timonel 2.5.0 → 2.6.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+# [2.6.0](https://github.com/KenkoGeek/timonel/compare/v2.5.1...v2.6.0) (2025-09-13)
+
+### Features
+
+- **core:** add security helpers - sanitizeEnvVar, validateImageTag, generateSecretName ([#43](https://github.com/KenkoGeek/timonel/issues/43)) ([323c9ae](https://github.com/KenkoGeek/timonel/commit/323c9ae3243dead04dacc6daf4e98e8af1a8d98b))
+
+## [2.5.1](https://github.com/KenkoGeek/timonel/compare/v2.5.0...v2.5.1) (2025-09-12)
+
+### Bug Fixes
+
+- **ci:** add comprehensive test suite with unit and integration tests ([#38](https://github.com/KenkoGeek/timonel/issues/38)) ([ffae52f](https://github.com/KenkoGeek/timonel/commit/ffae52fe357a8324959d74c5dd88594b21dafde1))
+
 # [2.5.0](https://github.com/KenkoGeek/timonel/compare/v2.4.0...v2.5.0) (2025-09-12)
 
 ### Features

package/dist/lib/helm.d.ts

@@ -217,4 +217,82 @@ export declare function stringRef(path: string): string;
  * @since 0.1.0
  */
 export declare function floatRef(path: string): string;
+/**
+ * Creates a conditional reference to a value in .Values
+ *
+ * Generates a Helm template expression that conditionally renders
+ * the value only if the condition is truthy.
+ *
+ * @param {string} path - Path to the value using dot notation
+ * @param {string} condition - Path to the condition value
+ * @returns {string} Helm template expression with conditional logic
+ * @throws {Error} If the path or condition is not valid for Helm templates
+ *
+ * @example
+ * ```typescript
+ * const secretName = conditionalRef('database.secretName', 'database.enabled');
+ * // Returns: '{{ if .Values.database.enabled }}{{ .Values.database.secretName }}{{ end }}'
+ * ```
+ *
+ * @since 2.6.0
+ */
+export declare function conditionalRef(path: string, condition: string): string;
+/**
+ * Creates a reference to a value in .Values with a default fallback
+ *
+ * Generates a Helm template expression that uses the default filter
+ * to provide a fallback value when the path is not set.
+ *
+ * @param {string} path - Path to the value using dot notation
+ * @param {string} defaultValue - Default value to use if path is not set
+ * @returns {string} Helm template expression with default fallback
+ * @throws {Error} If the path is not valid for Helm templates
+ *
+ * @example
+ * ```typescript
+ * const image = defaultRef('image.tag', 'latest');
+ * // Returns: '{{ .Values.image.tag | default "latest" }}'
+ * ```
+ *
+ * @since 2.6.0
+ */
+export declare function defaultRef(path: string, defaultValue: string): string;
+/**
+ * Creates a base64-encoded reference to a value in .Values
+ *
+ * Generates a Helm template expression that encodes the value
+ * using base64 encoding, useful for secrets and certificates.
+ *
+ * @param {string} path - Path to the value using dot notation
+ * @returns {string} Helm template expression with base64 encoding
+ * @throws {Error} If the path is not valid for Helm templates
+ *
+ * @example
+ * ```typescript
+ * const encodedSecret = base64Ref('secrets.apiKey');
+ * // Returns: '{{ .Values.secrets.apiKey | b64enc }}'
+ * ```
+ *
+ * @since 2.6.0
+ */
+export declare function base64Ref(path: string): string;
+/**
+ * Creates a JSON-serialized reference to a value in .Values
+ *
+ * Generates a Helm template expression that serializes the value
+ * to JSON format, useful for complex configuration objects.
