timonel 3.0.0-beta.1 → 3.0.0

package/CHANGELOG.md

@@ -1,3 +1,189 @@
+# [3.0.0](https://github.com/KenkoGeek/timonel/compare/v2.13.0...v3.0.0) (2025-12-07)
+
+- feat!: rename ChartFactory to Rutter (maritime pilot concept) ([b0a7a33](https://github.com/KenkoGeek/timonel/commit/b0a7a3361e761a5b20ff2c203d55bdfab35323af))
+
+### Bug Fixes
+
+- address all security vulnerabilities from code review ([bf3165b](https://github.com/KenkoGeek/timonel/commit/bf3165b2198ea7b67e653df9a1b47ed25b1129b1))
+- **aws:** update Karpenter API versions and add disruption/scheduling helpers ([#77](https://github.com/KenkoGeek/timonel/issues/77)) ([d03fb5f](https://github.com/KenkoGeek/timonel/commit/d03fb5f580810204905ad3ec95a0165f4e4339c1))
+- change imports to use 'timonel' package instead of relative paths ([ac77265](https://github.com/KenkoGeek/timonel/commit/ac772651a85ed4f45426e4f603091939560f669a))
+- **ci:** add comprehensive test suite with unit and integration tests ([#38](https://github.com/KenkoGeek/timonel/issues/38)) ([ad782c1](https://github.com/KenkoGeek/timonel/commit/ad782c1597469ffc98054a0b66f8091b6f2a1e0b))
+- **ci:** add mandatory CI status verification to beta release ([6b4083c](https://github.com/KenkoGeek/timonel/commit/6b4083c478c41415b5767cb311a7006f817f0bb7))
+- **ci:** and beside or ([401c06a](https://github.com/KenkoGeek/timonel/commit/401c06acf05d8fb60a34faf2991756d4b317b9e6))
+- **ci:** change CodeQL build-mode to 'none' for JavaScript/TypeScript ([e47c97a](https://github.com/KenkoGeek/timonel/commit/e47c97acf6670007c5dbdbc90a197aa438095694))
+- **ci:** clean up workflows and fix CodeQL configuration ([1dd7b62](https://github.com/KenkoGeek/timonel/commit/1dd7b6242e9ea5d3d98443965704d84bfca18a4a))
+- **ci:** configure GitHub App token for semantic-release bypass - Use RELEASE_TOKEN from npm-prd environment for checkout and semantic-release ([ab4eea3](https://github.com/KenkoGeek/timonel/commit/ab4eea394d98227ed330091f0a3972eee903de9a))
+- **ci:** correct CodeQL workflow configuration ([c6f9b53](https://github.com/KenkoGeek/timonel/commit/c6f9b53eb641a47c2c8723405c54f7119f0d0be8))
+- **ci:** correct CodeQL workflow name in release.yaml ([09db750](https://github.com/KenkoGeek/timonel/commit/09db750692a26e9195f03ea459acbd1549a9087f))
+- **ci:** correct job dependencies and summary references ([27a5d97](https://github.com/KenkoGeek/timonel/commit/27a5d9748a3a7d4fbe2b120830fd94c16f957336))
+- **ci:** disable body-max-line-length for semantic-release compatibility - Set body-max-line-length to 0 (disabled) to allow long changelog entries - Fixes semantic-release commit validation failures - Maintains other commitlint rules for developer commits ([cf2e199](https://github.com/KenkoGeek/timonel/commit/cf2e19972b31f30a8d681d5f540b02b6c381e04b))
+- **ci:** disable footer line length limit for semantic-release commits ([143d512](https://github.com/KenkoGeek/timonel/commit/143d512a8a41881c3cf84868a72b478598678c53))
+- **ci:** disable footer-leading-blank for semantic-release compatibility - Set footer-leading-blank to 0 (disabled) to allow semantic-release footer format ([b14b45c](https://github.com/KenkoGeek/timonel/commit/b14b45c4435b9bfecb20fa4e270d36994a942241))
+- **ci:** ensure real release on main branch ([fb898e6](https://github.com/KenkoGeek/timonel/commit/fb898e667d499bdc52166d6beb82c566f3c39eb1))
+- **ci:** lint errors ([210d0e2](https://github.com/KenkoGeek/timonel/commit/210d0e242a80568cb3a2a99fe9544bbc466aedd8))
+- **ci:** Q gate not needed ([7d809e0](https://github.com/KenkoGeek/timonel/commit/7d809e0cbb12f9d90d889537f8c8e2dff67d8343))
+- **ci:** Q gate not needed ([a6e1faf](https://github.com/KenkoGeek/timonel/commit/a6e1fafbc4c9a82b8b119d91d72b50970b2cd852))
+- **ci:** remove explicit pnpm version from CodeQL workflow ([8e947ee](https://github.com/KenkoGeek/timonel/commit/8e947eefd39ab050c6830fa21eb26141bf6ba4dc))
+- **ci:** remove explicit pnpm version from workflows ([22ff6d7](https://github.com/KenkoGeek/timonel/commit/22ff6d7f031f4d82449430d038c0b03cf0c1d670))
+- **ci:** remove npm-prd environment from beta release ([4cc4e77](https://github.com/KenkoGeek/timonel/commit/4cc4e77c066b1a39b0f6aa23d4b113cbeee0459e))
+- **ci:** remove pnpm cache from setup-node to prevent executable error ([349a87b](https://github.com/KenkoGeek/timonel/commit/349a87b2407374b6fa1da6a36df393465a6a4fc3))
+- **ci:** remove redundant publish workflow and configure release token ([4ac7597](https://github.com/KenkoGeek/timonel/commit/4ac75970bea9ca503af9d940b06f7ecb4ceb0bea))
+- **ci:** reorder pnpm setup before Node.js in CodeQL workflow ([6b806c8](https://github.com/KenkoGeek/timonel/commit/6b806c85f68aefd4531a5a20093a7f277da06fde))
+- **ci:** replace CodeQL with security check in release validation ([#15](https://github.com/KenkoGeek/timonel/issues/15)) ([6a3df07](https://github.com/KenkoGeek/timonel/commit/6a3df076d07bbf548a6acb86eea97a6e83441af8))
+- **ci:** resolve pnpm version conflict in workflows ([4d041ed](https://github.com/KenkoGeek/timonel/commit/4d041ede0716975efc65ce18b1656e4358ca8441))
+- **ci:** resolve release workflow issues ([#16](https://github.com/KenkoGeek/timonel/issues/16)) ([46a9581](https://github.com/KenkoGeek/timonel/commit/46a9581bc84c70bbb8b39cd4fbc0e3a15f4bfc13))
+- **ci:** restore release.yml workflow from v2.7.3 ([7d14a52](https://github.com/KenkoGeek/timonel/commit/7d14a522a913532a8bc214c1bc1b67596b2811d9))
