@r8s/core 0.1.0

package/dist/guardrails.js

@@ -0,0 +1,225 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultGuardrails = exports.noRootContainers = exports.requireTLS = exports.noPlaintextSecrets = exports.requireLabels = exports.requireResourceLimits = exports.requireNetworkPolicies = void 0;
+exports.runGuardrails = runGuardrails;
+/** Check that all namespaces have NetworkPolicies */
+exports.requireNetworkPolicies = {
+    id: 'require-network-policies',
+    description: 'All namespaces must have at least one NetworkPolicy',
+    severity: 'error',
+    test: (resources) => {
+        const errors = [];
+        const namespaces = new Set();
+        const hasNetworkPolicy = new Set();
+        for (const resource of resources) {
+            if (resource.metadata?.namespace) {
+                namespaces.add(resource.metadata.namespace);
+            }
+            if (resource.kind === 'NetworkPolicy' && resource.metadata?.namespace) {
+                hasNetworkPolicy.add(resource.metadata.namespace);
+            }
+        }
+        for (const ns of namespaces) {
+            if (!hasNetworkPolicy.has(ns)) {
+                errors.push({
+                    code: 'MISSING_NETWORK_POLICY',
+                    message: `Namespace "${ns}" is missing a NetworkPolicy`,
+                    resource: 'Namespace',
+                    field: 'networkPolicy',
+                    suggestion: `Add a NetworkPolicy for namespace "${ns}" to control ingress/egress traffic`,
+                });
+            }
+        }
+        return errors;
+    },
+};
+/** Check that all Deployments have resource limits */
+exports.requireResourceLimits = {
+    id: 'require-resource-limits',
+    description: 'All containers must have resource requests and limits',
+    severity: 'error',
+    test: (resources) => {
+        const errors = [];
+        for (const resource of resources) {
+            if (resource.kind === 'Deployment' ||
+                resource.kind === 'StatefulSet' ||
+                resource.kind === 'DaemonSet') {
+                const containers = resource.spec?.template?.spec?.containers || [];
+                for (const container of containers) {
+                    if (!container.resources?.requests) {
+                        errors.push({
+                            code: 'MISSING_RESOURCE_REQUESTS',
+                            message: `Container "${container.name}" in ${resource.kind} "${resource.metadata?.name}" is missing resource requests`,
+                            resource: resource.kind,
+                            field: 'spec.template.spec.containers[].resources.requests',
+                            suggestion: 'Add resource.requests with cpu and memory values',
+                        });
+                    }
+                    if (!container.resources?.limits) {
+                        errors.push({
+                            code: 'MISSING_RESOURCE_LIMITS',
+                            message: `Container "${container.name}" in ${resource.kind} "${resource.metadata?.name}" is missing resource limits`,
+                            resource: resource.kind,
+                            field: 'spec.template.spec.containers[].resources.limits',
+                            suggestion: 'Add resource.limits with cpu and memory values to prevent resource exhaustion',
+                        });
+                    }
+                }
+            }
+        }
+        return errors;
+    },
+};
+/** Check that all resources have required labels */
+const requireLabels = (requiredLabels) => ({
+    id: `require-labels-${requiredLabels.sort().join('-')}`,
+    description: `All resources must have labels: ${requiredLabels.join(', ')}`,
+    severity: 'warning',
+    test: (resources) => {
+        const errors = [];
+        for (const resource of resources) {
+            const labels = resource.metadata?.labels || {};
+            for (const label of requiredLabels) {
+                if (!labels[label]) {
+                    errors.push({
+                        code: 'MISSING_REQUIRED_LABEL',
+                        message: `${resource.kind} "${resource.metadata?.name}" is missing required label "${label}"`,
+                        resource: resource.kind,
+                        field: `metadata.labels.${label}`,
+                        suggestion: `Add label "${label}" to ${resource.kind} "${resource.metadata?.name}"`,
+                    });
+                }
+            }
+        }
+        return errors;
+    },
+});
+exports.requireLabels = requireLabels;
+/** Check that no secrets contain plaintext passwords */
+exports.noPlaintextSecrets = {
+    id: 'no-plaintext-secrets',
+    description: 'Secrets should not contain plaintext passwords in rendered output',
+    severity: 'error',
+    test: (resources) => {
+        const errors = [];
+        for (const resource of resources) {
+            if (resource.kind === 'Secret') {
