timonel 2.8.1 → 2.8.3

package/dist/lib/security.js

@@ -1,77 +1,36 @@
-/**
- * @fileoverview Security utilities for input validation and sanitization
- * Focused on CLI tool security concerns: path traversal, injection prevention
- * @since 2.2.0
- */
 import * as path from 'path';
-/**
- * Security utilities for input validation and sanitization
- * Focused on CLI tool security concerns: path traversal, injection prevention
- *
- * @since 2.2.0
- */
 export class SecurityUtils {
-    /**
-     * Validates and sanitizes file paths to prevent path traversal attacks
-     * @param inputPath - The path to validate
-     * @param allowedBasePath - The base path that the input should be within
-     * @returns Sanitized path if valid
-     * @throws Error if path is invalid or contains traversal sequences
-     *
-     * @since 2.2.0
-     */
     static validatePath(inputPath, allowedBasePath) {
         if (!inputPath || typeof inputPath !== 'string') {
             throw new Error('Invalid path: path must be a non-empty string');
         }
-        // Check for path traversal sequences
         if (inputPath.includes('../') ||
             inputPath.includes('..\\') ||
             inputPath.includes('%2e%2e%2f') ||
             inputPath.includes('%2e%2e%5c')) {
             throw new Error('Invalid path: path traversal sequences detected');
         }
-        // Resolve and normalize paths
         const resolvedInput = path.resolve(inputPath);
         const resolvedBase = path.resolve(allowedBasePath);
-        // Ensure the resolved path is within the allowed base path
         if (!resolvedInput.startsWith(resolvedBase + path.sep) && resolvedInput !== resolvedBase) {
             throw new Error(`Invalid path: path must be within ${resolvedBase}`);
         }
         return resolvedInput;
     }
-    /**
-     * Sanitizes log messages to prevent log injection attacks
-     * @param message - The message to sanitize
-     * @returns Sanitized message with control characters removed
-     *
-     * @since 2.2.0
-     */
     static sanitizeLogMessage(message) {
         if (typeof message !== 'string') {
             return String(message);
         }
-        // Remove control characters (ASCII 0-31 and 127) and normalize line endings
         return (message
-            // eslint-disable-next-line no-control-regex -- Intentionally removing control characters for security
-            .replace(/[\x00-\x1F\x7F]/g, '') // Remove control characters
-            .replace(/\r\n/g, ' ') // Replace CRLF with space
-            .replace(/[\r\n]/g, ' ') // Replace remaining CR/LF with space
+            .replace(/[\x00-\x1F\x7F]/g, '')
+            .replace(/\r\n/g, ' ')
+            .replace(/[\r\n]/g, ' ')
             .trim());
     }
-    /**
-     * Sanitizes environment names to prevent path traversal (CWE-22)
-     * @param env - Environment name to sanitize
-     * @returns Sanitized environment name
-     * @throws Error if environment name is invalid
-     *
-     * @since 2.2.0
-     */
     static sanitizeEnvironmentName(env) {
         if (!env || typeof env !== 'string') {
             throw new Error('Environment name must be a non-empty string');
         }
-        // Allow only alphanumeric, hyphens, and underscores
         const sanitized = env.replace(/[^a-zA-Z0-9-_]/g, '');
         if (sanitized !== env) {
             throw new Error(`Invalid environment name: ${this.sanitizeLogMessage(env)}`);
@@ -81,98 +40,49 @@ export class SecurityUtils {
         }
         return sanitized;
     }
-    /**
-     * Validates TypeScript file extensions for dynamic imports
-     * @param filePath - The file path to validate
-     * @returns True if the file has a valid TypeScript extension
-     *
-     * @since 2.2.0
-     */
     static isValidTypeScriptFile(filePath) {
         const allowedExtensions = ['.ts', '.tsx'];
         const ext = path.extname(filePath);
         return allowedExtensions.includes(ext);
     }
-    /**
-     * Validates if a path is safe for use in Helm templates
-     * Enhanced validation with better security checks and Helm best practices
-     * @param templatePath - The template path to validate
-     * @returns True if the path is valid for Helm templates
-     *
-     * @since 2.2.0
-     */
     static isValidHelmTemplatePath(templatePath) {
         if (!templatePath || typeof templatePath !== 'string') {
             return false;
         }
-        // Check length limits (reasonable for Helm paths)
         if (templatePath.length > 253) {
             return false;
         }
-        // Enhanced validation following Kubernetes naming conventions