+- **ci:** restore working release workflow from v2.7.3 ([e3540ac](https://github.com/KenkoGeek/timonel/commit/e3540acd65a84f1a06f8ded068c7431d39b35e51))
+- **ci:** simple but effective release ([20b439d](https://github.com/KenkoGeek/timonel/commit/20b439dd5d21e4fc43de662bb3f6ea21248b7498))
+- **ci:** simple but effective release, security.md updated ([45a0085](https://github.com/KenkoGeek/timonel/commit/45a00850f0653bcc41cca8b75050b5011551f7e4))
+- **ci:** specify explicit semantic-release config file ([8b7e5dc](https://github.com/KenkoGeek/timonel/commit/8b7e5dca2a357dcd55e206a512ef9b0428d928ad))
+- **ci:** use exact pnpm version 10.15.0 in workflows ([a91d38d](https://github.com/KenkoGeek/timonel/commit/a91d38d0690fb9e01235f5d44b6147ce0da4b286))
+- **ci:** use working semantic-release config from v2.7.3 ([bc23629](https://github.com/KenkoGeek/timonel/commit/bc23629a2fb0c9f174cded6964beeb2b309db359))
+- **cli:** consolidate path validation and improve error handling ([a46a5eb](https://github.com/KenkoGeek/timonel/commit/a46a5ebd6f27a23ac2d71b5d98dd371adfbec070))
+- **cli:** enable TypeScript execution with enhanced security and strict mode validation ([8dd9e4c](https://github.com/KenkoGeek/timonel/commit/8dd9e4c8c2f555707aea2fc53c9e5161b82c0b4b))
+- **cli:** handle flags after positional arguments ([#142](https://github.com/KenkoGeek/timonel/issues/142)) ([bea408f](https://github.com/KenkoGeek/timonel/commit/bea408fe88011185541acf9b102910321ff79642))
+- **cli:** harden flag handling and path validation ([#130](https://github.com/KenkoGeek/timonel/issues/130)) ([569f445](https://github.com/KenkoGeek/timonel/commit/569f445735626db50d68c4be88c2e805d390286f))
+- **cli:** improve version display and fallback handling ([#117](https://github.com/KenkoGeek/timonel/issues/117)) ([5d34db0](https://github.com/KenkoGeek/timonel/commit/5d34db0bfe092b640635e7edb0866359f6e8eb93))
+- **cli:** new feature for cli ([14f3a4a](https://github.com/KenkoGeek/timonel/commit/14f3a4afc3454bf27427c36a423ee234940e25e3))
+- **cli:** resolve ES modules \_\_dirname and scaffold import paths ([#80](https://github.com/KenkoGeek/timonel/issues/80)) ([8f1157f](https://github.com/KenkoGeek/timonel/commit/8f1157fa34d4b95c628961fc779661f747410859))
+- **cli:** resolve incorrect syntax in conditional Helm templates, ensuring namespace and ingress conditions work correctly ([86a9215](https://github.com/KenkoGeek/timonel/commit/86a9215dc782c01731ce7bdfd9c010b0c9f96523))
+- **cli:** resolve timonel module not found error in umbrella.ts ([c5e66fc](https://github.com/KenkoGeek/timonel/commit/c5e66fc815f8754f6592dc0bc407ce8515072f3d))
+- **core:** addIngress already normalized with NGINX best practices ([1107e44](https://github.com/KenkoGeek/timonel/commit/1107e441ad9e4b04007f494891840ef94acafc28))
+- **core:** correct StorageClass API structure for Kubernetes 1.32+ compatibility ([48ba6ca](https://github.com/KenkoGeek/timonel/commit/48ba6ca17ea104b894efc904786a41510fc6482e)), closes [#58](https://github.com/KenkoGeek/timonel/issues/58) [#58](https://github.com/KenkoGeek/timonel/issues/58)
+- **core:** correct TypeScript errors and improve version handling ([9ade121](https://github.com/KenkoGeek/timonel/commit/9ade121516c1c04e7b0d939e46b82cd76366fea4))
+- **core:** ensure Timonel header appears in all YAML files ([7d93d4e](https://github.com/KenkoGeek/timonel/commit/7d93d4ec9fbba703af9436c0b2e23acc3ef540ad))
+- **core:** implement CLI-focused security validations and centralized input sanitization ([0568d38](https://github.com/KenkoGeek/timonel/commit/0568d38eac2ba69b5cdccdc5f735e635a092f8e9))
+- **core:** resolve critical issues [#52](https://github.com/KenkoGeek/timonel/issues/52)-[#56](https://github.com/KenkoGeek/timonel/issues/56) and security vulnerabilities ([9c86e55](https://github.com/KenkoGeek/timonel/commit/9c86e5512716b686afa04e7b033652633cc340f7))
+- **core:** resolve issue [#114](https://github.com/KenkoGeek/timonel/issues/114) - invalid Helm template generation ([b958d45](https://github.com/KenkoGeek/timonel/commit/b958d454b49e8ab61be0f9bcddcb96a831c5298d))
+- **core:** resolve splitDocs removing Timonel headers from YAML ([7335025](https://github.com/KenkoGeek/timonel/commit/73350253d73f4adaa616b5290e35573b29702bf4))
+- **core:** TypeScript interfaces for GCP Artifact Registry and Karpenter helpers ([#72](https://github.com/KenkoGeek/timonel/issues/72)) ([914e6fa](https://github.com/KenkoGeek/timonel/commit/914e6fa04d286533255a9987802c60deae3e878c))
+- correct Helm template expression formatting for include and inline conditionals ([927d6a3](https://github.com/KenkoGeek/timonel/commit/927d6a353bd8b5fb8b2afa8cb6738a55fa36b3e9))
+- **deps:** merge conflict solved [skip ci] ([8931abd](https://github.com/KenkoGeek/timonel/commit/8931abd5c800fe85fa7cda0a06d2ea183f54e185))
+- **deps:** merge conflicts ([a0dd0bd](https://github.com/KenkoGeek/timonel/commit/a0dd0bdecf603fd43335721fc2e201f81bede2d1))
+- **deps:** merge conflicts ([0f2d49f](https://github.com/KenkoGeek/timonel/commit/0f2d49ff6316f9e76c4eb18f39ae78599b19475b))
+- **deps:** upgrade timonel version [skip ci] ([20cae6f](https://github.com/KenkoGeek/timonel/commit/20cae6fa57a61bc44a18d9c7af8e7ad8970d7af9))
+- **docs:** apply prettier formatting to README.md ([bc9c00b](https://github.com/KenkoGeek/timonel/commit/bc9c00be41167296ef5852e26547975aea7c9cc7))
