@r8s/core 0.1.0 → 0.2.0

package/dist/defaults.d.ts

@@ -15,10 +15,18 @@ export interface DatabaseConnection {
 }
 /** Secret provider configuration */
 export interface SecretProvider {
-    backend: 'vault' | 'openbao' | 'sealed-secrets' | 'manual-secrets';
+    backend: 'vault' | 'openbao' | 'sealed-secrets' | 'manual-secrets' | 'kubernetes';
     mount?: string;
     path?: string;
     authRef?: string;
+    /**
+     * How often the secrets operator re-syncs from the backend (e.g. '3600s'),
+     * rendered as `refreshAfter` on every generated
+     * VaultStaticSecret/OpenBaoStaticSecret. Enables credential rotation —
+     * combine with `rolloutRestartTargets` on consumers so pods pick up
+     * rotated values.
+     */
+    refreshAfter?: string;
 }
 /**
  * Default contexts for shared infrastructure properties.

package/dist/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AAChD,eAAO,MAAM,SAAS,qCAAmC,CAAA;AAEzD,6CAA6C;AAC7C,eAAO,MAAM,MAAM,qDAA4C,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,WAAW,qDAA4C,CAAA;AAEpE,6DAA6D;AAC7D,eAAO,MAAM,WAAW;UAA+B,MAAM;WAAS,MAAM;IAAQ,CAAA;AAEpF,gEAAgE;AAChE,eAAO,MAAM,SAAS;eACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;aACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;EAC3B,CAAA;AAEN,sDAAsD;AACtD,eAAO,MAAM,cAAc,qCAAmC,CAAA;AAE9D,6DAA6D;AAC7D,eAAO,MAAM,aAAa,qCAA4B,CAAA;AAEtD,2CAA2C;AAC3C,eAAO,MAAM,MAAM,qCAA4B,CAAA;AAE/C,iCAAiC;AACjC,eAAO,MAAM,GAAG;aACL,OAAO;aACP,MAAM;iBACF,MAAM;EACC,CAAA;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/C;AAED,eAAO,MAAM,cAAc,mDAA4C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,eAAe,wDAAiD,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,oDAA6C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,eAAe,yCAAgC,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,IAAI,EAAE,SAAS,GAAG,SAAS,CAAA;IAC3B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,eAAO,MAAM,cAAc,4CAAoD,CAAA;AAG/E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,YAAY,CAAA;IACjF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AAChD,eAAO,MAAM,SAAS,qCAAmC,CAAA;AAEzD,6CAA6C;AAC7C,eAAO,MAAM,MAAM,qDAA4C,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,WAAW,qDAA4C,CAAA;AAEpE,6DAA6D;AAC7D,eAAO,MAAM,WAAW;UAA+B,MAAM;WAAS,MAAM;IAAQ,CAAA;AAEpF,gEAAgE;AAChE,eAAO,MAAM,SAAS;eACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;aACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;EAC3B,CAAA;AAEN,sDAAsD;AACtD,eAAO,MAAM,cAAc,qCAAmC,CAAA;AAE9D,6DAA6D;AAC7D,eAAO,MAAM,aAAa,qCAA4B,CAAA;AAEtD,2CAA2C;AAC3C,eAAO,MAAM,MAAM,qCAA4B,CAAA;AAE/C,iCAAiC;AACjC,eAAO,MAAM,GAAG;aACL,OAAO;aACP,MAAM;iBACF,MAAM;EACC,CAAA;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/C;AAED,eAAO,MAAM,cAAc,mDAA4C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,eAAe,wDAAiD,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,oDAA6C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,eAAe,yCAAgC,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,IAAI,EAAE,SAAS,GAAG,SAAS,CAAA;IAC3B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,eAAO,MAAM,cAAc,4CAAoD,CAAA;AAG/E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA"}

package/dist/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":";;;AAAA,uCAAyC;AAuBzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AACnC,QAAA,SAAS,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAEzD,6CAA6C;AAChC,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAE/D,kDAAkD;AACrC,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAEpE,6DAA6D;AAChD,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyC,EAAE,CAAC,CAAA;AAEpF,gEAAgE;AACnD,QAAA,SAAS,GAAG,IAAA,uBAAa,EAGnC,EAAE,CAAC,CAAA;AAEN,sDAAsD;AACzC,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAE9D,6DAA6D;AAChD,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAEtD,2CAA2C;AAC9B,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAE/C,iCAAiC;AACpB,QAAA,GAAG,GAAG,IAAA,uBAAa,EAI7B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AAoCT,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAuB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAA4B,IAAI,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAwB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAAa,EAAE,CAAC,CAAA;AA6B/C,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;AAE/E,6DAA6D;AAC7D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":";;;AAAA,uCAAyC;AA+BzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AACnC,QAAA,SAAS,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAEzD,6CAA6C;AAChC,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAE/D,kDAAkD;AACrC,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAEpE,6DAA6D;AAChD,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyC,EAAE,CAAC,CAAA;AAEpF,gEAAgE;AACnD,QAAA,SAAS,GAAG,IAAA,uBAAa,EAGnC,EAAE,CAAC,CAAA;AAEN,sDAAsD;AACzC,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAE9D,6DAA6D;AAChD,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAEtD,2CAA2C;AAC9B,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAE/C,iCAAiC;AACpB,QAAA,GAAG,GAAG,IAAA,uBAAa,EAI7B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AAoCT,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAuB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAA4B,IAAI,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAwB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAAa,EAAE,CAAC,CAAA;AA6B/C,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;AAE/E,6DAA6D;AAC7D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA"}

package/dist/guardrails.d.ts

@@ -16,7 +16,19 @@ export declare const requireNetworkPolicies: GuardrailRule;
 export declare const requireResourceLimits: GuardrailRule;
 /** Check that all resources have required labels */
 export declare const requireLabels: (requiredLabels: string[]) => GuardrailRule;