+ *
+ * @param {string} path - Path to the value using dot notation
+ * @returns {string} Helm template expression with JSON serialization
+ * @throws {Error} If the path is not valid for Helm templates
+ *
+ * @example
+ * ```typescript
+ * const configJson = jsonRef('app.config');
+ * // Returns: '{{ .Values.app.config | toJson }}'
+ * ```
+ *
+ * @since 2.6.0
+ */
+export declare function jsonRef(path: string): string;
 //# sourceMappingURL=helm.d.ts.map

package/dist/lib/helm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helm.d.ts","sourceRoot":"","sources":["../../src/lib/helm.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAQxE;AAeD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,IAAI;IACf,wCAAwC;;IAExC,oCAAoC;;IAEpC,0CAA0C;;IAE1C,kDAAkD;;CAEnD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAM,GAAG,MAAM,CAE5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAM,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK7C"}
+{"version":3,"file":"helm.d.ts","sourceRoot":"","sources":["../../src/lib/helm.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAQxE;AAeD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,IAAI;IACf,wCAAwC;;IAExC,oCAAoC;;IAEpC,0CAA0C;;IAE1C,kDAAkD;;CAEnD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAM,GAAG,MAAM,CAE5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAM,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK7C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAOrE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5C"}

package/dist/lib/helm.js

@@ -279,4 +279,107 @@ export function floatRef(path) {
     }
     return `{{ .Values.${path} | float64 }}`;
 }
+/**
+ * Creates a conditional reference to a value in .Values
+ *
+ * Generates a Helm template expression that conditionally renders
+ * the value only if the condition is truthy.
+ *
+ * @param {string} path - Path to the value using dot notation
+ * @param {string} condition - Path to the condition value
+ * @returns {string} Helm template expression with conditional logic
+ * @throws {Error} If the path or condition is not valid for Helm templates
+ *
+ * @example
+ * ```typescript
+ * const secretName = conditionalRef('database.secretName', 'database.enabled');
+ * // Returns: '{{ if .Values.database.enabled }}{{ .Values.database.secretName }}{{ end }}'
+ * ```
+ *
+ * @since 2.6.0
+ */
+export function conditionalRef(path, condition) {
+    if (!isValidHelmPath(path)) {
+        throw new Error(`Invalid Helm template path: ${path}`);
+    }
+    if (!isValidHelmPath(condition)) {
+        throw new Error(`Invalid Helm template condition path: ${condition}`);
+    }
+    return `{{ if .Values.${condition} }}{{ .Values.${path} }}{{ end }}`;
+}
+/**
+ * Creates a reference to a value in .Values with a default fallback
+ *
+ * Generates a Helm template expression that uses the default filter
+ * to provide a fallback value when the path is not set.
+ *
+ * @param {string} path - Path to the value using dot notation
+ * @param {string} defaultValue - Default value to use if path is not set
+ * @returns {string} Helm template expression with default fallback
+ * @throws {Error} If the path is not valid for Helm templates
+ *
+ * @example
+ * ```typescript
+ * const image = defaultRef('image.tag', 'latest');
+ * // Returns: '{{ .Values.image.tag | default "latest" }}'
+ * ```
+ *
+ * @since 2.6.0
+ */
+export function defaultRef(path, defaultValue) {
+    if (!isValidHelmPath(path)) {
+        throw new Error(`Invalid Helm template path: ${path}`);
+    }
+    // Escape quotes and backslashes in defaultValue to prevent template injection
+    const escapedValue = defaultValue.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+    return `{{ .Values.${path} | default "${escapedValue}" }}`;
+}
+/**
+ * Creates a base64-encoded reference to a value in .Values
+ *
+ * Generates a Helm template expression that encodes the value
+ * using base64 encoding, useful for secrets and certificates.
