+				"kvm",
+				"nutanix",
+				"oci",
+				"openshift_virtualization",
+				"openstack",
+				"vmware",
+			],
+			"spec.eks_k8s.disable_anti_affinity": ["enable_anti_affinity"],
+			"spec.eks_k8s.enable_anti_affinity": ["disable_anti_affinity"],
 			"spec.enable_advanced_delivery": ["disable_advanced_delivery"],
 			"spec.enable_ha": ["disable_ha"],
 			"spec.enable_log_anonymization": ["disable_log_anonymization"],
@@ -2196,6 +2298,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 				"aws",
 				"azure",
 				"baremetal",
+				"eks_k8s",
 				"gcp",
 				"kvm",
 				"nutanix",
@@ -2204,11 +2307,12 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 				"openstack",
 				"vmware",
 			],
-			"spec.f5_proxy": ["custom_proxy"],
+			"spec.f5_proxy": ["custom_proxy", "private_adn"],
 			"spec.gcp": [
 				"aws",
 				"azure",
 				"baremetal",
+				"eks_k8s",
 				"equinix",
 				"kvm",
 				"nutanix",
@@ -2221,6 +2325,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 				"aws",
 				"azure",
 				"baremetal",
+				"eks_k8s",
 				"equinix",
 				"gcp",
 				"nutanix",
@@ -2254,6 +2359,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 				"aws",
 				"azure",
 				"baremetal",
+				"eks_k8s",
 				"equinix",
 				"gcp",
 				"kvm",
@@ -2266,6 +2372,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 				"aws",
 				"azure",
 				"baremetal",
+				"eks_k8s",
 				"equinix",
 				"gcp",
 				"kvm",
@@ -2280,6 +2387,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 				"aws",
 				"azure",
 				"baremetal",
+				"eks_k8s",
 				"equinix",
 				"gcp",
 				"kvm",
@@ -2292,6 +2400,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 				"aws",
 				"azure",
 				"baremetal",
+				"eks_k8s",
 				"equinix",
 				"gcp",
 				"kvm",
@@ -2306,8 +2415,10 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.performance_enhancement_mode.perf_mode_l7_enhanced": ["perf_mode_l3_enhanced"],
 			"spec.performance_enhancement_mode.perf_mode_l7_enhanced.jumbo_disabled": ["jumbo_enabled"],
 			"spec.performance_enhancement_mode.perf_mode_l7_enhanced.jumbo_enabled": ["jumbo_disabled"],
-			"spec.re_select.geo_proximity": ["specific_re"],
-			"spec.re_select.specific_re": ["geo_proximity"],
+			"spec.private_adn": ["custom_proxy", "f5_proxy"],
+			"spec.re_select.geo_proximity": ["specific_geography", "specific_re"],
+			"spec.re_select.specific_geography": ["geo_proximity", "specific_re"],
+			"spec.re_select.specific_re": ["geo_proximity", "specific_geography"],
 			"spec.site_mesh_group_on_slo": ["dc_cluster_group_slo", "no_s2s_connectivity_slo"],
 			"spec.site_mesh_group_on_slo.no_site_mesh_group": ["site_mesh_group"],
 			"spec.site_mesh_group_on_slo.site_mesh_group": ["no_site_mesh_group"],
@@ -2317,11 +2428,19 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.software_settings.os.operating_system_version": ["default_os_version"],
 			"spec.software_settings.sw.default_sw_version": ["volterra_software_version"],
 			"spec.software_settings.sw.volterra_software_version": ["default_sw_version"],
+			"spec.software_settings.waf_signatures.automatic": ["manual"],
+			"spec.software_settings.waf_signatures.manual": ["automatic"],
 			"spec.upgrade_settings.kubernetes_upgrade_drain.disable_upgrade_drain": ["enable_upgrade_drain"],
 			"spec.upgrade_settings.kubernetes_upgrade_drain.enable_upgrade_drain": ["disable_upgrade_drain"],
 			"spec.upgrade_settings.kubernetes_upgrade_drain.enable_upgrade_drain.disable_vega_upgrade_mode": [
 				"enable_vega_upgrade_mode",
 			],
+			"spec.upgrade_settings.kubernetes_upgrade_drain.enable_upgrade_drain.drain_max_unavailable_node_count": [
+				"drain_max_unavailable_node_percentage",
+			],
+			"spec.upgrade_settings.kubernetes_upgrade_drain.enable_upgrade_drain.drain_max_unavailable_node_percentage": [
+				"drain_max_unavailable_node_count",
+			],
 			"spec.upgrade_settings.kubernetes_upgrade_drain.enable_upgrade_drain.enable_vega_upgrade_mode": [
 				"disable_vega_upgrade_mode",
 			],
@@ -2329,6 +2448,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 				"aws",
 				"azure",
 				"baremetal",
+				"eks_k8s",
 				"equinix",
 				"gcp",
 				"kvm",
@@ -2355,6 +2475,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.port_matcher": null,
 		},
 		minimumConfigFields: [
+			"spec.action",
 			"spec.api_group_matcher.match",
 			"spec.asn_list.as_numbers",
 			"spec.asn_matcher.asn_sets",
@@ -2364,6 +2485,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.port_matcher.ports",
 			"spec.segment_policy.dst_segments.segments",
 			"spec.segment_policy.src_segments.segments",
+			"spec.waf_action",
 		],
 		fieldConflicts: {
 			"spec.any_asn": ["asn_list", "asn_matcher"],
@@ -2425,6 +2547,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.port_matcher": null,
 		},
 		minimumConfigFields: [
+			"spec.action",
 			"spec.api_group_matcher.match",
 			"spec.asn_list.as_numbers",
 			"spec.asn_matcher.asn_sets",
@@ -2434,6 +2557,7 @@ export const DEFAULTS_METADATA: Record<string, KindDefaultsMetadata> = {
 			"spec.port_matcher.ports",
 			"spec.segment_policy.dst_segments.segments",
 			"spec.segment_policy.src_segments.segments",
+			"spec.waf_action",
 		],
 		fieldConflicts: {
 			"spec.any_asn": ["asn_list", "asn_matcher"],

