@r8s/core 0.1.0 → 0.2.1

package/dist/defaults.d.ts

@@ -15,10 +15,26 @@ export interface DatabaseConnection {
 }
 /** Secret provider configuration */
 export interface SecretProvider {
-    backend: 'vault' | 'openbao' | 'sealed-secrets' | 'manual-secrets';
+    backend: 'vault' | 'openbao' | 'sealed-secrets' | 'manual-secrets' | 'kubernetes' | (string & {});
+    /**
+     * Custom provisioner hook. Built-in backends (vault/openbao) get one
+     * attached by the recipes' SecretProvider; anything carrying
+     * `provision()` is treated as provisioning-capable regardless of
+     * backend identity — orgs can plug ESO/Infisical/CSI without touching
+     * packages.
+     */
+    provision?: SecretProvisioner;
     mount?: string;
     path?: string;
     authRef?: string;
+    /**
+     * How often the secrets operator re-syncs from the backend (e.g. '3600s'),
+     * rendered as `refreshAfter` on every generated
+     * VaultStaticSecret/OpenBaoStaticSecret. Enables credential rotation —
+     * combine with `rolloutRestartTargets` on consumers so pods pick up
+     * rotated values.
+     */
+    refreshAfter?: string;
 }
 /**
  * Default contexts for shared infrastructure properties.
@@ -44,6 +60,72 @@ export interface SecretProvider {
  */
 /** Inherits namespace to all child resources */
 export declare const Namespace: import("./context").Context<string>;
+/**
+ * Resolve the effective namespace: explicit prop wins, otherwise inherit
+ * from the Platform tree, otherwise 'default'. Replaces the inline
+ * `namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace :
+ * undefined) ?? 'default'` formula that was copied through every recipe
+ * and package — namespace policy lives here now.
+ */
+export declare function useNamespace(override?: string): string;
+/** One bundle to provision through a secrets backend */
+export interface StaticSecretRequest {
+    /** Resource name (usually equals the destination Secret name) */
+    name: string;
+    namespace: string;
+    /** KV path in the secret store */
+    path: string;
+    /** Destination→source key mapping (env-case destination, snake_case source) */
+    keys: Record<string, string>;
+    /**
+     * Raw Go-template passthrough merged AFTER the keys mapping — for
+     * advanced bundles needing literals or composed templates
+     * (e.g. `AWS_ENDPOINTS: 'https://s3.berget.cloud'`).
+     */
+    templates?: Record<string, string>;
+    /** Provisioned Kubernetes Secret name (defaults to name) */
+    secretName?: string;
+    /** Store mount path */
+    mount?: string;
+    /** Auth reference override (defaults to the provider's authRef) */
+    authRef?: string;
+    /** Re-sync interval */
+    refreshAfter?: string;
+    /** Workloads restarted after rotation (already field-normalized) */
+    restartTargets?: {
+        kind?: string;
+        name: string;
+        apiVersion?: string;
+    }[];
+}
+/**
+ * Provisioner hook: given a request, produce the backend-specific resources
+ * (e.g. VaultStaticSecret, OpenBaoStaticSecret, ExternalSecret, …).
+ * Elements are flattened into the render result.
+ */
+export type SecretProvisioner = (req: StaticSecretRequest) => unknown;
+/** Route request handed to a custom routing provisioner */
+export interface RouteRequest {
+    name: string;
+    namespace: string;
+    host: string;
+    serviceName: string;
+    servicePort: number;
+    pathPrefix?: string;
+    annotations?: Record<string, string>;
+    additionalAnnotations?: Record<string, string>;
+    tls?: {
+        secretName?: string;
+        clusterIssuer?: string;
+        wildcardSecretName?: string;
+        ingressClassName?: string;
+    };
+}
+/**
+ * Route provisioner hook: given a request, produce the backend-specific
+ * route resources (Ingress/HTTPRoute/… + any supporting objects).
+ */
+export type RouteProvisioner = (req: RouteRequest) => unknown;
 /** Inherits labels to all child resources */
 export declare const Labels: import("./context").Context<Record<string, string>>;
 /** Inherits annotations to all child resources */
@@ -196,9 +278,15 @@ export declare const OperatorContext: import("./context").Context<Operator[]>;
  */
 export interface RoutingConfig {
     /** Routing implementation: 'ingress' (nginx) or 'gateway' (Envoy Gateway API) */
-    mode: 'ingress' | 'gateway';
+    mode: 'ingress' | 'gateway' | (string & {});
     /** Gateway class name (only used when mode='gateway', default: 'eg') */
     gatewayClassName?: string;
+    /**
+     * Custom route provisioner hook. When set, <Endpoint/> delegates the
+     * whole route render to it and ignores mode — orgs can plug a custom
+     * ingress controller / L7 stack without touching recipes or packages.
+     */
+    route?: RouteProvisioner;
 }
 export declare const RoutingContext: import("./context").Context<RoutingConfig>;
 export { createContext } from './context';

package/dist/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AAChD,eAAO,MAAM,SAAS,qCAAmC,CAAA;AAEzD,6CAA6C;AAC7C,eAAO,MAAM,MAAM,qDAA4C,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,WAAW,qDAA4C,CAAA;AAEpE,6DAA6D;AAC7D,eAAO,MAAM,WAAW;UAA+B,MAAM;WAAS,MAAM;IAAQ,CAAA;AAEpF,gEAAgE;AAChE,eAAO,MAAM,SAAS;eACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;aACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;EAC3B,CAAA;AAEN,sDAAsD;AACtD,eAAO,MAAM,cAAc,qCAAmC,CAAA;AAE9D,6DAA6D;AAC7D,eAAO,MAAM,aAAa,qCAA4B,CAAA;AAEtD,2CAA2C;AAC3C,eAAO,MAAM,MAAM,qCAA4B,CAAA;AAE/C,iCAAiC;AACjC,eAAO,MAAM,GAAG;aACL,OAAO;aACP,MAAM;iBACF,MAAM;EACC,CAAA;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/C;AAED,eAAO,MAAM,cAAc,mDAA4C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,eAAe,wDAAiD,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,oDAA6C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,eAAe,yCAAgC,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,IAAI,EAAE,SAAS,GAAG,SAAS,CAAA;IAC3B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,eAAO,MAAM,cAAc,4CAAoD,CAAA;AAG/E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACjG;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AAChD,eAAO,MAAM,SAAS,qCAAmC,CAAA;AAEzD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAGtD;AAQD,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uBAAuB;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,cAAc,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CACxE;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAA;AAErE,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9C,GAAG,CAAC,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAA;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,MAAM,qDAA4C,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,WAAW,qDAA4C,CAAA;AAEpE,6DAA6D;AAC7D,eAAO,MAAM,WAAW;UAA+B,MAAM;WAAS,MAAM;IAAQ,CAAA;AAEpF,gEAAgE;AAChE,eAAO,MAAM,SAAS;eACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;aACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;EAC3B,CAAA;AAEN,sDAAsD;AACtD,eAAO,MAAM,cAAc,qCAAmC,CAAA;AAE9D,6DAA6D;AAC7D,eAAO,MAAM,aAAa,qCAA4B,CAAA;AAEtD,2CAA2C;AAC3C,eAAO,MAAM,MAAM,qCAA4B,CAAA;AAE/C,iCAAiC;AACjC,eAAO,MAAM,GAAG;aACL,OAAO;aACP,MAAM;iBACF,MAAM;EACC,CAAA;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/C;AAED,eAAO,MAAM,cAAc,mDAA4C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,eAAe,wDAAiD,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,oDAA6C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,eAAe,yCAAgC,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAC3C,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB;AAED,eAAO,MAAM,cAAc,4CAAoD,CAAA;AAG/E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA"}

package/dist/defaults.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createContext = exports.RoutingContext = exports.OperatorContext = exports.SecretContext = exports.DatabaseContext = exports.ClusterContext = exports.TLS = exports.Domain = exports.ImageRegistry = exports.ServiceAccount = exports.Resources = exports.Environment = exports.Annotations = exports.Labels = exports.Namespace = void 0;
+exports.useNamespace = useNamespace;
 const context_1 = require("./context");
+const renderer_1 = require("./renderer");
 /**
  * Default contexts for shared infrastructure properties.
  *
@@ -26,6 +28,17 @@ const context_1 = require("./context");
  */
 /** Inherits namespace to all child resources */
 exports.Namespace = (0, context_1.createContext)('default');
+/**
+ * Resolve the effective namespace: explicit prop wins, otherwise inherit
+ * from the Platform tree, otherwise 'default'. Replaces the inline
+ * `namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace :
+ * undefined) ?? 'default'` formula that was copied through every recipe
+ * and package — namespace policy lives here now.
+ */
+function useNamespace(override) {
+    const contextNamespace = (0, renderer_1.useContext)(exports.Namespace);
+    return override ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default';
+}
 /** Inherits labels to all child resources */
 exports.Labels = (0, context_1.createContext)({});
 /** Inherits annotations to all child resources */