+ *
+ * @param {string} path - Path to the value using dot notation
+ * @returns {string} Helm template expression with base64 encoding
+ * @throws {Error} If the path is not valid for Helm templates
+ *
+ * @example
+ * ```typescript
+ * const encodedSecret = base64Ref('secrets.apiKey');
+ * // Returns: '{{ .Values.secrets.apiKey | b64enc }}'
+ * ```
+ *
+ * @since 2.6.0
+ */
+export function base64Ref(path) {
+    if (!isValidHelmPath(path)) {
+        throw new Error(`Invalid Helm template path: ${path}`);
+    }
+    return `{{ .Values.${path} | b64enc }}`;
+}
+/**
+ * Creates a JSON-serialized reference to a value in .Values
+ *
+ * Generates a Helm template expression that serializes the value
+ * to JSON format, useful for complex configuration objects.
+ *
+ * @param {string} path - Path to the value using dot notation
+ * @returns {string} Helm template expression with JSON serialization
+ * @throws {Error} If the path is not valid for Helm templates
+ *
+ * @example
+ * ```typescript
+ * const configJson = jsonRef('app.config');
+ * // Returns: '{{ .Values.app.config | toJson }}'
+ * ```
+ *
+ * @since 2.6.0
+ */
+export function jsonRef(path) {
+    if (!isValidHelmPath(path)) {
+        throw new Error(`Invalid Helm template path: ${path}`);
+    }
+    return `{{ .Values.${path} | toJson }}`;
+}
 //# sourceMappingURL=helm.js.map

package/dist/lib/helm.js.map

@@ -1 +1 @@
-{"version":3,"file":"helm.js","sourceRoot":"","sources":["../../src/lib/helm.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,KAAK,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAgB;IAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,IAAI,GAAG,IAAI,cAAc,CAAC;IAC7C,yEAAyE;IACzE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnE,OAAO,gBAAgB,UAAU,aAAa,IAAI,KAAK,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,gDAAgD;IAChD,OAAO,aAAa,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,wCAAwC;IACxC,WAAW,EAAE,qBAAqB;IAClC,oCAAoC;IACpC,SAAS,EAAE,mBAAmB;IAC9B,0CAA0C;IAC1C,YAAY,EAAE,sBAAsB;IACpC,kDAAkD;IAClD,SAAS,EAAE,0BAA0B;CACtC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,gEAAgE;IAChE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,IAAI,GAAG,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,MAAM,CAAC,CAAS,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAO,GAAG,GAAG;IAClD,OAAO,gBAAgB,IAAI,KAAK,OAAO,KAAK,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAO,GAAG,GAAG;IACjD,OAAO,eAAe,IAAI,KAAK,OAAO,KAAK,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,WAAW,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,cAAc,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,gBAAgB,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,eAAe,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"helm.js","sourceRoot":"","sources":["../../src/lib/helm.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,KAAK,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAgB;IAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,IAAI,GAAG,IAAI,cAAc,CAAC;IAC7C,yEAAyE;IACzE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnE,OAAO,gBAAgB,UAAU,aAAa,IAAI,KAAK,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,gDAAgD;IAChD,OAAO,aAAa,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,wCAAwC;IACxC,WAAW,EAAE,qBAAqB;IAClC,oCAAoC;IACpC,SAAS,EAAE,mBAAmB;IAC9B,0CAA0C;IAC1C,YAAY,EAAE,sBAAsB;IACpC,kDAAkD;IAClD,SAAS,EAAE,0BAA0B;CACtC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,gEAAgE;IAChE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,IAAI,GAAG,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,MAAM,CAAC,CAAS,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAO,GAAG,GAAG;IAClD,OAAO,gBAAgB,IAAI,KAAK,OAAO,KAAK,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAO,GAAG,GAAG;IACjD,OAAO,eAAe,IAAI,KAAK,OAAO,KAAK,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,WAAW,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,cAAc,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,gBAAgB,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,eAAe,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,SAAiB;IAC5D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,iBAAiB,SAAS,iBAAiB,IAAI,cAAc,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,YAAoB;IAC3D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,8EAA8E;IAC9E,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9E,OAAO,cAAc,IAAI,eAAe,YAAY,MAAM,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,cAAc,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,IAAI,cAAc,CAAC;AAC1C,CAAC"}