+- **docs:** use published npm package imports in example instead of local src ([80e19f4](https://github.com/KenkoGeek/timonel/commit/80e19f40acf9d0073db15d6d576a9e0776dbdc62))
+- **docs:** valuesRef and lib imported example ([72bc785](https://github.com/KenkoGeek/timonel/commit/72bc7858b615cbf5652cca81b45d9d2d799d913c))
+- **examples:** update timonel dependency to ^1.0.0 ([b9e8e19](https://github.com/KenkoGeek/timonel/commit/b9e8e19bf7cf942c675b9116efa6de5b8c7ba36c))
+- exclude examples from main lint script ([5ba6ea8](https://github.com/KenkoGeek/timonel/commit/5ba6ea8670459c53fd053e8938430ec8f180188b))
+- exclude examples from security linting ([5761d41](https://github.com/KenkoGeek/timonel/commit/5761d410471137b1655d624162a9921818ce2597))
+- format CHANGELOG.md with prettier ([b382ea0](https://github.com/KenkoGeek/timonel/commit/b382ea0d4dfacf1c3ffcd05648c762a9d4202938))
+- **helm:** implement Helm-aware YAML serializer ([#112](https://github.com/KenkoGeek/timonel/issues/112)) ([fdf7cd9](https://github.com/KenkoGeek/timonel/commit/fdf7cd90c86dbeff2136e618b20a9f86e0f8b51d))
+- **helm:** remove automatic numbering from template files ([#20](https://github.com/KenkoGeek/timonel/issues/20)) ([e21b1cf](https://github.com/KenkoGeek/timonel/commit/e21b1cf2bc62a73b3f2ab84514b6fa415452a725))
+- **helm:** remove debug logs from helmChartWriter ([63870a7](https://github.com/KenkoGeek/timonel/commit/63870a715db0c05e03a9b496b619284a3e34c848))
+- **helm:** trying to make it work ([3ce69d5](https://github.com/KenkoGeek/timonel/commit/3ce69d56969468260f159870abc5b3f089bad9ab))
+- ignore node_modules MDs ([fda76c4](https://github.com/KenkoGeek/timonel/commit/fda76c497ad7197195287aa5b47e8ee000bcc03e))
+- ignore node_modules MDs ([8804860](https://github.com/KenkoGeek/timonel/commit/88048609d155883b4c473ddc85ab276d368cf0a8))
+- **network:** Ingress API with TLS validation and security defaults ([#88](https://github.com/KenkoGeek/timonel/issues/88)) ([348ee2d](https://github.com/KenkoGeek/timonel/commit/348ee2dcf27d8b44064245f89279d0cfe9aa4973))
+- **release:** align required checks with ruleset configuration ([d912f3c](https://github.com/KenkoGeek/timonel/commit/d912f3c0229eb78f0fc927421007b8eb5347b8b9))
+- **release:** update required checks in release workflow ([ba2712e](https://github.com/KenkoGeek/timonel/commit/ba2712e2cc95cb55588fcf583a84da365acd84a7))
+- resolve ESLint sonarjs plugin compatibility for CI ([48c16e6](https://github.com/KenkoGeek/timonel/commit/48c16e641bbd0984df00268360a873e7bd5d58c9))
+- resolve Helm chart YAML generation issues ([5e8c779](https://github.com/KenkoGeek/timonel/commit/5e8c7794fcbfb3bddef1f2136ba78103b28ab62b))
+- resolve issue [#114](https://github.com/KenkoGeek/timonel/issues/114) - Helm template generation bug and enhance documentation ([#116](https://github.com/KenkoGeek/timonel/issues/116)) ([65d4f26](https://github.com/KenkoGeek/timonel/commit/65d4f26c1449135704e59eb8acf71268f4f660d0))
+- resolve markdown linting issues ([8a817ef](https://github.com/KenkoGeek/timonel/commit/8a817ef2836fb8289f612ad171e4aaf010904f53))
+- resolve prettier formatting issues and enhance CI checks ([648b35c](https://github.com/KenkoGeek/timonel/commit/648b35cbe55889b855bb56c652b6a4b8c3021bf1))
+- resolve remaining eslint errors ([64f60e5](https://github.com/KenkoGeek/timonel/commit/64f60e5967676f2b651967e9c53b6c083a18d69b))
+- resolve TypeScript module resolution error in CLI validation ([41ad96e](https://github.com/KenkoGeek/timonel/commit/41ad96e2e7dc2366f7fec189a0d9e551da3466ad))
+- resolve TypeScript strict optional types errors ([2906889](https://github.com/KenkoGeek/timonel/commit/2906889e352d94eae8070a5f99734ca1f5d35767))
+- resolve umbrella chart validation issues ([48206b6](https://github.com/KenkoGeek/timonel/commit/48206b660eb2998bb31f326e420ba2f4d3ceb89b))
+- **umbrella:** remove unused \_subchartInstance variables ([ee07f96](https://github.com/KenkoGeek/timonel/commit/ee07f96c49a032289654f57a407e9bfba7ebc171))
+- update examples versions and resolve security vulnerability ([68fad19](https://github.com/KenkoGeek/timonel/commit/68fad195baaac65085ca8634d1d7f62d8c1c1361))
+- update pnpm-lock.yaml after removing cdk8s-plus-28 ([ff1b929](https://github.com/KenkoGeek/timonel/commit/ff1b9298e068df7e0fc715f21dc7d4150eccc2c3))
+- update WordPress example imports to use timonel package ([19a36a6](https://github.com/KenkoGeek/timonel/commit/19a36a6e010abe2276268dbe64b27bb6144ae16e))
+
+### Features
+
+- add --set flag for dynamic value overrides ([36ae842](https://github.com/KenkoGeek/timonel/commit/36ae8422b4db34a2ded90eeede04d39a0ffe7b98))
+- add AWS ALB Ingress helper ([f9c7009](https://github.com/KenkoGeek/timonel/commit/f9c70095796db9147d8bc9a6bf513ebe4ae7eb46))
+- add AWS EBS CSI storage helpers ([dae2258](https://github.com/KenkoGeek/timonel/commit/dae2258b4beb1735430112f7f16b5ac7d0f17a83))
+- add AWS EFS CSI storage helpers ([343e5f8](https://github.com/KenkoGeek/timonel/commit/343e5f831855bc40a081d982eebc3b051d27ac99))
+- add AWS Secrets Manager and Parameter Store support ([c17cfe1](https://github.com/KenkoGeek/timonel/commit/c17cfe1f6b3d90619148f64e1db612946e305a32))
+- add CHANGELOG and GitHub templates following npm best practices ([51448cc](https://github.com/KenkoGeek/timonel/commit/51448cc00c47eaa1f5a6f9627c88249f734d3377))