+                const data = resource.stringData || resource.data || {};
+                for (const [key, value] of Object.entries(data)) {
+                    if (typeof value === 'string' && value.length > 0) {
+                        // Check if it looks like a password (not a reference)
+                        if (key.toLowerCase().includes('password') || key.toLowerCase().includes('secret')) {
+                            errors.push({
+                                code: 'PLAINTEXT_SECRET',
+                                message: `Secret "${resource.metadata?.name}" contains plaintext value for key "${key}"`,
+                                resource: 'Secret',
+                                field: `stringData.${key}`,
+                                suggestion: 'Use Vault, Sealed Secrets, or external secret management instead of plaintext',
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        return errors;
+    },
+};
+/** Check that Ingresses have TLS configured */
+exports.requireTLS = {
+    id: 'require-tls',
+    description: 'All Ingress resources must have TLS configured',
+    severity: 'warning',
+    test: (resources) => {
+        const errors = [];
+        for (const resource of resources) {
+            if (resource.kind === 'Ingress') {
+                const spec = resource.spec || {};
+                if (!spec.tls || spec.tls.length === 0) {
+                    errors.push({
+                        code: 'MISSING_TLS',
+                        message: `Ingress "${resource.metadata?.name}" is missing TLS configuration`,
+                        resource: 'Ingress',
+                        field: 'spec.tls',
+                        suggestion: 'Add TLS configuration with secretName and optionally cert-manager clusterIssuer',
+                    });
+                }
+            }
+        }
+        return errors;
+    },
+};
+/** Check that Pods don't run as root */
+exports.noRootContainers = {
+    id: 'no-root-containers',
+    description: 'Containers should not run as root user',
+    severity: 'error',
+    test: (resources) => {
+        const errors = [];
+        for (const resource of resources) {
+            if (resource.kind === 'Deployment' ||
+                resource.kind === 'StatefulSet' ||
+                resource.kind === 'DaemonSet' ||
+                resource.kind === 'Pod') {
+                const podSpec = resource.spec?.template?.spec || resource.spec || {};
+                const securityContext = podSpec.securityContext || {};
+                if (securityContext.runAsUser === 0 || securityContext.runAsRoot === true) {
+                    errors.push({
+                        code: 'CONTAINER_RUNS_AS_ROOT',
+                        message: `${resource.kind} "${resource.metadata?.name}" is configured to run as root`,
+                        resource: resource.kind,
+                        field: 'spec.template.spec.securityContext.runAsUser',
+                        suggestion: 'Set runAsUser to a non-zero UID and runAsRoot to false',
+                    });
+                }
+                for (const container of podSpec.containers || []) {
+                    const containerSecurity = container.securityContext || {};
+                    if (containerSecurity.runAsUser === 0 || containerSecurity.runAsRoot === true) {
+                        errors.push({
+                            code: 'CONTAINER_RUNS_AS_ROOT',
+                            message: `Container "${container.name}" in ${resource.kind} "${resource.metadata?.name}" runs as root`,
+                            resource: resource.kind,
+                            field: 'spec.template.spec.containers[].securityContext.runAsUser',
+                            suggestion: 'Set securityContext.runAsUser to a non-zero UID',
+                        });
+                    }
+                }
+            }
+        }
+        return errors;
+    },
+};
+/** Default set of guardrails for production use */
+exports.defaultGuardrails = [
+    exports.requireNetworkPolicies,
+    exports.requireResourceLimits,
+    exports.noPlaintextSecrets,
+    exports.requireTLS,
+    exports.noRootContainers,
+];
+/** Run all guardrail rules against a set of resources */
+function runGuardrails(resources, rules = exports.defaultGuardrails) {
+    const errors = [];
+    const warnings = [];
+    const info = [];
+    for (const rule of rules) {
+        const ruleErrors = rule.test(resources);
+        for (const error of ruleErrors) {
+            if (rule.severity === 'error') {
+                errors.push(error);
+            }
+            else if (rule.severity === 'warning') {
+                warnings.push(error);
+            }
+            else if (rule.severity === 'info') {
+                info.push(error);
+            }
+        }
+    }
+    return {
+        passed: errors.length === 0,
+        errors,
+        warnings,
+        info,
+    };
+}
+//# sourceMappingURL=guardrails.js.map