package/dist/lib/security.d.ts

@@ -69,5 +69,68 @@ export declare class SecurityUtils {
      * @since 2.2.0
      */
     static isValidSubchartName(subchartName: string): boolean;
+    /**
+     * Sanitizes environment variable names and values for Kubernetes security
+     * Prevents injection attacks and ensures compliance with Kubernetes naming rules
+     * @param name - Environment variable name to sanitize
+     * @param value - Environment variable value to sanitize
+     * @returns Object with sanitized name and value
+     * @throws Error if name or value contains dangerous patterns
+     *
+     * @since 2.6.0
+     */
+    static sanitizeEnvVar(name: string, value: string): {
+        name: string;
+        value: string;
+    };
+    /**
+     * Validates container image tags for security best practices
+     * Prevents use of dangerous tags and ensures proper versioning
+     * @param tag - Image tag to validate
+     * @returns True if tag is valid and secure
+     * @throws Error if tag violates security policies
+     *
+     * @since 2.6.0
+     */
+    static validateImageTag(tag: string): boolean;
+    /**
+     * Generates secure names for Kubernetes secrets
+     * Ensures names follow RFC 1123 and are safe for Kubernetes
+     * @param baseName - Base name for the secret
+     * @param suffix - Optional suffix to append
+     * @returns Secure secret name
+     * @throws Error if generated name is invalid
+     *
+     * @since 2.6.0
+     */
+    static generateSecretName(baseName: string, suffix?: string): string;
+    /**
+     * Sanitizes the base name for secret generation using safe string methods
+     * @param baseName - Base name to sanitize
+     * @returns Sanitized base name
+     * @throws Error if no valid characters remain
+     *
+     * @since 2.6.0
+     */
+    private static sanitizeBaseName;
+    /**
+     * Appends suffix to sanitized base name using safe string methods
+     * @param baseName - Sanitized base name
+     * @param suffix - Suffix to append
+     * @returns Base name with suffix
+     * @throws Error if suffix is invalid
+     *
+     * @since 2.6.0
+     */
+    private static appendSuffix;
+    /**
+     * Truncates name if it exceeds length limits
+     * @param name - Name to potentially truncate
+     * @param suffix - Original suffix for preservation
+     * @returns Truncated name if needed
+     *
+     * @since 2.6.0
+     */
+    private static truncateIfNeeded;
 }
 //# sourceMappingURL=security.d.ts.map

package/dist/lib/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;;GAKG;AACH,qBAAa,aAAa;IACxB;;;;;;;;OAQG;IACH,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM;IA2BvE;;;;;;OAMG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAgBlD;;;;;;;OAOG;IACH,MAAM,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAmBnD;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvD;;;;;;OAMG;IACH,MAAM,CAAC,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAU7D;;;;;;OAMG;IACH,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAWnD;;;;;;OAMG;IACH,MAAM,CAAC,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;CAG1D"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;;GAKG;AACH,qBAAa,aAAa;IACxB;;;;;;;;OAQG;IACH,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM;IA2BvE;;;;;;OAMG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAgBlD;;;;;;;OAOG;IACH,MAAM,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAmBnD;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvD;;;;;;OAMG;IACH,MAAM,CAAC,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAU7D;;;;;;OAMG;IACH,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAWnD;;;;;;OAMG;IACH,MAAM,CAAC,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAIzD;;;;;;;;;OASG;IACH,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IA6DnF;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IA+C7C;;;;;;;;;OASG;IACH,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IA0BpE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAsB/B;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;IA0B3B;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;CA4BhC"}

package/dist/lib/security.js

@@ -134,5 +134,228 @@ export class SecurityUtils {
     static isValidSubchartName(subchartName) {
         return this.isValidChartName(subchartName);
     }
+    /**
+     * Sanitizes environment variable names and values for Kubernetes security