package/src/index.ts

@@ -9,6 +9,7 @@ export type { ExportedManifest, ManifestOutputFormat, MinimalExportFilter } from
 export { applyMinimalExportFilter, formatManifestOutput, toManifest, toManifestList } from "./manifest-export";
 export { ManifestParseError, parseManifests } from "./manifest-parser";
 export { formatValidationErrors, validateManifest, validateManifests } from "./manifest-validator";
+export * from "./map-constraints";
 export type { RunResourceOperationOptions } from "./operation-runner";
 export { formatResourceOperationReport, readManifestInputs, runResourceOperation } from "./operation-runner";
 export {

package/src/manifest-validator.ts

@@ -72,6 +72,10 @@ export function validateManifest(
 		}
 	}
 
+	if (resolved?.validateFields && options.operation !== "identity") {
+		errors.push(...resolved.validateFields(manifest.rawObject, options.operation === "update" ? "update" : "create"));
+	}
+
 	return { result: { valid: errors.length === 0, errors, warnings }, resolved };
 }
 

package/src/map-constraints.ts

@@ -0,0 +1,100 @@
+/** Structured map contract rendering and local extension validation. */
+import { isIP } from "node:net";
+
+export interface MapScope {
+	type?: string;
+	minLength?: number;
+	maxLength?: number;
+	pattern?: string;
+	format?: string;
+	minimum?: number;
+	maximum?: number;
+	ranges?: number[][];
+}
+
+export interface MapConstraints {
+	constraintType: string;
+	keys?: MapScope;
+	values?: MapScope;
+	cardinality?: { minProperties?: number; maxProperties?: number };
+	crossEntry?: { uniqueValues?: boolean };
+	originalRules?: Record<string, unknown>;
+}
+
+export function formatMapConstraints(constraints: MapConstraints): string {
+	const parts: string[] = [];
+	for (const scope of ["keys", "values", "cardinality", "crossEntry"] as const) {
+		for (const [key, value] of Object.entries(constraints[scope] ?? {})) {
+			parts.push(`${scope}.${key}: ${typeof value === "string" ? value : JSON.stringify(value)}`);
+		}
+	}
+	return parts.join(", ");
+}
+
+function validateText(value: unknown, scope: MapScope, label: string): string[] {
+	const errors: string[] = [];
+	if (typeof value !== "string") return [`${label} must be a string`];
+	const length = Array.from(value).length;
+	if (scope.minLength !== undefined && length < scope.minLength) errors.push(`${label} below minimum length`);
+	if (scope.maxLength !== undefined && length > scope.maxLength) errors.push(`${label} exceeds maximum length`);
+	if (scope.pattern && !new RegExp(scope.pattern).test(value)) errors.push(`${label} does not match pattern`);
+	if (scope.type === "uint32-string") {
+		const number = Number(value);
+		if (!/^\d+$/.test(value) || !Number.isSafeInteger(number) || number > 4294967295)
+			errors.push(`${label} must be uint32`);