package/dist/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":";;;AAAA,uCAAyC;AAuBzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AACnC,QAAA,SAAS,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAEzD,6CAA6C;AAChC,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAE/D,kDAAkD;AACrC,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAEpE,6DAA6D;AAChD,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyC,EAAE,CAAC,CAAA;AAEpF,gEAAgE;AACnD,QAAA,SAAS,GAAG,IAAA,uBAAa,EAGnC,EAAE,CAAC,CAAA;AAEN,sDAAsD;AACzC,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAE9D,6DAA6D;AAChD,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAEtD,2CAA2C;AAC9B,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAE/C,iCAAiC;AACpB,QAAA,GAAG,GAAG,IAAA,uBAAa,EAI7B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AAoCT,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAuB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAA4B,IAAI,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAwB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAAa,EAAE,CAAC,CAAA;AA6B/C,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;AAE/E,6DAA6D;AAC7D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":";;;AAyEA,oCAGC;AA5ED,uCAAyC;AACzC,yCAAuC;AAuCvC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AACnC,QAAA,SAAS,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAEzD;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,QAAiB;IAC5C,MAAM,gBAAgB,GAAG,IAAA,qBAAU,EAAC,iBAAS,CAAC,CAAA;IAC9C,OAAO,QAAQ,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAA;AACjG,CAAC;AAkED,6CAA6C;AAChC,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAE/D,kDAAkD;AACrC,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAEpE,6DAA6D;AAChD,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyC,EAAE,CAAC,CAAA;AAEpF,gEAAgE;AACnD,QAAA,SAAS,GAAG,IAAA,uBAAa,EAGnC,EAAE,CAAC,CAAA;AAEN,sDAAsD;AACzC,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAE9D,6DAA6D;AAChD,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAEtD,2CAA2C;AAC9B,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAE/C,iCAAiC;AACpB,QAAA,GAAG,GAAG,IAAA,uBAAa,EAI7B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AAoCT,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAuB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAA4B,IAAI,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAwB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAAa,EAAE,CAAC,CAAA;AAmC/C,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;AAE/E,6DAA6D;AAC7D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA"}

package/dist/guardrails.d.ts

@@ -13,14 +13,27 @@ export interface GuardrailRule {
 /** Check that all namespaces have NetworkPolicies */
 export declare const requireNetworkPolicies: GuardrailRule;
 /** Check that all Deployments have resource limits */
+/** Workload kinds carrying a pod template with resource needs. */
+export declare const RESOURCE_LIMIT_KINDS: readonly ["Deployment", "StatefulSet", "DaemonSet"];
 export declare const requireResourceLimits: GuardrailRule;
 /** Check that all resources have required labels */
 export declare const requireLabels: (requiredLabels: string[]) => GuardrailRule;
-/** Check that no secrets contain plaintext passwords */
+/**
+ * Check that no credentials are rendered as plaintext. Covers:
+ * - Secret stringData/data values for credential keys, connection-string
+ *   URIs, and PEM private keys (encryptedData from sealed-secrets and
+ *   system TLS/service-account secrets are exempt)
+ * - ConfigMap data — flat credential keys and credential-looking
+ *   `key: value` lines inside embedded YAML/INI payloads (e.g. appservice
+ *   registrations holding as_token/hs_token)
+ * - Workload env vars that embed credentials via `value` (secretKeyRef or
+ *   $(VAR) runtime expansion are fine)
+ * - Any nested field (CRD specs, realm users, …) holding a plaintext
+ *   credential value
+ */
 export declare const noPlaintextSecrets: GuardrailRule;
 /** Check that Ingresses have TLS configured */
 export declare const requireTLS: GuardrailRule;
-/** Check that Pods don't run as root */
 export declare const noRootContainers: GuardrailRule;
 /** Default set of guardrails for production use */
 export declare const defaultGuardrails: GuardrailRule[];

package/dist/guardrails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACtC,wFAAwF;IACxF,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,CAAA;CAC7D;AAED,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,EAAE,aAgCpC,CAAA;AAED,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,EAAE,aAwCnC,CAAA;AAED,oDAAoD;AACpD,eAAO,MAAM,aAAa,GAAI,gBAAgB,MAAM,EAAE,KAAG,aAwBvD,CAAA;AAEF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,EAAE,aA8BhC,CAAA;AAED,+CAA+C;AAC/C,eAAO,MAAM,UAAU,EAAE,aAyBxB,CAAA;AAED,wCAAwC;AACxC,eAAO,MAAM,gBAAgB,EAAE,aA4C9B,CAAA;AAED,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,EAAE,aAAa,EAM5C,CAAA;AAED,yDAAyD;AACzD,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,EAAE,EAC/B,KAAK,GAAE,aAAa,EAAsB,GACzC;IACD,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,IAAI,EAAE,eAAe,EAAE,CAAA;CACxB,CAwBA"}
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACtC,wFAAwF;IACxF,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,CAAA;CAC7D;AAED,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,EAAE,aAgCpC,CAAA;AAED,sDAAsD;AACtD,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,qDAAsD,CAAA;AA6BvF,eAAO,MAAM,qBAAqB,EAAE,aAQnC,CAAA;AACD,oDAAoD;AACpD,eAAO,MAAM,aAAa,GAAI,gBAAgB,MAAM,EAAE,KAAG,aAwBvD,CAAA;AA+WF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAyDhC,CAAA;AAED,+CAA+C;AAC/C,eAAO,MAAM,UAAU,EAAE,aAyBxB,CAAA;AAkCD,eAAO,MAAM,gBAAgB,EAAE,aAU9B,CAAA;AACD,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,EAAE,aAAa,EAM5C,CAAA;AAED,yDAAyD;AACzD,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,EAAE,EAC/B,KAAK,GAAE,aAAa,EAAsB,GACzC;IACD,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,IAAI,EAAE,eAAe,EAAE,CAAA;CACxB,CAwBA"}