-        // Check if starts and ends with alphanumeric
         if (!/^[a-zA-Z0-9]/.test(templatePath) || !/[a-zA-Z0-9]$/.test(templatePath)) {
             return false;
         }
-        // Check for valid characters only (safe regex)
         if (!/^[a-zA-Z0-9._-]+$/.test(templatePath)) {
             return false;
         }
-        // Additional security checks
-        // Prevent path traversal attempts
         if (templatePath.includes('..') || templatePath.includes('//')) {
             return false;
         }
-        // Prevent reserved words that could cause issues
         const reservedWords = ['nil', 'null', 'undefined', 'true', 'false'];
         const pathSegments = templatePath.split('.');
         for (const segment of pathSegments) {
             if (reservedWords.includes(segment.toLowerCase())) {
                 return false;
             }
-            // Each segment should not be empty
             if (segment.length === 0) {
                 return false;
             }
         }
         return true;
     }
-    /**
-     * Validates chart names according to Helm conventions
-     * @param chartName - Chart name to validate
-     * @returns True if chart name follows Helm naming rules
-     *
-     * @since 2.2.0
-     */
     static isValidChartName(chartName) {
         if (!chartName || typeof chartName !== 'string') {
             return false;
         }
-        // Helm chart name validation (RFC 1123 subdomain) - safe regex
-        // eslint-disable-next-line security/detect-unsafe-regex -- Simple character class regex is safe
-        const chartNameRegex = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;
+        const chartNameRegex = /^[a-z]([-a-z0-9]*[a-z0-9])?$/;
         return chartNameRegex.test(chartName) && chartName.length <= 63;
     }
-    /**
-     * Validates subchart names according to Helm conventions
-     * @param subchartName - Subchart name to validate
-     * @returns True if subchart name is valid
-     *
-     * @since 2.2.0
-     */
     static isValidSubchartName(subchartName) {
         return this.isValidChartName(subchartName);
     }
-    /**
-     * Sanitizes environment variable names and values for Kubernetes security
-     * Prevents injection attacks and ensures compliance with Kubernetes naming rules
-     * @param name - Environment variable name to sanitize
-     * @param value - Environment variable value to sanitize
-     * @returns Object with sanitized name and value
-     * @throws Error if name or value contains dangerous patterns
-     *
-     * @since 2.6.0
-     */
     static sanitizeEnvVar(name, value) {
         if (!name || typeof name !== 'string') {
             throw new Error('Environment variable name must be a non-empty string');
@@ -180,9 +90,7 @@ export class SecurityUtils {
         if (typeof value !== 'string') {
             throw new Error('Environment variable value must be a string');
         }
-        // Kubernetes env var name validation (RFC 1123 compatible)
         let sanitizedName = name.toUpperCase().replace(/[^A-Z0-9_]/g, '_');
-        // Ensure name starts with letter or underscore
         if (/^[0-9]/.test(sanitizedName)) {
             sanitizedName = `_${sanitizedName}`;
         }
@@ -190,7 +98,6 @@ export class SecurityUtils {
         if (!nameRegex.test(sanitizedName)) {
             throw new Error(`Invalid environment variable name: ${this.sanitizeLogMessage(name)}`);
         }
-        // Check for dangerous patterns in value using safer string methods
         const hasDangerousPattern = (val) => {
             if (val.includes('$(') && val.includes(')'))
                 return 'command substitution';
@@ -198,7 +105,6 @@ export class SecurityUtils {
                 return 'backtick execution';
             if (val.includes('${') && val.includes('}'))
                 return 'variable expansion';
-            // Check for control characters
             for (let i = 0; i < val.length; i++) {
                 const code = val.charCodeAt(i);
                 if ((code >= 0x00 && code <= 0x08) ||
@@ -215,7 +121,6 @@ export class SecurityUtils {
         if (dangerousPattern) {
             throw new Error(`Environment variable value contains dangerous pattern (${dangerousPattern}): ${this.sanitizeLogMessage(value)}`);
         }
-        // Limit value length to prevent DoS
         if (value.length > 32768) {
             throw new Error('Environment variable value exceeds maximum length (32KB)');
         }
@@ -224,58 +129,31 @@ export class SecurityUtils {
             value: value.trim(),
         };
     }
-    /**
-     * Validates container image tags for security best practices