+- add comprehensive AWS 2048 game example ([2f9ac11](https://github.com/KenkoGeek/timonel/commit/2f9ac1115fd7980ba581fc9b1ca0adbedab11aa4))
+- add comprehensive IRSA ServiceAccount support ([eec3337](https://github.com/KenkoGeek/timonel/commit/eec333735fae2431aab9307f012ede01604462b2))
+- add custom manifest naming support ([4d70c8e](https://github.com/KenkoGeek/timonel/commit/4d70c8e70a6bb6d4b0b61bc15bfd3b15a7e8a30b))
+- add custom manifest naming support ([a631e06](https://github.com/KenkoGeek/timonel/commit/a631e065165c35f68e2ed39d97550fc9c52e5f38))
+- add custom manifest naming to all examples ([f3d1880](https://github.com/KenkoGeek/timonel/commit/f3d188096b74242c10317592fc09ba463ff43631))
+- add HorizontalPodAutoscaler support ([7b43d1b](https://github.com/KenkoGeek/timonel/commit/7b43d1b96f8b4dd50d64f4f3830de7c9b6f7c638))
+- add manual release workflow with GitHub Actions ([e45aaad](https://github.com/KenkoGeek/timonel/commit/e45aaad56d965a1337cede8fbda30d3a442f56be))
+- add NetworkPolicy helpers for Zero Trust network security ([#13](https://github.com/KenkoGeek/timonel/issues/13)) ([f80f23e](https://github.com/KenkoGeek/timonel/commit/f80f23e940f282715e2e0ef90f0a8224ddad0ea6))
+- add PodDisruptionBudget support ([2b8b14c](https://github.com/KenkoGeek/timonel/commit/2b8b14c697ec7d45763b0b0cda3adbcea6c462a6))
+- add umbrella charts support ([c37a366](https://github.com/KenkoGeek/timonel/commit/c37a3664e2ce5242ff4749ed72e7b0f0555a7f91))
+- add version command to CLI ([4d11f20](https://github.com/KenkoGeek/timonel/commit/4d11f20b0a3f1e560f862f3afa8d5a66321db4b0))
+- add VerticalPodAutoscaler support ([5f11343](https://github.com/KenkoGeek/timonel/commit/5f11343580e6ee3712098bfed7a71e3b4a3e7380))
+- add WordPress with MySQL example chart ([4971b61](https://github.com/KenkoGeek/timonel/commit/4971b61e7821e7ecc4a8ab1a529326198243400c))
+- **ci:** add automatic beta release workflow for main branch ([89fa5d2](https://github.com/KenkoGeek/timonel/commit/89fa5d2e5da4ef2d44a874371d485d25bdc4ba69))
+- **ci:** add automatic CHANGELOG.md formatting to semantic-release ([babe71f](https://github.com/KenkoGeek/timonel/commit/babe71f93e8e0344ea0239082fa4a327246c7b48))
+- **ci:** add beta releases on main with quality gates [skip ci] ([8b6b7da](https://github.com/KenkoGeek/timonel/commit/8b6b7da31901b954aa8eba1cd027c98a9a505109))
+- **ci:** add required status checks validation to release workflow ([#14](https://github.com/KenkoGeek/timonel/issues/14)) ([5f4e89d](https://github.com/KenkoGeek/timonel/commit/5f4e89df8c72f8d487cd95ce12789510cba29ce6))
+- **ci:** configure dual release strategy ([b114395](https://github.com/KenkoGeek/timonel/commit/b114395b820bfea5c1354e4b1229337db878af29))
+- **ci:** implement automated semantic release with conventional commits ([81dc9d4](https://github.com/KenkoGeek/timonel/commit/81dc9d4d266d90a5e70cabb67eabfd42a5069e69))
+- **ci:** implement automated semantic release with conventional commits ([3fb9abd](https://github.com/KenkoGeek/timonel/commit/3fb9abdd7fac413882737577a59eb5c5b13cddbf))
+- **ci:** optimize GitHub workflows with enhanced performance and reliability ([7e1b409](https://github.com/KenkoGeek/timonel/commit/7e1b409776f3e63ac79493630e70eb04fb5f416d))
+- **ci:** simplify to beta releases only ([e5aed20](https://github.com/KenkoGeek/timonel/commit/e5aed206d5247c7d11cba15c13d49904ef31c22e))
+- **cli:** add Helm helpers (helmIf, helmWith) to templates and new release ([#201](https://github.com/KenkoGeek/timonel/issues/201)) ([b5ecb0f](https://github.com/KenkoGeek/timonel/commit/b5ecb0f29b207f7ff225b971c6e698bbc2d26073))
+- **cli:** add Helm helpers (helmIf, helmWith) to templates and new release ([#201](https://github.com/KenkoGeek/timonel/issues/201)) ([e3f1cf8](https://github.com/KenkoGeek/timonel/commit/e3f1cf885d8f8fa4263013179144d51ac99afa0f))
+- **core:** add Azure Application Gateway Ingress Controller (AGIC) support ([#19](https://github.com/KenkoGeek/timonel/issues/19)) ([2d3cbdd](https://github.com/KenkoGeek/timonel/commit/2d3cbddda3b4206f5d465632d45ecd1dd9cf60ae))
+- **core:** add Azure Disk StorageClass helper for AKS ([#18](https://github.com/KenkoGeek/timonel/issues/18)) ([f88dac1](https://github.com/KenkoGeek/timonel/commit/f88dac1a79369227d85a0a7e90e2718192e4f9b4))
+- **core:** add comprehensive Azure helpers for AKS integration with enhanced security ([eb460b4](https://github.com/KenkoGeek/timonel/commit/eb460b483597ab9c72fc98df00df2cee54a125ed))
+- **core:** add GKE Workload Identity ServiceAccount, AWS ECR ServiceAccount helpers. implement modular architecture. add Role resource support for RBAC. with resource providers. add DaemonSet resource support. add StatefulSet resource support. add ClusterRole resource support for cluster-wide RBAC. add RoleBinding resource support for RBAC ([#33](https://github.com/KenkoGeek/timonel/issues/33)) ([6c6204e](https://github.com/KenkoGeek/timonel/commit/6c6204e1664912125a1cd22dc931cb4189ec066e))
+- **core:** add Job and CronJob helpers for batch workloads ([#21](https://github.com/KenkoGeek/timonel/issues/21)) ([b14d886](https://github.com/KenkoGeek/timonel/commit/b14d88654ef114fc0010487ded11953ca186dcd7))
+- **core:** add Karpenter integration with 5 methods, fix performance issues, and update security docs ([#31](https://github.com/KenkoGeek/timonel/issues/31)) ([9660467](https://github.com/KenkoGeek/timonel/commit/9660467512540e35cbeb55b0a212fd6ae0ac5c6b))