package/dist/guardrails.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.defaultGuardrails = exports.noRootContainers = exports.requireTLS = exports.noPlaintextSecrets = exports.requireLabels = exports.requireResourceLimits = exports.requireNetworkPolicies = void 0;
+exports.defaultGuardrails = exports.noRootContainers = exports.requireTLS = exports.noPlaintextSecrets = exports.requireLabels = exports.requireResourceLimits = exports.RESOURCE_LIMIT_KINDS = exports.requireNetworkPolicies = void 0;
 exports.runGuardrails = runGuardrails;
 /** Check that all namespaces have NetworkPolicies */
 exports.requireNetworkPolicies = {
@@ -34,41 +34,41 @@ exports.requireNetworkPolicies = {
     },
 };
 /** Check that all Deployments have resource limits */
+/** Workload kinds carrying a pod template with resource needs. */
+exports.RESOURCE_LIMIT_KINDS = ['Deployment', 'StatefulSet', 'DaemonSet'];
+function containerResourceErrors(resource) {
+    const name = resource.metadata?.name;
+    return (resource.spec?.template?.spec?.containers || []).flatMap((container) => {
+        const label = `Container "${container.name}" in ${resource.kind} "${name}"`;
+        const errors = [];
+        if (!container.resources?.requests) {
+            errors.push({
+                code: 'MISSING_RESOURCE_REQUESTS',
+                message: `${label} is missing resource requests`,
+                resource: resource.kind,
+                field: 'spec.template.spec.containers[].resources.requests',
+                suggestion: 'Add resource.requests with cpu and memory values',
+            });
+        }
+        if (!container.resources?.limits) {
+            errors.push({
+                code: 'MISSING_RESOURCE_LIMITS',
+                message: `${label} is missing resource limits`,
+                resource: resource.kind,
+                field: 'spec.template.spec.containers[].resources.limits',
+                suggestion: 'Add resource.limits with cpu and memory values to prevent resource exhaustion',
+            });
+        }
+        return errors;
+    });
+}
 exports.requireResourceLimits = {
     id: 'require-resource-limits',
     description: 'All containers must have resource requests and limits',
     severity: 'error',
-    test: (resources) => {
-        const errors = [];
-        for (const resource of resources) {
-            if (resource.kind === 'Deployment' ||
-                resource.kind === 'StatefulSet' ||
-                resource.kind === 'DaemonSet') {
-                const containers = resource.spec?.template?.spec?.containers || [];
-                for (const container of containers) {
-                    if (!container.resources?.requests) {
-                        errors.push({
-                            code: 'MISSING_RESOURCE_REQUESTS',
-                            message: `Container "${container.name}" in ${resource.kind} "${resource.metadata?.name}" is missing resource requests`,
-                            resource: resource.kind,
-                            field: 'spec.template.spec.containers[].resources.requests',
-                            suggestion: 'Add resource.requests with cpu and memory values',
-                        });
-                    }
-                    if (!container.resources?.limits) {
-                        errors.push({
-                            code: 'MISSING_RESOURCE_LIMITS',
-                            message: `Container "${container.name}" in ${resource.kind} "${resource.metadata?.name}" is missing resource limits`,
-                            resource: resource.kind,
-                            field: 'spec.template.spec.containers[].resources.limits',
-                            suggestion: 'Add resource.limits with cpu and memory values to prevent resource exhaustion',
-                        });
-                    }
-                }
-            }
-        }
-        return errors;
-    },
+    test: (resources) => resources
+        .filter((resource) => exports.RESOURCE_LIMIT_KINDS.includes(resource.kind))
+        .flatMap(containerResourceErrors),
 };
 /** Check that all resources have required labels */
 const requireLabels = (requiredLabels) => ({
@@ -95,31 +95,361 @@ const requireLabels = (requiredLabels) => ({
     },
 });
 exports.requireLabels = requireLabels;
-/** Check that no secrets contain plaintext passwords */
+/**
+ * Keys whose value is a credential when they appear with these endings
+ * (normalized: lowercased, `-`/`_`/`.` removed).
+ */
+const SECRET_KEY_SUFFIXES = [
+    'password',
+    'passwd',
+    'pwd',
+    'secretkey',
+    'secretaccesskey',
+    'accesskey',
+    'accesskeyid',
+    'privatekey',
+    'clientsecret',
+    'apikey',
+    'token', // bare token: csrf/as/hs/api tokens are all credentials
+    'authtoken',
+    'connectionstring',
+];
+/** Key endings that hold the *name* of a secret, not a credential value. */
+const SECRET_REFERENCE_SUFFIXES = [
+    'secretname',
+    'secretref',
+    'passwordsecret',
+    'passwordkey',
+    'passwordref',
+    'passwordname',
+    'secretkeyref',
+    'secretkeyname',
+    'tokenname',
+    'tokenref',
+    'keyref',
+    'keyname',
+    'credentialsref',
+];
+/**
+ * Key prefixes that name a reference to an existing secret (chart
+ * convention), not credential values — e.g. the Harbor/Bitnami
+ * `existingSecretAdminPassword`, `existingSecretSecretKey` parameters.
+ */
+const SECRET_REFERENCE_PREFIXES = ['existingsecret'];
+/** Does this normalized key hold a reference rather than a credential? */
+function isReferenceKey(normalized) {
+    return (SECRET_REFERENCE_SUFFIXES.some((s) => normalized.endsWith(s)) ||
+        SECRET_REFERENCE_PREFIXES.some((s) => normalized.startsWith(s)));
+}
+/** Env var names that suggest the value is a credential. */
+const SECRET_ENV_NAME_PATTERN = /(password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|credential|client[_-]?secret)/i;
+/** Env var names that carry policy/lifetime metadata, not credentials
+ *  (e.g. REFRESH_TOKEN_EXPIRY, ACCESS_TOKEN_TTL, JWT_LIFESPAN). */
+const NON_SECRET_ENV_NAME_PATTERN = /(_expiry|_expires(_at|_in)?$|_ttl$|max[_-]age|lifespan|_timeout$|_url|_uri|_endpoint$|_provider$|_issuer$|_audience$|_header$|_transport$)/i;
+/** Matches scheme://[user[:password]@]host — a credentials-bearing URI. */
+const CONNECTION_STRING_RE = /[a-z][a-z0-9+.-]*:\/\/([^/\s:@]*):([^@/\s]+)@/i;
+/** Secret types that hold non-credential material (TLS certs, SA tokens managed in-cluster). */
+const EXEMPT_SECRET_TYPES = [
+    'kubernetes.io/tls',
+    'kubernetes.io/ssl',
+    'kubernetes.io/service-account-token',
+    'bootstrap.kubernetes.io/token',
+    'helm.sh/release.v1',
+];
+function normalizeKey(key) {
+    return key.toLowerCase().replace(/[-_.]/g, '');
+}
+/** Values that are references/placeholders rather than live credentials. */
+function looksLikeReference(value) {
+    return (value.includes('$(') ||
+        /^\$\{.+\}/.test(value) ||
+        value.startsWith('${') ||
+        value.startsWith('$') ||
+        value.startsWith('file://'));
+}
+/** "Fill in via GitOps"-style placeholder values — not live credentials. */
+const PLACEHOLDER_VALUE_RE = /^(replace|provide|change|todo|fixme|your[_-]|xxx+|<|\.\.\.|\*+)/i;
+/**
+ * Credential-looking `key: value` / `key=value` / `export key=value` lines
+ * inside multi-line text — embedded YAML/INI/dotenv payloads in ConfigMap
+ * data and Secret stringData blobs.
+ */
+const EMBEDDED_CREDENTIAL_LINE_RE = /^[ \t]*(?:export[ \t]+)?([A-Za-z0-9_.-]*?(?:token|password|passwd|secret|secretaccesskey|private[_-]?key|api[_-]?key|access[_-]?key|client[_-]?secret|authtoken)[A-Za-z0-9_.-]*?)\s*[:=]\s*['"]?([^\s'"]{8,})['"]?[ \t]*$/gim;
+/**
+ * Embedded keys whose value is metadata about a credential, not the
+ * credential itself (token_endpoint, password_file, secret_name, …).
+ */
+const EMBEDDED_KEY_EXCLUDE_SUFFIXES = [
+    'endpoint',
+    'url',
+    'uri',
+    'ttl',
+    'expiry',
+    'expires',
+    'maxage',
+    'lifespan',
+    'timeout',
+    'header',
+    'name',
+    'type',
+    'ref',
+    'file',
+    'path',
+    'algorithm',
+    'alg',
+    'issuer',
+    'audience',
+    'provider',
+    'transport',
+    'rotation',
+    'method', // e.g. token_endpoint_auth_method — OIDC metadata, not a credential
+];
+/** Find live credential values embedded in multi-line config text. */
+function embeddedCredentialLines(text) {
+    const hits = [];
+    for (const match of text.matchAll(EMBEDDED_CREDENTIAL_LINE_RE)) {
+        const [, key, value] = match;
+        const normalized = normalizeKey(key);
+        if (EMBEDDED_KEY_EXCLUDE_SUFFIXES.some((suffix) => normalized.endsWith(suffix)))
+            continue;
+        if (looksLikeReference(value))
+            continue;
+        if (PLACEHOLDER_VALUE_RE.test(value))
+            continue;
+        // Paths and URLs point at credentials; they are not credentials
+        if (value.startsWith('/') || /^[a-z][a-z0-9+.-]*:\/\//i.test(value))
+            continue;
+        hits.push({ key, value });
+    }
+    return hits;
+}
+function connectionStringPassword(value) {
+    const match = value.match(CONNECTION_STRING_RE);
+    if (!match)
+        return null;
+    const [, , password] = match;
+    // Kubernetes $(VAR) expansion and env interpolation — the credential is
+    // injected at runtime, not embedded in the manifest.
+    if (password.includes('$(') || password.includes('${'))
+        return null;
+    return password;
+}
+/** Collect pod containers from any workload-shaped resource. */
+function workloadsContainers(resource) {
+    const anyResource = resource;
+    const kind = anyResource.kind;
+    if (kind === 'CronJob') {
+        return [
+            ...(anyResource.spec?.jobTemplate?.spec?.template?.spec?.containers ?? []),
+            ...(anyResource.spec?.jobTemplate?.spec?.template?.spec?.initContainers ?? []),
+        ];
+    }
+    const podSpec = anyResource.spec?.template?.spec ?? anyResource.spec ?? {};
+    return [...(podSpec.containers ?? []), ...(podSpec.initContainers ?? [])];
+}
+const CREDENTIAL_VALUE_SUGGESTION = 'Use a secrets backend (openbao/vault/sealed-secrets) or let the operator provision the credential';
+const SEALED_FILE_SUGGESTION = 'Move the credential into a secrets backend and reference it, or render this file as a sealed secret';
+const CONFIGMAP_SUGGESTION = 'ConfigMaps carry no protection — render credentials as a Secret (from a secrets backend or sealed secret) instead';
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+/** Does this key name look like it holds a credential value (not a reference)? */
+function isCredentialKeyName(normalized, extraExclusions = []) {
+    return (SECRET_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) &&
+        !isReferenceKey(normalized) &&
+        !extraExclusions.some((suffix) => normalized.endsWith(suffix)));
+}
+/** Multi-line values may embed YAML/INI payloads holding credential keys (e.g. appservice registration.yaml). */
+function pushEmbeddedCredentialHits(ctx, hitInfo) {
+    const { kind, where, field, value, suggestion } = hitInfo;
+    if (typeof value !== 'string' || !value.includes('\n'))
+        return;
+    for (const hit of embeddedCredentialLines(value)) {
+        ctx.push(kind, `${where} — embedded key "${hit.key}"`, field, suggestion);
+    }
+}
+/** One stringData/data entry: credential keys, connection strings, PEM keys, embedded payloads. */
+function scanSecretEntry(ctx, entry) {
+    const { name, map, key, value } = entry;
+    const where = `Secret "${name}" (${map}.${key})`;
+    const field = `${map}.${key}`;
+    if (isCredentialKeyName(normalizeKey(key)) && isNonEmptyString(value)) {
+        ctx.push('Secret', where, field, CREDENTIAL_VALUE_SUGGESTION);
+    }
+    ctx.scanValue('Secret', where, field, value);
+    pushEmbeddedCredentialHits(ctx, {
+        kind: 'Secret',
+        where,
+        field,
+        value,
+        suggestion: SEALED_FILE_SUGGESTION,
+    });
+}
+/** Secret stringData/data maps of a non-exempt Secret. */