-     * Prevents use of dangerous tags and ensures proper versioning
-     * @param tag - Image tag to validate
-     * @returns True if tag is valid and secure
-     * @throws Error if tag violates security policies
-     *
-     * @since 2.6.0
-     */
     static validateImageTag(tag) {
         if (!tag || typeof tag !== 'string') {
             throw new Error('Image tag must be a non-empty string');
         }
         const trimmedTag = tag.trim();
-        // Reject dangerous or non-specific tags
         const dangerousTags = ['latest', 'master', 'main', 'dev', 'development', 'test', 'staging'];
         if (dangerousTags.includes(trimmedTag.toLowerCase())) {
             throw new Error(`Insecure image tag detected: '${trimmedTag}'. Use specific version tags for security.`);
         }
-        // Validate tag format (Docker tag rules)
         const tagRegex = /^[a-zA-Z0-9._-]+$/;
         if (!tagRegex.test(trimmedTag)) {
             throw new Error(`Invalid image tag format: ${this.sanitizeLogMessage(trimmedTag)}`);
         }
-        // Check length limits
         if (trimmedTag.length > 128) {
             throw new Error('Image tag exceeds maximum length (128 characters)');
         }
-        // Prefer semantic versioning patterns
-        // eslint-disable-next-line security/detect-unsafe-regex -- Simple regex patterns are safe for validation
         const semverPattern = /^v?\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?$/;
         const hashPattern = /^[a-f0-9]{7,64}$/;
-        // eslint-disable-next-line security/detect-unsafe-regex -- Simple date pattern is safe for validation
         const datePattern = /^\d{4}-\d{2}-\d{2}(-[a-zA-Z0-9.-]+)?$/;
         if (!semverPattern.test(trimmedTag) &&
             !hashPattern.test(trimmedTag) &&
             !datePattern.test(trimmedTag)) {
-            // Warning for non-standard tags but don't fail
-            console.warn(`Warning: Image tag '${trimmedTag}' doesn't follow recommended patterns (semver, hash, or date)`);
         }
         return true;
     }
-    /**
-     * Generates secure names for Kubernetes secrets
-     * Ensures names follow RFC 1123 and are safe for Kubernetes
-     * @param baseName - Base name for the secret
-     * @param suffix - Optional suffix to append
-     * @returns Secure secret name
-     * @throws Error if generated name is invalid
-     *
-     * @since 2.6.0
-     */
     static generateSecretName(baseName, suffix) {
         if (!baseName || typeof baseName !== 'string') {
             throw new Error('Base name must be a non-empty string');
@@ -284,27 +162,16 @@ export class SecurityUtils {
         if (suffix) {
             sanitizedBase = this.appendSuffix(sanitizedBase, suffix);
         }
-        // Ensure name starts with letter (not number)
         if (/^[0-9]/.test(sanitizedBase)) {
             sanitizedBase = `s${sanitizedBase}`;
         }
         sanitizedBase = this.truncateIfNeeded(sanitizedBase, suffix);
-        // Final validation
         if (!this.isValidChartName(sanitizedBase)) {
             throw new Error(`Generated secret name is invalid: ${sanitizedBase}`);
         }
         return sanitizedBase;
     }
-    /**
-     * Sanitizes the base name for secret generation using safe string methods
-     * @param baseName - Base name to sanitize
-     * @returns Sanitized base name
-     * @throws Error if no valid characters remain
-     *
-     * @since 2.6.0
-     */
     static sanitizeBaseName(baseName) {
-        // Use character-by-character processing instead of regex
         let sanitized = '';
         for (const char of baseName.toLowerCase()) {
             if ((char >= 'a' && char <= 'z') || (char >= '0' && char <= '9') || char === '-') {
@@ -314,7 +181,6 @@ export class SecurityUtils {
                 sanitized += '-';
             }
         }
-        // Collapse multiple hyphens using split/filter/join
         const parts = sanitized.split('-').filter((part) => part.length > 0);
         sanitized = parts.join('-');
         if (!sanitized) {
@@ -322,20 +188,10 @@ export class SecurityUtils {
         }
         return sanitized;
     }
-    /**
-     * Appends suffix to sanitized base name using safe string methods
-     * @param baseName - Sanitized base name
-     * @param suffix - Suffix to append
-     * @returns Base name with suffix
-     * @throws Error if suffix is invalid
-     *
-     * @since 2.6.0
-     */
     static appendSuffix(baseName, suffix) {
         if (typeof suffix !== 'string') {
             throw new Error('Suffix must be a string');
         }
-        // Use character-by-character processing instead of regex