package/dist/guardrails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":";;;AA6OA,sCAgCC;AA/PD,qDAAqD;AACxC,QAAA,sBAAsB,GAAkB;IACnD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qDAAqD;IAClE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;QACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;QAE1C,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC7C,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACtE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,cAAc,EAAE,8BAA8B;oBACvD,QAAQ,EAAE,WAAW;oBACrB,KAAK,EAAE,eAAe;oBACtB,UAAU,EAAE,sCAAsC,EAAE,qCAAqC;iBAC1F,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,sDAAsD;AACzC,QAAA,qBAAqB,GAAkB;IAClD,EAAE,EAAE,yBAAyB;IAC7B,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC/B,QAAQ,CAAC,IAAI,KAAK,WAAW,EAC7B,CAAC;gBACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAA;gBAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;oBACnC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;wBACnC,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,2BAA2B;4BACjC,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;4BACtH,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,oDAAoD;4BAC3D,UAAU,EAAE,kDAAkD;yBAC/D,CAAC,CAAA;oBACJ,CAAC;oBACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,yBAAyB;4BAC/B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,8BAA8B;4BACpH,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,kDAAkD;4BACzD,UAAU,EACR,+EAA+E;yBAClF,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,oDAAoD;AAC7C,MAAM,aAAa,GAAG,CAAC,cAAwB,EAAiB,EAAE,CAAC,CAAC;IACzE,EAAE,EAAE,kBAAkB,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;IACvD,WAAW,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC3E,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;YAC9C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC,KAAK,GAAG;wBAC7F,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,mBAAmB,KAAK,EAAE;wBACjC,UAAU,EAAE,cAAc,KAAK,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAC,CAAA;AAxBW,QAAA,aAAa,iBAwBxB;AAEF,wDAAwD;AAC3C,QAAA,kBAAkB,GAAkB;IAC/C,EAAE,EAAE,sBAAsB;IAC1B,WAAW,EAAE,mEAAmE;IAChF,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAI,QAAgB,CAAC,UAAU,IAAK,QAAgB,CAAC,IAAI,IAAI,EAAE,CAAA;gBACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAClD,sDAAsD;wBACtD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACnF,MAAM,CAAC,IAAI,CAAC;gCACV,IAAI,EAAE,kBAAkB;gCACxB,OAAO,EAAE,WAAW,QAAQ,CAAC,QAAQ,EAAE,IAAI,uCAAuC,GAAG,GAAG;gCACxF,QAAQ,EAAE,QAAQ;gCAClB,KAAK,EAAE,cAAc,GAAG,EAAE;gCAC1B,UAAU,EACR,+EAA+E;6BAClF,CAAC,CAAA;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,+CAA+C;AAClC,QAAA,UAAU,GAAkB;IACvC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,IAAI,EAAE,CAAA;gBACzC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBAC5E,QAAQ,EAAE,SAAS;wBACnB,KAAK,EAAE,UAAU;wBACjB,UAAU,EACR,iFAAiF;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,wCAAwC;AAC3B,QAAA,gBAAgB,GAAkB;IAC7C,EAAE,EAAE,oBAAoB;IACxB,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC/B,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAC7B,QAAQ,CAAC,IAAI,KAAK,KAAK,EACvB,CAAC;gBACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;gBACpE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;gBAErD,IAAI,eAAe,CAAC,SAAS,KAAK,CAAC,IAAI,eAAe,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBAC1E,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBACrF,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,8CAA8C;wBACrD,UAAU,EAAE,wDAAwD;qBACrE,CAAC,CAAA;gBACJ,CAAC;gBAED,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBACjD,MAAM,iBAAiB,GAAG,SAAS,CAAC,eAAe,IAAI,EAAE,CAAA;oBACzD,IAAI,iBAAiB,CAAC,SAAS,KAAK,CAAC,IAAI,iBAAiB,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;wBAC9E,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,wBAAwB;4BAC9B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;4BACtG,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,2DAA2D;4BAClE,UAAU,EAAE,iDAAiD;yBAC9D,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,mDAAmD;AACtC,QAAA,iBAAiB,GAAoB;IAChD,8BAAsB;IACtB,6BAAqB;IACrB,0BAAkB;IAClB,kBAAU;IACV,wBAAgB;CACjB,CAAA;AAED,yDAAyD;AACzD,SAAgB,aAAa,CAC3B,SAA+B,EAC/B,QAAyB,yBAAiB;IAO1C,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM;QACN,QAAQ;QACR,IAAI;KACL,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { jsx, jsxs, jsxDEV, Fragment } from './jsx-runtime';
+export type { r8sElement } from './jsx-runtime';
+export { render, type RenderResult, useContext } from './renderer';
+export { declareOperator, isOperatorDeclaration, getOperator } from './operator';
+export { createContext } from './context';
+export { fetchOperatorManifests } from './fetch-operators';
+export { validateResource, validateIngress, validateService, validateDeployment, validateOperator, checkDuplicates, r8sValidationError, } from './validate';
+export type { ValidationError } from './validate';
+export { runGuardrails, defaultGuardrails, requireNetworkPolicies, requireResourceLimits, requireLabels, noPlaintextSecrets, requireTLS, noRootContainers, } from './guardrails';
+export type { GuardrailRule } from './guardrails';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,gBAAgB,GACjB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA"}