+function scanSecretResource(resource, ctx) {
+    const anyResource = resource;
+    const secretType = anyResource.type || '';
+    if (EXEMPT_SECRET_TYPES.includes(secretType) || anyResource.encryptedData !== undefined)
+        return;
+    for (const map of ['stringData', 'data']) {
+        const data = anyResource[map];
+        if (!data || typeof data !== 'object')
+            continue;
+        for (const [key, value] of Object.entries(data)) {
+            scanSecretEntry(ctx, { name: resource.metadata?.name, map, key, value });
+        }
+    }
+}
+/** ConfigMap data — same exposure as Secrets when credentials are embedded. */
+function scanConfigMapResource(resource, ctx) {
+    const { push, scanValue } = ctx;
+    const data = resource.data;
+    if (!data || typeof data !== 'object')
+        return;
+    const name = resource.metadata?.name;
+    for (const [key, value] of Object.entries(data)) {
+        if (!isNonEmptyString(value))
+            continue;
+        const where = `ConfigMap "${name}" (data.${key})`;
+        const field = `data.${key}`;
+        const isCredentialKey = isCredentialKeyName(normalizeKey(key), EMBEDDED_KEY_EXCLUDE_SUFFIXES) &&
+            !looksLikeReference(value) &&
+            !PLACEHOLDER_VALUE_RE.test(value);
+        if (isCredentialKey)
+            push('ConfigMap', where, field, CONFIGMAP_SUGGESTION);
+        pushEmbeddedCredentialHits(ctx, {
+            kind: 'ConfigMap',
+            where,
+            field,
+            value,
+            suggestion: CONFIGMAP_SUGGESTION,
+        });
+        scanValue('ConfigMap', where, field, value);
+    }
+}
+/** Env entries that embed a literal string via `value` (valueFrom is a reference, not exposure). */
+function hasPlainValue(env) {
+    return (!!env &&
+        typeof env === 'object' &&
+        typeof env.name === 'string' &&
+        typeof env.value === 'string' &&
+        env.valueFrom === undefined);
+}
+function envIsSecretNamed(name) {
+    return SECRET_ENV_NAME_PATTERN.test(name) && !NON_SECRET_ENV_NAME_PATTERN.test(name);
+}
+/** Workload env vars: only `value` embeds the credential — valueFrom is a reference. */
+function scanWorkloadEnv(resource, kindName, push) {
+    for (const container of workloadsContainers(resource)) {
+        for (const env of (container.env ?? []).filter(hasPlainValue)) {
+            const where = `${kindName} container "${container.name}" env "${env.name}"`;
+            const field = `spec.template.spec.containers[].env[name=${env.name}].value`;
+            if (envIsSecretNamed(env.name) && !looksLikeReference(env.value)) {
+                push(resource.kind, where, field, 'Use valueFrom.secretKeyRef, a Vault/OpenBao secret reference, or $(VAR) expansion');
+            }
+            if (connectionStringPassword(env.value) !== null) {
+                push(resource.kind, where, field, 'Connection string embeds a password. Split into individual vars and reference the secret');
+            }
+        }
+    }
+}
+/** Nested fields — credentials anywhere in the resource tree (CRD specs, realm users, …). */
+function walkNestedFields(resource, kindName, ctx) {
+    const { push, scanValue } = ctx;
+    const leafScan = (value, path) => {
+        if (typeof value === 'string')
+            scanValue(resource.kind, `${kindName} (${path})`, path, value);
+    };
+    const reportCredentialKey = (key, value, path) => {
+        if (!isCredentialKeyName(normalizeKey(key)))
+            return;
+        if (!isNonEmptyString(value) || looksLikeReference(value))
+            return;
+        push(resource.kind, `${kindName} (${path}.${key})`, `${path}.${key}`, 'Move the credential into a secrets backend and reference it by name');
+    };
+    const walkObject = (obj, path) => {
+        for (const [key, value] of Object.entries(obj)) {
+            // sealed-secrets ciphertext is encrypted with the cluster key
+            if (key === 'encryptedData')
+                continue;
+            reportCredentialKey(key, value, path);
+            // Recurse into child objects/arrays so credentials are caught at every
+            // depth; leaf strings are scanned for connection strings / PEM keys
+            if (value && typeof value === 'object')
+                walk(value, `${path}.${key}`);
+            else
+                leafScan(value, `${path}.${key}`);
+        }
+    };
+    const walk = (node, path) => {
+        if (Array.isArray(node)) {
+            node.forEach((item, i) => walk(item, `${path}[${i}]`));
+            return;
+        }
+        if (!node || typeof node !== 'object') {
+            leafScan(node, path);
+            return;
+        }
+        walkObject(node, path);
+    };
+    walk(resource.spec, 'spec');
+}
+/**
+ * Check that no credentials are rendered as plaintext. Covers:
+ * - Secret stringData/data values for credential keys, connection-string
+ *   URIs, and PEM private keys (encryptedData from sealed-secrets and
+ *   system TLS/service-account secrets are exempt)
+ * - ConfigMap data — flat credential keys and credential-looking
+ *   `key: value` lines inside embedded YAML/INI payloads (e.g. appservice
+ *   registrations holding as_token/hs_token)
+ * - Workload env vars that embed credentials via `value` (secretKeyRef or
+ *   $(VAR) runtime expansion are fine)
+ * - Any nested field (CRD specs, realm users, …) holding a plaintext
+ *   credential value
+ */
 exports.noPlaintextSecrets = {
     id: 'no-plaintext-secrets',
-    description: 'Secrets should not contain plaintext passwords in rendered output',
+    description: 'Manifests must not contain plaintext credentials',
     severity: 'error',
     test: (resources) => {
         const errors = [];
+        const seen = new Set();
+        const push = (kind, where, field, suggestion) => {
+            const dedupeKey = `${where}:${field}`;
+            if (seen.has(dedupeKey))
+                return;
+            seen.add(dedupeKey);
+            errors.push({
+                code: 'PLAINTEXT_SECRET',
+                message: `Plaintext credential in ${where}`,
+                resource: kind,
+                field,
+                suggestion,
+            });
+        };
+        const scanValue = (resourceKind, where, field, value) => {
+            if (typeof value !== 'string' || value.length === 0)
+                return;
+            if (connectionStringPassword(value) !== null) {
+                push(resourceKind, where, field, 'Connection string embeds a password. Inject the credential at runtime via secretKeyRef or $(VAR) expansion instead');
+            }
+            else if (value.startsWith('-----BEGIN') && value.includes('PRIVATE KEY')) {
+                push(resourceKind, where, field, 'PEM private key is embedded in the manifest. Store it in a secrets backend or a sealed secret instead');
+            }
+        };
+        const ctx = { push, scanValue };
         for (const resource of resources) {
+            const kindName = `${resource.kind} "${resource.metadata?.name ?? '?'}"`;
             if (resource.kind === 'Secret') {
-                const data = resource.stringData || resource.data || {};
-                for (const [key, value] of Object.entries(data)) {
-                    if (typeof value === 'string' && value.length > 0) {
-                        // Check if it looks like a password (not a reference)
-                        if (key.toLowerCase().includes('password') || key.toLowerCase().includes('secret')) {
-                            errors.push({
-                                code: 'PLAINTEXT_SECRET',
-                                message: `Secret "${resource.metadata?.name}" contains plaintext value for key "${key}"`,
-                                resource: 'Secret',
-                                field: `stringData.${key}`,
-                                suggestion: 'Use Vault, Sealed Secrets, or external secret management instead of plaintext',
-                            });
-                        }
-                    }
-                }
+                scanSecretResource(resource, ctx);
+                continue;
+            }
+            if (resource.kind === 'ConfigMap') {
+                scanConfigMapResource(resource, ctx);
+                continue;
             }
+            scanWorkloadEnv(resource, kindName, push);
+            walkNestedFields(resource, kindName, ctx);
         }
         return errors;
     },
@@ -149,44 +479,42 @@ exports.requireTLS = {
     },
 };
 /** Check that Pods don't run as root */
+function runsAsRoot(securityContext) {
+    return securityContext?.runAsUser === 0 || securityContext?.runAsRoot === true;
+}
+function rootContainerErrors(resource) {
+    const podSpec = resource.spec?.template?.spec || resource.spec || {};
+    const name = resource.metadata?.name;
+    const errors = [];
+    if (runsAsRoot(podSpec.securityContext ?? {})) {
+        errors.push({
+            code: 'CONTAINER_RUNS_AS_ROOT',
+            message: `${resource.kind} "${name}" is configured to run as root`,
+            resource: resource.kind,
+            field: 'spec.template.spec.securityContext.runAsUser',
+            suggestion: 'Set runAsUser to a non-zero UID and runAsRoot to false',
+        });
+    }
+    for (const container of podSpec.containers || []) {
+        if (runsAsRoot(container.securityContext ?? {})) {
+            errors.push({
+                code: 'CONTAINER_RUNS_AS_ROOT',
+                message: `Container "${container.name}" in ${resource.kind} "${name}" runs as root`,
+                resource: resource.kind,
+                field: 'spec.template.spec.containers[].securityContext.runAsUser',
+                suggestion: 'Set securityContext.runAsUser to a non-zero UID',
+            });
+        }
+    }
+    return errors;
+}
 exports.noRootContainers = {
     id: 'no-root-containers',
     description: 'Containers should not run as root user',
     severity: 'error',
-    test: (resources) => {
-        const errors = [];
-        for (const resource of resources) {
-            if (resource.kind === 'Deployment' ||
-                resource.kind === 'StatefulSet' ||
-                resource.kind === 'DaemonSet' ||
-                resource.kind === 'Pod') {
-                const podSpec = resource.spec?.template?.spec || resource.spec || {};
-                const securityContext = podSpec.securityContext || {};
-                if (securityContext.runAsUser === 0 || securityContext.runAsRoot === true) {
-                    errors.push({
-                        code: 'CONTAINER_RUNS_AS_ROOT',
-                        message: `${resource.kind} "${resource.metadata?.name}" is configured to run as root`,
-                        resource: resource.kind,
-                        field: 'spec.template.spec.securityContext.runAsUser',
-                        suggestion: 'Set runAsUser to a non-zero UID and runAsRoot to false',
-                    });
-                }
-                for (const container of podSpec.containers || []) {
-                    const containerSecurity = container.securityContext || {};
-                    if (containerSecurity.runAsUser === 0 || containerSecurity.runAsRoot === true) {
-                        errors.push({
-                            code: 'CONTAINER_RUNS_AS_ROOT',
-                            message: `Container "${container.name}" in ${resource.kind} "${resource.metadata?.name}" runs as root`,
-                            resource: resource.kind,
-                            field: 'spec.template.spec.containers[].securityContext.runAsUser',
-                            suggestion: 'Set securityContext.runAsUser to a non-zero UID',
-                        });
-                    }
-                }
-            }
-        }
-        return errors;
-    },
+    test: (resources) => resources
+        .filter((resource) => [...exports.RESOURCE_LIMIT_KINDS, 'Pod'].includes(resource.kind))
+        .flatMap(rootContainerErrors),
 };
 /** Default set of guardrails for production use */
 exports.defaultGuardrails = [