+- **core:** add NetworkPolicy helpers for Zero Trust network security ([df3b344](https://github.com/KenkoGeek/timonel/commit/df3b344172f9b60402bc8172e343023194ed6b57))
+- **core:** Add NetworkPolicy, ServiceAccount, CronJob, HPA, VPA, Ingress, and Karpenter resources ([8804102](https://github.com/KenkoGeek/timonel/commit/8804102d20ce430457db3674f11b41464a6ba360))
+- **core:** add reusable pod template helpers with security profiles, workload optimization, sidecar patterns, and health checks ([9c7acfc](https://github.com/KenkoGeek/timonel/commit/9c7acfcc370da34457d6f6f1bb15ba15883bc8bd))
+- **core:** add security helpers - sanitizeEnvVar, validateImageTag, generateSecretName ([#43](https://github.com/KenkoGeek/timonel/issues/43)) ([247bb57](https://github.com/KenkoGeek/timonel/commit/247bb57ea775014c2a3debef89ebda1551412d13))
+- **core:** add Whatever tomorrow brings Ill be there ([51cb023](https://github.com/KenkoGeek/timonel/commit/51cb023d8dcded034a3b25774d7010f00bb94733))
+- **core:** Add with open arms and open eyes, yeah ([a6e6a68](https://github.com/KenkoGeek/timonel/commit/a6e6a681d7ca66069312089276f3cf1d917ee9f2))
+- **core:** enhance ChartProps for better flexibility ([49919c2](https://github.com/KenkoGeek/timonel/commit/49919c2cb6bd1361243e6eb5735dbf89972338b5))
+- **core:** exporting createHelmExpression() from helmYamlSerializer ([#196](https://github.com/KenkoGeek/timonel/issues/196)) ([d99b5b6](https://github.com/KenkoGeek/timonel/commit/d99b5b6276cf074bb400d8ef3209e337264a74b1))
+- **core:** refactor addConditionalManifest to manage helm templates ([cd38ca1](https://github.com/KenkoGeek/timonel/commit/cd38ca144fdfabc7e41220eea9783a5a189046da))
+- **core:** restore v2.3.0 functionality with modern architecture ([4dfa2c9](https://github.com/KenkoGeek/timonel/commit/4dfa2c928f90fa3fc3d927484c6e6baabe106f3f)), closes [#34](https://github.com/KenkoGeek/timonel/issues/34) [#35](https://github.com/KenkoGeek/timonel/issues/35) [#36](https://github.com/KenkoGeek/timonel/issues/36)
+- **docs:** update references and CLI [skip ci] ([7d236c8](https://github.com/KenkoGeek/timonel/commit/7d236c8aa142aa98b60fa9275deb3017fb5dda3e))
+- **docs:** update references and CLI [skip ci] ([75238c6](https://github.com/KenkoGeek/timonel/commit/75238c6ecd15e3c900d255338efb12fc1205f845))
+- enhance AWS 2048 example with production-ready AWS features ([5a6c3ea](https://github.com/KenkoGeek/timonel/commit/5a6c3eabc9df7ae9554e742c5e3855540a6fcd0e))
+- enhance CLI with CI/CD support commands and flags ([ddb2cc7](https://github.com/KenkoGeek/timonel/commit/ddb2cc75bbd8e7fb2db1f9d6e09ce77b48db5f75))
+- enhance validate command with helm lint and installation detection ([62d56a9](https://github.com/KenkoGeek/timonel/commit/62d56a9c2b86d94fbe9c01b2a4a399b72b9c4b84))
+- **helm:** add comprehensive helm helpers with Helm template validation ([#123](https://github.com/KenkoGeek/timonel/issues/123)) ([29c4934](https://github.com/KenkoGeek/timonel/commit/29c4934e79a50b3b2f86d38eb15a5e613502ef3c))
+- **helm:** adding new and typesafe helpers ([7b1e951](https://github.com/KenkoGeek/timonel/commit/7b1e951df5c0550889e56f0f2e18fb6bfb97ed79))
+- **network:** enhance NGINX Ingress support with cert-manager integration and security enhanced ([#91](https://github.com/KenkoGeek/timonel/issues/91)) ([feec4d1](https://github.com/KenkoGeek/timonel/commit/feec4d1cea93f261b7e302aafbb2a700d6885812))
+- rename example to examples and document in README ([490fbe8](https://github.com/KenkoGeek/timonel/commit/490fbe89d33e56612804b66399be6191cdfb038b))
+- update examples package.json for v0.3.0 ([bcd4a2e](https://github.com/KenkoGeek/timonel/commit/bcd4a2e6ec85e29ca98f81597199353d3fcf8bc4))
+- update TypeScript to Node16 module resolution ([ab3e347](https://github.com/KenkoGeek/timonel/commit/ab3e347e66fb71c772a09346803c699785db29a4))
+
+### Performance Improvements
+
+- **ci:** homogenize CI/CD workflows and optimize release pipeline ([#17](https://github.com/KenkoGeek/timonel/issues/17)) ([787e85c](https://github.com/KenkoGeek/timonel/commit/787e85cd91ff78ed90394b98d99cc6c558365a42))
+
+### Reverts
+
+- **ci:** restore original release workflow ([4660b1e](https://github.com/KenkoGeek/timonel/commit/4660b1e5298ad86b9b37b1b814b07ea0f090cdb8))
+
+### BREAKING CHANGES
+
+- **helm:** Template files no longer have automatic numbering prefixes
+
+- refactor(helm): unify template naming strategy and add breaking change notice
+
+* Simplify file naming logic with unified approach
+* Use consistent naming strategy for single and multiple documents
+* Add breaking change warning in README for numbered filename dependencies
+* Improve code maintainability with cleaner implementation
+
+Addresses PR review feedback for better consistency and user awareness.
+
+- **ci:** ESLint configuration migrated to flat config format
+- **ci:** ESLint configuration migrated to flat config format
+- ChartFactory class renamed to Rutter
+
+* Rename ChartFactory class to Rutter across all files
+* Update examples to use new Rutter class
+* Update README and documentation
+* Rename ChartFactory.ts to Rutter.ts
+* All tests pass, linting and security checks pass
+* Bump version to 0.1.7
+
 # [3.0.0-beta.1](https://github.com/KenkoGeek/timonel/compare/v2.14.0-beta.1...v3.0.0-beta.1) (2025-12-01)
 