+     * Prevents injection attacks and ensures compliance with Kubernetes naming rules
+     * @param name - Environment variable name to sanitize
+     * @param value - Environment variable value to sanitize
+     * @returns Object with sanitized name and value
+     * @throws Error if name or value contains dangerous patterns
+     *
+     * @since 2.6.0
+     */
+    static sanitizeEnvVar(name, value) {
+        if (!name || typeof name !== 'string') {
+            throw new Error('Environment variable name must be a non-empty string');
+        }
+        if (typeof value !== 'string') {
+            throw new Error('Environment variable value must be a string');
+        }
+        // Kubernetes env var name validation (RFC 1123 compatible)
+        let sanitizedName = name.toUpperCase().replace(/[^A-Z0-9_]/g, '_');
+        // Ensure name starts with letter or underscore
+        if (/^[0-9]/.test(sanitizedName)) {
+            sanitizedName = `_${sanitizedName}`;
+        }
+        const nameRegex = /^[A-Z_][A-Z0-9_]*$/;
+        if (!nameRegex.test(sanitizedName)) {
+            throw new Error(`Invalid environment variable name: ${this.sanitizeLogMessage(name)}`);
+        }
+        // Check for dangerous patterns in value using safer string methods
+        const hasDangerousPattern = (val) => {
+            if (val.includes('$(') && val.includes(')'))
+                return 'command substitution';
+            if (val.includes('`'))
+                return 'backtick execution';
+            if (val.includes('${') && val.includes('}'))
+                return 'variable expansion';
+            // Check for control characters
+            for (let i = 0; i < val.length; i++) {
+                const code = val.charCodeAt(i);
+                if ((code >= 0x00 && code <= 0x08) ||
+                    code === 0x0b ||
+                    code === 0x0c ||
+                    (code >= 0x0e && code <= 0x1f) ||
+                    code === 0x7f) {
+                    return 'control characters';
+                }
+            }
+            return null;
+        };
+        const dangerousPattern = hasDangerousPattern(value);
+        if (dangerousPattern) {
+            throw new Error(`Environment variable value contains dangerous pattern (${dangerousPattern}): ${this.sanitizeLogMessage(value)}`);
+        }
+        // Limit value length to prevent DoS
+        if (value.length > 32768) {
+            throw new Error('Environment variable value exceeds maximum length (32KB)');
+        }
+        return {
+            name: sanitizedName,
+            value: value.trim(),
+        };
+    }
+    /**
+     * Validates container image tags for security best practices
+     * Prevents use of dangerous tags and ensures proper versioning
+     * @param tag - Image tag to validate
+     * @returns True if tag is valid and secure
+     * @throws Error if tag violates security policies
+     *
+     * @since 2.6.0
+     */
+    static validateImageTag(tag) {
+        if (!tag || typeof tag !== 'string') {
+            throw new Error('Image tag must be a non-empty string');
+        }
+        const trimmedTag = tag.trim();
+        // Reject dangerous or non-specific tags
+        const dangerousTags = ['latest', 'master', 'main', 'dev', 'development', 'test', 'staging'];
+        if (dangerousTags.includes(trimmedTag.toLowerCase())) {
+            throw new Error(`Insecure image tag detected: '${trimmedTag}'. Use specific version tags for security.`);
+        }
+        // Validate tag format (Docker tag rules)
+        const tagRegex = /^[a-zA-Z0-9._-]+$/;
+        if (!tagRegex.test(trimmedTag)) {
+            throw new Error(`Invalid image tag format: ${this.sanitizeLogMessage(trimmedTag)}`);
+        }
+        // Check length limits
+        if (trimmedTag.length > 128) {
+            throw new Error('Image tag exceeds maximum length (128 characters)');
+        }
+        // Prefer semantic versioning patterns
+        // eslint-disable-next-line security/detect-unsafe-regex -- Simple regex patterns are safe for validation
+        const semverPattern = /^v?\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?$/;
+        const hashPattern = /^[a-f0-9]{7,64}$/;
+        // eslint-disable-next-line security/detect-unsafe-regex -- Simple date pattern is safe for validation
+        const datePattern = /^\d{4}-\d{2}-\d{2}(-[a-zA-Z0-9.-]+)?$/;