-/** Check that no secrets contain plaintext passwords */
+/**
+ * Check that no credentials are rendered as plaintext. Covers:
+ * - Secret stringData/data values for credential keys, connection-string
+ *   URIs, and PEM private keys (encryptedData from sealed-secrets and
+ *   system TLS/service-account secrets are exempt)
+ * - ConfigMap data — flat credential keys and credential-looking
+ *   `key: value` lines inside embedded YAML/INI payloads (e.g. appservice
+ *   registrations holding as_token/hs_token)
+ * - Workload env vars that embed credentials via `value` (secretKeyRef or
+ *   $(VAR) runtime expansion are fine)
+ * - Any nested field (CRD specs, realm users, …) holding a plaintext
+ *   credential value
+ */
 export declare const noPlaintextSecrets: GuardrailRule;
 /** Check that Ingresses have TLS configured */
 export declare const requireTLS: GuardrailRule;

package/dist/guardrails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACtC,wFAAwF;IACxF,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,CAAA;CAC7D;AAED,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,EAAE,aAgCpC,CAAA;AAED,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,EAAE,aAwCnC,CAAA;AAED,oDAAoD;AACpD,eAAO,MAAM,aAAa,GAAI,gBAAgB,MAAM,EAAE,KAAG,aAwBvD,CAAA;AAEF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,EAAE,aA8BhC,CAAA;AAED,+CAA+C;AAC/C,eAAO,MAAM,UAAU,EAAE,aAyBxB,CAAA;AAED,wCAAwC;AACxC,eAAO,MAAM,gBAAgB,EAAE,aA4C9B,CAAA;AAED,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,EAAE,aAAa,EAM5C,CAAA;AAED,yDAAyD;AACzD,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,EAAE,EAC/B,KAAK,GAAE,aAAa,EAAsB,GACzC;IACD,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,IAAI,EAAE,eAAe,EAAE,CAAA;CACxB,CAwBA"}
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACtC,wFAAwF;IACxF,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,CAAA;CAC7D;AAED,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,EAAE,aAgCpC,CAAA;AAED,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,EAAE,aAwCnC,CAAA;AAED,oDAAoD;AACpD,eAAO,MAAM,aAAa,GAAI,gBAAgB,MAAM,EAAE,KAAG,aAwBvD,CAAA;AA4JF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAmNhC,CAAA;AAED,+CAA+C;AAC/C,eAAO,MAAM,UAAU,EAAE,aAyBxB,CAAA;AAED,wCAAwC;AACxC,eAAO,MAAM,gBAAgB,EAAE,aA4C9B,CAAA;AAED,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,EAAE,aAAa,EAM5C,CAAA;AAED,yDAAyD;AACzD,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,EAAE,EAC/B,KAAK,GAAE,aAAa,EAAsB,GACzC;IACD,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,IAAI,EAAE,eAAe,EAAE,CAAA;CACxB,CAwBA"}

package/dist/guardrails.js

@@ -95,31 +95,306 @@ const requireLabels = (requiredLabels) => ({
     },
 });
 exports.requireLabels = requireLabels;
-/** Check that no secrets contain plaintext passwords */
+/**
+ * Keys whose value is a credential when they appear with these endings
+ * (normalized: lowercased, `-`/`_`/`.` removed).
+ */
+const SECRET_KEY_SUFFIXES = [
+    'password',
+    'passwd',
+    'pwd',
+    'secretkey',
+    'secretaccesskey',
+    'accesskey',
+    'accesskeyid',
+    'privatekey',
+    'clientsecret',
+    'apikey',
+    'token', // bare token: csrf/as/hs/api tokens are all credentials
+    'authtoken',
+    'connectionstring',
+];
+/** Key endings that hold the *name* of a secret, not a credential value. */
+const SECRET_REFERENCE_SUFFIXES = [
+    'secretname',
+    'secretref',
+    'passwordsecret',
+    'passwordkey',
+    'passwordref',
+    'passwordname',
+    'secretkeyref',
+    'secretkeyname',
+    'tokenname',
+    'tokenref',
+    'keyref',
+    'keyname',
+    'credentialsref',
+];
+/** Env var names that suggest the value is a credential. */
+const SECRET_ENV_NAME_PATTERN = /(password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|credential|client[_-]?secret)/i;
+/** Env var names that carry policy/lifetime metadata, not credentials
+ *  (e.g. REFRESH_TOKEN_EXPIRY, ACCESS_TOKEN_TTL, JWT_LIFESPAN). */
+const NON_SECRET_ENV_NAME_PATTERN = /(_expiry|_expires(_at|_in)?$|_ttl$|max[_-]age|lifespan|_timeout$|_url|_uri|_endpoint$|_provider$|_issuer$|_audience$|_header$|_transport$)/i;
+/** Matches scheme://[user[:password]@]host — a credentials-bearing URI. */
+const CONNECTION_STRING_RE = /[a-z][a-z0-9+.-]*:\/\/([^/\s:@]*):([^@/\s]+)@/i;
+/** Secret types that hold non-credential material (TLS certs, SA tokens managed in-cluster). */
+const EXEMPT_SECRET_TYPES = [
+    'kubernetes.io/tls',
+    'kubernetes.io/ssl',
+    'kubernetes.io/service-account-token',
+    'bootstrap.kubernetes.io/token',
+    'helm.sh/release.v1',
+];
+function normalizeKey(key) {
+    return key.toLowerCase().replace(/[-_.]/g, '');
+}
+/** Values that are references/placeholders rather than live credentials. */
+function looksLikeReference(value) {
+    return (value.includes('$(') ||
+        /^\$\{.+\}/.test(value) ||
+        value.startsWith('${') ||
+        value.startsWith('$') ||
+        value.startsWith('file://'));
+}
+/** "Fill in via GitOps"-style placeholder values — not live credentials. */
+const PLACEHOLDER_VALUE_RE = /^(replace|provide|change|todo|fixme|your[_-]|xxx+|<|\.\.\.|\*+)/i;
+/**
+ * Credential-looking `key: value` / `key=value` / `export key=value` lines
+ * inside multi-line text — embedded YAML/INI/dotenv payloads in ConfigMap
+ * data and Secret stringData blobs.
+ */
+const EMBEDDED_CREDENTIAL_LINE_RE = /^[ \t]*(?:export[ \t]+)?([A-Za-z0-9_.-]*?(?:token|password|passwd|secret|secretaccesskey|private[_-]?key|api[_-]?key|access[_-]?key|client[_-]?secret|authtoken)[A-Za-z0-9_.-]*?)\s*[:=]\s*['"]?([^\s'"]{8,})['"]?[ \t]*$/gim;
+/**
+ * Embedded keys whose value is metadata about a credential, not the
+ * credential itself (token_endpoint, password_file, secret_name, …).