         let sanitizedSuffix = '';
         for (const char of suffix.toLowerCase()) {
             if ((char >= 'a' && char <= 'z') || (char >= '0' && char <= '9') || char === '-') {
@@ -345,7 +201,6 @@ export class SecurityUtils {
                 sanitizedSuffix += '-';
             }
         }
-        // Collapse multiple hyphens using split/filter/join
         const parts = sanitizedSuffix.split('-').filter((part) => part.length > 0);
         sanitizedSuffix = parts.join('-');
         if (sanitizedSuffix) {
@@ -353,22 +208,12 @@ export class SecurityUtils {
         }
         return baseName;
     }
-    /**
-     * Truncates name if it exceeds length limits
-     * @param name - Name to potentially truncate
-     * @param suffix - Original suffix for preservation
-     * @returns Truncated name if needed
-     *
-     * @since 2.6.0
-     */
     static truncateIfNeeded(name, suffix) {
         const maxLength = 63;
         if (name.length <= maxLength) {
             return name;
         }
-        // Truncate but preserve suffix if possible
         if (suffix) {
-            // Use safe character processing instead of regex
             let safeSuffix = '';
             for (const char of suffix.toLowerCase()) {
                 if ((char >= 'a' && char <= 'z') || (char >= '0' && char <= '9') || char === '-') {
@@ -387,4 +232,3 @@ export class SecurityUtils {
         return name.substring(0, maxLength);
     }
 }
-//# sourceMappingURL=security.js.map

package/dist/lib/umbrella.d.ts

@@ -1,27 +1,3 @@
-/**
- * @fileoverview Umbrella chart utilities for managing multiple subcharts as a single unit
- * @since 0.2.0
- */
 import type { UmbrellaRutter, UmbrellaRutterProps } from './umbrellaRutter.js';
-/**
- * Create an umbrella chart from multiple Rutter instances
- *
- * @param props - Umbrella chart configuration
- * @returns UmbrellaRutter instance for managing subcharts
- *
- * @example
- * ```typescript
- * const umbrella = createUmbrella({
- *   meta: { name: 'my-umbrella', version: '1.0.0' },
- *   subcharts: [
- *     { name: 'frontend', rutter: frontendChart },
- *     { name: 'backend', rutter: backendChart }
- *   ]
- * });
- * ```
- *
- * @since 0.2.0
- */
 export declare function createUmbrella(props: UmbrellaRutterProps): UmbrellaRutter;
 export type { UmbrellaRutterProps, SubchartSpec } from './umbrellaRutter.js';
-//# sourceMappingURL=umbrella.d.ts.map

package/dist/lib/umbrella.js

@@ -1,28 +1,4 @@
-/**
- * @fileoverview Umbrella chart utilities for managing multiple subcharts as a single unit
- * @since 0.2.0
- */
 import { UmbrellaRutter as UmbrellaRutterClass } from './umbrellaRutter.js';
-/**
- * Create an umbrella chart from multiple Rutter instances
- *
- * @param props - Umbrella chart configuration
- * @returns UmbrellaRutter instance for managing subcharts
- *
- * @example
- * ```typescript
- * const umbrella = createUmbrella({
- *   meta: { name: 'my-umbrella', version: '1.0.0' },
- *   subcharts: [
- *     { name: 'frontend', rutter: frontendChart },
- *     { name: 'backend', rutter: backendChart }
- *   ]
- * });
- * ```
- *
- * @since 0.2.0
- */
 export function createUmbrella(props) {
     return new UmbrellaRutterClass(props);
 }
-//# sourceMappingURL=umbrella.js.map

package/dist/lib/umbrellaRutter.d.ts

@@ -1,97 +1,26 @@
-/**
- * @fileoverview UmbrellaRutter class for managing Helm umbrella charts with multiple subcharts
- * @since 0.2.0
- */
 import type { HelmChartMeta } from './helmChartWriter.js';
 import type { Rutter } from './rutter.js';
-/**
- * Configuration for a subchart within an umbrella chart
- *
- * @since 0.2.0
- */
 export interface SubchartSpec {
-    /** Name of the subchart */
     name: string;
-    /** Rutter instance that generates the subchart */
     rutter: Rutter;
-    /** Version of the subchart (optional) */
     version?: string;
-    /** Helm condition for enabling/disabling the subchart */
     condition?: string;
-    /** Tags for grouping subcharts */
     tags?: string[];
-    /** Repository URL for the subchart */
     repository?: string;
 }
-/**
- * Configuration properties for UmbrellaRutter
- *
- * @since 0.2.0
- */
 export interface UmbrellaRutterProps {
-    /** Metadata for the umbrella chart */
     meta: HelmChartMeta;
-    /** Array of subchart specifications */
     subcharts: SubchartSpec[];
-    /** Default values for the umbrella chart */
     defaultValues?: Record<string, unknown>;
-    /** Environment-specific values */
     envValues?: Record<string, Record<string, unknown>>;
 }
-/**
- * UmbrellaRutter manages multiple Rutter instances as subcharts
- * to create Helm umbrella charts with dependencies.