+        if (!semverPattern.test(trimmedTag) &&
+            !hashPattern.test(trimmedTag) &&
+            !datePattern.test(trimmedTag)) {
+            // Warning for non-standard tags but don't fail
+            console.warn(`Warning: Image tag '${trimmedTag}' doesn't follow recommended patterns (semver, hash, or date)`);
+        }
+        return true;
+    }
+    /**
+     * Generates secure names for Kubernetes secrets
+     * Ensures names follow RFC 1123 and are safe for Kubernetes
+     * @param baseName - Base name for the secret
+     * @param suffix - Optional suffix to append
+     * @returns Secure secret name
+     * @throws Error if generated name is invalid
+     *
+     * @since 2.6.0
+     */
+    static generateSecretName(baseName, suffix) {
+        if (!baseName || typeof baseName !== 'string') {
+            throw new Error('Base name must be a non-empty string');
+        }
+        let sanitizedBase = this.sanitizeBaseName(baseName);
+        if (suffix) {
+            sanitizedBase = this.appendSuffix(sanitizedBase, suffix);
+        }
+        // Ensure name starts with letter (not number)
+        if (/^[0-9]/.test(sanitizedBase)) {
+            sanitizedBase = `s${sanitizedBase}`;
+        }
+        sanitizedBase = this.truncateIfNeeded(sanitizedBase, suffix);
+        // Final validation
+        if (!this.isValidChartName(sanitizedBase)) {
+            throw new Error(`Generated secret name is invalid: ${sanitizedBase}`);
+        }
+        return sanitizedBase;
+    }
+    /**
+     * Sanitizes the base name for secret generation using safe string methods
+     * @param baseName - Base name to sanitize
+     * @returns Sanitized base name
+     * @throws Error if no valid characters remain
+     *
+     * @since 2.6.0
+     */
+    static sanitizeBaseName(baseName) {
+        // Use character-by-character processing instead of regex
+        let sanitized = '';
+        for (const char of baseName.toLowerCase()) {
+            if ((char >= 'a' && char <= 'z') || (char >= '0' && char <= '9') || char === '-') {
+                sanitized += char;
+            }
+            else {
+                sanitized += '-';
+            }
+        }
+        // Collapse multiple hyphens using split/filter/join
+        const parts = sanitized.split('-').filter((part) => part.length > 0);
+        sanitized = parts.join('-');
+        if (!sanitized) {
+            throw new Error('Base name contains no valid characters');
+        }
+        return sanitized;
+    }
+    /**
+     * Appends suffix to sanitized base name using safe string methods
+     * @param baseName - Sanitized base name
+     * @param suffix - Suffix to append
+     * @returns Base name with suffix
+     * @throws Error if suffix is invalid
+     *
+     * @since 2.6.0
+     */
+    static appendSuffix(baseName, suffix) {
+        if (typeof suffix !== 'string') {
+            throw new Error('Suffix must be a string');
+        }
+        // Use character-by-character processing instead of regex
+        let sanitizedSuffix = '';
+        for (const char of suffix.toLowerCase()) {
+            if ((char >= 'a' && char <= 'z') || (char >= '0' && char <= '9') || char === '-') {
+                sanitizedSuffix += char;
+            }
+            else {
+                sanitizedSuffix += '-';
+            }
+        }
+        // Collapse multiple hyphens using split/filter/join
+        const parts = sanitizedSuffix.split('-').filter((part) => part.length > 0);
+        sanitizedSuffix = parts.join('-');
+        if (sanitizedSuffix) {
+            return `${baseName}-${sanitizedSuffix}`;
+        }
+        return baseName;
+    }
+    /**
+     * Truncates name if it exceeds length limits
+     * @param name - Name to potentially truncate
+     * @param suffix - Original suffix for preservation
+     * @returns Truncated name if needed
+     *
+     * @since 2.6.0
+     */
+    static truncateIfNeeded(name, suffix) {
+        const maxLength = 63;
+        if (name.length <= maxLength) {
+            return name;
+        }
+        // Truncate but preserve suffix if possible
+        if (suffix) {
+            // Use safe character processing instead of regex
+            let safeSuffix = '';
+            for (const char of suffix.toLowerCase()) {
+                if ((char >= 'a' && char <= 'z') || (char >= '0' && char <= '9') || char === '-') {
+                    safeSuffix += char;