+ */
+const EMBEDDED_KEY_EXCLUDE_SUFFIXES = [
+    'endpoint',
+    'url',
+    'uri',
+    'ttl',
+    'expiry',
+    'expires',
+    'maxage',
+    'lifespan',
+    'timeout',
+    'header',
+    'name',
+    'type',
+    'ref',
+    'file',
+    'path',
+    'algorithm',
+    'alg',
+    'issuer',
+    'audience',
+    'provider',
+    'transport',
+    'rotation',
+    'method', // e.g. token_endpoint_auth_method — OIDC metadata, not a credential
+];
+/** Find live credential values embedded in multi-line config text. */
+function embeddedCredentialLines(text) {
+    const hits = [];
+    for (const match of text.matchAll(EMBEDDED_CREDENTIAL_LINE_RE)) {
+        const [, key, value] = match;
+        const normalized = normalizeKey(key);
+        if (EMBEDDED_KEY_EXCLUDE_SUFFIXES.some((suffix) => normalized.endsWith(suffix)))
+            continue;
+        if (looksLikeReference(value))
+            continue;
+        if (PLACEHOLDER_VALUE_RE.test(value))
+            continue;
+        // Paths and URLs point at credentials; they are not credentials
+        if (value.startsWith('/') || /^[a-z][a-z0-9+.-]*:\/\//i.test(value))
+            continue;
+        hits.push({ key, value });
+    }
+    return hits;
+}
+function connectionStringPassword(value) {
+    const match = value.match(CONNECTION_STRING_RE);
+    if (!match)
+        return null;
+    const [, , password] = match;
+    // Kubernetes $(VAR) expansion and env interpolation — the credential is
+    // injected at runtime, not embedded in the manifest.
+    if (password.includes('$(') || password.includes('${'))
+        return null;
+    return password;
+}
+/** Collect pod containers from any workload-shaped resource. */
+function workloadsContainers(resource) {
+    const anyResource = resource;
+    const kind = anyResource.kind;
+    if (kind === 'CronJob') {
+        return [
+            ...(anyResource.spec?.jobTemplate?.spec?.template?.spec?.containers ?? []),
+            ...(anyResource.spec?.jobTemplate?.spec?.template?.spec?.initContainers ?? []),
+        ];
+    }
+    const podSpec = anyResource.spec?.template?.spec ?? anyResource.spec ?? {};
+    return [...(podSpec.containers ?? []), ...(podSpec.initContainers ?? [])];
+}
+/**
+ * Check that no credentials are rendered as plaintext. Covers:
+ * - Secret stringData/data values for credential keys, connection-string
+ *   URIs, and PEM private keys (encryptedData from sealed-secrets and
+ *   system TLS/service-account secrets are exempt)
+ * - ConfigMap data — flat credential keys and credential-looking
+ *   `key: value` lines inside embedded YAML/INI payloads (e.g. appservice
+ *   registrations holding as_token/hs_token)
+ * - Workload env vars that embed credentials via `value` (secretKeyRef or
+ *   $(VAR) runtime expansion are fine)
+ * - Any nested field (CRD specs, realm users, …) holding a plaintext
+ *   credential value
+ */
 exports.noPlaintextSecrets = {
     id: 'no-plaintext-secrets',
-    description: 'Secrets should not contain plaintext passwords in rendered output',
+    description: 'Manifests must not contain plaintext credentials',
     severity: 'error',
     test: (resources) => {
         const errors = [];
+        const seen = new Set();
+        const push = (kind, where, field, suggestion) => {
+            const dedupeKey = `${where}:${field}`;
+            if (seen.has(dedupeKey))
+                return;
+            seen.add(dedupeKey);
+            errors.push({
+                code: 'PLAINTEXT_SECRET',
+                message: `Plaintext credential in ${where}`,
+                resource: kind,
+                field,
+                suggestion,
+            });
+        };
+        const scanValue = (resourceKind, where, field, value) => {
+            if (typeof value !== 'string' || value.length === 0)
+                return;
+            if (connectionStringPassword(value) !== null) {
+                push(resourceKind, where, field, 'Connection string embeds a password. Inject the credential at runtime via secretKeyRef or $(VAR) expansion instead');
+            }
+            else if (value.startsWith('-----BEGIN') && value.includes('PRIVATE KEY')) {
+                push(resourceKind, where, field, 'PEM private key is embedded in the manifest. Store it in a secrets backend or a sealed secret instead');
+            }
+        };
         for (const resource of resources) {
+            const kindName = `${resource.kind} "${resource.metadata?.name ?? '?'}"`;
+            const anyResource = resource;
+            // 1. Kubernetes Secret resources
             if (resource.kind === 'Secret') {
-                const data = resource.stringData || resource.data || {};
-                for (const [key, value] of Object.entries(data)) {
-                    if (typeof value === 'string' && value.length > 0) {
-                        // Check if it looks like a password (not a reference)
-                        if (key.toLowerCase().includes('password') || key.toLowerCase().includes('secret')) {
-                            errors.push({
-                                code: 'PLAINTEXT_SECRET',
-                                message: `Secret "${resource.metadata?.name}" contains plaintext value for key "${key}"`,
-                                resource: 'Secret',
-                                field: `stringData.${key}`,
-                                suggestion: 'Use Vault, Sealed Secrets, or external secret management instead of plaintext',
-                            });
+                const secretType = anyResource.type || '';
+                const isEncrypted = anyResource.encryptedData !== undefined;
+                const exempt = EXEMPT_SECRET_TYPES.includes(secretType);
+                if (!exempt && !isEncrypted) {
+                    for (const map of ['stringData', 'data']) {
+                        const data = anyResource[map];
+                        if (!data || typeof data !== 'object')
+                            continue;
+                        for (const [key, value] of Object.entries(data)) {
+                            const normalized = normalizeKey(key);
+                            const isCredentialKey = SECRET_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) &&
+                                !SECRET_REFERENCE_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
+                            if (isCredentialKey && typeof value === 'string' && value.length > 0) {
+                                push('Secret', `Secret "${resource.metadata?.name}" (${map}.${key})`, `${map}.${key}`, 'Use a secrets backend (openbao/vault/sealed-secrets) or let the operator provision the credential');
+                            }
+                            scanValue('Secret', `Secret "${resource.metadata?.name}" (${map}.${key})`, `${map}.${key}`, value);
+                            // Multi-line values may embed YAML/INI with credential keys
+                            // (e.g. appservice registration.yaml holding as_token)
+                            if (typeof value === 'string' && value.includes('\n')) {
+                                for (const hit of embeddedCredentialLines(value)) {
+                                    push('Secret', `Secret "${resource.metadata?.name}" (${map}.${key}) — embedded key "${hit.key}"`, `${map}.${key}`, 'Move the credential into a secrets backend and reference it, or render this file as a sealed secret');
+                                }
+                            }
+                        }
+                    }
+                }
+                continue;
+            }
+            // 1b. ConfigMap data — same exposure as Secrets when credentials are
+            // embedded (ConfigMaps are committed to git alongside everything else)
+            if (resource.kind === 'ConfigMap') {
+                const data = anyResource.data;
+                if (data && typeof data === 'object') {
+                    for (const [key, value] of Object.entries(data)) {
+                        if (typeof value !== 'string' || value.length === 0)
+                            continue;
+                        const normalized = normalizeKey(key);
+                        const isCredentialKey = SECRET_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) &&
+                            !SECRET_REFERENCE_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) &&
+                            !EMBEDDED_KEY_EXCLUDE_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
+                        if (isCredentialKey &&
+                            !looksLikeReference(value) &&
+                            !PLACEHOLDER_VALUE_RE.test(value)) {
+                            push('ConfigMap', `ConfigMap "${resource.metadata?.name}" (data.${key})`, `data.${key}`, 'ConfigMaps carry no protection — render credentials as a Secret (from a secrets backend or sealed secret) instead');
+                        }
+                        if (value.includes('\n')) {
+                            for (const hit of embeddedCredentialLines(value)) {
+                                push('ConfigMap', `ConfigMap "${resource.metadata?.name}" (data.${key}) — embedded key "${hit.key}"`, `data.${key}`, 'ConfigMaps carry no protection — render credentials as a Secret (from a secrets backend or sealed secret) instead');
+                            }
                         }
+                        scanValue('ConfigMap', `ConfigMap "${resource.metadata?.name}" (data.${key})`, `data.${key}`, value);
+                    }
+                }
+                continue;
+            }
+            // 2. Workload env vars
+            for (const container of workloadsContainers(resource)) {
+                for (const env of container.env ?? []) {
+                    if (!env || typeof env !== 'object' || !env.name)
+                        continue;
+                    // Only `value` embeds the credential — valueFrom is a reference.