package/dist/guardrails.js.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":";;;AA6OA,sCAgCC;AA/PD,qDAAqD;AACxC,QAAA,sBAAsB,GAAkB;IACnD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qDAAqD;IAClE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;QACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;QAE1C,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC7C,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACtE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,cAAc,EAAE,8BAA8B;oBACvD,QAAQ,EAAE,WAAW;oBACrB,KAAK,EAAE,eAAe;oBACtB,UAAU,EAAE,sCAAsC,EAAE,qCAAqC;iBAC1F,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,sDAAsD;AACzC,QAAA,qBAAqB,GAAkB;IAClD,EAAE,EAAE,yBAAyB;IAC7B,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC/B,QAAQ,CAAC,IAAI,KAAK,WAAW,EAC7B,CAAC;gBACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAA;gBAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;oBACnC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;wBACnC,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,2BAA2B;4BACjC,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;4BACtH,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,oDAAoD;4BAC3D,UAAU,EAAE,kDAAkD;yBAC/D,CAAC,CAAA;oBACJ,CAAC;oBACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,yBAAyB;4BAC/B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,8BAA8B;4BACpH,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,kDAAkD;4BACzD,UAAU,EACR,+EAA+E;yBAClF,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,oDAAoD;AAC7C,MAAM,aAAa,GAAG,CAAC,cAAwB,EAAiB,EAAE,CAAC,CAAC;IACzE,EAAE,EAAE,kBAAkB,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;IACvD,WAAW,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC3E,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;YAC9C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC,KAAK,GAAG;wBAC7F,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,mBAAmB,KAAK,EAAE;wBACjC,UAAU,EAAE,cAAc,KAAK,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAC,CAAA;AAxBW,QAAA,aAAa,iBAwBxB;AAEF,wDAAwD;AAC3C,QAAA,kBAAkB,GAAkB;IAC/C,EAAE,EAAE,sBAAsB;IAC1B,WAAW,EAAE,mEAAmE;IAChF,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAI,QAAgB,CAAC,UAAU,IAAK,QAAgB,CAAC,IAAI,IAAI,EAAE,CAAA;gBACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAClD,sDAAsD;wBACtD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACnF,MAAM,CAAC,IAAI,CAAC;gCACV,IAAI,EAAE,kBAAkB;gCACxB,OAAO,EAAE,WAAW,QAAQ,CAAC,QAAQ,EAAE,IAAI,uCAAuC,GAAG,GAAG;gCACxF,QAAQ,EAAE,QAAQ;gCAClB,KAAK,EAAE,cAAc,GAAG,EAAE;gCAC1B,UAAU,EACR,+EAA+E;6BAClF,CAAC,CAAA;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,+CAA+C;AAClC,QAAA,UAAU,GAAkB;IACvC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,IAAI,EAAE,CAAA;gBACzC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBAC5E,QAAQ,EAAE,SAAS;wBACnB,KAAK,EAAE,UAAU;wBACjB,UAAU,EACR,iFAAiF;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,wCAAwC;AAC3B,QAAA,gBAAgB,GAAkB;IAC7C,EAAE,EAAE,oBAAoB;IACxB,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC/B,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAC7B,QAAQ,CAAC,IAAI,KAAK,KAAK,EACvB,CAAC;gBACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;gBACpE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;gBAErD,IAAI,eAAe,CAAC,SAAS,KAAK,CAAC,IAAI,eAAe,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBAC1E,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBACrF,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,8CAA8C;wBACrD,UAAU,EAAE,wDAAwD;qBACrE,CAAC,CAAA;gBACJ,CAAC;gBAED,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBACjD,MAAM,iBAAiB,GAAG,SAAS,CAAC,eAAe,IAAI,EAAE,CAAA;oBACzD,IAAI,iBAAiB,CAAC,SAAS,KAAK,CAAC,IAAI,iBAAiB,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;wBAC9E,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,wBAAwB;4BAC9B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;4BACtG,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,2DAA2D;4BAClE,UAAU,EAAE,iDAAiD;yBAC9D,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,mDAAmD;AACtC,QAAA,iBAAiB,GAAoB;IAChD,8BAAsB;IACtB,6BAAqB;IACrB,0BAAkB;IAClB,kBAAU;IACV,wBAAgB;CACjB,CAAA;AAED,yDAAyD;AACzD,SAAgB,aAAa,CAC3B,SAA+B,EAC/B,QAAyB,yBAAiB;IAO1C,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM;QACN,QAAQ;QACR,IAAI;KACL,CAAA;AACH,CAAC"}
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":";;;AA0nBA,sCAgCC;AA5oBD,qDAAqD;AACxC,QAAA,sBAAsB,GAAkB;IACnD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qDAAqD;IAClE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;QACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;QAE1C,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC7C,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACtE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,cAAc,EAAE,8BAA8B;oBACvD,QAAQ,EAAE,WAAW;oBACrB,KAAK,EAAE,eAAe;oBACtB,UAAU,EAAE,sCAAsC,EAAE,qCAAqC;iBAC1F,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,sDAAsD;AACtD,kEAAkE;AACrD,QAAA,oBAAoB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,CAAU,CAAA;AAEvF,SAAS,uBAAuB,CAAC,QAAa;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAc,EAAE,EAAE;QAClF,MAAM,KAAK,GAAG,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,IAAI,GAAG,CAAA;QAC3E,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,GAAG,KAAK,+BAA+B;gBAChD,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,oDAAoD;gBAC3D,UAAU,EAAE,kDAAkD;aAC/D,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,GAAG,KAAK,6BAA6B;gBAC9C,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,kDAAkD;gBACzD,UAAU,EAAE,+EAA+E;aAC5F,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAEY,QAAA,qBAAqB,GAAkB;IAClD,EAAE,EAAE,yBAAyB;IAC7B,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CACjB,SAAmB;SACjB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAE,4BAA0C,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACzF,OAAO,CAAC,uBAAuB,CAAC;CACtC,CAAA;AACD,oDAAoD;AAC7C,MAAM,aAAa,GAAG,CAAC,cAAwB,EAAiB,EAAE,CAAC,CAAC;IACzE,EAAE,EAAE,kBAAkB,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;IACvD,WAAW,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC3E,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;YAC9C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC,KAAK,GAAG;wBAC7F,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,mBAAmB,KAAK,EAAE;wBACjC,UAAU,EAAE,cAAc,KAAK,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAC,CAAA;AAxBW,QAAA,aAAa,iBAwBxB;AAEF;;;GAGG;AACH,MAAM,mBAAmB,GAAG;IAC1B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,OAAO,EAAE,wDAAwD;IACjE,WAAW;IACX,kBAAkB;CACnB,CAAA;AAED,4EAA4E;AAC5E,MAAM,yBAAyB,GAAG;IAChC,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,WAAW;IACX,UAAU;IACV,QAAQ;IACR,SAAS;IACT,gBAAgB;CACjB,CAAA;AAED;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,CAAC,gBAAgB,CAAC,CAAA;AAEpD,0EAA0E;AAC1E,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,CACL,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7D,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAChE,CAAA;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,uBAAuB,GAC3B,6GAA6G,CAAA;AAE/G;mEACmE;AACnE,MAAM,2BAA2B,GAC/B,6IAA6I,CAAA;AAE/I,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,gDAAgD,CAAA;AAE7E,gGAAgG;AAChG,MAAM,mBAAmB,GAAG;IAC1B,mBAAmB;IACnB,mBAAmB;IACnB,qCAAqC;IACrC,+BAA+B;IAC/B,oBAAoB;CACrB,CAAA;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACtB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,kEAAkE,CAAA;AAE/F;;;;GAIG;AACH,MAAM,2BAA2B,GAC/B,8NAA8N,CAAA;AAEhO;;;GAGG;AACH,MAAM,6BAA6B,GAAG;IACpC,UAAU;IACV,KAAK;IACL,KAAK;IACL,KAAK;IACL,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,WAAW;IACX,KAAK;IACL,QAAQ;IACR,UAAU;IACV,UAAU;IACV,WAAW;IACX,UAAU;IACV,QAAQ,EAAE,oEAAoE;CAC/E,CAAA;AAED,sEAAsE;AACtE,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAqC,EAAE,CAAA;IACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QAC5B,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,SAAQ;QACzF,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,SAAQ;QACvC,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC9C,gEAAgE;QAChE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,AAAD,EAAG,QAAQ,CAAC,GAAG,KAAK,CAAA;IAC5B,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnE,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,gEAAgE;AAChE,SAAS,mBAAmB,CAAC,QAA4B;IACvD,MAAM,WAAW,GAAG,QAAe,CAAA;IACnC,MAAM,IAAI,GAAW,WAAW,CAAC,IAAI,CAAA;IACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YAC1E,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC;SAC/E,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,WAAW,CAAC,IAAI,IAAI,EAAE,CAAA;IAC1E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAA;AAC3E,CAAC;AASD,MAAM,2BAA2B,GAC/B,mGAAmG,CAAA;AACrG,MAAM,sBAAsB,GAC1B,qGAAqG,CAAA;AACvG,MAAM,oBAAoB,GACxB,mHAAmH,CAAA;AAErH,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;AACtD,CAAC;AAED,kFAAkF;AAClF,SAAS,mBAAmB,CAAC,UAAkB,EAAE,kBAA4B,EAAE;IAC7E,OAAO,CACL,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC,cAAc,CAAC,UAAU,CAAC;QAC3B,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC/D,CAAA;AACH,CAAC;AAED,iHAAiH;AACjH,SAAS,0BAA0B,CACjC,GAAkB,EAClB,OAA2F;IAE3F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAM;IAC9D,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,oBAAoB,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,eAAe,CACtB,GAAkB,EAClB,KAA6E;IAE7E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IACvC,MAAM,KAAK,GAAG,WAAW,IAAI,MAAM,GAAG,IAAI,GAAG,GAAG,CAAA;IAChD,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,EAAE,CAAA;IAC7B,IAAI,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAA;IAC/D,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC5C,0BAA0B,CAAC,GAAG,EAAE;QAC9B,IAAI,EAAE,QAAQ;QACd,KAAK;QACL,KAAK;QACL,KAAK;QACL,UAAU,EAAE,sBAAsB;KACnC,CAAC,CAAA;AACJ,CAAC;AAED,0DAA0D;AAC1D,SAAS,kBAAkB,CAAC,QAA4B,EAAE,GAAkB;IAC1E,MAAM,WAAW,GAAG,QAAe,CAAA;IACnC,MAAM,UAAU,GAAI,WAAW,CAAC,IAAe,IAAI,EAAE,CAAA;IACrD,IAAI,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,aAAa,KAAK,SAAS;QAAE,OAAM;IAE/F,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAU,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAQ;QAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,eAAe,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,QAA4B,EAAE,GAAkB;IAC7E,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;IAC/B,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAM;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,SAAQ;QACtC,MAAM,KAAK,GAAG,cAAc,IAAI,WAAW,GAAG,GAAG,CAAA;QACjD,MAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,CAAA;QAC3B,MAAM,eAAe,GACnB,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,6BAA6B,CAAC;YACrE,CAAC,kBAAkB,CAAC,KAAK,CAAC;YAC1B,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnC,IAAI,eAAe;YAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAA;QAC1E,0BAA0B,CAAC,GAAG,EAAE;YAC9B,IAAI,EAAE,WAAW;YACjB,KAAK;YACL,KAAK;YACL,KAAK;YACL,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAA;QACF,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC7C,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,aAAa,CAAC,GAAQ;IAC7B,OAAO,CACL,CAAC,CAAC,GAAG;QACL,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC5B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,GAAG,CAAC,SAAS,KAAK,SAAS,CAC5B,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACtF,CAAC;AAED,wFAAwF;AACxF,SAAS,eAAe,CACtB,QAA4B,EAC5B,QAAgB,EAChB,IAAoB;IAEpB,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,GAAG,QAAQ,eAAe,SAAS,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,GAAG,CAAA;YAC3E,MAAM,KAAK,GAAG,4CAA4C,GAAG,CAAC,IAAI,SAAS,CAAA;YAC3E,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,KAAK,EACL,KAAK,EACL,mFAAmF,CACpF,CAAA;YACH,CAAC;YACD,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,KAAK,EACL,KAAK,EACL,0FAA0F,CAC3F,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,gBAAgB,CACvB,QAA4B,EAC5B,QAAgB,EAChB,GAAkB;IAElB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;IAE/B,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,IAAY,EAAQ,EAAE;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAC/F,CAAC,CAAA;IAED,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,IAAY,EAAQ,EAAE;QAC9E,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAAE,OAAM;QACnD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAM;QACjE,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,GAAG,QAAQ,KAAK,IAAI,IAAI,GAAG,GAAG,EAC9B,GAAG,IAAI,IAAI,GAAG,EAAE,EAChB,qEAAqE,CACtE,CAAA;IACH,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,GAA4B,EAAE,IAAY,EAAQ,EAAE;QACtE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,8DAA8D;YAC9D,IAAI,GAAG,KAAK,eAAe;gBAAE,SAAQ;YACrC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YACrC,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;;gBAChE,QAAQ,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;QACxC,CAAC;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,IAAY,EAAQ,EAAE;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACtD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QACD,UAAU,CAAC,IAA+B,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC,CAAA;IAED,IAAI,CAAE,QAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACU,QAAA,kBAAkB,GAAkB;IAC/C,EAAE,EAAE,sBAAsB;IAC1B,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAE9B,MAAM,IAAI,GAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC9D,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE,CAAA;YACrC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAM;YAC/B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACnB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,2BAA2B,KAAK,EAAE;gBAC3C,QAAQ,EAAE,IAAI;gBACd,KAAK;gBACL,UAAU;aACX,CAAC,CAAA;QACJ,CAAC,CAAA;QAED,MAAM,SAAS,GAAoB,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YAC3D,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,IAAI,CACF,YAAY,EACZ,KAAK,EACL,KAAK,EACL,oHAAoH,CACrH,CAAA;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC3E,IAAI,CACF,YAAY,EACZ,KAAK,EACL,KAAK,EACL,uGAAuG,CACxG,CAAA;YACH,CAAC;QACH,CAAC,CAAA;QAED,MAAM,GAAG,GAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC9C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,GAAG,CAAA;YACvE,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;gBACjC,SAAQ;YACV,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,qBAAqB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;gBACpC,SAAQ;YACV,CAAC;YACD,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YACzC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC3C,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,+CAA+C;AAClC,QAAA,UAAU,GAAkB;IACvC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,IAAI,EAAE,CAAA;gBACzC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBAC5E,QAAQ,EAAE,SAAS;wBACnB,KAAK,EAAE,UAAU;wBACjB,UAAU,EACR,iFAAiF;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,wCAAwC;AACxC,SAAS,UAAU,CAAC,eAAoB;IACtC,OAAO,eAAe,EAAE,SAAS,KAAK,CAAC,IAAI,eAAe,EAAE,SAAS,KAAK,IAAI,CAAA;AAChF,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAa;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;IACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACpC,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,IAAI,UAAU,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,gCAAgC;YAClE,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,KAAK,EAAE,8CAA8C;YACrD,UAAU,EAAE,wDAAwD;SACrE,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,UAAU,CAAC,SAAS,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,IAAI,gBAAgB;gBACnF,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,2DAA2D;gBAClE,UAAU,EAAE,iDAAiD;aAC9D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAEY,QAAA,gBAAgB,GAAkB;IAC7C,EAAE,EAAE,oBAAoB;IACxB,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CACjB,SAAmB;SACjB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAClB,CAAC,GAAG,4BAAoB,EAAE,KAAK,CAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChF;SACA,OAAO,CAAC,mBAAmB,CAAC;CAClC,CAAA;AACD,mDAAmD;AACtC,QAAA,iBAAiB,GAAoB;IAChD,8BAAsB;IACtB,6BAAqB;IACrB,0BAAkB;IAClB,kBAAU;IACV,wBAAgB;CACjB,CAAA;AAED,yDAAyD;AACzD,SAAgB,aAAa,CAC3B,SAA+B,EAC/B,QAAyB,yBAAiB;IAO1C,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM;QACN,QAAQ;QACR,IAAI;KACL,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -8,4 +8,5 @@ export { validateResource, validateIngress, validateService, validateDeployment,
 export type { ValidationError } from './validate';
 export { runGuardrails, defaultGuardrails, requireNetworkPolicies, requireResourceLimits, requireLabels, noPlaintextSecrets, requireTLS, noRootContainers, } from './guardrails';
 export type { GuardrailRule } from './guardrails';
+export { sanitizeErrorMessage, redactConnectionStrings, redactPrivateKeys, maskSecretValues, } from './redact';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,gBAAgB,GACjB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,gBAAgB,GACjB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.noRootContainers = exports.requireTLS = exports.noPlaintextSecrets = exports.requireLabels = exports.requireResourceLimits = exports.requireNetworkPolicies = exports.defaultGuardrails = exports.runGuardrails = exports.r8sValidationError = exports.checkDuplicates = exports.validateOperator = exports.validateDeployment = exports.validateService = exports.validateIngress = exports.validateResource = exports.fetchOperatorManifests = exports.createContext = exports.getOperator = exports.isOperatorDeclaration = exports.declareOperator = exports.useContext = exports.render = exports.Fragment = exports.jsxDEV = exports.jsxs = exports.jsx = void 0;
+exports.maskSecretValues = exports.redactPrivateKeys = exports.redactConnectionStrings = exports.sanitizeErrorMessage = exports.noRootContainers = exports.requireTLS = exports.noPlaintextSecrets = exports.requireLabels = exports.requireResourceLimits = exports.requireNetworkPolicies = exports.defaultGuardrails = exports.runGuardrails = exports.r8sValidationError = exports.checkDuplicates = exports.validateOperator = exports.validateDeployment = exports.validateService = exports.validateIngress = exports.validateResource = exports.fetchOperatorManifests = exports.createContext = exports.getOperator = exports.isOperatorDeclaration = exports.declareOperator = exports.useContext = exports.render = exports.Fragment = exports.jsxDEV = exports.jsxs = exports.jsx = void 0;
 var jsx_runtime_1 = require("./jsx-runtime");
 Object.defineProperty(exports, "jsx", { enumerable: true, get: function () { return jsx_runtime_1.jsx; } });
 Object.defineProperty(exports, "jsxs", { enumerable: true, get: function () { return jsx_runtime_1.jsxs; } });
@@ -34,4 +34,9 @@ Object.defineProperty(exports, "requireLabels", { enumerable: true, get: functio
 Object.defineProperty(exports, "noPlaintextSecrets", { enumerable: true, get: function () { return guardrails_1.noPlaintextSecrets; } });
 Object.defineProperty(exports, "requireTLS", { enumerable: true, get: function () { return guardrails_1.requireTLS; } });
 Object.defineProperty(exports, "noRootContainers", { enumerable: true, get: function () { return guardrails_1.noRootContainers; } });
+var redact_1 = require("./redact");
+Object.defineProperty(exports, "sanitizeErrorMessage", { enumerable: true, get: function () { return redact_1.sanitizeErrorMessage; } });
+Object.defineProperty(exports, "redactConnectionStrings", { enumerable: true, get: function () { return redact_1.redactConnectionStrings; } });
+Object.defineProperty(exports, "redactPrivateKeys", { enumerable: true, get: function () { return redact_1.redactPrivateKeys; } });
+Object.defineProperty(exports, "maskSecretValues", { enumerable: true, get: function () { return redact_1.maskSecretValues; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,6CAA2D;AAAlD,kGAAA,GAAG,OAAA;AAAE,mGAAA,IAAI,OAAA;AAAE,qGAAA,MAAM,OAAA;AAAE,uGAAA,QAAQ,OAAA;AAEpC,uCAAkE;AAAzD,kGAAA,MAAM,OAAA;AAAqB,sGAAA,UAAU,OAAA;AAC9C,uCAAgF;AAAvE,2GAAA,eAAe,OAAA;AAAE,iHAAA,qBAAqB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAC5D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA;AACtB,qDAA0D;AAAjD,yHAAA,sBAAsB,OAAA;AAC/B,uCAQmB;AAPjB,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAClB,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAGpB,2CASqB;AARnB,2GAAA,aAAa,OAAA;AACb,+GAAA,iBAAiB,OAAA;AACjB,oHAAA,sBAAsB,OAAA;AACtB,mHAAA,qBAAqB,OAAA;AACrB,2GAAA,aAAa,OAAA;AACb,gHAAA,kBAAkB,OAAA;AAClB,wGAAA,UAAU,OAAA;AACV,8GAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,6CAA2D;AAAlD,kGAAA,GAAG,OAAA;AAAE,mGAAA,IAAI,OAAA;AAAE,qGAAA,MAAM,OAAA;AAAE,uGAAA,QAAQ,OAAA;AAEpC,uCAAkE;AAAzD,kGAAA,MAAM,OAAA;AAAqB,sGAAA,UAAU,OAAA;AAC9C,uCAAgF;AAAvE,2GAAA,eAAe,OAAA;AAAE,iHAAA,qBAAqB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAC5D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA;AACtB,qDAA0D;AAAjD,yHAAA,sBAAsB,OAAA;AAC/B,uCAQmB;AAPjB,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAClB,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAGpB,2CASqB;AARnB,2GAAA,aAAa,OAAA;AACb,+GAAA,iBAAiB,OAAA;AACjB,oHAAA,sBAAsB,OAAA;AACtB,mHAAA,qBAAqB,OAAA;AACrB,2GAAA,aAAa,OAAA;AACb,gHAAA,kBAAkB,OAAA;AAClB,wGAAA,UAAU,OAAA;AACV,8GAAA,gBAAgB,OAAA;AAGlB,mCAKiB;AAJf,8GAAA,oBAAoB,OAAA;AACpB,iHAAA,uBAAuB,OAAA;AACvB,2GAAA,iBAAiB,OAAA;AACjB,0GAAA,gBAAgB,OAAA"}