- *
- * @example
- * ```typescript
- * const umbrella = new UmbrellaRutter({
- *   meta: { name: 'my-app', version: '1.0.0' },
- *   subcharts: [
- *     { name: 'frontend', rutter: frontendChart },
- *     { name: 'backend', rutter: backendChart }
- *   ]
- * });
- *
- * umbrella.write('./charts/my-app');
- * ```
- *
- * @since 0.2.0
- */
 export declare class UmbrellaRutter {
     private readonly props;
-    /**
-     * Creates a new UmbrellaRutter instance
-     *
-     * @param props - Configuration properties for the umbrella chart
-     * @throws {Error} If chart metadata is invalid
-     *
-     * @since 0.2.0
-     */
     constructor(props: UmbrellaRutterProps);
     private validateMetadata;
-    /**
-     * Write the umbrella chart with all subcharts to the output directory
-     *
-     * Creates the complete umbrella chart structure including:
-     * - Parent Chart.yaml with dependencies
-     * - Parent values.yaml with global and subchart values
-     * - Individual subchart directories under charts/
-     * - NOTES.txt template
-     *
-     * @param outDir - Output directory path for the umbrella chart
-     * @throws {Error} If output directory path is invalid
-     *
-     * @example
-     * ```typescript
-     * umbrella.write('./dist/my-umbrella-chart');
-     * ```
-     *
-     * @since 0.2.0
-     */
     write(outDir: string): void;
     private writeParentChart;
     private writeParentValues;
     private deepMerge;
     private generateNotesTemplate;
 }
-//# sourceMappingURL=umbrellaRutter.d.ts.map

package/dist/lib/umbrellaRutter.js

@@ -1,101 +1,35 @@
-/**
- * @fileoverview UmbrellaRutter class for managing Helm umbrella charts with multiple subcharts
- * @since 0.2.0
- */
 import { writeFileSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import YAML from 'yaml';
 import { SecurityUtils } from './security.js';
-/**
- * UmbrellaRutter manages multiple Rutter instances as subcharts
- * to create Helm umbrella charts with dependencies.
- *
- * @example
- * ```typescript
- * const umbrella = new UmbrellaRutter({
- *   meta: { name: 'my-app', version: '1.0.0' },
- *   subcharts: [
- *     { name: 'frontend', rutter: frontendChart },
- *     { name: 'backend', rutter: backendChart }
- *   ]
- * });
- *
- * umbrella.write('./charts/my-app');
- * ```
- *
- * @since 0.2.0
- */
 export class UmbrellaRutter {
-    /**
-     * Creates a new UmbrellaRutter instance
-     *
-     * @param props - Configuration properties for the umbrella chart
-     * @throws {Error} If chart metadata is invalid
-     *
-     * @since 0.2.0
-     */
     constructor(props) {
-        // Validate chart metadata
         this.validateMetadata(props.meta);
         this.props = props;
     }
     validateMetadata(meta) {
-        // Validate chart name follows Helm conventions
-        // eslint-disable-next-line security/detect-unsafe-regex -- Safe regex for chart name validation
         if (!/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(meta.name)) {
             throw new Error('Chart name must contain only lowercase letters, numbers, and dashes');
         }
-        // Validate semantic versioning
-        // eslint-disable-next-line security/detect-unsafe-regex -- Safe regex for semver validation
         if (!/^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/.test(meta.version)) {
             throw new Error('Chart version must follow semantic versioning (e.g., 1.0.0)');
         }
     }
-    /**
-     * Write the umbrella chart with all subcharts to the output directory
-     *
-     * Creates the complete umbrella chart structure including:
-     * - Parent Chart.yaml with dependencies
-     * - Parent values.yaml with global and subchart values
-     * - Individual subchart directories under charts/
-     * - NOTES.txt template
-     *
-     * @param outDir - Output directory path for the umbrella chart
-     * @throws {Error} If output directory path is invalid
-     *
-     * @example
-     * ```typescript
-     * umbrella.write('./dist/my-umbrella-chart');
-     * ```
-     *
-     * @since 0.2.0
-     */
     write(outDir) {
-        // Validate output directory path
         const validatedOutDir = SecurityUtils.validatePath(outDir, process.cwd());
-        // Create output directory structure
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