+                    if (env.value === undefined || env.valueFrom)
+                        continue;
+                    if (typeof env.value !== 'string')
+                        continue;
+                    const isSecretName = SECRET_ENV_NAME_PATTERN.test(env.name) && !NON_SECRET_ENV_NAME_PATTERN.test(env.name);
+                    const hasConnectionString = connectionStringPassword(env.value) !== null;
+                    if (isSecretName && !looksLikeReference(env.value)) {
+                        push(resource.kind, `${kindName} container "${container.name}" env "${env.name}"`, `spec.template.spec.containers[].env[name=${env.name}].value`, 'Use valueFrom.secretKeyRef, a Vault/OpenBao secret reference, or $(VAR) expansion');
+                    }
+                    if (hasConnectionString) {
+                        push(resource.kind, `${kindName} container "${container.name}" env "${env.name}"`, `spec.template.spec.containers[].env[name=${env.name}].value`, 'Connection string embeds a password. Split into individual vars and reference the secret');
                     }
                 }
             }
+            // 3. Nested fields — credentials anywhere in the resource tree
+            const walk = (node, path) => {
+                if (Array.isArray(node)) {
+                    node.forEach((item, i) => walk(item, `${path}[${i}]`));
+                    return;
+                }
+                if (!node || typeof node !== 'object') {
+                    if (typeof node === 'string')
+                        scanValue(resource.kind, `${kindName} (${path})`, path, node);
+                    return;
+                }
+                for (const [key, value] of Object.entries(node)) {
+                    // sealed-secrets ciphertext is encrypted with the cluster key
+                    if (key === 'encryptedData')
+                        continue;
+                    const normalized = normalizeKey(key);
+                    const isCredentialKey = SECRET_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) &&
+                        !SECRET_REFERENCE_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
+                    if (isCredentialKey &&
+                        typeof value === 'string' &&
+                        value.length > 0 &&
+                        !looksLikeReference(value)) {
+                        push(resource.kind, `${kindName} (${path}.${key})`, `${path}.${key}`, 'Move the credential into a secrets backend and reference it by name');
+                    }
+                    // Recurse into child objects/arrays so credentials are caught at
+                    // every depth (pod templates, CRD specs, realm users, …); leaf
+                    // strings are scanned for connection strings / PEM keys
+                    if (value && typeof value === 'object') {
+                        walk(value, `${path}.${key}`);
+                    }
+                    else {
+                        scanValue(resource.kind, `${kindName} (${path}.${key})`, `${path}.${key}`, value);
+                    }
+                }
+            };
+            walk(anyResource.spec, 'spec');
         }
         return errors;
     },

package/dist/guardrails.js.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":";;;AA6OA,sCAgCC;AA/PD,qDAAqD;AACxC,QAAA,sBAAsB,GAAkB;IACnD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qDAAqD;IAClE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;QACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;QAE1C,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC7C,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACtE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,cAAc,EAAE,8BAA8B;oBACvD,QAAQ,EAAE,WAAW;oBACrB,KAAK,EAAE,eAAe;oBACtB,UAAU,EAAE,sCAAsC,EAAE,qCAAqC;iBAC1F,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,sDAAsD;AACzC,QAAA,qBAAqB,GAAkB;IAClD,EAAE,EAAE,yBAAyB;IAC7B,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC/B,QAAQ,CAAC,IAAI,KAAK,WAAW,EAC7B,CAAC;gBACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAA;gBAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;oBACnC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;wBACnC,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,2BAA2B;4BACjC,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;4BACtH,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,oDAAoD;4BAC3D,UAAU,EAAE,kDAAkD;yBAC/D,CAAC,CAAA;oBACJ,CAAC;oBACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,yBAAyB;4BAC/B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,8BAA8B;4BACpH,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,kDAAkD;4BACzD,UAAU,EACR,+EAA+E;yBAClF,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,oDAAoD;AAC7C,MAAM,aAAa,GAAG,CAAC,cAAwB,EAAiB,EAAE,CAAC,CAAC;IACzE,EAAE,EAAE,kBAAkB,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;IACvD,WAAW,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC3E,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;YAC9C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC,KAAK,GAAG;wBAC7F,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,mBAAmB,KAAK,EAAE;wBACjC,UAAU,EAAE,cAAc,KAAK,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAC,CAAA;AAxBW,QAAA,aAAa,iBAwBxB;AAEF,wDAAwD;AAC3C,QAAA,kBAAkB,GAAkB;IAC/C,EAAE,EAAE,sBAAsB;IAC1B,WAAW,EAAE,mEAAmE;IAChF,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAI,QAAgB,CAAC,UAAU,IAAK,QAAgB,CAAC,IAAI,IAAI,EAAE,CAAA;gBACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAClD,sDAAsD;wBACtD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACnF,MAAM,CAAC,IAAI,CAAC;gCACV,IAAI,EAAE,kBAAkB;gCACxB,OAAO,EAAE,WAAW,QAAQ,CAAC,QAAQ,EAAE,IAAI,uCAAuC,GAAG,GAAG;gCACxF,QAAQ,EAAE,QAAQ;gCAClB,KAAK,EAAE,cAAc,GAAG,EAAE;gCAC1B,UAAU,EACR,+EAA+E;6BAClF,CAAC,CAAA;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,+CAA+C;AAClC,QAAA,UAAU,GAAkB;IACvC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,IAAI,EAAE,CAAA;gBACzC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBAC5E,QAAQ,