package/dist/redact.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Redaction helpers — scrub credential material from error messages,
+ * logs and rendered output so secrets don't leak through secondary
+ * channels (CI logs, CRD status, support tickets).
+ */
+/**
+ * Mask credentials embedded in connection strings:
+ *   postgresql://app:staging-password@db:5432/app
+ *     → postgresql://app:*****@db:5432/app
+ */
+export declare function redactConnectionStrings(text: string): string;
+/**
+ * Mask PEM private key blocks:
+ *   -----BEGIN RSA PRIVATE KEY-----
+ *   ...
+ *   -----END RSA PRIVATE KEY-----
+ *     → [REDACTED PRIVATE KEY]
+ */
+export declare function redactPrivateKeys(text: string): string;
+/**
+ * Return a copy of a resource with plaintext credential values masked:
+ * - Secret stringData/data values for credential keys → '*****'
+ * - Connection-string passwords anywhere → '*****'
+ * - PEM private key blocks → '[REDACTED PRIVATE KEY]'
+ *
+ * Used when rendered output is written to logs/stdout so committed or
+ * displayed YAML never carries live credentials.
+ */
+export declare function maskSecretValues<T>(resource: T): T;
+/**
+ * Best-effort sanitization for error messages, logs and CRD status.
+ * Masks connection-string credentials and private key blocks. Framework
+ * errors are value-free by design (they reference the location of a
+ * credential, never its value); this covers messages produced by
+ * external tooling (kubectl, kubernetes API, esbuild source excerpts).
+ */
+export declare function sanitizeErrorMessage(text: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKtD;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAElD;AA8CD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/redact.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * Redaction helpers — scrub credential material from error messages,
+ * logs and rendered output so secrets don't leak through secondary
+ * channels (CI logs, CRD status, support tickets).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactConnectionStrings = redactConnectionStrings;
+exports.redactPrivateKeys = redactPrivateKeys;
+exports.maskSecretValues = maskSecretValues;
+exports.sanitizeErrorMessage = sanitizeErrorMessage;
+/**
+ * Mask credentials embedded in connection strings:
+ *   postgresql://app:staging-password@db:5432/app
+ *     → postgresql://app:*****@db:5432/app
+ */
+function redactConnectionStrings(text) {
+    return text.replace(/([a-z][a-z0-9+.-]*:\/\/[^/\s:@]*):([^@/\s]+)@/gi, (_match, schemeAndUser) => `${schemeAndUser}:*****@`);
+}
+/**
+ * Mask PEM private key blocks:
+ *   -----BEGIN RSA PRIVATE KEY-----
+ *   ...
+ *   -----END RSA PRIVATE KEY-----
+ *     → [REDACTED PRIVATE KEY]
+ */
+function redactPrivateKeys(text) {
+    return text.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, '[REDACTED PRIVATE KEY]');
+}
+/** Keys (normalized) whose value in a Secret map is a credential. */
+const SECRET_DATA_KEY_SUFFIXES = [
+    'password',
+    'passwd',
+    'pwd',
+    'secretkey',
+    'secretaccesskey',
+    'accesskey',
+    'accesskeyid',
+    'privatekey',
+    'clientsecret',
+    'apikey',
+    'authtoken',
+    'connectionstring',
+];
+/**
+ * Return a copy of a resource with plaintext credential values masked:
+ * - Secret stringData/data values for credential keys → '*****'
+ * - Connection-string passwords anywhere → '*****'
+ * - PEM private key blocks → '[REDACTED PRIVATE KEY]'
+ *
+ * Used when rendered output is written to logs/stdout so committed or
+ * displayed YAML never carries live credentials.
+ */
+function maskSecretValues(resource) {
+    return maskNode(resource);
+}
+function maskNode(node) {
+    if (typeof node === 'string') {
+        let masked = redactPrivateKeys(node);
+        masked = redactConnectionStrings(masked);
+        return masked;
+    }
+    if (Array.isArray(node)) {
+        return node.map(maskNode);
+    }
+    if (node && typeof node === 'object') {
+        const result = {};
+        for (const [key, value] of Object.entries(node)) {
+            const normalized = key.toLowerCase().replace(/[-_.]/g, '');
+            if (normalized === 'data' || normalized === 'stringdata') {
+                result[key] = maskSecretMap(value);
+            }
+            else {
+                result[key] = maskNode(value);
+            }
+        }
+        return result;
+    }
+    return node;
+}
+function maskSecretMap(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return maskNode(value);
+    }
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+        const normalized = key.toLowerCase().replace(/[-_.]/g, '');
+        if (typeof entry === 'string' &&
+            entry.length > 0 &&
+            SECRET_DATA_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix))) {
+            result[key] = '*****';
+        }
+        else {
+            result[key] = maskNode(entry);
+        }
+    }
+    return result;
+}
+/**
+ * Best-effort sanitization for error messages, logs and CRD status.
+ * Masks connection-string credentials and private key blocks. Framework
+ * errors are value-free by design (they reference the location of a
+ * credential, never its value); this covers messages produced by
+ * external tooling (kubectl, kubernetes API, esbuild source excerpts).
+ */
+function sanitizeErrorMessage(text) {
+    return redactPrivateKeys(redactConnectionStrings(text));
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAOH,0DAKC;AASD,8CAKC;AA2BD,4CAEC;AAqDD,oDAEC;AA5GD;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,IAAY;IAClD,OAAO,IAAI,CAAC,OAAO,CACjB,iDAAiD,EACjD,CAAC,MAAM,EAAE,aAAqB,EAAE,EAAE,CAAC,GAAG,aAAa,SAAS,CAC7D,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CACjB,yEAAyE,EACzE,wBAAwB,CACzB,CAAA;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,wBAAwB,GAAG;IAC/B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,WAAW;IACX,kBAAkB;CACnB,CAAA;AAED;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAAI,QAAW;IAC7C,OAAO,QAAQ,CAAC,QAAQ,CAAM,CAAA;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;QACxC,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YAC1D,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBACzD,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QAC1D,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EACtE,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,OAAO,iBAAiB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAA;AACzD,CAAC"}