 - feat!: rename ChartFactory to Rutter (maritime pilot concept) ([b0a7a33](https://github.com/KenkoGeek/timonel/commit/b0a7a3361e761a5b20ff2c203d55bdfab35323af))

package/README.md

@@ -17,18 +17,102 @@ directory.
 
 ## ✨ Key Features
 
-- **🔒 Type-safe API** with strict TypeScript and cdk8s constructs.
-- **🎯 Type-Safe Helm Helpers** with 9 composable template helpers (`helmIf`, `helmRange`,
-  `helmWith`, `helmInclude`, etc.)
-- **🔧 Flexible resource creation** with built-in methods and `addManifest()` for custom resources.
-- **🌍 Multi-environment support** with automatic values files generation.
-- **☂️ Umbrella Charts** for managing multiple subcharts as a single unit.
-- **🛠️ Enhanced Helm Helpers** with environment, GitOps, observability, and validation helpers.
-- **☁️ Cloud integrations**:
-  - **AWS**: EBS/EFS StorageClass, ALB Ingress, IRSA ServiceAccount, ECR, and Karpenter.
-- **🛡️ Security-first approach** with NetworkPolicies and best practices.
-- **⚡ Minimal CLI** (`tl`) for scaffolding and chart generation.
-- **📦 Flexible subchart templates** supporting cdk8s and cdk8s-plus-33.
+### Core Capabilities
+
+- **🔒 Type-safe API** with strict TypeScript and cdk8s constructs
+- **🔧 Flexible resource creation** with built-in methods and `addManifest()` for custom resources
+- **🌍 Multi-environment support** with automatic values files generation
+- **☂️ Umbrella Charts** for managing multiple subcharts as a single unit
+- **⚡ Minimal CLI** (`tl`) for scaffolding, synthesis, validation, and deployment
+- **📦 Flexible subchart templates** supporting both cdk8s and cdk8s-plus-33
+
+### Type-Safe Helm Helpers (v3.0+)
+
+#### ValuesRef System (NEW in v3.0 - RECOMMENDED)
+
+Type-safe proxy-based values references with full IDE support:
+
+- Import: `import { valuesRef } from 'timonel'`
+- **Comparison operators**: `eq`, `ne`, `gt`, `ge`, `lt`, `le`
+- **Logical operators**: `not`, `and`, `or`
+- **String functions**: `quote`, `upper`, `lower`, `trim`, `replace`, `contains`
+- **Default values**: `default()`
+- **Type checking**: `kindIs`, `hasKey`
+- **YAML functions**: `toYaml`, `toJson`, `nindent`, `indent`
+- **Field-level conditionals**: `v.if()`, `v.ifElse()` - Complex conditional logic
+- **Range loops**: `v.range()` - Type-safe iteration
+- **Context switching**: `v.with()` - Scoped value access
+
+#### Composable Helpers
+
+Template definition and inclusion helpers:
+
+- `helmInclude`, `helmDefine`, `helmVar`, `helmBlock`, `helmComment`, `helmFragment`
+- `template`, `include`, `quote`, `indent`
+
+#### Value Reference Helpers
+
+Useful string-based utilities (no ValuesRef equivalent):
+
+- `requiredValuesRef` - Required value with validation
+- `numberRef`, `boolRef`, `floatRef` - Type-cast references (int, bool, float64)
+- `base64Ref` - Base64 encoding
+
+#### Legacy Helpers (NOT RECOMMENDED)
+
+**⚠️ Use ValuesRef system instead:**
+
+- `valuesRef(path)` → use `v.path` (ValuesRef system)
+- `stringRef()` → use `v.quote()` (ValuesRef system)
+- `defaultRef()` → use `v.default()` (ValuesRef system)
+- `jsonRef()` → use `v.toJson()` (ValuesRef system)
+- `conditionalRef()` → use `v.if()` (ValuesRef system)
+- `helmIf`, `helmIfSimple` → use `v.if()` (ValuesRef system)
+- `helmRange` → use `v.range()` (ValuesRef system)
+- `helmWith` → use `v.with()` (ValuesRef system)
+- `helmIfElseIf` → use `v.if()` with nested conditions
+
+### Enhanced Helm Helpers
+
+- **Environment Helpers**: `envRef`, `envDefault`, `envRequired`, `envFromSecret`, `envFromConfigMap`
+- **GitOps Helpers**: `gitBranch`, `gitCommit`, `gitTag`, `gitopsAnnotations`
+- **Observability Helpers**: `prometheusAnnotations`, `datadogAnnotations`, `tracingAnnotations`
+- **Validation Helpers**: `validateRequired`, `validatePattern`, `validateRange`, `validateEnum`
+- **Standard Helpers**: 40+ built-in Helm helpers (chart.name, chart.fullname, chart.labels, etc.)
+
+### Cloud Integrations
+
+- **AWS Resources**:
+  - EBS/EFS StorageClass with encryption and performance options
+  - ALB Ingress with SSL/TLS and health checks
+  - IRSA ServiceAccount for pod-level IAM roles
+  - ECR integration
+  - Karpenter NodePool, NodeClaim, and EC2NodeClass
+- **Karpenter Features**:
+  - Disruption budgets and consolidation policies
+  - Instance type selection and requirements
+  - Spot instance support
+  - Custom AMI and user data
+
+### Security & Validation
+
+- **🛡️ Security-first approach**:
+  - Input validation (CWE-20, CWE-22/23)
+  - Path traversal prevention
+  - Command injection prevention (CWE-78/77/88)
+  - Log injection protection (CWE-117)
+  - Code injection prevention (CWE-94)
+- **NetworkPolicy support** for pod-level network isolation
+- **Helm chart validation** with `validateHelmYaml`
+- **SecurityUtils** for path validation and sanitization
+
+### Developer Experience
+
+- **Structured logging** with Pino (JSON format, performance tracking)
+- **Environment variables loader** for external configuration
+- **YAML serialization** with Helm template preservation
+- **TypeScript strict mode** with all compiler checks enabled
+- **Comprehensive error handling** with detailed messages
 