EAAE,SAAS;wBACnB,KAAK,EAAE,UAAU;wBACjB,UAAU,EACR,iFAAiF;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,wCAAwC;AAC3B,QAAA,gBAAgB,GAAkB;IAC7C,EAAE,EAAE,oBAAoB;IACxB,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC/B,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAC7B,QAAQ,CAAC,IAAI,KAAK,KAAK,EACvB,CAAC;gBACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;gBACpE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;gBAErD,IAAI,eAAe,CAAC,SAAS,KAAK,CAAC,IAAI,eAAe,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBAC1E,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBACrF,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,8CAA8C;wBACrD,UAAU,EAAE,wDAAwD;qBACrE,CAAC,CAAA;gBACJ,CAAC;gBAED,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBACjD,MAAM,iBAAiB,GAAG,SAAS,CAAC,eAAe,IAAI,EAAE,CAAA;oBACzD,IAAI,iBAAiB,CAAC,SAAS,KAAK,CAAC,IAAI,iBAAiB,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;wBAC9E,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,wBAAwB;4BAC9B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;4BACtG,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,2DAA2D;4BAClE,UAAU,EAAE,iDAAiD;yBAC9D,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,mDAAmD;AACtC,QAAA,iBAAiB,GAAoB;IAChD,8BAAsB;IACtB,6BAAqB;IACrB,0BAAkB;IAClB,kBAAU;IACV,wBAAgB;CACjB,CAAA;AAED,yDAAyD;AACzD,SAAgB,aAAa,CAC3B,SAA+B,EAC/B,QAAyB,yBAAiB;IAO1C,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM;QACN,QAAQ;QACR,IAAI;KACL,CAAA;AACH,CAAC"}
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":";;;AAwkBA,sCAgCC;AA1lBD,qDAAqD;AACxC,QAAA,sBAAsB,GAAkB;IACnD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qDAAqD;IAClE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;QACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;QAE1C,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC7C,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACtE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,cAAc,EAAE,8BAA8B;oBACvD,QAAQ,EAAE,WAAW;oBACrB,KAAK,EAAE,eAAe;oBACtB,UAAU,EAAE,sCAAsC,EAAE,qCAAqC;iBAC1F,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,sDAAsD;AACzC,QAAA,qBAAqB,GAAkB;IAClD,EAAE,EAAE,yBAAyB;IAC7B,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC/B,QAAQ,CAAC,IAAI,KAAK,WAAW,EAC7B,CAAC;gBACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAA;gBAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;oBACnC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;wBACnC,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,2BAA2B;4BACjC,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;4BACtH,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,oDAAoD;4BAC3D,UAAU,EAAE,kDAAkD;yBAC/D,CAAC,CAAA;oBACJ,CAAC;oBACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,yBAAyB;4BAC/B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,8BAA8B;4BACpH,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,kDAAkD;4BACzD,UAAU,EACR,+EAA+E;yBAClF,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,oDAAoD;AAC7C,MAAM,aAAa,GAAG,CAAC,cAAwB,EAAiB,EAAE,CAAC,CAAC;IACzE,EAAE,EAAE,kBAAkB,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;IACvD,WAAW,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC3E,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;YAC9C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC,KAAK,GAAG;wBAC7F,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,mBAAmB,KAAK,EAAE;wBACjC,UAAU,EAAE,cAAc,KAAK,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAC,CAAA;AAxBW,QAAA,aAAa,iBAwBxB;AAEF;;;GAGG;AACH,MAAM,mBAAmB,GAAG;IAC1B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,OAAO,EAAE,wDAAwD;IACjE,WAAW;IACX,kBAAkB;CACnB,CAAA;AAED,4EAA4E;AAC5E,MAAM,yBAAyB,GAAG;IAChC,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,WAAW;IACX,UAAU;IACV,QAAQ;IACR,SAAS;IACT,gBAAgB;CACjB,CAAA;AAED,4DAA4D;AAC5D,MAAM,uBAAuB,GAC3B,6GAA6G,CAAA;AAE/G;mEACmE;AACnE,MAAM,2BAA2B,GAC/B,6IAA6I,CAAA;AAE/I,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,gDAAgD,CAAA;AAE7E,gGAAgG;AAChG,MAAM,mBAAmB,GAAG;IAC1B,mBAAmB;IACnB,mBAAmB;IACnB,qCAAqC;IACrC,+BAA+B;IAC/B,oBAAoB;CACrB,CAAA;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACtB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,kEAAkE,CAAA;AAE/F;;;;GAIG;AACH,MAAM,2BAA2B,GAC/B,8NAA8N,CAAA;AAEhO;;;GAGG;AACH,MAAM,6BAA6B,GAAG;IACpC,UAAU;IACV,KAAK;IACL,KAAK;IACL,KAAK;IACL,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,WAAW;IACX,KAAK;IACL,QAAQ;IACR,UAAU;IACV,UAAU;IACV,WAAW;IACX,UAAU;IACV,QAAQ,EAAE,oEAAoE;CAC/E,CAAA;AAED,sEAAsE;AACtE,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAqC,EAAE,CAAA;IACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QAC5B,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,SAAQ;QACzF,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,SAAQ;QACvC,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC9C,gEAAgE;QAChE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,AAAD,EAAG,QAAQ,CAAC,GAAG,KAAK,CAAA;IAC5B,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnE,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,gEAAgE;AAChE,SAAS,mBAAmB,CAAC,QAA4B;IACvD,MAAM,WAAW,GAAG,QAAe,CAAA;IACnC,MAAM,IAAI,GAAW,WAAW,CAAC,IAAI,CAAA;IACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YAC1E,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC;SAC/E,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,WAAW,CAAC,IAAI,IAAI,EAAE,CAAA;IAC1E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;;;;;;;;GAYG;AACU,QAAA,kBAAkB,GAAkB;IAC/C,EAAE,EAAE,sBAAsB;IAC1B,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAE9B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,KAAa,EAAE,UAAkB,EAAE,EAAE;YAC9E,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE,CAAA;YACrC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAM;YAC/B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACnB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,2BAA2B,KAAK,EAAE;gBAC3C,QAAQ,EAAE,IAAI;gBACd,KAAK;gBACL,UAAU;aACX,CAAC,CAAA;QACJ,CAAC,CAAA;QAED,MAAM,SAAS,GAAG,CAAC,YAAoB,EAAE,KAAa,EAAE,KAAa,EAAE,KAAc,EAAE,EAAE;YACