timonel 2.8.0 → 2.8.3

package/dist/lib/rutter.js

@@ -5,13 +5,6 @@ import { HelmChartWriter } from './helmChartWriter.js';
 import { AWSResources } from './resources/cloud/aws/awsResources.js';
 import { KarpenterResources } from './resources/cloud/aws/karpenterResources.js';
 import { generateHelpersTemplate } from './utils/helmHelpers.js';
-/**
- * Rutter class with modular architecture
- * Provides a clean API while delegating to specialized resource providers
- * Maintains full backward compatibility with the original Rutter class
- *
- * @since 2.4.0
- */
 export class Rutter {
     constructor(props) {
         this.assets = [];
@@ -19,286 +12,47 @@ export class Rutter {
         this.meta = props.meta;
         this.defaultValues = props.defaultValues ?? {};
         this.envValues = props.envValues ?? {};
-        // Create CDK8s infrastructure
         this.app = new App();
         this.chart = new Chart(this.app, props.meta.name, {
             ...props.chartProps,
             ...(props.namespace ? { namespace: props.namespace } : {}),
         });
-        // Initialize resource providers
         this.awsResources = new AWSResources(this.chart);
         this.karpenterResources = new KarpenterResources(this.chart);
     }
-    // AWS Resources
-    /**
-     * Creates an AWS EBS StorageClass
-     * @param spec - EBS StorageClass specification
-     * @returns Created StorageClass ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addAWSEBSStorageClass({
-     *   name: 'fast-ebs',
-     *   volumeType: 'gp3',
-     *   encrypted: true,
-     *   allowVolumeExpansion: true
-     * });
-     * ```
-     *
-     * @since 1.0.0
-     */
     addAWSEBSStorageClass(spec) {
         return this.awsResources.addEBSStorageClass(spec);
     }
-    /**
-     * Creates an AWS EFS StorageClass
-     * @param spec - EFS StorageClass specification
-     * @returns Created StorageClass ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addAWSEFSStorageClass({
-     *   name: 'efs-storage',
-     *   fileSystemId: 'fs-12345678',
-     *   directoryPerms: '0755'
-     * });
-     * ```
-     *
-     * @since 1.0.0
-     */
     addAWSEFSStorageClass(spec) {
         return this.awsResources.addEFSStorageClass(spec);
     }
-    /**
-     * Creates an AWS IRSA ServiceAccount
-     * @param spec - IRSA ServiceAccount specification
-     * @returns Created ServiceAccount ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addAWSIRSAServiceAccount({
-     *   name: 'my-service-account',
-     *   roleArn: 'arn:aws:iam::ACCOUNT_ID:role/MyRole'
-     * });
-     * ```
-     *
-     * @since 1.0.0
-     */
     addAWSIRSAServiceAccount(spec) {
         return this.awsResources.addIRSAServiceAccount(spec);
     }
-    /**
-     * Creates an AWS ALB Ingress
-     * @param spec - ALB Ingress specification
-     * @returns Created Ingress ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addAWSALBIngress({
-     *   name: 'web-ingress',
-     *   rules: [{
-     *     paths: [{
-     *       path: '/',
-     *       pathType: 'Prefix',
-     *       backend: { service: { name: 'web-service', port: { number: 80 } } }
-     *     }]
-     *   }],
-     *   scheme: 'internet-facing'
-     * });
-     * ```
-     *
-     * @since 1.0.0
-     */
     addAWSALBIngress(spec) {
         return this.awsResources.addALBIngress(spec);
     }
-    // AWS Karpenter Resources
-    /**
-     * Creates a Karpenter NodePool resource
-     * @param spec - NodePool specification
-     * @returns Created NodePool ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addKarpenterNodePool({
-     *   name: 'default-nodepool',
-     *   template: {
-     *     spec: {
-     *       nodeClassRef: {
-     *         apiVersion: 'karpenter.k8s.aws/v1beta1',
-     *         kind: 'EC2NodeClass',
-     *         name: 'default'
-     *       }
-     *     }
-     *   }
-     * });
-     * ```
-     *
-     * @since 2.7.0
-     */