+		if (scope.minimum !== undefined && number < scope.minimum) errors.push(`${label} below minimum`);
+		if (scope.maximum !== undefined && number > scope.maximum) errors.push(`${label} exceeds maximum`);
+		if (scope.ranges && !scope.ranges.some(([lo, hi]) => number >= lo! && number <= hi!))
+			errors.push(`${label} outside ranges`);
+	}
+	switch (scope.format) {
+		case "ipv4":
+			if (isIP(value) !== 4) errors.push(`${label} must be IPv4`);
+			break;
+		case "ipv6":
+			if (isIP(value) !== 6) errors.push(`${label} must be IPv6`);
+			break;
+		case "ip-address":
+			if (!isIP(value)) errors.push(`${label} must be IP`);
+			break;
+		case "mac-address":
+			if (!/^(?:[\da-f]{2}:){5}[\da-f]{2}$/i.test(value)) errors.push(`${label} must be MAC`);
+			break;
+		case "regex":
+			try {
+				new RegExp(value);
+			} catch {
+				errors.push(`${label} must be a valid regex`);
+			}
+			break;
+		case "k8s-label-value":
+			if (value.length > 63 || !/^(?:[A-Za-z0-9](?:[A-Za-z0-9_.-]*[A-Za-z0-9])?)?$/.test(value))
+				errors.push(`${label} must be a Kubernetes label value`);
+			break;
+		case "uri-reference":
+			if (/[^\x21-\x7e]|%(?![\da-f]{2})/i.test(value)) errors.push(`${label} must be a URI-reference`);
+			break;
+	}
+	return errors;
+}
+
+export function validateMapConstraints(value: unknown, constraints: MapConstraints): string[] {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return ["Expected a map object"];
+	const entries = Object.entries(value);
+	const errors: string[] = [];
+	const cardinality = constraints.cardinality;
+	if (cardinality?.minProperties !== undefined && entries.length < cardinality.minProperties)
+		errors.push("Too few map pairs");
+	if (cardinality?.maxProperties !== undefined && entries.length > cardinality.maxProperties)
+		errors.push("Too many map pairs");
+	for (const [key, item] of entries) {
+		if (constraints.keys) errors.push(...validateText(key, constraints.keys, `key ${key}`));
+		if (constraints.values) errors.push(...validateText(item, constraints.values, `value at ${key}`));
+	}
+	if (
+		constraints.crossEntry?.uniqueValues &&
+		new Set(entries.map(([, item]) => JSON.stringify(item))).size !== entries.length
+	)
+		errors.push("Map values must be unique");
+	return errors;
+}

package/src/types.ts

@@ -85,9 +85,16 @@ export interface ResolvedKind {
 		delete: string;
 	};
 	validation?: ApiSpecValidationResourceEntry;
+	validateFields?: (object: Record<string, unknown>, operation: "create" | "update") => ValidationError[];
 }
 
-export type ValidationErrorCode = "MISSING_FIELD" | "UNKNOWN_KIND" | "INVALID_TYPE" | "PARSE_ERROR" | "DUPLICATE_NAME";
+export type ValidationErrorCode =
+	| "MISSING_FIELD"
+	| "UNKNOWN_KIND"
+	| "INVALID_TYPE"
+	| "PARSE_ERROR"
+	| "DUPLICATE_NAME"
+	| "INVALID_MAP";
 
 export type ValidationWarningCode = "EXTRA_FIELD" | "DEPRECATED_FIELD";