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YAC3D,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,IAAI,CACF,YAAY,EACZ,KAAK,EACL,KAAK,EACL,oHAAoH,CACrH,CAAA;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC3E,IAAI,CACF,YAAY,EACZ,KAAK,EACL,KAAK,EACL,uGAAuG,CACxG,CAAA;YACH,CAAC;QACH,CAAC,CAAA;QAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,GAAG,CAAA;YACvE,MAAM,WAAW,GAAG,QAAe,CAAA;YAEnC,iCAAiC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,UAAU,GAAI,WAAW,CAAC,IAAe,IAAI,EAAE,CAAA;gBACrD,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,KAAK,SAAS,CAAA;gBAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;gBAEvD,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAU,EAAE,CAAC;wBAClD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;wBAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;4BAAE,SAAQ;wBAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;4BAChD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;4BACpC,MAAM,eAAe,GACnB,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gCACjE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;4BAC1E,IAAI,eAAe,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCACrE,IAAI,CACF,QAAQ,EACR,WAAW,QAAQ,CAAC,QAAQ,EAAE,IAAI,MAAM,GAAG,IAAI,GAAG,GAAG,EACrD,GAAG,GAAG,IAAI,GAAG,EAAE,EACf,mGAAmG,CACpG,CAAA;4BACH,CAAC;4BACD,SAAS,CACP,QAAQ,EACR,WAAW,QAAQ,CAAC,QAAQ,EAAE,IAAI,MAAM,GAAG,IAAI,GAAG,GAAG,EACrD,GAAG,GAAG,IAAI,GAAG,EAAE,EACf,KAAK,CACN,CAAA;4BACD,4DAA4D;4BAC5D,uDAAuD;4BACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gCACtD,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;oCACjD,IAAI,CACF,QAAQ,EACR,WAAW,QAAQ,CAAC,QAAQ,EAAE,IAAI,MAAM,GAAG,IAAI,GAAG,qBAAqB,GAAG,CAAC,GAAG,GAAG,EACjF,GAAG,GAAG,IAAI,GAAG,EAAE,EACf,qGAAqG,CACtG,CAAA;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAA;gBAC7B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;4BAAE,SAAQ;wBAC7D,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;wBACpC,MAAM,eAAe,GACnB,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;4BACjE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;4BACxE,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;wBAC9E,IACE,eAAe;4BACf,CAAC,kBAAkB,CAAC,KAAK,CAAC;4BAC1B,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;4BACD,IAAI,CACF,WAAW,EACX,cAAc,QAAQ,CAAC,QAAQ,EAAE,IAAI,WAAW,GAAG,GAAG,EACtD,QAAQ,GAAG,EAAE,EACb,mHAAmH,CACpH,CAAA;wBACH,CAAC;wBACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;4BACzB,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;gCACjD,IAAI,CACF,WAAW,EACX,cAAc,QAAQ,CAAC,QAAQ,EAAE,IAAI,WAAW,GAAG,qBAAqB,GAAG,CAAC,GAAG,GAAG,EAClF,QAAQ,GAAG,EAAE,EACb,mHAAmH,CACpH,CAAA;4BACH,CAAC;wBACH,CAAC;wBACD,SAAS,CACP,WAAW,EACX,cAAc,QAAQ,CAAC,QAAQ,EAAE,IAAI,WAAW,GAAG,GAAG,EACtD,QAAQ,GAAG,EAAE,EACb,KAAK,CACN,CAAA;oBACH,CAAC;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,uBAAuB;YACvB,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;oBACtC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI;wBAAE,SAAQ;oBAC1D,iEAAiE;oBACjE,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS;wBAAE,SAAQ;oBACtD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;wBAAE,SAAQ;oBAC3C,MAAM,YAAY,GAChB,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBACvF,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAA;oBACxE,IAAI,YAAY,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACnD,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,GAAG,QAAQ,eAAe,SAAS,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,GAAG,EAC7D,4CAA4C,GAAG,CAAC,IAAI,SAAS,EAC7D,mFAAmF,CACpF,CAAA;oBACH,CAAC;oBACD,IAAI,mBAAmB,EAAE,CAAC;wBACxB,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,GAAG,QAAQ,eAAe,SAAS,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,GAAG,EAC7D,4CAA4C,GAAG,CAAC,IAAI,SAAS,EAC7D,0FAA0F,CAC3F,CAAA;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,IAAY,EAAE,EAAE;gBAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;oBACtD,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtC,IAAI,OAAO,IAAI,KAAK,QAAQ;wBAC1B,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;oBAC/D,OAAM;gBACR,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;oBAC3E,8DAA8D;oBAC9D,IAAI,GAAG,KAAK,eAAe;wBAAE,SAAQ;oBACrC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;oBACpC,MAAM,eAAe,GACnB,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBACjE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;oBAC1E,IACE,eAAe;wBACf,OAAO,KAAK,KAAK,QAAQ;wBACzB,KAAK,CAAC,MAAM,GAAG,CAAC;wBAChB,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAC1B,CAAC;wBACD,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,GAAG,QAAQ,KAAK,IAAI,IAAI,GAAG,GAAG,EAC9B,GAAG,IAAI,IAAI,GAAG,EAAE,EAChB,qEAAqE,CACtE,CAAA;oBACH,CAAC;oBACD,iEAAiE;oBACjE,+DAA+D;oBAC/D,wDAAwD;oBACxD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACvC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;oBAC/B,CAAC;yBAAM,CAAC;wBACN,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,KAAK,IAAI,IAAI,GAAG,GAAG,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;oBACnF,CAAC;gBACH,CAAC;YACH,CAAC,CAAA;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAChC,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,+CAA+C;AAClC,QAAA,UAAU,GAAkB;IACvC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,IAAI,EAAE,CAAA;gBACzC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBAC5E,QAAQ,EAAE,SAAS;wBACnB,KAAK,EAAE,UAAU;wBACjB,UAAU,EACR,iFAAiF;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,wCAAwC;AAC3B,QAAA,gBAAgB,GAAkB;IAC7C,EAAE,EAAE,oBAAoB;IACxB,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC/B,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAC7B,QAAQ,CAAC,IAAI,KAAK,KAAK,EACvB,CAAC;gBACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;gBACpE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;gBAErD,IAAI,eAAe,CAAC,SAAS,KAAK,CAAC,IAAI,eAAe,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBAC1E,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBACrF,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,8CAA8C;wBACrD,UAAU,EAAE,wDAAwD;qBACrE,CAAC,CAAA;gBACJ,CAAC;gBAED,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBACjD,MAAM,iBAAiB,GAAG,SAAS,CAAC,eAAe,IAAI,EAAE,CAAA;oBACzD,IAAI,iBAAiB,CAAC,SAAS,KAAK,CAAC,IAAI,iBAAiB,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;wBAC9E,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,wBAAwB;4BAC9B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;4BACtG,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,2DAA2D;4BAClE,UAAU,EAAE,iDAAiD;yBAC9D,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,mDAAmD;AACtC,QAAA,iBAAiB,GAAoB;IAChD,8BAAsB;IACtB,6BAAqB;IACrB,0BAAkB;IAClB,kBAAU;IACV,wBAAgB;CACjB,CAAA;AAED,yDAAyD;AACzD,SAAgB,aAAa,CAC3B,SAA+B,EAC/B,QAAyB,yBAAiB;IAO1C,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM;QACN,QAAQ;QACR,IAAI;KACL,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -8,4 +8,5 @@ export { validateResource, validateIngress, validateService, validateDeployment,