     addKarpenterNodePool(spec) {
         return this.karpenterResources.addKarpenterNodePool(spec);
     }
-    /**
-     * Creates a Karpenter NodeClaim resource
-     * @param spec - NodeClaim specification
-     * @returns Created NodeClaim ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addKarpenterNodeClaim({
-     *   name: 'my-node-claim',
-     *   nodeClassRef: {
-     *     apiVersion: 'karpenter.k8s.aws/v1beta1',
-     *     kind: 'EC2NodeClass',
-     *     name: 'default'
-     *   }
-     * });
-     * ```
-     *
-     * @since 2.7.0
-     */
     addKarpenterNodeClaim(spec) {
         return this.karpenterResources.addKarpenterNodeClaim(spec);
     }
-    /**
-     * Creates a Karpenter EC2NodeClass resource
-     * @param spec - EC2NodeClass specification
-     * @returns Created EC2NodeClass ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addKarpenterEC2NodeClass({
-     *   name: 'default',
-     *   amiFamily: 'AL2',
-     *   subnetSelectorTerms: [{ tags: { 'karpenter.sh/discovery': 'my-cluster' } }],
-     *   securityGroupSelectorTerms: [{ tags: { 'karpenter.sh/discovery': 'my-cluster' } }]
-     * });
-     * ```
-     *
-     * @since 2.7.0
-     */
     addKarpenterEC2NodeClass(spec) {
         return this.karpenterResources.addKarpenterEC2NodeClass(spec);
     }
-    /**
-     * Creates a Karpenter NodePool with optimized disruption settings for cost efficiency
-     * @param spec - NodePool specification with disruption optimization
-     * @returns Created NodePool ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addKarpenterNodePoolWithDisruption({
-     *   name: 'cost-optimized',
-     *   nodeClassRef: {
-     *     apiVersion: 'karpenter.k8s.aws/v1beta1',
-     *     kind: 'EC2NodeClass',
-     *     name: 'default'
-     *   },
-     *   consolidationPolicy: 'WhenEmptyOrUnderutilized',
-     *   consolidateAfter: '30s',
-     *   expireAfter: '24h',
-     *   disruptionBudgets: [
-     *     { nodes: '20%' },
-     *     { nodes: '0', schedule: '0 9 * * 1-5', duration: '8h' }
-     *   ]
-     * });
-     * ```
-     *
-     * @since 2.7.1
-     */
     addKarpenterNodePoolWithDisruption(spec) {
         return this.karpenterResources.addKarpenterNodePoolWithDisruption(spec);
     }
-    /**
-     * Creates a Karpenter NodePool with scheduling constraints and priorities
-     * @param spec - NodePool specification with scheduling optimization
-     * @returns Created NodePool ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addKarpenterNodePoolWithScheduling({
-     *   name: 'gpu-workloads',
-     *   nodeClassRef: {
-     *     apiVersion: 'karpenter.k8s.aws/v1beta1',
-     *     kind: 'EC2NodeClass',
-     *     name: 'gpu-nodeclass'
-     *   },
-     *   requirements: [
-     *     { key: 'node.kubernetes.io/instance-type', operator: 'In', values: ['g4dn.xlarge', 'g4dn.2xlarge'] }
-     *   ],
-     *   taints: [
-     *     { key: 'nvidia.com/gpu', effect: 'NoSchedule' }
-     *   ],
-     *   terminationGracePeriod: '60s',
-     *   weight: 100
-     * });
-     * ```
-     *
-     * @since 2.7.1
-     */
     addKarpenterNodePoolWithScheduling(spec) {
         return this.karpenterResources.addKarpenterNodePoolWithScheduling(spec);
     }
-    // AWS ECR ServiceAccount
-    /**
-     * Creates a ServiceAccount with ECR access annotations
-     * @param spec - ECR ServiceAccount specification
-     * @returns Created ServiceAccount ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addAWSECRServiceAccount({
-     *   name: 'ecr-service-account',
-     *   roleArn: 'arn:aws:iam::ACCOUNT_ID:role/ECRAccessRole'
-     * });
-     * ```
-     *
-     * @since 2.7.0
-     */
     addAWSECRServiceAccount(spec) {
         return this.awsResources.addECRServiceAccount(spec);
     }
-    // Utility methods
-    /**
-     * Adds a Kubernetes manifest to the chart using CDK8S
-     *
-     * This method allows you to add any Kubernetes manifest (CRDs, custom resources, etc.)