package/dist/index.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noRootContainers = exports.requireTLS = exports.noPlaintextSecrets = exports.requireLabels = exports.requireResourceLimits = exports.requireNetworkPolicies = exports.defaultGuardrails = exports.runGuardrails = exports.r8sValidationError = exports.checkDuplicates = exports.validateOperator = exports.validateDeployment = exports.validateService = exports.validateIngress = exports.validateResource = exports.fetchOperatorManifests = exports.createContext = exports.getOperator = exports.isOperatorDeclaration = exports.declareOperator = exports.useContext = exports.render = exports.Fragment = exports.jsxDEV = exports.jsxs = exports.jsx = void 0;
+var jsx_runtime_1 = require("./jsx-runtime");
+Object.defineProperty(exports, "jsx", { enumerable: true, get: function () { return jsx_runtime_1.jsx; } });
+Object.defineProperty(exports, "jsxs", { enumerable: true, get: function () { return jsx_runtime_1.jsxs; } });
+Object.defineProperty(exports, "jsxDEV", { enumerable: true, get: function () { return jsx_runtime_1.jsxDEV; } });
+Object.defineProperty(exports, "Fragment", { enumerable: true, get: function () { return jsx_runtime_1.Fragment; } });
+var renderer_1 = require("./renderer");
+Object.defineProperty(exports, "render", { enumerable: true, get: function () { return renderer_1.render; } });
+Object.defineProperty(exports, "useContext", { enumerable: true, get: function () { return renderer_1.useContext; } });
+var operator_1 = require("./operator");
+Object.defineProperty(exports, "declareOperator", { enumerable: true, get: function () { return operator_1.declareOperator; } });
+Object.defineProperty(exports, "isOperatorDeclaration", { enumerable: true, get: function () { return operator_1.isOperatorDeclaration; } });
+Object.defineProperty(exports, "getOperator", { enumerable: true, get: function () { return operator_1.getOperator; } });
+var context_1 = require("./context");
+Object.defineProperty(exports, "createContext", { enumerable: true, get: function () { return context_1.createContext; } });
+var fetch_operators_1 = require("./fetch-operators");
+Object.defineProperty(exports, "fetchOperatorManifests", { enumerable: true, get: function () { return fetch_operators_1.fetchOperatorManifests; } });
+var validate_1 = require("./validate");
+Object.defineProperty(exports, "validateResource", { enumerable: true, get: function () { return validate_1.validateResource; } });
+Object.defineProperty(exports, "validateIngress", { enumerable: true, get: function () { return validate_1.validateIngress; } });
+Object.defineProperty(exports, "validateService", { enumerable: true, get: function () { return validate_1.validateService; } });
+Object.defineProperty(exports, "validateDeployment", { enumerable: true, get: function () { return validate_1.validateDeployment; } });
+Object.defineProperty(exports, "validateOperator", { enumerable: true, get: function () { return validate_1.validateOperator; } });
+Object.defineProperty(exports, "checkDuplicates", { enumerable: true, get: function () { return validate_1.checkDuplicates; } });
+Object.defineProperty(exports, "r8sValidationError", { enumerable: true, get: function () { return validate_1.r8sValidationError; } });
+var guardrails_1 = require("./guardrails");
+Object.defineProperty(exports, "runGuardrails", { enumerable: true, get: function () { return guardrails_1.runGuardrails; } });
+Object.defineProperty(exports, "defaultGuardrails", { enumerable: true, get: function () { return guardrails_1.defaultGuardrails; } });
+Object.defineProperty(exports, "requireNetworkPolicies", { enumerable: true, get: function () { return guardrails_1.requireNetworkPolicies; } });
+Object.defineProperty(exports, "requireResourceLimits", { enumerable: true, get: function () { return guardrails_1.requireResourceLimits; } });
+Object.defineProperty(exports, "requireLabels", { enumerable: true, get: function () { return guardrails_1.requireLabels; } });
+Object.defineProperty(exports, "noPlaintextSecrets", { enumerable: true, get: function () { return guardrails_1.noPlaintextSecrets; } });
+Object.defineProperty(exports, "requireTLS", { enumerable: true, get: function () { return guardrails_1.requireTLS; } });
+Object.defineProperty(exports, "noRootContainers", { enumerable: true, get: function () { return guardrails_1.noRootContainers; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,6CAA2D;AAAlD,kGAAA,GAAG,OAAA;AAAE,mGAAA,IAAI,OAAA;AAAE,qGAAA,MAAM,OAAA;AAAE,uGAAA,QAAQ,OAAA;AAEpC,uCAAkE;AAAzD,kGAAA,MAAM,OAAA;AAAqB,sGAAA,UAAU,OAAA;AAC9C,uCAAgF;AAAvE,2GAAA,eAAe,OAAA;AAAE,iHAAA,qBAAqB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAC5D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA;AACtB,qDAA0D;AAAjD,yHAAA,sBAAsB,OAAA;AAC/B,uCAQmB;AAPjB,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAClB,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,8GAAA,kBAAkB,OAAA;AAGpB,2CASqB;AARnB,2GAAA,aAAa,OAAA;AACb,+GAAA,iBAAiB,OAAA;AACjB,oHAAA,sBAAsB,OAAA;AACtB,mHAAA,qBAAqB,OAAA;AACrB,2GAAA,aAAa,OAAA;AACb,gHAAA,kBAAkB,OAAA;AAClB,wGAAA,UAAU,OAAA;AACV,8GAAA,gBAAgB,OAAA"}