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,EAAE,eAAe,EAAE,CAAA;gBAEb,MAAM,EAAE,eAAe,EAAE;CAMtC;AAED,qCAAqC;AACrC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAoEhF;AAED,gDAAgD;AAChD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAkE/E;AAED,kCAAkC;AAClC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAwC/E;AAED,qCAAqC;AACrC,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA6DlF;AAED,uCAAuC;AACvC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,GAAG,eAAe,EAAE,CAsCjE;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,eAAe,EAAE,CA2BlF"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,EAAE,eAAe,EAAE,CAAA;gBAEb,MAAM,EAAE,eAAe,EAAE;CAMtC;AAED,qCAAqC;AACrC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAoEhF;AAED,gDAAgD;AAChD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAkE/E;AAED,kCAAkC;AAClC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAoD/E;AAED,qCAAqC;AACrC,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA6DlF;AAED,uCAAuC;AACvC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,GAAG,eAAe,EAAE,CAsCjE;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,eAAe,EAAE,CA2BlF"}

package/dist/validate.js

@@ -174,6 +174,17 @@ function validateService(resource) {
     else {
         for (let i = 0; i < spec.ports.length; i++) {
             const port = spec.ports[i];
+            // The API server rejects multi-port Services whose ports lack names —
+            // Flux catches this at dry-run time (after merge), so catch it in tests
+            if (spec.ports.length > 1 && !port.name) {
+                errors.push({
+                    code: 'MULTI_PORT_WITHOUT_NAME',
+                    message: `Service "${resource.metadata?.name}" has ${spec.ports.length} ports — every port requires a name (spec.ports[${i}] is anonymous)`,
+                    resource: 'Service',
+                    field: `spec.ports[${i}].name`,
+                    suggestion: 'Name every port when a Service has more than one, e.g. { name: "http", port: 8080 }',
+                });
+            }
             if (!port.port || port.port < 1 || port.port > 65535) {
                 errors.push({
                     code: 'INVALID_PORT',