-     * either as YAML strings or as objects. The manifest will be processed using CDK8S
-     * for better type safety and validation.
-     *
-     * @param yamlOrObject - Kubernetes manifest as YAML string or object
-     * @param id - Unique identifier for the manifest (required for multiple manifests)
-     *
-     * @example
-     * ```typescript
-     * // Using YAML string for CRD
-     * rutter.addManifest(`
-     * apiVersion: apiextensions.k8s.io/v1
-     * kind: CustomResourceDefinition
-     * metadata:
-     *   name: example.com
-     * spec:
-     *   group: example.com
-     *   versions: []
-     * `, 'my-crd');
-     *
-     * // Using object for any Kubernetes resource
-     * rutter.addManifest({
-     *   apiVersion: 'v1',
-     *   kind: 'ConfigMap',
-     *   metadata: { name: 'my-config' },
-     *   data: { key: 'value' }
-     * }, 'my-configmap');
-     * ```
-     *
-     * @since 3.0.0
-     * @note Consider using cdk8s-plus constructs for better type safety when available
-     */
     addManifest(yamlOrObject, id) {
         let manifestObject;
         if (typeof yamlOrObject === 'string') {
-            // Parse YAML string to object
             try {
                 manifestObject = YAML.parse(yamlOrObject);
             }
@@ -307,15 +61,12 @@ export class Rutter {
             }
         }
         else if (typeof yamlOrObject === 'object' && yamlOrObject !== null) {
-            // Use object directly
             manifestObject = yamlOrObject;
         }
         else {
             throw new Error('addManifest() requires either a YAML string or an object');
         }
-        // Validate basic Kubernetes manifest structure
         this.validateManifestStructure(manifestObject);
-        // Create CDK8S ApiObject from the manifest
         return new ApiObject(this.chart, id, {
             apiVersion: manifestObject['apiVersion'],
             kind: manifestObject['kind'],
@@ -323,54 +74,24 @@ export class Rutter {
             spec: manifestObject['spec'],
         });
     }
-    /**
-     * Adds a Kubernetes manifest wrapped in a Helm conditional
-     *
-     * This method creates a manifest that will only be rendered if the specified
-     * condition evaluates to true. The condition is checked against .Values in Helm.