package/dist/jsx-runtime.d.ts

@@ -0,0 +1,11 @@
+export declare const Fragment: unique symbol;
+export type r8sProps = Record<string, unknown>;
+export interface r8sElement {
+    type: string | Function | symbol;
+    props: any;
+    key: string | null;
+}
+export declare function jsx<P = any>(type: string | Function | symbol, props: P, key?: string): r8sElement;
+export declare function jsxs<P = any>(type: string | Function | symbol, props: P, key?: string): r8sElement;
+export { jsx as jsxDEV };
+//# sourceMappingURL=jsx-runtime.d.ts.map

package/dist/jsx-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsx-runtime.d.ts","sourceRoot":"","sources":["../src/jsx-runtime.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,QAAQ,eAA6B,CAAA;AAElD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE9C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAChC,KAAK,EAAE,GAAG,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,wBAAgB,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,CAMjG;AAED,wBAAgB,IAAI,CAAC,CAAC,GAAG,GAAG,EAC1B,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,EAChC,KAAK,EAAE,CAAC,EACR,GAAG,CAAC,EAAE,MAAM,GACX,UAAU,CAEZ;AAED,OAAO,EAAE,GAAG,IAAI,MAAM,EAAE,CAAA"}

package/dist/jsx-runtime.js

@@ -0,0 +1,20 @@
+"use strict";
+// JSX Runtime for r8s
+// Implements the react-jsx transform (v17+)
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Fragment = void 0;
+exports.jsx = jsx;
+exports.jsxDEV = jsx;
+exports.jsxs = jsxs;
+exports.Fragment = Symbol.for('r8s.fragment');
+function jsx(type, props, key) {
+    return {
+        type,
+        props,
+        key: key ?? null,
+    };
+}
+function jsxs(type, props, key) {
+    return jsx(type, props, key);
+}
+//# sourceMappingURL=jsx-runtime.js.map

package/dist/jsx-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsx-runtime.js","sourceRoot":"","sources":["../src/jsx-runtime.ts"],"names":[],"mappings":";AAAA,sBAAsB;AACtB,4CAA4C;;;AAY5C,kBAMC;AAUe,qBAAM;AARtB,oBAMC;AAxBY,QAAA,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;AAUlD,SAAgB,GAAG,CAAU,IAAgC,EAAE,KAAQ,EAAE,GAAY;IACnF,OAAO;QACL,IAAI;QACJ,KAAK;QACL,GAAG,EAAE,GAAG,IAAI,IAAI;KACjB,CAAA;AACH,CAAC;AAED,SAAgB,IAAI,CAClB,IAAgC,EAChC,KAAQ,EACR,GAAY;IAEZ,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;AAC9B,CAAC"}