package/dist/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":";;;AA4BA,4CAoEC;AAGD,0CAkEC;AAGD,0CAwCC;AAGD,gDA6DC;AAGD,4CAsCC;AAGD,0CA2BC;AAvUD,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,CAAmB;IAEzB,YAAY,MAAyB;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxE,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AATD,gDASC;AAED,qCAAqC;AACrC,SAAgB,gBAAgB,CAAC,QAA4B;IAC3D,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,IAAI,SAAS,CAAA;IAEhD,mBAAmB;IACnB,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,aAAa,IAAI,yBAAyB;YACnD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,iDAAiD;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,aAAa;IACb,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,oDAAoD;SACjE,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,aAAa,IAAI,uBAAuB;YACjD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU;YACjB,UAAU,EAAE,uCAAuC;SACpD,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,aAAa;QACb,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,aAAa,IAAI,4BAA4B;gBACtD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,eAAe;gBACtB,UAAU,EAAE,sCAAsC;aACnD,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,kBAAkB,QAAQ,CAAC,QAAQ,CAAC,IAAI,qCAAqC;gBACtF,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,eAAe;gBACtB,UAAU,EACR,yFAAyF;aAC5F,CAAC,CAAA;QACJ,CAAC;QAED,kBAAkB;QAClB,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,aAAa,QAAQ,CAAC,QAAQ,CAAC,IAAI,0BAA0B;gBACtE,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,UAAU,EAAE,0EAA0E;aACvF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gDAAgD;AAChD,SAAgB,eAAe,CAAC,QAA4B;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,uDAAuD;SACpE,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,cAAc;IACd,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;YAC5D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,qDAAqD;SAClE,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,UAAU,CAAC,kBAAkB;oBACzE,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,QAAQ;oBAC9B,UAAU,EAAE,yCAAyC;iBACtD,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,UAAU,CAAC,eAAe;oBACtE,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,cAAc;oBACpC,UAAU,EAAE,8CAA8C;iBAC3D,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB,CAAC,wBAAwB;oBACrF,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,YAAY,CAAC,cAAc;oBAClC,UAAU,EACR,wGAAwG;iBAC3G,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,kCAAkC;AAClC,SAAgB,eAAe,CAAC,QAA4B;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,kCAAkC;SAC/C,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,cAAc;IACd,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;YAC5D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,6DAA6D;SAC1E,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,UAAU,CAAC,6BAA6B,IAAI,CAAC,IAAI,EAAE;oBAC/F,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,QAAQ;oBAC9B,UAAU,EAAE,kCAAkC;iBAC/C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qCAAqC;AACrC,SAAgB,kBAAkB,CAAC,QAA4B;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,mBAAmB;YAClE,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,gDAAgD;SAC7D,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,iBAAiB;IACjB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,2BAA2B,IAAI,CAAC,QAAQ,EAAE;YACzF,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,yCAAyC;SACtD,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,4BAA4B;YAC3E,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,iDAAiD;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,4BAA4B;YAC3E,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,uDAAuD;SACpE,CAAC,CAAA;IACJ,CAAC;SAAM,IACL,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;QACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAC1C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,qBAAqB;YACpE,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,+BAA+B;YACtC,UAAU,EAAE,gDAAgD;SAC7D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,uCAAuC;AACvC,SAAgB,gBAAgB,CAAC,QAAa;IAC5C,MAAM,MAAM,GAAsB,EAAE,CAAA;IAEpC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,wEAAwE;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,IAAI,SAAS,sBAAsB;YACtE,KAAK,EAAE,SAAS;YAChB,UAAU,EAAE,0CAA0C;SACvD,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,2BAA2B,QAAQ,CAAC,OAAO,GAAG;YACjF,KAAK,EAAE,SAAS;YAChB,UAAU,EAAE,yDAAyD;SACtE,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,IAAI,SAAS,qBAAqB;YACrE,KAAK,EAAE,QAAQ;YACf,UAAU,EAAE,yDAAyD;SACtE,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+DAA+D;AAC/D,SAAgB,eAAe,CAAC,SAA+B;IAC7D,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAA;IAExC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,IAAI,SAAS,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAE,CAAA;QAChI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACnB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC9C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,aAAa,IAAI,KAAK,IAAI,mBAAmB,SAAS,YAAY,OAAO,CAAC,MAAM,SAAS;gBAClG,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,eAAe;gBACtB,UAAU,EACR,oHAAoH;aACvH,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":";;;AA4BA,4CAoEC;AAGD,0CAkEC;AAGD,0CAoDC;AAGD,gDA6DC;AAGD,4CAsCC;AAGD,0CA2BC;AAnVD,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,CAAmB;IAEzB,YAAY,MAAyB;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxE,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AATD,gDASC;AAED,qCAAqC;AACrC,SAAgB,gBAAgB,CAAC,QAA4B;IAC3D,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,IAAI,SAAS,CAAA;IAEhD,mBAAmB;IACnB,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,aAAa,IAAI,yBAAyB;YACnD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,iDAAiD;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,aAAa;IACb,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,oDAAoD;SACjE,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,aAAa,IAAI,uBAAuB;YACjD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU;YACjB,UAAU,EAAE,uCAAuC;SACpD,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,aAAa;QACb,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,aAAa,IAAI,4BAA4B;gBACtD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,eAAe;gBACtB,UAAU,EAAE,sCAAsC;aACnD,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,kBAAkB,QAAQ,CAAC,QAAQ,CAAC,IAAI,qCAAqC;gBACtF,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,eAAe;gBACtB,UAAU,EACR,yFAAyF;aAC5F,CAAC,CAAA;QACJ,CAAC;QAED,kBAAkB;QAClB,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,aAAa,QAAQ,CAAC,QAAQ,CAAC,IAAI,0BAA0B;gBACtE,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,UAAU,EAAE,0EAA0E;aACvF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gDAAgD;AAChD,SAAgB,eAAe,CAAC,QAA4B;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,uDAAuD;SACpE,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,cAAc;IACd,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;YAC5D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,qDAAqD;SAClE,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,UAAU,CAAC,kBAAkB;oBACzE,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,QAAQ;oBAC9B,UAAU,EAAE,yCAAyC;iBACtD,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,UAAU,CAAC,eAAe;oBACtE,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,cAAc;oBACpC,UAAU,EAAE,8CAA8C;iBAC3D,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB,CAAC,wBAAwB;oBACrF,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,YAAY,CAAC,cAAc;oBAClC,UAAU,EACR,wGAAwG;iBAC3G,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,kCAAkC;AAClC,SAAgB,eAAe,CAAC,QAA4B;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,kCAAkC;SAC/C,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,cAAc;IACd,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;YAC5D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,6DAA6D;SAC1E,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,sEAAsE;YACtE,wEAAwE;YACxE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,mDAAmD,CAAC,iBAAiB;oBAC3I,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,QAAQ;oBAC9B,UAAU,EACR,qFAAqF;iBACxF,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,UAAU,CAAC,6BAA6B,IAAI,CAAC,IAAI,EAAE;oBAC/F,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,QAAQ;oBAC9B,UAAU,EAAE,kCAAkC;iBAC/C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qCAAqC;AACrC,SAAgB,kBAAkB,CAAC,QAA4B;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,mBAAmB;YAClE,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,gDAAgD;SAC7D,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,iBAAiB;IACjB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,2BAA2B,IAAI,CAAC,QAAQ,EAAE;YACzF,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,yCAAyC;SACtD,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,4BAA4B;YAC3E,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,iDAAiD;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,4BAA4B;YAC3E,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,uDAAuD;SACpE,CAAC,CAAA;IACJ,CAAC;SAAM,IACL,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;QACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAC1C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,qBAAqB;YACpE,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,+BAA+B;YACtC,UAAU,EAAE,gDAAgD;SAC7D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,uCAAuC;AACvC,SAAgB,gBAAgB,CAAC,QAAa;IAC5C,MAAM,MAAM,GAAsB,EAAE,CAAA;IAEpC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,wEAAwE;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,IAAI,SAAS,sBAAsB;YACtE,KAAK,EAAE,SAAS;YAChB,UAAU,EAAE,0CAA0C;SACvD,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,2BAA2B,QAAQ,CAAC,OAAO,GAAG;YACjF,KAAK,EAAE,SAAS;YAChB,UAAU,EAAE,yDAAyD;SACtE,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,IAAI,SAAS,qBAAqB;YACrE,KAAK,EAAE,QAAQ;YACf,UAAU,EAAE,yDAAyD;SACtE,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+DAA+D;AAC/D,SAAgB,eAAe,CAAC,SAA+B;IAC7D,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAA;IAExC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,IAAI,SAAS,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAE,CAAA;QAChI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACnB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC9C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,aAAa,IAAI,KAAK,IAAI,mBAAmB,SAAS,YAAY,OAAO,CAAC,MAAM,SAAS;gBAClG,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,eAAe;gBACtB,UAAU,EACR,oHAAoH;aACvH,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r8s/core",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "JSX factory and renderer for r8s",
   "license": "MIT",
   "author": "Berget AI AB",
@@ -52,7 +52,7 @@
     "clean": "rm -rf dist tsconfig.tsbuildinfo"
   },
   "dependencies": {
-    "@r8s/k8s-types": "^0.1.0"
+    "@r8s/k8s-types": "^0.2.0"
   },
   "devDependencies": {
     "typescript": "^5.3.0",