-     *
-     * @param manifestObject - JavaScript object representing the Kubernetes manifest
-     * @param condition - Path to the condition value in .Values (e.g., 'createNamespace')
-     * @param id - Unique identifier for this manifest within the chart
-     * @returns The created ApiObject instance
-     * @throws {Error} If the manifest structure is incorrect or condition path is invalid
-     *
-     * @example
-     * ```typescript
-     * // Add a namespace that's only created if .Values.createNamespace is true
-     * rutter.addConditionalManifest(
-     *   {
-     *     apiVersion: 'v1',
-     *     kind: 'Namespace',
-     *     metadata: {
-     *       name: valuesRef('namespace'),
-     *       labels: {
-     *         environment: conditionalRef('environment', 'environment')
-     *       }
-     *     }
-     *   },
-     *   'createNamespace',
-     *   'namespace'
-     * );
-     * ```
-     *
-     * @since 2.7.4
-     */
     addConditionalManifest(manifestObject, condition, id) {
-        // Validate condition path
         if (!condition || typeof condition !== 'string') {
             throw new Error('Condition must be a non-empty string');
         }
-        // Validate basic Kubernetes manifest structure
         this.validateManifestStructure(manifestObject);
-        // Store the manifest as a conditional asset that will be processed during write
+        let helmCondition;
+        if (condition.startsWith('{{') && condition.endsWith('}}')) {
+            helmCondition = condition.slice(2, -2).trim();
+        }
+        else {
+            helmCondition = `.Values.${condition}`;
+        }
         const conditionalAsset = {
             id,
-            yaml: `{{- if .Values.${condition} }}\n${YAML.stringify(manifestObject)}{{- end }}`,
+            yaml: `{{- if ${helmCondition} }}\n${YAML.stringify(manifestObject)}{{- end }}`,
             target: 'templates',
         };
         this.assets.push(conditionalAsset);
-        // Create a placeholder CDK8S ApiObject for consistency
         return new ApiObject(this.chart, id, {
             apiVersion: manifestObject['apiVersion'],
             kind: manifestObject['kind'],
@@ -384,12 +105,6 @@ export class Rutter {
             spec: manifestObject['spec'],
         });
     }
-    /**
-     * Validates the structure of a Kubernetes manifest object
-     * @param manifest - The manifest object to validate
-     * @private
-     * @since 3.0.0
-     */
     validateManifestStructure(manifest) {
         if (!manifest['apiVersion'] || typeof manifest['apiVersion'] !== 'string') {
             throw new Error('Kubernetes manifest must have a valid apiVersion');
@@ -406,7 +121,6 @@ export class Rutter {
         if (!metadata['name'] || typeof metadata['name'] !== 'string') {
             throw new Error('Kubernetes manifest metadata must have a valid name');
         }
-        // Additional validation for specific resource types
         const kind = manifest['kind'];
         if (kind === 'CustomResourceDefinition') {
             if (!manifest['spec'] || typeof manifest['spec'] !== 'object' || manifest['spec'] === null) {
@@ -421,59 +135,26 @@ export class Rutter {
             }
         }
     }
-    /**
-     * Gets chart metadata
-     * @returns Chart metadata
-     *
-     * @since 1.0.0
-     */
     getMeta() {
         return { ...this.meta };
     }
-    /**
-     * Gets default values
-     * @returns Default values object
-     *
-     * @since 1.0.0
-     */
     getDefaultValues() {
         return { ...this.defaultValues };
     }
-    /**
-     * Gets environment-specific values
-     * @returns Environment values object
-     *
-     * @since 1.0.0
-     */
     getEnvValues() {
         return { ...this.envValues };
     }
-    /**
-     * Gets all assets (CRDs, etc.)