         mkdirSync(validatedOutDir, { recursive: true });
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
         mkdirSync(join(validatedOutDir, 'charts'), { recursive: true });
-        // Write each subchart to charts/ directory
         for (const subchart of this.props.subcharts) {
-            // Validate subchart name using centralized validation
             if (!SecurityUtils.isValidSubchartName(subchart.name)) {
                 throw new Error(`Invalid subchart name: ${SecurityUtils.sanitizeLogMessage(subchart.name)}`);
             }
-            const sanitizedName = subchart.name; // Already validated by SecurityUtils
+            const sanitizedName = subchart.name;
             const subchartDir = join(validatedOutDir, 'charts', sanitizedName);
             subchart.rutter.write(subchartDir);
         }
-        // Generate parent Chart.yaml with dependencies
         this.writeParentChart(validatedOutDir);
-        // Generate parent values.yaml
         this.writeParentValues(validatedOutDir);
-        // Generate empty templates directory (umbrella charts typically don't have templates)
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
         mkdirSync(join(validatedOutDir, 'templates'), { recursive: true });
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
         writeFileSync(join(validatedOutDir, 'templates', 'NOTES.txt'), this.generateNotesTemplate());
     }
     writeParentChart(outDir) {
@@ -111,7 +45,6 @@ export class UmbrellaRutter {
             sources: this.props.meta.sources,
             maintainers: this.props.meta.maintainers,
             dependencies: this.props.subcharts.map((subchart) => {
-                // Subchart name already validated in write() method
                 return {
                     name: subchart.name,
                     version: subchart.version || '0.1.0',
@@ -121,17 +54,13 @@ export class UmbrellaRutter {
                 };
             }),
         };
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
         writeFileSync(join(outDir, 'Chart.yaml'), YAML.stringify(chartYaml));
     }
     writeParentValues(outDir) {
         const values = {
-            // Global values that can be shared across subcharts
             global: {},
-            // Individual subchart values
             ...this.props.defaultValues,
         };
-        // Add subchart-specific value sections
         for (const subchart of this.props.subcharts) {
             if (!(subchart.name in values)) {
                 values[subchart.name] = {
@@ -139,15 +68,11 @@ export class UmbrellaRutter {
                 };
             }
         }
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
         writeFileSync(join(outDir, 'values.yaml'), YAML.stringify(values));
-        // Write environment-specific values files
         if (this.props.envValues) {
             for (const [env, envVals] of Object.entries(this.props.envValues)) {
-                // Use centralized environment name sanitization
                 const sanitizedEnv = SecurityUtils.sanitizeEnvironmentName(env);
                 const envValues = this.deepMerge(values, envVals);
-                // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
                 writeFileSync(join(outDir, `values-${sanitizedEnv}.yaml`), YAML.stringify(envValues));
             }
         }
@@ -156,13 +81,9 @@ export class UmbrellaRutter {
         const result = { ...target };
         for (const [key, value] of Object.entries(source)) {
             if (value && typeof value === 'object' && !Array.isArray(value)) {
-                // eslint-disable-next-line security/detect-object-injection -- Safe object property access in deep merge
-                result[key] = this.deepMerge(
-                // eslint-disable-next-line security/detect-object-injection -- Safe object property access in deep merge
-                result[key] || {}, value);
+                result[key] = this.deepMerge(result[key] || {}, value);
             }
             else {
-                // eslint-disable-next-line security/detect-object-injection -- Safe object property access in deep merge
                 result[key] = value;
             }
         }
@@ -184,4 +105,3 @@ ${this.props.subcharts.map((s) => `  - charts/${s.name}/README.md`).join('\n')}
 `;
     }
 }
-//# sourceMappingURL=umbrellaRutter.js.map