 ## 🚀 Quick Start
 
@@ -153,142 +237,114 @@ const umbrellaConfig = {
 export const umbrella = new UmbrellaChartTemplate(umbrellaConfig);
 ```
 
-### Type-Safe Helm Helpers
+### Using Type-Safe Helm Helpers
 
-Timonel provides 9 composable, type-safe helpers for Helm template generation: `helmIf`,
-`helmRange`, `helmWith`, `helmInclude`, `helmDefine`, `helmVar`, `helmBlock`, `helmComment`, and
-`helmFragment`.
+#### ValuesRef System (Recommended)
 
-**Benefits:**
+The new ValuesRef system provides a type-safe, proxy-based approach to Helm values with full IDE support.
 
-## 🔧 Dynamic Environment Variables
+**⚠️ Important:** This is completely different from the legacy `valuesRef(path: string)` helper.
+The new system uses generics and returns a proxy object with methods.
 
-Timonel supports flexible environment variable configuration that can be defined in code or
-loaded from external sources (e.g., Vault during CI/CD).
+```typescript
+import { valuesRef } from 'timonel';
 
-### Configuration Methods
+interface MyValues {
+  replicaCount: number;
+  image: { repository: string; tag: string };
+  autoscaling: { enabled: boolean; minReplicas: number };
+}
 
-**1. In-Code Defaults:**
+const v = valuesRef<MyValues>();
 
-```typescript
-const envVars = [
-  { name: 'VERSION', type: 'value', defaultValue: '1.0.0' },
-  { name: 'DATABASE_URL', type: 'secret', secretName: 'app-secrets' },
-];
-```
+// Type-safe value references with IDE autocomplete
+const replicas = v.replicaCount; // {{ .Values.replicaCount }}
+const imageTag = v.image.tag; // {{ .Values.image.tag }}
 
-**2. External JSON/YAML (CI/CD):**
+// Comparison operators
+const isProd = v.environment.eq('production'); // eq .Values.environment "production"
+const hasReplicas = v.replicaCount.gt(1); // gt .Values.replicaCount 1
 
-```bash
-# Load from Vault during CI
-vault kv get -format=json secret/app/env | jq '.data.data' > env-config.json
-pnpm run synth
-```
+// Logical operators
+const notEnabled = v.autoscaling.enabled.not(); // not .Values.autoscaling.enabled
 
-**3. Generated Templates:**
+// String functions
+const upperEnv = v.environment.upper(); // .Values.environment | upper
+const quotedTag = v.image.tag.quote(); // .Values.image.tag | quote
 
-```yaml
-# Value variables
-- name: VERSION
-  value: { { .Values.global.env.VERSION | default "1.0.0" } }
+// Default values
+const port = v.port.default(8080); // {{ .Values.port | default 8080 }}
 
-# Secret variables
-- name: DATABASE_URL
-  valueFrom:
-    secretKeyRef:
-      name: app-secrets
-      key: DATABASE_URL
-      optional: true
+// Field-level conditionals
+const deployment = {
+  spec: {
+    replicas: v.if(notEnabled, v.replicaCount), // Conditionally include field
+  },
+};
+
+// Range loops
+const envVars = v.env.range((item, index) => ({
+  name: item.name,
+  value: item.value,
+}));
+
+// Context switching
+const dbConfig = v.database.with((db) => ({
+  host: db.host,
+  port: db.port,
+}));
 ```
 
+#### Template Composition Helpers
+
+Use these helpers for template definitions and inclusions:
+
 ```typescript
-import { Rutter, helmInclude, createHelmExpression as helm } from 'timonel';
+import { helmInclude, helmDefine, helmFragment } from 'timonel';
 
-const chart = new Rutter({
-  meta: {
-    name: 'web-app',
-    version: '1.0.0',
-    description: 'Simple web application',
-  },
-  defaultValues: {
-    replicas: 3,
-    image: {
-      repository: 'nginx',
-      tag: 'latest',
-    },
-  },
-});
+// Template inclusion with pipe
+const labels = helmInclude('chart.labels', '.', { pipe: 'nindent 4' });
 
-// Add Deployment with type-safe helpers
-chart.addManifest(
-  {
-    apiVersion: 'apps/v1',
-    kind: 'Deployment',
-    metadata: {
-      name: helmInclude('chart.fullname', '.'),
-      labels: helmInclude('chart.labels', '.', { pipe: 'nindent 4' }),
-    },
-    spec: {
-      replicas: helm('{{ .Values.replicas }}'),
-      selector: {
-        matchLabels: helmInclude('chart.selectorLabels', '.', { pipe: 'nindent 6' }),
-      },
-      template: {
-        metadata: {
-          labels: helmInclude('chart.selectorLabels', '.', { pipe: 'nindent 8' }),
-        },
-        spec: {
-          containers: [
-            {
-              name: 'web',
-              image: helm('{{ .Values.image.repository }}:{{ .Values.image.tag }}'),
-              ports: [{ containerPort: 80, name: 'http' }],
-            },
-          ],
-        },
-      },
-    },
-  },
-  'deployment',
-);
+// Define a named template
+const myTemplate = helmDefine('myapp.config', {
+  key: 'value',
+});
 
-// Generate the chart
-chart.write('./dist');
+// Combine multiple constructs
+const combined = helmFragment(helmInclude('chart.labels', '.'), { customKey: 'customValue' });
 ```
 
+#### Legacy Flow Control (NOT RECOMMENDED)
+
+**⚠️ These are legacy and NOT RECOMMENDED. Use ValuesRef system (v.if, v.range, v.with)
+instead:**
+
 ```typescript
-import { UmbrellaChartTemplate } from 'timonel';
+// ❌ OLD WAY - string-based valuesRef (no type safety)
+const oldRef = valuesRef('.Values.production');
 
-const umbrellaConfig = {
-  name: 'my-umbrella-app',
-  version: '1.0.0',
-  subcharts: [
-    {
-      name: 'frontend',
-      version: '1.0.0',
-      chart: frontendChartFunction,
-    },
-    {
-      name: 'backend',
-      version: '1.0.0',
-      chart: backendChartFunction,
-    },
-  ],
-};
+// ✅ NEW WAY - ValuesRef system (type-safe)
+const v = valuesRef<MyValues>();
+const newRef = v.production; // {{ .Values.production }}
 
-export const umbrella = new UmbrellaChartTemplate(umbrellaConfig);
+// ❌ OLD WAY - helmIf, helmRange, helmWith (string-based)
+const config = helmIf('.Values.production', { replicas: 5 }, { replicas: 1 });
+
+// ✅ NEW WAY - v.if(), v.range(), v.with() (type-safe)
+const config = v.if(v.production, { replicas: 5 });
 ```
 