-     * @returns Array of assets
-     *
-     * @since 1.0.0
-     */
     getAssets() {
         return [...this.assets];
     }
-    /**
-     * Converts the chart to SynthAsset array for HelmChartWriter
-     * @returns Array of synthesized assets
-     *
-     * @since 2.4.0
-     */
     toSynthArray() {
-        // Get ApiObject IDs before synthesis
         const apiObjectIds = [];
         for (const child of this.chart.node.children) {
             if (child instanceof ApiObject) {
                 apiObjectIds.push(child.node.id);
             }
         }
-        // Use cdk8s Testing.synth to obtain manifest objects
         const manifestObjs = Testing.synth(this.chart);
-        // Enforce common labels best-practice on all rendered objects
         const enriched = manifestObjs.map((obj) => {
             if (obj && typeof obj === 'object') {
                 const o = obj;
@@ -488,10 +169,8 @@ export class Rutter {
                     'app.kubernetes.io/managed-by': '{{ .Release.Service }}',
                     'app.kubernetes.io/part-of': helm.chartName,
                 };
-                // Apply defaults only if not already set
                 for (const [key, value] of Object.entries(defaults)) {
                     if (!(key in labels)) {
-                        // eslint-disable-next-line security/detect-object-injection -- Safe: controlled label assignment
                         labels[key] = value;
                     }
                 }
@@ -500,7 +179,6 @@ export class Rutter {
         });
         const synthAssets = [];
         if (this.props.singleManifestFile) {
-            // Combine all resources into single manifest
             const combinedYaml = enriched
                 .map((obj) => this.processHelmTemplates(YAML.stringify(obj).trim()))
                 .filter(Boolean)
@@ -509,47 +187,28 @@ export class Rutter {
             synthAssets.push({ id: manifestId, yaml: combinedYaml });
         }
         else {
-            // Create separate files for each resource (default behavior)
             enriched.forEach((obj, index) => {
                 const yaml = this.processHelmTemplates(YAML.stringify(obj).trim());
                 if (yaml) {
-                    // Use descriptive name from ApiObject ID if available, otherwise fallback to generic name
-                    // eslint-disable-next-line security/detect-object-injection
                     const apiObjectId = apiObjectIds[index];
                     const manifestId = apiObjectId || `manifest-${index + 1}`;
                     synthAssets.push({ id: manifestId, yaml });
                 }
             });
         }
-        // Add any additional assets (CRDs, etc.)
         this.assets.forEach((asset) => {
             synthAssets.push({ id: asset.id, yaml: asset.yaml });
         });
         return synthAssets;
     }
-    /**
-     * Process YAML content to remove quotes from Helm templates
-     * This fixes the issue where YAML.stringify adds quotes around Helm template expressions
-     * Removes quotes from all Helm template expressions
-     */
     processHelmTemplates(yaml) {
-        // Remove quotes from Helm template expressions
-        // Match patterns like "{{ .Values.replicas | int }}", "{{ .Release.Name }}", etc.
-        // Handle both key-value pairs and standalone values
         return yaml
             .replace(/": "\{\{([^}]+)\}\}"/g, ': {{ $1 }}')
             .replace(/: "\{\{([^}]+)\}\}"/g, ': {{ $1 }}')
             .replace(/"\{\{([^}]+)\}\}"/g, '{{ $1 }}')
             .replace(/": "\.nan"/g, ': .nan');
     }
-    /**
-     * Writes the Helm chart to the specified output directory
-     * @param outDir - Output directory path
-     *
-     * @since 1.0.0
-     */
     write(outDir) {
-        // Generate helpers template
         let helpersContent;
         if (this.props.helpersTpl) {
             if (typeof this.props.helpersTpl === 'string') {
@@ -567,7 +226,6 @@ ${helper.template}
             }
         }
         else {
-            // Auto-generate standard helpers
             helpersContent = generateHelpersTemplate(this.props.cloudProvider);
         }
         HelmChartWriter.write({
@@ -580,6 +238,4 @@ ${helper.template}
         });
     }
 }
-// Constants for labels
 Rutter.HELPER_NAME = 'chart.name';
-//# sourceMappingURL=rutter.js.map

package/dist/lib/security.d.ts

@@ -1,137 +1,18 @@
-/**
- * @fileoverview Security utilities for input validation and sanitization
- * Focused on CLI tool security concerns: path traversal, injection prevention
- * @since 2.2.0
- */
-/**
- * Security utilities for input validation and sanitization