+                }
+                else {
+                    safeSuffix += '-';
+                }
+            }
+            const suffixPart = `-${safeSuffix}`;
+            const maxBaseLength = maxLength - suffixPart.length;
+            if (maxBaseLength > 0) {
+                return name.substring(0, maxBaseLength) + suffixPart;
+            }
+        }
+        return name.substring(0, maxLength);
+    }
 }
 //# sourceMappingURL=security.js.map

package/dist/lib/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACxB;;;;;;;;OAQG;IACH,MAAM,CAAC,YAAY,CAAC,SAAiB,EAAE,eAAuB;QAC5D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,qCAAqC;QACrC,IACE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzB,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,8BAA8B;QAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEnD,2DAA2D;QAC3D,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,KAAK,YAAY,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAe;QACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,4EAA4E;QAC5E,OAAO,CACL,OAAO;YACL,sGAAsG;aACrG,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,4BAA4B;aAC5D,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,0BAA0B;aAChD,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,qCAAqC;aAC7D,IAAI,EAAE,CACV,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,uBAAuB,CAAC,GAAW;QACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,oDAAoD;QACpD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAErD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAAC,QAAgB;QAC3C,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,uBAAuB,CAAC,YAAoB;QACjD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,oFAAoF;QACpF,MAAM,aAAa,GAAG,2BAA2B,CAAC;QAClD,OAAO,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,gBAAgB,CAAC,SAAiB;QACvC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,+DAA+D;QAC/D,gGAAgG;QAChG,MAAM,cAAc,GAAG,iCAAiC,CAAC;QACzD,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,mBAAmB,CAAC,YAAoB;QAC7C,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACxB;;;;;;;;OAQG;IACH,MAAM,CAAC,YAAY,CAAC,SAAiB,EAAE,eAAuB;QAC5D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,qCAAqC;QACrC,IACE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzB,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,8BAA8B;QAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEnD,2DAA2D;QAC3D,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,KAAK,YAAY,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAe;QACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,4EAA4E;QAC5E,OAAO,CACL,OAAO;YACL,sGAAsG;aACrG,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,4BAA4B;aAC5D,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,0BAA0B;aAChD,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,qCAAqC;aAC7D,IAAI,EAAE,CACV,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,uBAAuB,CAAC,GAAW;QACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,oDAAoD;QACpD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAErD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CAAC,QAAgB;QAC3C,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,uBAAuB,CAAC,YAAoB;QACjD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,oFAAoF;QACpF,MAAM,aAAa,GAAG,2BAA2B,CAAC;QAClD,OAAO,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,gBAAgB,CAAC,SAAiB;QACvC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,+DAA+D;QAC/D,gGAAgG;QAChG,MAAM,cAAc,GAAG,iCAAiC,CAAC;QACzD,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,mBAAmB,CAAC,YAAoB;QAC7C,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,cAAc,CAAC,IAAY,EAAE,KAAa;QAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,2DAA2D;QAC3D,IAAI,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAEnE,+CAA+C;QAC/C,IAAI,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,SAAS,GAAG,oBAAoB,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,mEAAmE;QACnE,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAiB,EAAE;YACzD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,sBAAsB,CAAC;YAC3E,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,oBAAoB,CAAC;YACnD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,oBAAoB,CAAC;YACzE,+BAA+B;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC/B,IACE,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;oBAC9B,IAAI,KAAK,IAAI;oBACb,IAAI,KAAK,IAAI;oBACb,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;oBAC9B,IAAI,KAAK,IAAI,EACb,CAAC;oBACD,OAAO,oBAAoB,CAAC;gBAC