package/dist/operator.d.ts

@@ -0,0 +1,28 @@
+import { Operator } from '@r8s/k8s-types';
+import { r8sElement } from './jsx-runtime';
+/**
+ * Declare an operator dependency.
+ *
+ * Components use this to declare that they require a specific
+ * Kubernetes operator to be installed. The renderer collects
+ * all operators so the deployment pipeline can install them.
+ *
+ * @example
+ * ```tsx
+ * import { declareOperator } from '@r8s/core';
+ * import { cnpgOperator } from '@r8s/recipes';
+ *
+ * function Database(props) {
+ *   return [
+ *     declareOperator(cnpgOperator('1.22.5')),
+ *     jsx('Cluster', cluster),
+ *   ];
+ * }
+ * ```
+ */
+export declare function declareOperator(operator: Operator): r8sElement;
+/** Check if a value is an operator declaration */
+export declare function isOperatorDeclaration(element: unknown): boolean;
+/** Extract operator from declaration element */
+export declare function getOperator(element: unknown): Operator | null;
+//# sourceMappingURL=operator.d.ts.map

package/dist/operator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../src/operator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAI1C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAM9D;AAED,kDAAkD;AAClD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAO/D;AAED,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAK7D"}

package/dist/operator.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.declareOperator = declareOperator;
+exports.isOperatorDeclaration = isOperatorDeclaration;
+exports.getOperator = getOperator;
+const OPERATOR_SYMBOL = Symbol.for('r8s.operator');
+/**
+ * Declare an operator dependency.
+ *
+ * Components use this to declare that they require a specific
+ * Kubernetes operator to be installed. The renderer collects
+ * all operators so the deployment pipeline can install them.
+ *
+ * @example
+ * ```tsx
+ * import { declareOperator } from '@r8s/core';
+ * import { cnpgOperator } from '@r8s/recipes';
+ *
+ * function Database(props) {
+ *   return [
+ *     declareOperator(cnpgOperator('1.22.5')),
+ *     jsx('Cluster', cluster),
+ *   ];
+ * }
+ * ```
+ */
+function declareOperator(operator) {
+    return {
+        type: OPERATOR_SYMBOL,
+        props: { operator },
+        key: null,
+    };
+}
+/** Check if a value is an operator declaration */
+function isOperatorDeclaration(element) {
+    if (!element || typeof element !== 'object')
+        return false;
+    return ('type' in element &&
+        typeof element.type === 'symbol' &&
+        element.type === OPERATOR_SYMBOL);
+}
+/** Extract operator from declaration element */
+function getOperator(element) {
+    if (!isOperatorDeclaration(element))
+        return null;
+    const props = element.props;
+    if (!props || typeof props !== 'object')
+        return null;
+    return props.operator || null;
+}
+//# sourceMappingURL=operator.js.map

package/dist/operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../src/operator.ts"],"names":[],"mappings":";;AAyBA,0CAMC;AAGD,sDAOC;AAGD,kCAKC;AA9CD,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;AAElD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,eAAe,CAAC,QAAkB;IAChD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,EAAE,QAAQ,EAAE;QACnB,GAAG,EAAE,IAAI;KACe,CAAA;AAC5B,CAAC;AAED,kDAAkD;AAClD,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACzD,OAAO,CACL,MAAM,IAAI,OAAO;QACjB,OAAQ,OAAmC,CAAC,IAAI,KAAK,QAAQ;QAC5D,OAAmC,CAAC,IAAI,KAAK,eAAe,CAC9D,CAAA;AACH,CAAC;AAED,gDAAgD;AAChD,SAAgB,WAAW,CAAC,OAAgB;IAC1C,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,KAAK,GAAI,OAAmC,CAAC,KAAK,CAAA;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACpD,OAAQ,KAAiC,CAAC,QAAQ,IAAI,IAAI,CAAA;AAC5D,CAAC"}

package/dist/renderer.d.ts

@@ -0,0 +1,10 @@
+import { r8sElement } from './jsx-runtime';
+import { KubernetesResource, Operator } from '@r8s/k8s-types';
+import { Context } from './context';
+export interface RenderResult {
+    resources: KubernetesResource[];
+    operators: Operator[];
+}
+export declare function useContext<T>(context: Context<T>): T;
+export declare function render(element: r8sElement): RenderResult;
+//# sourceMappingURL=renderer.d.ts.map