- * Focused on CLI tool security concerns: path traversal, injection prevention
- *
- * @since 2.2.0
- */
 export declare class SecurityUtils {
-    /**
-     * Validates and sanitizes file paths to prevent path traversal attacks
-     * @param inputPath - The path to validate
-     * @param allowedBasePath - The base path that the input should be within
-     * @returns Sanitized path if valid
-     * @throws Error if path is invalid or contains traversal sequences
-     *
-     * @since 2.2.0
-     */
     static validatePath(inputPath: string, allowedBasePath: string): string;
-    /**
-     * Sanitizes log messages to prevent log injection attacks
-     * @param message - The message to sanitize
-     * @returns Sanitized message with control characters removed
-     *
-     * @since 2.2.0
-     */
     static sanitizeLogMessage(message: string): string;
-    /**
-     * Sanitizes environment names to prevent path traversal (CWE-22)
-     * @param env - Environment name to sanitize
-     * @returns Sanitized environment name
-     * @throws Error if environment name is invalid
-     *
-     * @since 2.2.0
-     */
     static sanitizeEnvironmentName(env: string): string;
-    /**
-     * Validates TypeScript file extensions for dynamic imports
-     * @param filePath - The file path to validate
-     * @returns True if the file has a valid TypeScript extension
-     *
-     * @since 2.2.0
-     */
     static isValidTypeScriptFile(filePath: string): boolean;
-    /**
-     * Validates if a path is safe for use in Helm templates
-     * Enhanced validation with better security checks and Helm best practices
-     * @param templatePath - The template path to validate
-     * @returns True if the path is valid for Helm templates
-     *
-     * @since 2.2.0
-     */
     static isValidHelmTemplatePath(templatePath: string): boolean;
-    /**
-     * Validates chart names according to Helm conventions
-     * @param chartName - Chart name to validate
-     * @returns True if chart name follows Helm naming rules
-     *
-     * @since 2.2.0
-     */
     static isValidChartName(chartName: string): boolean;
-    /**
-     * Validates subchart names according to Helm conventions
-     * @param subchartName - Subchart name to validate
-     * @returns True if subchart name is valid
-     *
-     * @since 2.2.0
-     */
     static isValidSubchartName(subchartName: string): boolean;
-    /**
-     * Sanitizes environment variable names and values for Kubernetes security
-     * Prevents injection attacks and ensures compliance with Kubernetes naming rules
-     * @param name - Environment variable name to sanitize
-     * @param value - Environment variable value to sanitize
-     * @returns Object with sanitized name and value
-     * @throws Error if name or value contains dangerous patterns
-     *
-     * @since 2.6.0
-     */
     static sanitizeEnvVar(name: string, value: string): {
         name: string;
         value: string;
     };
-    /**
-     * Validates container image tags for security best practices
-     * Prevents use of dangerous tags and ensures proper versioning
-     * @param tag - Image tag to validate
-     * @returns True if tag is valid and secure
-     * @throws Error if tag violates security policies
-     *
-     * @since 2.6.0
-     */
     static validateImageTag(tag: string): boolean;
-    /**
-     * Generates secure names for Kubernetes secrets
-     * Ensures names follow RFC 1123 and are safe for Kubernetes
-     * @param baseName - Base name for the secret
-     * @param suffix - Optional suffix to append
-     * @returns Secure secret name
-     * @throws Error if generated name is invalid
-     *
-     * @since 2.6.0
-     */
     static generateSecretName(baseName: string, suffix?: string): string;
-    /**
-     * Sanitizes the base name for secret generation using safe string methods
-     * @param baseName - Base name to sanitize
-     * @returns Sanitized base name
-     * @throws Error if no valid characters remain
-     *
-     * @since 2.6.0
-     */
     private static sanitizeBaseName;
-    /**
-     * Appends suffix to sanitized base name using safe string methods
-     * @param baseName - Sanitized base name
-     * @param suffix - Suffix to append
-     * @returns Base name with suffix
-     * @throws Error if suffix is invalid
-     *
-     * @since 2.6.0
-     */
     private static appendSuffix;
-    /**
-     * Truncates name if it exceeds length limits
-     * @param name - Name to potentially truncate
-     * @param suffix - Original suffix for preservation
-     * @returns Truncated name if needed
-     *
-     * @since 2.6.0
-     */
     private static truncateIfNeeded;
 }
-//# sourceMappingURL=security.d.ts.map