 export type { ValidationError } from './validate';
 export { runGuardrails, defaultGuardrails, requireNetworkPolicies, requireResourceLimits, requireLabels, noPlaintextSecrets, requireTLS, noRootContainers, } from './guardrails';
 export type { GuardrailRule } from './guardrails';
+export { sanitizeErrorMessage, redactConnectionStrings, redactPrivateKeys, maskSecretValues, } from './redact';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,gBAAgB,GACjB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,gBAAgB,GACjB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.noRootContainers = exports.requireTLS = exports.noPlaintextSecrets = exports.requireLabels = exports.requireResourceLimits = exports.requireNetworkPolicies = exports.defaultGuardrails = exports.runGuardrails = exports.r8sValidationError = exports.checkDuplicates = exports.validateOperator = exports.validateDeployment = exports.validateService = exports.validateIngress = exports.validateResource = exports.fetchOperatorManifests = exports.createContext = exports.getOperator = exports.isOperatorDeclaration = exports.declareOperator = exports.useContext = exports.render = exports.Fragment = exports.jsxDEV = exports.jsxs = exports.jsx = void 0;
+exports.maskSecretValues = exports.redactPrivateKeys = exports.redactConnectionStrings = exports.sanitizeErrorMessage = exports.noRootContainers = exports.requireTLS = exports.noPlaintextSecrets = exports.requireLabels = exports.requireResourceLimits = exports.requireNetworkPolicies = exports.defaultGuardrails = exports.runGuardrails = exports.r8sValidationError = exports.checkDuplicates = exports.validateOperator = exports.validateDeployment = exports.validateService = exports.validateIngress = exports.validateResource = exports.fetchOperatorManifests = exports.createContext = exports.getOperator = exports.isOperatorDeclaration = exports.declareOperator = exports.useContext = exports.render = exports.Fragment = exports.jsxDEV = exports.jsxs = exports.jsx = void 0;
 var jsx_runtime_1 = require("./jsx-runtime");
 Object.defineProperty(exports, "jsx", { enumerable: true, get: function () { return jsx_runtime_1.jsx; } });
 Object.defineProperty(exports, "jsxs", { enumerable: true, get: function () { return jsx_runtime_1.jsxs; } });
@@ -34,4 +34,9 @@ Object.defineProperty(exports, "requireLabels", { enumerable: true, get: functio
 Object.defineProperty(exports, "noPlaintextSecrets", { enumerable: true, get: function () { return guardrails_1.noPlaintextSecrets; } });
 Object.defineProperty(exports, "requireTLS", { enumerable: true, get: function () { return guardrails_1.requireTLS; } });
 Object.defineProperty(exports, "noRootContainers", { enumerable: true, get: function () { return guardrails_1.noRootContainers; } });
+var redact_1 = require("./redact");
+Object.defineProperty(exports, "sanitizeErrorMessage", { enumerable: true, get: function () { return redact_1.sanitizeErrorMessage; } });
+Object.defineProperty(exports, "redactConnectionStrings", { enumerable: true, get: function () { return redact_1.redactConnectionStrings; } });
+Object.defineProperty(exports, "redactPrivateKeys", { enumerable: true, get: function () { return redact_1.redactPrivateKeys; } });
+Object.defineProperty(exports, "maskSecretValues", { enumerable: true, get: function () { return redact_1.maskSecretValues; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,6CAA2D;AAAlD,kGAAA,GAAG,OAAA;AAAE,mGAAA,IAAI,OAAA;AAAE,qGAAA,MAAM,OAAA;AAAE,uGAAA,QAAQ,OAAA;AAEpC,uCAAkE;AAAzD,kGAAA,MAAM,OAAA;AAAqB,sGAAA,UAAU,OAAA;AAC9C,uCAAgF;AAAvE,2GAAA,eAAe,OAAA;AAAE,iHAAA,qBAAqB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAC5D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA;AACtB,qDAA0D;AAAjD,yHAAA,sBAAsB,OAAA;AAC/B,uCAQmB;AAPjB,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAClB,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAGpB,2CASqB;AARnB,2GAAA,aAAa,OAAA;AACb,+GAAA,iBAAiB,OAAA;AACjB,oHAAA,sBAAsB,OAAA;AACtB,mHAAA,qBAAqB,OAAA;AACrB,2GAAA,aAAa,OAAA;AACb,gHAAA,kBAAkB,OAAA;AAClB,wGAAA,UAAU,OAAA;AACV,8GAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,6CAA2D;AAAlD,kGAAA,GAAG,OAAA;AAAE,mGAAA,IAAI,OAAA;AAAE,qGAAA,MAAM,OAAA;AAAE,uGAAA,QAAQ,OAAA;AAEpC,uCAAkE;AAAzD,kGAAA,MAAM,OAAA;AAAqB,sGAAA,UAAU,OAAA;AAC9C,uCAAgF;AAAvE,2GAAA,eAAe,OAAA;AAAE,iHAAA,qBAAqB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAC5D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA;AACtB,qDAA0D;AAAjD,yHAAA,sBAAsB,OAAA;AAC/B,uCAQmB;AAPjB,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAClB,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAGpB,2CASqB;AARnB,2GAAA,aAAa,OAAA;AACb,+GAAA,iBAAiB,OAAA;AACjB,oHAAA,sBAAsB,OAAA;AACtB,mHAAA,qBAAqB,OAAA;AACrB,2GAAA,aAAa,OAAA;AACb,gHAAA,kBAAkB,OAAA;AAClB,wGAAA,UAAU,OAAA;AACV,8GAAA,gBAAgB,OAAA;AAGlB,mCAKiB;AAJf,8GAAA,oBAAoB,OAAA;AACpB,iHAAA,uBAAuB,OAAA;AACvB,2GAAA,iBAAiB,OAAA;AACjB,0GAAA,gBAAgB,OAAA"}

package/dist/redact.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Redaction helpers — scrub credential material from error messages,
+ * logs and rendered output so secrets don't leak through secondary
+ * channels (CI logs, CRD status, support tickets).