package/dist/renderer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../src/renderer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAsB,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE7D,OAAO,EACL,OAAO,EAOR,MAAM,WAAW,CAAA;AAElB,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,kBAAkB,EAAE,CAAA;IAC/B,SAAS,EAAE,QAAQ,EAAE,CAAA;CACtB;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAEpD;AAoHD,wBAAgB,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY,CA4BxD"}

package/dist/renderer.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useContext = useContext;
+exports.render = render;
+const jsx_runtime_1 = require("./jsx-runtime");
+const operator_1 = require("./operator");
+const context_1 = require("./context");
+function useContext(context) {
+    return (0, context_1.getContextValue)(context);
+}
+function isr8sElement(value) {
+    return value !== null && typeof value === 'object' && 'type' in value && 'props' in value;
+}
+function flattenChildren(children) {
+    if (children === null || children === undefined || typeof children === 'boolean') {
+        return [];
+    }
+    if (Array.isArray(children)) {
+        return children.flatMap(flattenChildren);
+    }
+    return [children];
+}
+function renderChildren(children) {
+    const flattened = flattenChildren(children);
+    const resources = [];
+    const operators = [];
+    for (const child of flattened) {
+        if (isr8sElement(child)) {
+            const result = renderElement(child);
+            resources.push(...result.resources);
+            operators.push(...result.operators);
+        }
+    }
+    return { resources, operators };
+}
+function renderElement(element) {
+    // Handle operator declarations
+    if ((0, operator_1.isOperatorDeclaration)(element)) {
+        const operator = (0, operator_1.getOperator)(element);
+        if (operator) {
+            return { resources: [], operators: [operator] };
+        }
+        return { resources: [], operators: [] };
+    }
+    // Handle Fragment - just render children
+    if (element.type === jsx_runtime_1.Fragment) {
+        return renderChildren(element.props.children);
+    }
+    // Handle context providers
+    if (element.type === Symbol.for('r8s.context.provider')) {
+        const { contextId, value, children } = element.props;
+        // Push context value
+        const hadPrevious = (0, context_1.hasContextValue)(contextId);
+        const previousValue = (0, context_1.getContextValueById)(contextId);
+        (0, context_1.setContextValue)(contextId, value);
+        // Render children with new context
+        const result = renderChildren(children);
+        // If the context value contains operators, include them
+        if (Array.isArray(value)) {
+            const ops = value.filter((v) => v && typeof v === 'object' && 'name' in v && 'source' in v);
+            result.operators.unshift(...ops);
+        }
+        // Restore previous context
+        (0, context_1.restoreContextValue)(contextId, hadPrevious, previousValue);
+        return result;
+    }
+    // Handle function components
+    if (typeof element.type === 'function') {
+        const componentFn = element.type;
+        const props = element.props;
+        const result = componentFn(props);
+        if (isr8sElement(result)) {
+            return renderElement(result);
+        }
+        if (Array.isArray(result)) {
+            return renderChildren(result);
+        }
+        return { resources: [], operators: [] };
+    }
+    // Handle built-in Kubernetes resource components
+    if (typeof element.type === 'string' && element.props && typeof element.props === 'object') {
+        const props = element.props;
+        // If this is a raw Kubernetes resource (has apiVersion and kind)
+        if ('apiVersion' in props && 'kind' in props) {
+            return { resources: [props], operators: [] };
+        }
+    }
+    return { resources: [], operators: [] };
+}
+function render(element) {
+    // Clear context stack before rendering
+    (0, context_1.clearContextStack)();
+    const { resources, operators } = renderElement(element);
+    // Deduplicate resources by kind/namespace/name, keeping the first occurrence.
+    // Components like Platform, Superset, and RustFS may all declare the same
+    // Namespace — emitting it twice produces invalid multi-doc YAML.
+    const resourceMap = new Map();
+    for (const res of resources) {
+        const meta = res.metadata ?? {};
+        const key = `${res.kind}/${meta.namespace ?? ''}/${meta.name ?? ''}`;
+        if (!resourceMap.has(key)) {
+            resourceMap.set(key, res);
+        }
+    }
+    // Deduplicate operators by name, keeping the last version
+    const operatorMap = new Map();
+    for (const op of operators) {
+        operatorMap.set(op.name, op);
+    }
+    return {
+        resources: Array.from(resourceMap.values()),
+        operators: Array.from(operatorMap.values()),
+    };
+}
+//# sourceMappingURL=renderer.js.map