-Timonel provides 9 composable, type-safe helpers for Helm template generation: `helmIf`,
-`helmRange`, `helmWith`, `helmInclude`, `helmDefine`, `helmVar`, `helmBlock`, `helmComment`, and
-`helmFragment`.
+**Why ValuesRef is Better:**
 
-**Benefits:**
+- ✅ **100% Type-Safe** - Catch errors at compile time with TypeScript generics
+- ✅ **No Raw Strings** - Eliminate manual template interpolation and typos
+- ✅ **Full IDE Support** - Autocomplete, type hints, and refactoring support
+- ✅ **Proxy-based** - Chainable methods for complex logic
+- ✅ **Composable** - Nest and combine operations naturally
+- ❌ **Legacy helpers** - String-based, error-prone, no IDE support
 
-- ✅ 100% Type-Safe - catch errors at compile time
-- ✅ No Raw Strings - eliminate manual template interpolation
-- ✅ Composable - nest and combine helpers freely
-- ✅ Full IDE Support - autocomplete and type hints
+**Migration:** Replace `valuesRef(path)` with `v.path`. Replace `helmIf`, `helmRange`, `helmWith`
+with `v.if()`, `v.range()`, `v.with()`.
 
 **Learn more:** See the
 [Type-Safe Helm Helpers Guide](https://github.com/KenkoGeek/timonel/wiki/Helm-Helpers-System) for
@@ -324,10 +380,10 @@ If you get `Error: Cannot find module 'cdk8s'` when running `tl umbrella synth`:
   "version": "1.0.0",
   "type": "module",
   "dependencies": {
-    "cdk8s": "^2.70.16",
-    "cdk8s-plus-33": "^2.3.8",
-    "constructs": "^10.4.2",
-    "timonel": "^2.11.0"
+    "cdk8s": "^2.70.28",
+    "cdk8s-plus-33": "^2.4.6",
+    "constructs": "^10.4.3",
+    "timonel": "^3.0.0-beta.1"
   },
   "devDependencies": {
     "@types/node": "^24.5.2",
@@ -362,7 +418,7 @@ MIT
 [security-url]: SECURITY.md
 [pnpm-badge]: https://img.shields.io/badge/pm-pnpm-ffd95a?logo=pnpm&logoColor=fff&labelColor=24292e
 [pnpm-url]: https://pnpm.io/
-[node-badge]: https://img.shields.io/badge/node-%3E%3D20-339933?logo=node.js&logoColor=fff
+[node-badge]: https://img.shields.io/badge/node-%3E%3D22-339933?logo=node.js&logoColor=fff
 [node-url]: https://nodejs.org/
 [ts-badge]: https://img.shields.io/badge/TypeScript-5.x-3178C6?logo=typescript&logoColor=fff
 [ts-url]: https://www.typescriptlang.org/

package/SECURITY.md

@@ -36,13 +36,14 @@ We provide security updates for the following versions:
 
 <!-- markdownlint-disable MD060 -->
 
-| Version | Supported      | Security Updates | End of Life |
-| ------- | -------------- | ---------------- | ----------- |
-| 2.4.0+  | ✅ Current     | Full support     | TBD         |
-| 2.3.x   | ✅ Supported   | Full support     | TBD         |
-| 2.0-2.2 | ⚠️ Limited     | Critical only    | 2024-12-31  |
-| 1.x.x   | ❌ End of life | None             | 2024-06-30  |
-| < 1.0   | ❌ End of life | None             | 2024-01-01  |
+| Version      | Supported      | Security Updates | End of Life |
+| ------------ | -------------- | ---------------- | ----------- |
+| 3.0.0-beta.1 | ✅ Current     | Full support     | TBD         |
+| 2.14.x       | ✅ Supported   | Full support     | TBD         |
+| 2.8.0-2.13.x | ✅ Supported   | Full support     | 2025-06-30  |
+| 2.0-2.7.x    | ⚠️ Limited     | Critical only    | 2025-03-31  |
+| 1.x.x        | ❌ End of life | None             | 2024-06-30  |
+| < 1.0        | ❌ End of life | None             | 2024-01-01  |
 
 **Update policy:**
 
@@ -83,15 +84,28 @@ We provide security updates for the following versions:
 ### Security Features
 
 - **Input validation**: Comprehensive path traversal prevention and sanitization via SecurityUtils
-- **Log injection protection**: All user inputs sanitized before logging
-- **Code injection prevention**: Strict validation for dynamic module loading
-- **TypeScript strict mode**: Compile-time safety checks
+  - CWE-22/23: Path traversal protection with URL-encoded sequence detection
+  - CWE-20: Proper input validation for CLI flags (--set, --env)
+  - Null byte injection prevention
+  - Reserved key validation in resource providers
+- **Log injection protection**: All user inputs sanitized before logging (CWE-117)
+- **Code injection prevention**: Strict validation for dynamic module loading (CWE-94)
+  - Regex escaping for dynamic pattern construction
+  - Function name validation before template generation
+- **Command injection prevention**: Validated inputs for all shell commands (CWE-78/77/88)
+  - Release name validation (RFC 1123 subdomain)
+  - Namespace validation (Kubernetes naming rules)
+  - --set flag validation with support for nested paths and arrays
+- **TypeScript strict mode**: Compile-time safety checks with all strict options enabled
 - **No eval()**: Static code generation only
 - **File system isolation**: Controlled output directory access with path validation
+  - Absolute path support with explicit allowAbsolute flag
+  - Base directory validation for all file operations
 - **Helm template validation**: Input validation for all template functions
 - **Karpenter security**: Secure node pool and scheduling configurations
 - **Performance optimization**: Efficient algorithms preventing DoS via resource exhaustion
-- **OWASP compliance**: Following secure coding guidelines (CWE-22, CWE-94, CWE-117)
+- **OWASP compliance**: Following secure coding guidelines (CWE-22, CWE-23, CWE-94, CWE-117,
+  CWE-78, CWE-77, CWE-88, CWE-20)
 
 ## Security Considerations for Users