+ */
+/**
+ * Mask credentials embedded in connection strings:
+ *   postgresql://app:staging-password@db:5432/app
+ *     → postgresql://app:*****@db:5432/app
+ */
+export declare function redactConnectionStrings(text: string): string;
+/**
+ * Mask PEM private key blocks:
+ *   -----BEGIN RSA PRIVATE KEY-----
+ *   ...
+ *   -----END RSA PRIVATE KEY-----
+ *     → [REDACTED PRIVATE KEY]
+ */
+export declare function redactPrivateKeys(text: string): string;
+/**
+ * Return a copy of a resource with plaintext credential values masked:
+ * - Secret stringData/data values for credential keys → '*****'
+ * - Connection-string passwords anywhere → '*****'
+ * - PEM private key blocks → '[REDACTED PRIVATE KEY]'
+ *
+ * Used when rendered output is written to logs/stdout so committed or
+ * displayed YAML never carries live credentials.
+ */
+export declare function maskSecretValues<T>(resource: T): T;
+/**
+ * Best-effort sanitization for error messages, logs and CRD status.
+ * Masks connection-string credentials and private key blocks. Framework
+ * errors are value-free by design (they reference the location of a
+ * credential, never its value); this covers messages produced by
+ * external tooling (kubectl, kubernetes API, esbuild source excerpts).
+ */
+export declare function sanitizeErrorMessage(text: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKtD;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAElD;AA8CD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/redact.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * Redaction helpers — scrub credential material from error messages,
+ * logs and rendered output so secrets don't leak through secondary
+ * channels (CI logs, CRD status, support tickets).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactConnectionStrings = redactConnectionStrings;
+exports.redactPrivateKeys = redactPrivateKeys;
+exports.maskSecretValues = maskSecretValues;
+exports.sanitizeErrorMessage = sanitizeErrorMessage;
+/**
+ * Mask credentials embedded in connection strings:
+ *   postgresql://app:staging-password@db:5432/app
+ *     → postgresql://app:*****@db:5432/app
+ */
+function redactConnectionStrings(text) {
+    return text.replace(/([a-z][a-z0-9+.-]*:\/\/[^/\s:@]*):([^@/\s]+)@/gi, (_match, schemeAndUser) => `${schemeAndUser}:*****@`);
+}
+/**
+ * Mask PEM private key blocks:
+ *   -----BEGIN RSA PRIVATE KEY-----
+ *   ...
+ *   -----END RSA PRIVATE KEY-----
+ *     → [REDACTED PRIVATE KEY]
+ */
+function redactPrivateKeys(text) {
+    return text.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, '[REDACTED PRIVATE KEY]');
+}
+/** Keys (normalized) whose value in a Secret map is a credential. */
+const SECRET_DATA_KEY_SUFFIXES = [
+    'password',
+    'passwd',
+    'pwd',
+    'secretkey',
+    'secretaccesskey',
+    'accesskey',
+    'accesskeyid',
+    'privatekey',
+    'clientsecret',
+    'apikey',
+    'authtoken',
+    'connectionstring',
+];
+/**
+ * Return a copy of a resource with plaintext credential values masked:
+ * - Secret stringData/data values for credential keys → '*****'
+ * - Connection-string passwords anywhere → '*****'
+ * - PEM private key blocks → '[REDACTED PRIVATE KEY]'
+ *
+ * Used when rendered output is written to logs/stdout so committed or
+ * displayed YAML never carries live credentials.
+ */
+function maskSecretValues(resource) {
+    return maskNode(resource);
+}
+function maskNode(node) {
+    if (typeof node === 'string') {
+        let masked = redactPrivateKeys(node);
+        masked = redactConnectionStrings(masked);
+        return masked;
+    }
+    if (Array.isArray(node)) {
+        return node.map(maskNode);
+    }
+    if (node && typeof node === 'object') {
+        const result = {};
+        for (const [key, value] of Object.entries(node)) {
+            const normalized = key.toLowerCase().replace(/[-_.]/g, '');
+            if (normalized === 'data' || normalized === 'stringdata') {
+                result[key] = maskSecretMap(value);
+            }
+            else {
+                result[key] = maskNode(value);
+            }
+        }
+        return result;
+    }
+    return node;
+}
+function maskSecretMap(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return maskNode(value);
+    }
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+        const normalized = key.toLowerCase().replace(/[-_.]/g, '');
+        if (typeof entry === 'string' &&
+            entry.length > 0 &&
+            SECRET_DATA_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix))) {
+            result[key] = '*****';
+        }
+        else {
+            result[key] = maskNode(entry);
+        }
+    }
+    return result;
+}
+/**
+ * Best-effort sanitization for error messages, logs and CRD status.
+ * Masks connection-string credentials and private key blocks. Framework
+ * errors are value-free by design (they reference the location of a
+ * credential, never its value); this covers messages produced by
+ * external tooling (kubectl, kubernetes API, esbuild source excerpts).
+ */
+function sanitizeErrorMessage(text) {
+    return redactPrivateKeys(redactConnectionStrings(text));
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAOH,0DAKC;AASD,8CAKC;AA2BD,4CAEC;AAqDD,oDAEC;AA5GD;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,IAAY;IAClD,OAAO,IAAI,CAAC,OAAO,CACjB,iDAAiD,EACjD,CAAC,MAAM,EAAE,aAAqB,EAAE,EAAE,CAAC,GAAG,aAAa,SAAS,CAC7D,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CACjB,yEAAyE,EACzE,wBAAwB,CACzB,CAAA;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,wBAAwB,GAAG;IAC/B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,WAAW;IACX,kBAAkB;CACnB,CAAA;AAED;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAAI,QAAW;IAC7C,OAAO,QAAQ,CAAC,QAAQ,CAAM,CAAA;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;QACxC,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YAC1D,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBACzD,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QAC1D,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EACtE,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,OAAO,iBAAiB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAA;AACzD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r8s/core",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "JSX factory and renderer for r8s",
   "license": "MIT",
   "author": "Berget AI AB",
@@ -52,7 +52,7 @@
     "clean": "rm -rf dist tsconfig.tsbuildinfo"
   },
   "dependencies": {
-    "@r8s/k8s-types": "^0.1.0"
+    "@r8s/k8s-types": "^0.2.0"
   },
   "devDependencies": {
     "typescript": "^5.3.0",