package/dist/renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer.js","sourceRoot":"","sources":["../src/renderer.ts"],"names":[],"mappings":";;AAkBA,gCAEC;AAoHD,wBA4BC;AApKD,+CAA8D;AAE9D,yCAA+D;AAC/D,uCAQkB;AAOlB,SAAgB,UAAU,CAAI,OAAmB;IAC/C,OAAO,IAAA,yBAAe,EAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,IAAI,KAAK,CAAA;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,QAAiB;IACxC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAC1C,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,QAAiB;IAIvC,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAyB,EAAE,CAAA;IAC1C,MAAM,SAAS,GAAe,EAAE,CAAA;IAEhC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;YACnC,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;YACnC,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,OAAmB;IAIxC,+BAA+B;IAC/B,IAAI,IAAA,gCAAqB,EAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAA,sBAAW,EAAC,OAAO,CAAC,CAAA;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAA;QACjD,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IACzC,CAAC;IAED,yCAAyC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC/C,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACxD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAI9C,CAAA;QAED,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAA,yBAAe,EAAC,SAAS,CAAC,CAAA;QAC9C,MAAM,aAAa,GAAG,IAAA,6BAAmB,EAAC,SAAS,CAAC,CAAA;QACpD,IAAA,yBAAe,EAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAEjC,mCAAmC;QACnC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;QAEvC,wDAAwD;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CACtB,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,CACjF,CAAA;YACD,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;QAClC,CAAC;QAED,2BAA2B;QAC3B,IAAA,6BAAmB,EAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;QAE1D,OAAO,MAAM,CAAA;IACf,CAAC;IAED,6BAA6B;IAC7B,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAgB,CAAA;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAE3B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAEjC,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,aAAa,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,cAAc,CAAC,MAAM,CAAC,CAAA;QAC/B,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IACzC,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAA;QAEtD,iEAAiE;QACjE,IAAI,YAAY,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YAC7C,OAAO,EAAE,SAAS,EAAE,CAAC,KAAsC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;AACzC,CAAC;AAED,SAAgB,MAAM,CAAC,OAAmB;IACxC,uCAAuC;IACvC,IAAA,2BAAiB,GAAE,CAAA;IAEnB,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAEvD,8EAA8E;IAC9E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAA;IACzD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAI,GAA4D,CAAC,QAAQ,IAAI,EAAE,CAAA;QACzF,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAA;QACpE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC/C,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC9B,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;KAC5C,CAAA;AACH,CAAC"}

package/dist/validate.d.ts

@@ -0,0 +1,30 @@
+import { KubernetesResource } from '@r8s/k8s-types';
+export interface ValidationError {
+    /** Error code for programmatic handling */
+    code: string;
+    /** Human-readable error message */
+    message: string;
+    /** Resource or component that caused the error */
+    resource?: string;
+    /** Field path within the resource */
+    field?: string;
+    /** Suggested fix */
+    suggestion?: string;
+}
+export declare class r8sValidationError extends Error {
+    errors: ValidationError[];
+    constructor(errors: ValidationError[]);
+}
+/** Validate a Kubernetes resource */
+export declare function validateResource(resource: KubernetesResource): ValidationError[];
+/** Validate an Ingress resource specifically */
+export declare function validateIngress(resource: KubernetesResource): ValidationError[];
+/** Validate a Service resource */
+export declare function validateService(resource: KubernetesResource): ValidationError[];
+/** Validate a Deployment resource */
+export declare function validateDeployment(resource: KubernetesResource): ValidationError[];
+/** Validate an operator declaration */
+export declare function validateOperator(operator: any): ValidationError[];
+/** Check for duplicate resource names in the same namespace */
+export declare function checkDuplicates(resources: KubernetesResource[]): ValidationError[];
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,EAAE,eAAe,EAAE,CAAA;gBAEb,MAAM,EAAE,eAAe,EAAE;CAMtC;AAED,qCAAqC;AACrC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAoEhF;AAED,gDAAgD;AAChD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAkE/E;AAED,kCAAkC;AAClC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAwC/E;AAED,qCAAqC;AACrC,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA6DlF;AAED,uCAAuC;AACvC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,GAAG,eAAe,EAAE,CAsCjE;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,eAAe,EAAE,CA2BlF"}