9B,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,0DAA0D,gBAAgB,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CACjH,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;SACpB,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CAAC,GAAW;QACjC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,wCAAwC;QACxC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5F,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,iCAAiC,UAAU,4CAA4C,CACxF,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,sBAAsB;QACtB,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,sCAAsC;QACtC,yGAAyG;QACzG,MAAM,aAAa,GAAG,qCAAqC,CAAC;QAC5D,MAAM,WAAW,GAAG,kBAAkB,CAAC;QACvC,sGAAsG;QACtG,MAAM,WAAW,GAAG,uCAAuC,CAAC;QAE5D,IACE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YAC/B,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7B,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAC7B,CAAC;YACD,+CAA+C;YAC/C,OAAO,CAAC,IAAI,CACV,uBAAuB,UAAU,+DAA+D,CACjG,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,kBAAkB,CAAC,QAAgB,EAAE,MAAe;QACzD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,MAAM,EAAE,CAAC;YACX,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,8CAA8C;QAC9C,IAAI,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;QACtC,CAAC;QAED,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAE7D,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,aAAa,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,gBAAgB,CAAC,QAAgB;QAC9C,yDAAyD;QACzD,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjF,SAAS,IAAI,IAAI,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,SAAS,IAAI,GAAG,CAAC;YACnB,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE5B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc;QAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,yDAAyD;QACzD,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjF,eAAe,IAAI,IAAI,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,eAAe,IAAI,GAAG,CAAC;YACzB,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3E,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,GAAG,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,gBAAgB,CAAC,IAAY,EAAE,MAAe;QAC3D,MAAM,SAAS,GAAG,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,2CAA2C;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,iDAAiD;YACjD,IAAI,UAAU,GAAG,EAAE,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACjF,UAAU,IAAI,IAAI,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,UAAU,IAAI,GAAG,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;YACpC,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC;YAEpD,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,UAAU,CAAC;YACvD,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;CACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "timonel",
   "type": "module",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "Timonel: programmatic Helm chart generator using cdk8s (TypeScript)",
   "bin": {
     "timonel": "dist/cli.js",
@@ -31,13 +31,18 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "security:lint": "eslint .",
-    "security:audit": "pnpm audit --audit-level=moderate",
+    "security:audit": "pnpm audit --audit-level=high",
     "security:check": "pnpm run security:lint && pnpm run security:audit",
     "deps:check": "pnpm outdated",
     "deps:update": "pnpm update --latest",
     "md:lint": "markdownlint \"**/*.md\"",
     "md:fix": "markdownlint --fix \"**/*.md\"",
-    "test": "echo \"No tests specified\" && exit 0",
+    "test": "pnpm test:unit && pnpm test:integration",
+    "test:unit": "vitest run --config vitest.config.ts",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "test:basic-integration": "vitest run tests/integration/basic-chart-generation.int.spec.ts --config vitest.integration.config.ts",
     "ci:check": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm build",
     "release": "semantic-release",
     "release:dry": "semantic-release --dry-run",
@@ -94,6 +99,7 @@
     "@types/node": "^24.3.0",
     "@typescript-eslint/eslint-plugin": "^8.42.0",
     "@typescript-eslint/parser": "^8.42.0",
+    "@vitest/coverage-v8": "^2.1.9",
     "conventional-changelog-cli": "^5.0.0",
     "eslint": "^9.35.0",
     "eslint-config-prettier": "^10.1.8",
@@ -108,7 +114,8 @@
     "markdownlint-cli": "^0.45.0",
     "prettier": "^3.6.2",
     "semantic-release": "^24.2.7",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.2",
+    "vitest": "^2.1.9"
   },
   "files": [
     "dist",